---
title: "Audit Log Code Definitions"
slug: "audit-log-code-definitions"
tags: ["Audit", "Audit log"]
updated: 2025-06-10T17:35:05Z
published: 2025-06-10T17:35:05Z
canonical: "docs.revealdata.com/audit-log-code-definitions"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.revealdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit Log Code Definitions

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/audit-log-code-definitions-image-adsywien.png)

#### **In this article**:

- Audit Log Code Categories
- Audit Log Codes, Types, and Messages

## **Audit Log Code Categories**

| - Authorized Connections (AC) - Cloud Transfers (CT) - Custom Field (CF) - Data Source (DS) - Export (EX) - File (FL) - Identity Mapping (ID) | - Integrated Legal Holds (ILH) - Login (LG) - Preservation (WP) - Retention Policy (RP) - Smart Action (SA) - Special Permission (SP) - User (UA) - Workspace (WS) |
| --- | --- |

## **Audit Log Codes, Types, and Messages**

Below you will find audit log codes, the corresponding type of log: success, info, or error, and a message giving additional details for that code.

### **Authorized Connections (AC)**

| **Code** | **Type** | **Message** |
| --- | --- | --- |
| AC001 | Success | Added credentials: {{Connector}} using {{account@email.com}} |
| AC002 | Success | Added admin credentials: {{Connector}} using {{account@email.com}} |
| AC003 | Info | Renewed credentials: {{Connector}} using {{account@email.com}} |
| AC004 | Info | Renewed admin credentials: {{Connector}} using {{account@email.com}} |
| AC005 | Info | Credentials shared: Granted access to {{User-name}} for {{Connector}} using {{account@email.com}} |
| AC006 | Success | Credentials shared: Declined adding to {{User-name}} for {{Connector}} using {{account@email.com}} |
| AC007 | Success | Credentials shared: Revoked credentials to {{User-name}} for {{Connector}} using {{account@email.com}} |
| AC008 | Success | Deleted credentials: {{Connector}} using {{account@email.com}} |
| AC009 | Success | Deleted admin credentials: {{Connector}} using {{account@email.com}} |

### **Cloud Transfers (CT)**

| **Code** | **Type** | **Message** |
| --- | --- | --- |
| CT001 | Success | Credentials added: {{SFTP}} using {{host name}}. Folder path: {{folder path}} |
|  |  |  |
| CT002 | Success | Credentials edited: From {{SFTP}} using {{host name}} Folder path: {{folder path}} to {{SFTP}} using {{host name}} Folder path: {{folder path}} |
| CT003 | Info | Credentials renewed: {{SFTP}} using {{host name}} Folder path: {{folder path}} |
| CT007 | Success | Deleted credentials: {{SFTP} using {{host name}} |
| CT008 | Info | Cloud transfer {{Cloud-transfer-name}} added to {{export}} |
| CT009 | Info | Cloud transfer {{Cloud-transfer-name}} loaded to {{host name}} {{folder path}} |

### **Custom Field (CF)**

| **Code** | **Type** | **Message** |
| --- | --- | --- |
| CF001 | Success | Custom field added to platform by Admin: "{{custom-field}}" |
| CF002 | Success | Custom field removed from platform by Admin: "{{custom-field}}" |
| CF003 | Info | Custom field disabled in platform by Admin: "{{custom-field}}" |
| CF004 | Info | Custom field enabled in platform by Admin: "{{custom-field}}" |
| CF005 | Info | Custom field edited in platform by Admin: "{{custom-field}}" |
| CF006 | Success | Custom field added to workspace {{Workspace-name}}: "{{custom-field}}" |
| CF007 | Success | Custom field removed from workspace {{Workspace-name}}: "{{custom-field}}" |

