OneTrust Activity Log

Important:

The OneTrust Activity Log feature is limited to users with the Site Admin role.

Overview

The OneTrust Activity Log delivers a unified, real-time view of user and system audit events across the OneTrust platform, helping administrators increase visibility and control, investigate issues faster, and meet compliance requirements with a complete, traceable audit trail. Through a centralized audit experience, teams can quickly search and filter audit records, monitor activity across solutions from a single location, and export audit data for broader reporting and analysis.

Captured activity and events

As of the OneTrust 202611.1.0 release, the Activity Log records activity across supported areas such as authentication, sessions, credentials, user and organization management, risk, branding and email settings, domains, and language settings. Document downloads and file attachments are also recorded. Coverage depends on the supported product areas and object types. Use the API endpoint to retrieve supported event types.

Activity information is also available in the activity tabs of supported product areas, such as users, organizations, and risks. In these areas, you can filter an entity's activity by event type when the option is available.

Record retention periods

Global Audit records are retained for one year in standard environments and seven years in HIPAA environments. This retention policy takes effect on [confirmed effective date].

To access audit records older than the retention period, use the reporting area to export records by model or object type.

Integration events and legacy trigger deprecation

Global Audit records are available through integration events. Use an integration workflow to send audit data to a webhook or an Amazon S3 bucket. The Activity Record Created trigger provides audit information in a format intended for SIEM tools.

The Activity Record Created (Legacy) trigger will be supported alongside the standardized audit event (known as Activity Record Created until the Spring '27 release. After that transition period, the legacy event is planned for deprecation. If your integration uses the Activity Record Created (Legacy) trigger in your integrations, you will need to update them with the standardized audit event before deprecation.

Accessing the Activity Log

Note:

It may take a few minutes for logged events to appear in the Activity log screen. Refresh to populate new results.

  1. Click the gear icon in the upper right-hand corner to access Global Settings.
    The Global Settings screen appears.
  2. Select Global activity > Activity log.


    The Activity log screen appears. By default, the Activity Log displays records from the preceding 30 days. You can select a different date range of up to 30 days.



  3. The Activity Log loads the first page of results. Select Next page to load more results. You can change the page size, but the activity log does not use a multi-page navigation bar.
  4. Search for events by record name. You can sort events by Record name or Timestamp.

  5. Use the +Add filter option or the pinned filters to search and populate the list screen:

    Filter

    Description

    Activity

    Action categories like create, update, delete, login, export, view/activity-style events, and configuration changes.

    Organization

    Shows records associated with the organization you select. It does not include records associated with that organization’s parent or child organizations. Records for object types that are not associated with an organization can display a null organization value.

    Performed by

    The actor responsible for the activity. This could be a person, system, or an API. This option uniquely supports search for Inactive or Deleted users to investigate historical activity.

    Users must have the Delete users permission. Site admins receive this permission by default.

    Product Area

    Origin of the audit log in the platform sorted by capability or product focus (e.g., AI Governance, Privacy Rights).

    The available product areas depend on the solutions subscribed to by your tenant. Selecting a product area limits the record types to the object types supported by that area. Available activities also depend on the selected product area and record type. If you do not select a product area, the activity list includes activities for the subscribed product areas and their supported object types.

    Record type

    Object or inventory type in the platform (e.g., Role, Organization).

    Timestamp

    By default, the activity log displays records from the preceding 30 days. You can select a different date range of up to 30 days.
  6. Use the Advanced filter option to build more granular queries than what is offered in the pinned filters.


  7. Click on the linked Activity for a given row to open the Audit History pane. The Activity Log will list the captured fields and their values, timestamps, and provide additional information about the user who made the change.


    Activity Section

    Description

    Activity Timeline

    Provides a timeline of the audit event, including what action occurred and the key context around that activity.

    Performed by

    Identifies the user who triggered the event and the time the action was performed.

    Record details

    Shows which record was affected and what type of record or activity is associated with the event.

    Access details

    Captures the access context for the event, such as where the request came from and the client environment used to perform it.

    Network details

    Triggered by

    Trigger details are available for operations performed by integration workflows. They identify the workflow, event type, and trigger type associated with the operation.
  8. Use the View record link to be taken directly to the object or inventory record. If the entity has been deleted, the activity record remains available, but View Record opens the not-found page for that product area.
  9. Use the Raw JSON tab to view and copy the underlying structured payload instead of the simplified log view. This helps when you need the full event data exactly as recorded, rather than the grouped sections shown in the standard pane.


Auditing Activity Actions

You can retrieve a complete list of the event names currently available via the public API endpoint. This approach is useful when you want a reusable export of event names for compliance review, rule mapping, or downstream analysis outside the OneTrust platform.

