> ## Documentation Index > Fetch the complete documentation index at: https://resources.athenaintel.com/llms.txt > Use this file to discover all available pages before exploring further. # Audit records > Review asset change history, export audit trails, and inspect privileged administration events Athena records asset edits and privileged administration events in separate histories. Use asset history to trace changes to a sheet, document, or deck. Use the administration timeline to review workspace and user administration. ![Asset changes are read in the Activity pane and exported with history\_audit\_trail. Administration events are read in the Admin Audit Log and exported as CSV. Computer snapshots are read in the Versions pane and link to a conversation.](https://mintcdn.com/athenaintelligence-e46bc9d3/6ueVSVCwufwDQRFe/images/diagrams/audit-records.webp?fit=max\&auto=format\&n=6ueVSVCwufwDQRFe\&q=85\&s=a5d64bed12499fa6adf0b35c02297145) Three kinds of record, where you read each one, and how you export it. ## Review an asset's changes The **Activity** pane groups edits by person or Athena activity. It can link an attributed edit to the conversation where Athena made it. 1. Open the sheet, document, or deck and its **Activity** pane. 2. Select **Timeline** to review changes over time or **Sessions** to group activity by session. 3. Review the author and time of the change. 4. Follow an available conversation link to inspect its context. Opening that conversation requires access to the conversation itself. History can distinguish a person, Athena, an undo, a restore, and an automatic update. An Athena edit can also identify the person it was made on behalf of. View access lets you inspect change metadata. The history tools leave old and new values out when you do not have edit access to the asset. ## Request an asset audit export The `history_audit_trail` tool exports change rows for one asset in JSON or CSV. You need administrator status and access to the asset in the run's workspace. Workspace ownership alone does not satisfy the export's administrator check. 1. In a session with the history tool available, ask Athena to export the asset's audit trail. 2. Identify the asset and the time window you need. 3. Specify JSON or CSV. Add an author, conversation, or location filter if needed. 4. Review the export's `complete` field and `note` before treating it as a complete record. For example, ask: “Use history\_audit\_trail to export this sheet's changes from yesterday as CSV, including the completeness note.” | Export field | Meaning | | - | - | | `when` | Time of the recorded edit. | | `who` | Person, Athena, or other recorded actor. | | `on_behalf_of` | Person associated with an Athena edit, when recorded. | | `conversation` | Attributed conversation identifier, when recorded. | | `where` | Location of the change in the asset. | | `change` | Description of the change. | | `before`, `after` | Values available under your access rights. | JSON returns the rows with completeness information. CSV output returns the CSV text alongside the export's metadata and note. ## Check export coverage An export describes at most 200 activity items in one request. Its `complete` field is false when the scan is capped or edits cannot be described. The note reports older edits outside the scan and edits missing from the rows. If older edits remain, request narrower time windows. If an edit could not be described, keep that gap with your exported record. An empty value can mean that attribution was not recorded or that your access excludes past values. It is not proof that no change occurred. ## Review administration events Athena records privileged administration events: workspace membership and role changes, administrator grants and revocations, primary-workspace transfers, and users created by an administrator. Each row has the time, event, outcome, actor, target user, workspace, and request details when available. The **Admin Audit Log** screen shows these events to deployment administrators. It is in beta and is not listed in the sidebar yet. Ask Athena support for access. 1. Open **Admin Audit Log** as a deployment administrator. 2. Set **Event type** and **Outcome** as needed. 3. Narrow by **Workspace ID**, **Actor user ID**, or **Target user ID**. 4. Set **From** and **To** for the time window. 5. Expand a row to review its details. 6. Load more rows until **Loaded** matches **Total events**. 7. Select **Export CSV**. The button reads **Export loaded** while matching rows remain unloaded. > [!NOTE] > > The CSV contains the loaded rows only. Compare **Loaded** with **Total events** before you treat it as the full set. ## Review Computer snapshot provenance When Computer snapshots are enabled and available for the asset, their records include the capture trigger, time, creator identifier when recorded, and associated conversation and message identifiers when available. In a Computer's **Versions** pane, a run-completion snapshot can link to the conversation that captured it. Manual and safety snapshots may have no conversation link. ## Retrieve records on demand These exports are pulled on demand. Athena does not stream asset history or administration events to a SIEM. To feed one, export on a schedule and keep each export's time window, filters and completeness note with the file. ## Related * [Legal holds and retention](https://resources.athenaintel.com/docs/getting-started/legal-holds-and-retention.md) * [Workspace tool policy](https://resources.athenaintel.com/docs/getting-started/tool-registry.md) * [Computer](https://resources.athenaintel.com/docs/pillars/applications/computer.md) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.