### **Data Source (DS)**

| **Code** | **Type** | **Message** |
| --- | --- | --- |
| DS001 | Success | Added {{Source-type}} source: "{{Source-name}}" ({{Source-URL}}) |
| DS002 | Success | Deleted {{Source-type}} source: "{{Source-name}}" ({{Source-URL}}) |
| DS003 | Info | {{Source-type}} source "{{Source-name}}" renamed to "{{New-source-name}}" ({{Source-URL}}) |
| DS004 | Info | {{Source-type}} source "{{Source-name}}" shared with {{People-list}} ({{Source-URL}}) |
| DS012 | Error | Failed to sync {{Source-type}} source "{{Source-name}}". Reason: {{Error-number}} ({{Source-URL}}) |
| DS015 | Success | Added {{Source-type}} source using shared credentials ({{credentials-account}}): "{{Source-name}}" ({{Source-URL}}) |

### **Export (EX)**

| **Code** | **Type** | **Message** |
| --- | --- | --- |
| EX001 | Success | Export "{{ export }}" added to platform |
| EX002 | Success | Export "{{ export }}" removed from platform |

### **File (FL)**

| **Code** | **Type** | **Message** |
| --- | --- | --- |
| FL001 | Success | File uploaded by user: "{{file-name}}" ({{file-URL}}) |
| FL005 | Info | File "{{File-name}}" shared with "{{People-list}}" ({{File-URL}}) |
| FL006 | Info | File "{{File-name}}" downloaded ({{File-URL}}) |
| FL013 | Success | File deleted by user: "{{file-name}}" ({{file-URL}}) |
| FL014 | Info | File "{{File-name}}" viewed ({{file-URL}}) |
| FL015 | Success | File deleted due to Retention policy: "{{file-name}}" ({{file-URL}}) |

### **Identity Mapping (ID)**

| **Code** | **Type** | **Message** |
| --- | --- | --- |
| ID001 | Success | Added source to identity mapping: "{{Source-type}}" mapped |
| ID002 | Success | Added source automatically to identity mapping: "{{Source-type}}" mapped |
| ID007 | Info | Rename {{Identity-name}}: to {{new-identity-name}} |
| ID008 | Info | Details of identity "{{Identity-name-1}}" viewed ({{Identity-name-1-URL}}) |
| ID009 | Info | Identity search for "{{search-term}}" done |
| ID010 | Info | Filter of search "{{search-term}}" viewed |
| ID011 | Add | Failed to add "{{Source-type}}" to identity mapping. |
| ID012 | Sync | Failed to sync {{Source-type}} source. Reason: {{Error-number}} ({{Source-URL}}). |

