About this block

Audit Trail Timeline is the compliance view of the workspace, strict rows of actor, mono action code like billing.plan.update and auth.login.failed, a target string, a timestamp to the second, and a source IP, all grouped under date headers. Two days ship: Jun 12 holds plan changes, key creation, and a role update; Jun 11 shows failed login attempts, a project archive, and an SSO login. The Export CSV button and the footer immutability line say what they mean: append only, exportable, and we cannot edit it either.

Days and their entries are two nested arrays. The mono action codes and second precision timestamps are the thing that makes this useful to a compliance team or an engineer debugging an incident.

When to use

Reach for this block on the Security or Audit settings page, wired to your audit log API filtered by date range. Pair the export with a server route that streams rows as CSV with the date range as query params.

A natural flow around it on an Application Pro page:

Before

• Settings shell
• Filters and search

After

• Settings page

What you can display

One strong use is the workspace security log. Other audit trail scopes:

• Billing events only. Filtered to plan changes, invoice approval, and payment method updates.
• Member events. Invites, role changes, removals, and SSO logins in one chronological view.
• API key activity. Key creation, rotation, and revocation with the key suffix as the target.

Tip: the IP column earns its width on mobile only when it is actionable, consider hiding it at small breakpoints and surfacing it on a detail row expand.