View a user's audit history

To review everything a particular person did in your tenant, MobilityManager provides a per-user audit history. It returns the changes made by one user's email, newest first, with an optional date range. This is useful for access reviews, incident investigations, and responding to data-subject requests. This article explains how to use it.

Required permission

Viewing a user's audit history requires the settings:view permission. Access is read-only and scoped to your current tenant.

How to retrieve a user's history

1. Identify the user's email address.
2. Call GET /api/audit/user/{userEmail}.
3. Optionally add fromDate and toDate query parameters to restrict the results to a date-and-time window (inclusive).

Entries are returned from most recent to oldest.

Note: For safety, this view returns up to 1,000 of the user's most recent entries. If someone made more changes than that within your date range, narrow the range with fromDate and toDate to be sure you see everything.

What each entry shows

Each entry records the action (Insert, Update, or Delete), the affected entity type and ID, the UTC timestamp, and — for updates — the specific columns that changed with their old and new values. Together this gives a chronological record of that user's activity.

Users who have been pseudonymized

When a user is pseudonymized for GDPR erasure, their email on past audit entries is replaced with the pseudonym, for example Deleted User #00042-58391. The audit entries themselves are preserved — only the identity is removed. To find an erased user's history after the fact, search by the pseudonym rather than the original email.

Tip: The history is matched on the exact email string. If a user's email address was changed over time, run the query once for each address they used.

Related

• View and filter audit entries
• View the audit history of an entity
• Pseudonymize a user (GDPR right to erasure)
• The audit trail and what it captures