Observability

Identity › Audience › Observability is your organization’s identity log: one row per thing that happened to a user, a grant or a profile, newest first. Nothing is authored here, and nothing on it can be changed. Use it to answer questions such as why does this user not have access? or did this person ever sign in?.

Paywall decisions have their own log in Revenue › Decision Engine › Observability.

Tabs

• Users: registrations, sign-ins, grant changes and refusals. Described on this page.
• Profile: profile rebuilds, and the ones that failed.
• Streaming: what your pipelines delivered, and what was rejected.

The Profile and Streaming tabs belong to EdgeKit Profile; see Profile. Switching tab keeps the time range and the search, and drops filters that only mean something on the old tab.

What the Users tab records

The What happened column names each row.

What happened	When it is written
user.created	A user row was created.
user.updated	A user’s details changed, for example a staff name correction.
user.email_changed	A user’s email address changed.
user.erased	A user was erased.
user.joined_site	A user was attached to a site.
grant.created	A grant was created.
grant.updated	A grant’s term was extended, for example by a renewal.
grant.suspended	A grant was suspended.
grant.resumed	A suspended grant became active again.
grant.revoked	A grant was revoked.
identity.session.created	A user signed in.
identity.session.refreshed	A user’s sign-in session was renewed.
identity.session.ended	A user signed out through your site’s sign-out.
identity.adoption_refused	Refused: EdgeKit did not link a sign-in through your identity provider to the existing user holding the address.
access.seat_overage	Refused: a user organization took a member past its seat limit.

A row marked refused records something that did not happen, or that someone needs to act on. A seat overage is one: the member got the seat, and the user organization is now over what it bought (see Seats and the seat limit).

identity.session.ended is written only for a sign-out the user makes. When EdgeKit ends a user’s sessions itself, for example after a staff email correction or an erasure, there is no row here.

Each row also shows:

• Time (UTC).
• Actor: who caused it. A staff change names the staff member. EdgeKit’s own work shows EdgeKit, Sign-in, Billing sync, Streaming input or Provisioning.
• User: the user’s id, or No user.
• Site: the site id, or Tenant-wide when the row belongs to no single site.

Rows name users by id, not by name or email address. Select a row to see its full detail.

Narrow the log

• Time range: 15m, 1h, 24h (the default), 7d or 30d. Nothing older than 30 days is shown.
• Result: Refused shows only the rows marked refused. Happened shows every row.
• Session, on the Users tab: Signed in, Refreshed or Signed out.
• Search: text contained in the row’s record type, its change name or its error message, up to 200 characters.

The table shows the 200 most recent rows that match, and says so when it reaches that cap: narrow the range or the filters to see further back. A chart above the table counts the matching rows over the range.

The screen does not refresh by itself. Select Refresh to read the log again.

Who can read it

Reading the log needs the Observability permission, the same one Revenue’s decide log uses. Every built-in role holds it: Owner, Admin, Developer, Editor and Member. Without it, the screen says so, and every other Identity screen stays open.

Every read of the log is a staff read of your organization’s data, and is recorded like any other (see Every staff read and change is recorded).

When the screen shows nothing

• No events in this range: nothing matched. Try a longer range or drop a filter.
• Not set up yet: your organization’s account is not open yet, so there is no log.
• If your organization keeps its logs in its own telemetry account, the screen says so and shows no rows: read them there.