How Do I Search the Audit Log in Dave by voolama to See Who Approved a Task?

Summary

The steps

1. 1

   Confirm you have the right role to open the audit log

   In Dave by voolama, the audit log is restricted to users with specific permissions. Before navigating to it, confirm that your account has either the Admin role (which carries the admin:* permission, covering all admin screens and settings) or the Reporting role (which carries the audit:read permission specifically). Dave by voolama has six default roles: Admin, Create, Curate, Use, Reporting, and Financial. All six are editable. Only Admin and Reporting can open the Audit Log tab.

   If you cannot see the Audit Log tab at Admin, then Settings, your role does not include audit access. The resource at Why Can't I See Agents, Workflows, or Other Sections in Dave by voolama? explains the role-to-section mapping in detail. Ask your workspace Admin to assign the Reporting role if you need read-only audit access without full Admin privileges.

   The Reporting role is the right choice for an office manager or bookkeeper who needs to look up decisions but should not be able to create users or change workspace settings. The Admin role grants full tenant administration and is appropriate for the business owner or IT lead. Small businesses that keep records for internal accountability purposes, such as tracking who approved a refund or a payment, can use the Reporting role to give one designated person audit log access without expanding Admin privileges across the team.

   Do this

   • Log in to Dave by voolama and navigate to Admin in the sidebar.
   • Click Settings, then look for the Audit Log tab at the top of the Settings page.
   • If the tab is not visible, your role does not include audit access. Contact your workspace Admin and ask for the Reporting role (audit:read permission) or the Admin role.
   • To check your current role: navigate to Admin, then Settings, then Users and Roles, and find your own account row. Your assigned roles appear as colored badges.

   Example

   A hypothetical small business owner assigns the Reporting role to their office manager so the manager can search the audit log and answer questions about who approved a refund, without giving the manager full Admin access to create users or change workspace settings.

   Best practice

   • Give the Reporting role to anyone who needs to look up decisions but does not need to change settings. It is read-only for the audit log and for reports.
   • Do not give the Admin role just for audit log access. The Reporting role's audit:read permission is sufficient for searching and exporting.
   • Review role assignments periodically. As team responsibilities change, confirm that audit log access still matches who actually needs it.
2. 2

   Open the Audit Log and understand the default view

   Navigate to Admin, then Settings, and select the Audit Log tab. The page displays a table of all recorded audit events for your workspace, sorted by most recent first.

   Each row in the table shows seven columns:

   • Timestamp: when the event occurred.
   • Event Type: a categorized label for the action, such as auth.login, users.create, or tenant.update.
   • Actor: the email address and user ID of the person who performed the action.
   • Entity: the type and ID of the object that was affected.
   • Method: the HTTP method (POST, PUT, DELETE, and so on).
   • Status: the HTTP status code of the request.
   • Action: a short description of what happened.

   Rows are color-coded by event type: green for create, activate, and start events; blue for updates; red for deletes and failed logins; purple for logins; amber for compliance changes and cancellations; cyan for completed events. You can click any column header to sort by that field: Time, Event Type, Actor, Entity Type, Method, Status, or Action.

   The audit log records mutations (create, update, delete) and authentication events by default. When compliance modes are enabled in System Parameters, it also captures read access to sensitive endpoints including users, roles, secrets, API clients, OAuth providers, and reports. These read-access events carry a complianceTriggered: true flag in their Details JSON, distinguishing them from standard mutation events.

   Do this

   • Navigate to Admin, then Settings, then the Audit Log tab.
   • Scan the default view (most recent first) to get a sense of recent activity.
   • Note the column headers: Time, Event Type, Actor, Entity Type, Method, Status, Action. You can click any column header to sort by that field.
   • Do not click any row yet. In the next step you will use the filter controls to narrow the list before expanding a specific entry.

   Example

   A hypothetical office manager opens the audit log and sees a mix of green rows (new workflow instances started), blue rows (workflow edits), and purple rows (team logins). The most recent amber row shows a compliance setting was changed. None of these are the task decision they are looking for, so they move on to filtering.

   Best practice

   • The default view shows all event types. For a busy workspace, the list can be long. Always use the filter controls in Step 3 rather than scrolling through the full list.
   • Click the Actor column header to group all actions by the same person together. This is useful when you want to see everything a reviewer did in a session rather than just one specific decision.
3. 3

   Filter the log to find the task decision you are looking for

   The Audit Log page provides four filter controls. Use them in combination to narrow the list to the specific decision you need.

   • Text search: searches across actions, email addresses, URL paths, and entity IDs at the same time. Type the reviewer's email address to find every action they took. If you know the task ID or instance ID (visible in the Task Inbox), paste it here to find all events linked to that specific task.
   • Event Type dropdown: shows all distinct event types present in your log. Select a specific type to show only those events.
   • Entity Type dropdown: shows all distinct entity types present in your log. Select a type to narrow by what was affected.
   • Date range (From and To date pickers): scope the results to a specific time window. Use this to find decisions made during a particular week or on a specific date.

   A Clear Filters button resets all four controls back to their defaults.

   Gap note: The audit-logs help documentation does not list a specific event type code for task decisions (such as a dedicated tasks.approve or tasks.complete event type). The text search and entity type filter are the most reliable ways to find task-related entries. If your workspace's Event Type dropdown includes a task-specific event type, use it; otherwise, use the text search with the reviewer's email address and a date range.

