Activity reports

Activity reports answer "who did what, and when" across your organization. Each one is the Trace explorer pinned to one kind of event from the tamper-evident audit log, so the common questions are one click away and every tool the Trace explorer has — date ranges, filters, search, paging and export — is there too.

The four activity views#

View	Stream	What it shows
Login History	Sign-in & sessions	Sign-ins and sign-outs, two-factor challenges, vault unlocks and failed attempts
Item Modifications	Vault changes	Creating, changing, sharing, archiving and deleting vaults, items and notes
Access Logs	Vault access	Viewing, revealing, copying and downloading stored secrets
Sharing Activity	Sharing (and older sharing entries)	Invitations, approvals, access granted and ended, secure links, sharing-policy changes and organization-vault custody — see Sharing Activity

Open a report#

1. In the console sidebar, open Reports.
2. Under Activity, choose Login History, Item Modifications, Access Logs, or Sharing Activity.
3. The view opens on the last 30 days, newest first. Pick another range, or set exact dates, above the table.

Narrow it down#

• Search actions — type part of an action name, such as login, share or export.
• Severity and Result — for example, only Failure results to find failed sign-ins.
• Include sign-in & read activity — session refreshes and vault listings are recorded but hidden by default, because they outnumber everything else. Access Logs starts with them shown, since reads are what that view is for.
• Select a row's stream to open its details: what happened, the event code, the correlation ID shared by everything recorded in the same request, and the affected member or resource.

A range can span up to three months. Open the full trail at the top of each view switches to the Trace explorer with every stream.

Sharing Activity#

Reports → Sharing Activity is the view an access review starts from: who shared what, with whom, at what level, who approved it, and when it ended. It differs from the other three in that it is a scope rather than a single stream — it also reads sharing entries recorded before sharing had a stream of its own, so an older grant does not vanish from the answer.

Above the table, Filter by kind of sharing event narrows it to one group:

Option	Covers
All sharing events	Everything below
Invitations	Sent, accepted, declined, cancelled, approved, rejected and expired invitations
Access granted & ended	Shares granted, revoked, left, expired and changed; team vault grants
Secure links	Links created, revoked or expired, one-time codes sent, links opened and verified
Policy changes	Organization and per-vault sharing-setting changes, and shares the policy refused
Organisation vaults & keys	Organization vaults created, custodians added or removed, owner nominations and transfers, key rotations

Two deep links open the view already narrowed, shown as a removable chip above the table:

• History beside an organization vault (under the organization's vaults) opens it on that one vault.
• A member link opens it on one person. A switch beside the chip chooses which side of the event they are on: Shared with them (the default — they were given or refused access) or Done by them (they did the sharing).

Select a row's stream to expand it. Beyond the usual details, a sharing row can show:

• Access level — the level before and after (Viewer → Editor), or only the one level when there is no change.
• Why access ended — Removed by the owner or an admin, Left on their own, Reached its expiry date or Replaced by a newer share.
• Reason given — the note typed by whoever refused or removed access.
• Settings changed — a Before / After table for a policy change, with each setting named as its settings page names it.

Export CSV on this view adds six columns after the usual ones: Target Email, Level Before, Level After, Reason, Policy Changes and Summary. Summary is the description with the roles, permissions and members it mentions spelled out by name; the Description column keeps the text exactly as it was recorded, because that text is part of the log's tamper-evidence.

Sharing events are recorded however the other audit toggles are set. See Audit logs for retention.

Reading the results#

• Action — the recorded operation, such as Signed in or Item updated.
• Actor — the member's email and the address the request came from. Events the platform produces on its own show System.
• Resource — the affected resource's type and its name or ID.
• Result — Success, Failure (the operation errored), or Denied (a permission or policy refused it). Repeated failures or denials are worth investigating.

Export#

Every activity view has Export CSV and Export JSON, which download exactly the rows your filters select. The file name records the stream and the date range. Each export is itself recorded in the audit trail — see Export center.

Who can open these#

Anyone whose role includes audit read access to the organization — Organization Administrator by default, and any custom or delegated role your organization grants it to. See Roles & permissions. Members can review their own activity from their account, but not the organization's.

Activity reports are available on Team, Business and Enterprise. How far back events go depends on your retention policy — see Audit & compliance.