Prerequisites

Configuring the API

  1. In Postman, create a new POST request to generate an OAuth access token using your client credential.
    JSON 
    POST https://<your-domain>/api/access/v1/oauth/token

Headers: 
accept: application/json

Body (form-data): 
grant_type=client_credentials
client_id={{client_id}}
client_secret={{client_secret}}
  2. Send the request and copy the access_token from the response. You can set this as a variable for protection, {{access_token}}


  3. Create a second request in Postman to using the Get List of Event Types endpoint with the bearer token from the previous step.
    JSON 
    GET https://{hostname}/api/audit/v4/audits/event-types

Accept: application/json
Authorization: Bearer {{access_token}}


  4. The response returns event records that include the event code, event name (value), object type name, and module name. This payload can be used as a source record for reporting or review. You can keep it as the complete raw export, then pull out the fields you need to validate coverage, compare event names, or support audit discussions.
    JSON 
    [
  {
    "code": 1001,
    "value": "User created",
    "objectTypeName": "User",
    "moduleName": "User management"
  }
]


Impacts & Considerations for OneTrust Products

Consent & Preferences - DS GUIDs

Global Activity is designed to provide centralized visibility into platform activity without storing personally identifiable information in the audit layer. Because of that design, consent-related audit records for data subjects are not searchable by familiar personal identifiers such as an email address or values.

This approach helps limit unnecessary exposure of personal data in Global Activity while still preserving the audit trail needed for investigation and review. When a user needs to find audit activity related to a specific data subject, they must search using the data subject GUID (DS GUID) instead of the personal identifier. The DS GUID is the system-level identifier available to Global Audit and is the supported value for locating the relevant audit record.

  1. Locate the DS GUID for the data subject in the source data subject record or related workflow.

  2. Open Global Activity and go to the search or filter experience.

  3. Enter the DS GUID as the search value instead of the email address or other personal identifier.

  4. Review the returned audit records to find the relevant activity for that data subject.

Tenant Copy & User IDs

A current limitation of tenant copy with Activity Logs is that some historical audit records may retain source-tenant userIDs instead of mapping cleanly to userIDs in the target tenant, which can cause missing or incomplete user details in audit history after the copy.

For more information, see Submitting a Tenant Copy Request.

Activity Log FAQ

Can I export Global Activity logs?

Yes, you can export events in real time to SIEM via Integrations. Although HTTP POST request URLs are the primary documented method for sending Activity Log data to external SIEM tools, Workflow Builder supports multiple integration patterns. Depending on the use case, you can use seeded SIEM connectors from the Gallery, apply filtering and transformation logic before delivery, route events through reusable subflows, or leverage other supported integration targets and export mechanisms.

For more information, see Integrating OneTrust Activity Logs with External SIEM Tools.

Will Global Activity logs replace the Activity tabs available across the platform?

No, it will not replace Activity tabs within individual solutions. Global Activity provides a central view and does not replace activity tabs within individual product areas. In supported areas, you can also filter an entity's activity by event type from its activity tab.

Can I filter the Global Activity log by specific product without navigating to that product's menu?

Yes. You can filter by one or more product areas from the solutions subscribed to by your tenant. Selecting a product area narrows the available record types and activities to those supported for that area.

For records that are updated using client credentials, will the activity log show which client credentials were used?

Not currently. The Performed by details show the user's name, email address, and the time of the activity. Displaying information about the client credentials used for an operation is planned for a future release.

What information does OneTrust log for client credentials?

Network details in an activity record can include the domain or custom subdomain, user-agent information, and the user's IP address. These details do not identify which client credential was used; client-credential information is not currently displayed in the Performed by section. Integration-initiated SIEM payloads may not include the original network context.

For records that are updated via integrations, will the activity log show which workflow triggered the update?

Yes. For operations performed by an integration workflow, the Trigger details section identifies the workflow, event type, and trigger type. Other trigger sources are not currently described as supported.

What happens if the record associated with an activity has been deleted?

The activity record remains available. If you select View Record for an entity that has been deleted, OneTrust opens the not-found page for the relevant product area.

How does the organization filter work?

The organization filter returns records associated with the organization you select. It does not include records for parent or child organizations. Records for object types that are not associated with an organization can show a null organization value.

What is changing about the Activity Record Created integration event?

Activity Record Created (Legacy) is the previous audit integration event. A standardized audit event (Activity Record Created) is also available for sending audit information to SIEM tools. We plan to support both event formats until the Spring '27 release. After the transition period, the legacy event is planned for deprecation. If your workflow uses Activity Record Created (Legacy), update it to use the standardized event before the legacy event is deprecated.

How long are Global Audit records retained, and can I access older records?

Global Audit records are retained for one year in standard environments and seven years in HIPAA environments, starting [effective date]. To access records older than the retention period, use the reporting area to export records by model or object type.