   Do this

   • In the text search box, type the email address of the person whose decision you are looking for. The list updates as you type.
   • Set the From and To date pickers to the date range when the decision was made. If you are not sure of the exact date, use a wider range and narrow it after you see the results.
   • If the list is still long, open the Entity Type dropdown and select the entity type for tasks or instances, if it appears in the dropdown for your workspace.
   • Scan the filtered results for the row that matches the task decision you are looking for. Look for the amber or cyan color coding (cancelled or completed events) and the Actor column showing the reviewer's email address.

   Example

   A hypothetical owner wants to know who approved a refund request last Tuesday. They type the approver's email address into the text search box, set the From date to last Monday and the To date to last Wednesday, and the list narrows to a handful of rows. They spot a cyan completed-event row with the approver's email in the Actor column and click it to expand the full details.

   Best practice

   • Start with the email address search. It is the fastest way to find all actions by one person.
   • Combine email search with a date range to avoid seeing unrelated actions by the same person on other days.
   • If you know the task ID from the Task Inbox, paste it into the text search box. The audit log text search covers entity IDs, so the task's ID should surface the relevant entries.
4. 4

   Expand a row to read the full decision record

   Click any row in the filtered audit log table to expand it. The expanded view shows the complete event details:

   • Actor: the reviewer's full email address and user ID.
   • Entity: the entity type and ID of the object affected by the decision.
   • HTTP method and path: the API call that recorded the decision.
   • IP address: the source IP of the request at the time of the decision.
   • User agent: the browser or client the reviewer was using.
   • Details: a formatted JSON block containing the captured request data. This includes the submitted decision (Approve, Reject, or Request Changes) and any comment the reviewer added. Passwords, secrets, and tokens are automatically redacted. Large payloads are truncated.

   The Details JSON is the primary record of what the reviewer decided and what they said. If the reviewer added a comment explaining their reasoning, it appears here. You can also use the copy icon on the row to copy the full event details to your clipboard without expanding the row.

   For businesses that need to retain decision records for internal accountability, the expanded row view and the row-level copy action are the fastest ways to capture a single decision. For bulk retention across a period, the CSV export in Step 5 is more practical.

   Do this

   • Click the row for the decision you identified in Step 3. The row expands in place.
   • Read the Actor section to confirm the email address and user ID of the person who made the decision.
   • Read the Details JSON block to see the decision (Approve, Reject, or Request Changes) and any comment the reviewer added.
   • Note the Timestamp at the top of the expanded row. This is the exact date and time the decision was recorded.
   • If you need to share the details, click the copy icon on the row to copy the full event to your clipboard, or proceed to Step 5 to export as CSV.

   Example

   A hypothetical owner expands the row they found in Step 3 and reads the Details JSON. It shows the decision as 'approved' and a comment that reads: 'Customer provided proof of purchase. Refund approved per policy.' The Actor section shows the approver's email address and user ID. The Timestamp shows the exact minute the decision was recorded.

   Best practice

   • Check the IP address in the expanded row if you need to confirm the decision was made from an expected location. An unexpected IP address may indicate the account was accessed from an unfamiliar device.
   • If the Details JSON shows a truncated payload, the full data is stored in the system but the display is capped for readability. The CSV export in Step 5 includes the full captured data.
5. 5

   Export the filtered results as CSV

   If you need a permanent record of the decision, or a set of decisions over a period, export the filtered results as a CSV file. The CSV export downloads only the events that match your current filters. If you have a date range, an event type, or a text search active, the export reflects those filters.

   Click the download button on the Audit Log page to export the currently filtered results. The exported CSV includes all event fields: timestamp, event type, actor, entity, HTTP context, IP address, user agent, and details.

   If you want to export the full log with no filters applied, click Clear Filters first, then click the download button.

   This step covers exporting a filtered result for a specific decision. For a detailed walkthrough of preparing a date-scoped export for an external audit submission, see How Do I Export the Audit Log for a SOC 2 Audit in Dave by voolama? That guide covers bulk export for compliance review, which is a different task from saving one filtered result for a specific decision.

   Note the default retention period: audit log records are kept for 365 days by default. If you need records beyond that window, export them before they are automatically purged. You can change the retention period at Admin, then Settings, then General, then System Parameters, then Retention Policy. Setting retention to 0 keeps records indefinitely. Small businesses that keep internal records for accountability, such as tracking who approved payments or refunds, should consider whether 365 days covers their typical review window before relying on the default.

   Do this

   • With your filters still set from Step 3 (email address and date range), click the download button on the Audit Log page.
   • Save the CSV file to a location your team can access. Name it descriptively, for example: 'audit-log-refund-approval-2026-11-07.csv'.
   • Open the CSV to confirm it contains the rows you expected. Check that the Actor, Timestamp, and Details columns are present.
   • If the CSV is missing rows, return to the Audit Log, click Clear Filters, and check whether the missing events appear in the unfiltered view. A filter may be excluding them.

   Example

   A hypothetical owner exports the filtered audit log for the week of a disputed refund decision. The CSV shows three rows: the task completion event with the approver's email and decision, a prior login event for the same user, and an update event for the workflow instance. The owner saves the file and attaches it to the customer's dispute record.

   Best practice

   • Export before the retention period expires. The default is 365 days. If your business keeps records for longer, either export regularly or increase the retention setting.
   • Keep exported CSV files in a location with controlled access. The files contain email addresses, IP addresses, and decision details for your team members.
   • Do not rely on screenshots alone. The CSV export is a structured record that is easier to search and share than a screenshot of the expanded row.

What the audit log records and what it does not

The four filter controls and when to use each one

What this guide does not cover