Activity Log

Flowstate records every change to your organisation's workforce data. The Activity Log shows this record as a chronological feed inside the app. Use it to answer "who changed what, and when" during reviews and investigations.

Where to find it

Navigate to Settings → Organisation → Activity Log.

Access is gated by the SETTINGS_SIEM_VIEW permission.

What it records

The feed captures create, update, delete, archive, and sync events for your workforce data:

• Employees
• Contractors
• Vacancies
• Teams
• Projects
• AI agents
• Skills
• Initiatives

Each entry records who made the change, what changed, and where the change came from (a manual edit, an integration sync, a data import, or the API).

Columns

Column	Description
Timestamp	When the change happened
Actor	The user or system that made the change
Action	create, update, delete, archive, or sync
Change	A summary of what changed on the record

Filtering

Use the filter controls to narrow the feed:

Filter	Options
Entity Type	Employee, contractor, vacancy, team, project, AI agent, skill, initiative
Action	create, update, delete, archive, sync
Source	manual, sync, import, api
Date Range	Last 7 days, last 30 days, last 90 days

You can also search the feed and page through results.

TIP

Filter by Source = api to review changes made through API keys, or sync to review changes made by your integrations.

Security events stream to your SIEM

The Activity Log covers changes to workforce data. Security events, such as authentication activity, configuration changes, and API key lifecycle events, are delivered through the SIEM integration instead. See that page for the event categories, severity levels, and payload format of what gets streamed to your SIEM.

Capability	Activity Log (In-App)	SIEM Integration
Scope	Workforce data changes	Security events
Viewing events	Flowstate UI	Your SIEM platform
Filtering	Entity type, action, source, date range	Full SIEM query language
Alerting	Not available	Configure in your SIEM
Correlation	Flowstate events only	Correlate with other systems

Best Practices

1. Review the feed regularly. Look for unexpected deletes and bulk changes, especially from the api and import sources.
2. Investigate anomalies promptly. Each entry gives you the actor, timestamp, and change summary you need to assess a situation.
3. Use SIEM integration for security monitoring. Configure alerts in your SIEM for authentication and configuration events. The Activity Log is for data-change review, not automated alerting.
4. Restrict access. The SETTINGS_SIEM_VIEW permission gates both this page and the SIEM configuration. Grant it to security, compliance, and IT administration roles only.

Related Pages

• SIEM Integration -- Stream security events to your SIEM platform in real time
• API Keys -- Authenticate the API access that appears under the api source
• Roles & Permissions -- The permission model, including SETTINGS_SIEM_VIEW
• SCIM 2.0 Provisioning -- Automated user lifecycle management