## **Integrated Legal Holds (ILH)**

### 

| **Code** | **Type** | **Message** |
| --- | --- | --- |
| ILH001 | Success | User {{username}} created {{matter-name}}: ({{matter-id}}). Matter details: From {{preservation-start-date}} to {{preservation-end-date}}, {{matter-type}}, {{jurisdiction}}, {{billing-number}}, {{notes}} |
| ILH002 | Success | User {{username}} added {{custodians-list}} to {{matter-name}}: ({{matter-id}}). Custodian details: {{Custodian-first-name}}, {{Custodian-last-name}}, {{Custodian-email}}, {{Custodian-role}} |
| ILH003 | Success | User {{username}} added a hold on {{source-type}} with {{email-account}} to {{matter-name}}: ({{matter-id}}) Hold details: {{content-information}}, {{custodians-list}}, {{preservation-start-date}}, {{preservation-end-date}} |
| ILH004 | Success | User {{username}} added {{notification-type}} to {{matter-name}}: ({{matter-id}}) Notice content: {{initial-notice-message}} |
| ILH005 | Success | User {{username}} added {{notification-type}} to {{matter-name}} to be sent every {{frequency-days}} days: ({{matter-id}}) Notice content: {{reminder-notice-message}} |
| ILH006 | Success | User {{username}} added {{notification-type}} to {{matter-name}} to be sent every {{frequency-days}} days: ({{matter-id}}) Notice content: {{acknowledge-notice-message}} |
| ILH007 | Success | User {{username}} added {{notification-type}} to {{matter-name}}: ({{matter-id}}) Notice content: {{release-notice-message}} |
| ILH008 | Success | User {{username}} added {{attachment-file}} to {{matter-name}}: ({{matter-id}}) |
| ILH009 | Error | Failed to create {{matter-name}} in Integrated Legal Holds |
| ILH010 | Error | Failed to add {{custodians-list}} to {{matter-name}}: ({{matter-id}}) |
| ILH011 | Error | Failed to add a hold on {{source-type}} with {{email-account}} to {{matter-name}}: ({{matter-id}}) |
| ILH012 | Error | Failed to add {{custodians-not-found-list}} to {{source-type}} hold on {{matter-name}} because were not found: ({{matter-id}}) |
| ILH013 | Error | Failed to add {{notification-type}} to {{matter-name}}: ({{matter-id}}) |
| ILH014 | Error | Failed to add {{attachment-file}} to {matter-name}}: ({{matter-id}}) |
| ILH015 | Success | User {{username}} deleted {{matter-name}}: ({{matter-id}}) |
| ILH016 | Success | User {{username}} deleted {{custodians-list}} from {{matter-name}}: ({{matter-id}}) |
| ILH017 | Success | User {{username}} deleted a {{source-type}} hold with {{email-account}} from {{matter-name}}: ({{matter-id}}) |
| ILH018 | Success | User {{username}} deleted {{notification-type}} from {{matter-name}}: ({{matter-id}}) |
| ILH019 | Success | User {{username}} deleted {{attachment-file}} from {{matter-name}}: ({{matter-id}}) |
| ILH020 | Error | Failed to delete {{matter-name}} from Integrated Legal Holds |
| ILH021 | Error | Failed to delete {{custodians-list}} from {{matter-name}}: ({{matter-id}}) |
| ILH022 | Error | Failed to delete {{source-type}} hold with {{email-account}} from {matter-name}}: ({{matter-id}}) |
| ILH023 | Error | Failed to delete {{notification-type}} from {matter-name}}: ({{matter-id}}) |
| ILH024 | Error | Failed to delete {{attachment-file}} from {matter-name}}: ({{matter-id}}) |
| ILH025 | Info | User {{username}} viewed {{matter-name}}: ({{matter-id}}) |
| ILH026 | Info | User {{username}} viewed {{custodian-name}} custodian details from {{matter-name}}: ({{matter-id}}) |
| ILH027 | Info | User {{username}} viewed {{source-type}} hold with {{email-account}} details from {{matter-name}}: ({{matter-id}}) |
| ILH028 | Info | User {{username}} viewed {{notification-type}} notification details from {{matter-name}}: ({{matter-id}}) |
