> ## Documentation Index
> Fetch the complete documentation index at: https://knowledge.cloudquant.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Admin Activity Audits

> Review who changed users, entitlements, datasets, and other admin settings in Liberator 2.5

# Admin activity audits

In Liberator **2.5** and later, Liberator keeps an activity audit of administrative changes. It records who did what, when, and whether the change succeeded. Use it for access reviews and for questions that usage and entitlements reports do not answer, such as who granted access or what was deleted.

<Note>
  Reviewing another administrator's activity is a **Super Admin** capability. The audit is separate from [`usage_log`](/administration/usage-log), which records dataset queries rather than admin changes.
</Note>

## Ask from Reporting

Open **Reporting** and ask in plain language, for example:

* "Who gave this user access?"
* "What changed last Tuesday?"
* "What has this admin done this month?"
* "Was anything deleted?"
* "Show me failed attempts."

Ask for a download when you want the matching rows in a file. You can also save that question as a template and schedule it, the same way as other Reporting queries.

## What each entry contains

| Field              | Meaning                                                                                               |
| ------------------ | ----------------------------------------------------------------------------------------------------- |
| **When**           | The time of the change, in the environment's reporting timezone                                       |
| **Who**            | The administrator's username and role. An entry with no signed-in admin is unattributed.              |
| **Action**         | What was done, such as creating a user, updating a dataset, or changing permissions                   |
| **Target**         | The user, dataset, connection, group, webhook, file, report template, or report schedule that changed |
| **Outcome**        | `success` or `failure`. Failed attempts stay in the audit.                                            |
| **Changed fields** | Which fields differed, when Liberator recorded them                                                   |

When you ask what a value changed from and to, the answer can include the before and after values. Passwords, API tokens, and similar secrets are omitted.

## What the audit covers

Liberator records changes made through the admin portal, including:

* Users, including create, update, enable, disable, and password or API-key actions
* Entitlements and permissions
* Datasets and connections
* User groups and dataset groups
* Webhooks and file uploads
* Report templates and report schedules, including who a scheduled report is sent to

Changes made outside Liberator, such as edits in the identity provider's own console, are not included. The audit starts when it was enabled for the environment, so an empty result for an older date means those changes were not recorded.

## Related

<CardGroup cols={2}>
  <Card title="AI-based reporting" icon="chart-mixed" href="/administration/ai-based-reporting">
    Run admin queries, save templates, and schedule email delivery
  </Card>

  <Card title="Query usage log" icon="list" href="/administration/usage-log">
    Per-query dataset usage, separate from admin changes
  </Card>

  <Card title="Managing users and entitlements" icon="users" href="/administration/managing-users-and-entitlements">
    The user and access changes the audit records
  </Card>

  <Card title="What's new in 2.5" icon="rocket" href="/whats-new/liberator-2.5">
    Liberator 2.5 release notes
  </Card>
</CardGroup>