| ILH029 | Info | User {{username}} viewed {{notification-type}} notification preview from {{matter-name}}: ({{matter-id}}) Notification content: {{notification-message}} |
| ILH030 | Success | User {{username}} sent initial notice to {{custodians-list}} from {{matter-name}}: ({{matter-id}}) |
| ILH031 | Success | Reminder notice has been automatically sent to {{custodians-list}} from {{matter-name}}: ({{matter-id}}) |
| ILH032 | Success | Acknowledge notice has been automatically sent to {{custodians-list}} from {{matter-name}}: ({{matter-id}}) |
| ILH033 | Success | User {{username}} sent release notice to {{custodians-list}} from {{matter-name}}: ({{matter-id}}) |
| ILH034 | Success | User {{username}} released {{custodians-list}} from {{source-type}} hold with {{email-account}} from {{matter-name}}: ({{matter-id}}) |
| ILH035 | Success | User {{username}} released {{source-type}} hold with {{email-account}} with {{custodians-list}} from {{matter-name}}: ({{matter-id}}) |
| ILH036 | Success | User {{username}} changed matter {{matter-name}} information from {{previous-values}} to {{new-values}}: ({{matter-id}}) |
| ILH037 | Success | User {{username}} edited matter {{matter-name}} configuration from {{previous-values}} to {{new-values}}: ({{matter-id}}) |
| ILH038 | Success | User {{username}} edited {{notification-type}} content from {{previous-notice-message}} to {{new-notice-message}} from {{matter-name}}: ({{matter-id}}) |
| ILH039 | Success | User {{username}} changed {{custodian-name}} custodian role from {{previous-value}} to {{new-value}}: ({{matter-id}}) |
| ILH040 | Success | User {{username}} closed {{matter-name}}: ({{matter-id}}) |
| ILH041 | Error | Failed to send initial notice to {{custodians-list}} from {{matter-name}}: ({{matter-id}}) |
| ILH042 | Error | Failed to send reminder notice to {{custodians-list}} from {{matter-name}}: ({{matter-id}}) |
| ILH043 | Error | Failed to send acknowledge notice to {{custodians-list}} from {{matter-name}}: ({{matter-id}}) |
| ILH044 | Error | Failed to send release notice to {{custodians-list}} from {{matter-name}}: ({{matter-id}}) |
| ILH045 | Error | Failed to release {{custodians-list}} from {{source-type}} hold with {{email-account}} from {{matter-name}}: ({{matter-id}}) |
| ILH046 | Error | Failed to release {{source-type}} hold with {{email-account}} from {{matter-name}}: ({{matter-id}}) |
| ILH047 | Error | Failed to change matter {{matter-name}} information from {{previous-value}} to {{new-value}}: ({{matter-id}}) |
| ILH048 | Error | Failed to edit matter {{matter-name}} configuration from {{previous-value}} to {{new-value}}: ({{matter-id}}) |
| ILH049 | Error | Failed to edit notification {{notification-type}} from {{previous-value}} to {{new-value}}: {{matter-id}} |
| ILH050 | Error | Failed to change {{custodian-name}} custodian role from {{previous-value}} to {{new-value}}: ({{matter-id}}) |
| ILH051 | Error | Failed to close {{matter-name}} matter: ({{matter-id}}) |
| ILH052 | Success | User {{username}} added {{custodians-list, max of 5}} + X more to hold {{source-type}} from {{matter-name}}: ({{matter-id}}) |
| ILH053 | Info | Matter "{matter_name}" shared with {people_list} ({matter_id}) |
| ILH054 | Info | Matter "{matter_name}" permission changed for {username} from {old_permission} to {new_permission} ({matter_id}) |
| ILH055 | Success | Revoked matter permissions from {username} for "{matter_name}" ({matter_id}) |
| ILH056 | Error | Failed to share matter "{matter_name}" with {people_list} ({matter_id}) |
| ILH057 | Error | Failed to change permissions for {username} from {old_permission} to {new_permission} for matter "{matter_name}" ({matter_id}) |
| ILH058 | Error | Failed to revoke matter permissions from {people_list} for "{matter_name}" ({matter_id}) |

### **Login (LG)**

| **Code** | **Type** | **Message** |
| --- | --- | --- |
| LG001 | Success | Logged in with user and password |
| LG002 | Error | Failed to log in with user and password |
| LG003 | Success | Logged out |
| LG006 | Success | Logged in with two step verification |
| LG009 | Info | Email sent to reset password |
| LG010 | Success | Password updated |
| LG011 | Error | Failed to change password |
| LG012 | Success | Logged in with SSO |
| LG017 | Success | SSO configuration deleted by {{actor-username}}. |
| LG018 | Success | Issued temporary user |

### **Preservation (WP)**

| **Code** | **Type** | **Message** |
| --- | --- | --- |
| WP001 | Success | Added preservation: "{{Preservation-name}}" ({{Preservation-URL}}) |
| WP002 | Success | Deleted preservation: "{{Preservation-name}}" ({{Preservation-URL}}) |
| WP003 | Info | Preservation "{{Preservation-name}}" renamed to "{{New-preservation-name}}" ({{Preservation-URL}}) |
| WP004 | Info | Preservation "{{Preservation-name}}" shared with "{{People-list}}" ({{Preservation-URL}}) |
| WP005 | Info | Details of preservation "{{Preservation-name}}" viewed ({{Preservation-URL}}) |
| WP006 | Error | Failed to delete preservation "{{Preservation-name}}" ({{Preservation-URL}}) |
| WP007 | Error | Failed to rename preservation "{{Preservation-name}}" ({{Preservation-URL}}) |
| WP008 | Success | Finished preservation: "{{Preservation-finished}}" ({{Preservation-URL}) |
| WP009 | Info | Preservation "{{Preservation-name}} viewed ({{Preservation-URL}}) |
| WP010 | Info | Preservation "{{Preservation}}" permission changed for {{user}} from {{old permission}} to {{new permission}} ({{Preservation-URL}}) |
| WP011 | Info | Preservation "{{Preservation}}" configuration changed to {{Edit Preservation-URL}} |

### **Retention Policy (RP)**

| **Code** | **Type** | **Message** |
| --- | --- | --- |
| RP001 | Success | Added retention policy: Delete from "{{Source-type}}" content older than {{2 years}} |
| RP002 | Success | Deleted retention policy: Delete from "{{Source-type}}" content older than {{2 years}} |
| RP003 | Success | Updated retention policy: Delete from "{{Source-type}}" content older than {{2 years}} |

### **Smart Action (SA)**

| **Code** | **Type** | **Message** |
| --- | --- | --- |
| SA001 | Success | Smart Action "{{ smart action }}" added to platform |
| SA002 | Success | Smart Action "{{ smart action }}" removed from platform |
| SA003 | Info | Smart Action "{{ smart action }}" triggered |
| SA004 | Info | Smart Action "{{smart action}}" modified |

### **Special Permission (SP)**

| **Code** | **Type** | **Message** |
| --- | --- | --- |
| SP002 | Success | Added special permission: "{{Pepito}}" can {{Manage custom fields / Manage groups / Audit log}} |
| SP004 | Success | Removed special permission: "{{Pepito}}" can {{Manage custom fields / Manage groups / Audit log}} |

### **User (UA)**

| **Code** | **Type** | **Message** |
| --- | --- | --- |
| UA001 | Success | User {{username}} invited to Onna by {{actor username}}. |
| UA002 | Success | User {{username}} added to Onna through SSO. |
| UA003 | Success | User {{username}} invited to Onna as Guest by {{actor username}}. |
| UA004 | Success | User {{username}}'s role was changed from {{starting-role}} to {{ending-role}} by {{actor username}}. |
| UA011 | Info | User viewed Notifications |

### **Workspace (WS)**

| **Code** | **Type** | **Message** |
| --- | --- | --- |
| WS001 | Success | Added workspace: "{{Workspace-name}}" ({{Workspace-URL}}) |
| WS002 | Success | Deleted workspace: "{{Workspace-name}}" ({{Workspace-URL}}) |
| WS003 | Info | Workspace "{{Workspace-name}}" renamed to "{{New-workspace-name}}" ({{Workspace-URL}}) |
| WS004 | Info | Workspace "{{Workspace-name}}" shared with "{{People-list}}" ({{Workspace-URL}}) |
| WS005 | Info | Workspace "{{Workspace-name}}" viewed ({{Workspace-URL}}) |
| WS006 | Error | Failed to delete workspace "{{Workspace-name}}" ({{Workspace-URL}}) |
| WS009 | Info | Workspace "{{Workspace-name}}" permission changed for {{user}} form {{old permission}} to {{new permission}} ({{Workspace-URL}}) |

##

## Related

- [Viewing, Filtering, and Downloading Audit Logs](/viewing-filtering-and-downloading-audit-logs.md)