---
category: [Administration & Integrations, Platform and Product Extensions, Platform and Product Extensions/Integration, Administration & Integrations/Custom Integrations & Apps]
keyword: [Integrate, Workday Integration, Orchestrate for Integrations, Orchestration, Orchestration Builder]
nav: wcp_docs
parent_url: /wcp_docs/
title: >- 
  Reference: Audit User Activity
layout: subsection
---

<a id="section_N1003D_N1003A_N10001"></a>
You can view these additional user activity audit log fields on the <b>Audit Logs</b> tab of the <b>Account</b> dashboard:

<table><thead><tr><th>Log Field</th><th>Description</th></tr></thead><tbody><tr><td><p><b>wd_affected_user_account</b></p></td><td><p>Identifies the user whose activity is being logged.</p></td></tr><tr><td><p><b>wd_category</b></p></td><td><p>The category of app log information.</p> <p>Possible values:</p><ul><li><code>ConfigChange</code> – Returns details about configuration changes made by an administrator or developer, such as:

<ul><li>Creating or deleting allowlists.
</li><li>Developer tenant password resets.
</li><li>Updates to API clients.
</li></ul></li><li><code>PasswordChange</code> – Returns details about the password change for a user, including when the password was changed, and which account made the change.
</li><li><code>RoleModification</code> – Returns details about the role modification for a user, including the user whose role was modified, which account modified the role, when the role was modified, and the user's new role.
</li><li><code>UnknownLogin</code> – Returns details about a failed login attempt by an unknown user with an accepted email domain, including the date and time of the login attempt and the email address of the unknown user.
</li><li><code>UserCreation</code> – Returns details about who created the user, when they were created, what role they were given and the account information that was created.
</li><li><code>UserDeletion</code> – Returns details about who deleted the user, when was the account deleted, and which account was deleted.
</li><li><code>UserDisablement</code> – Returns details about who disabled the user, when was the user disabled and which account was disabled.
</li><li><code>UserLogin</code> – Returns details about a user login attempt, including the account that attempted to log in, the time of the login attempt, and whether the attempt was successful.
</li><li><code>UserLogout</code> – Returns details about a user logout, including the account that logged out and the time the account logged out.
</li></ul></td></tr><tr><td><p><b>wd_log_type</b></p></td><td><p>The type of logs returned.</p> <p>Value: <code>useraudit</code> – Audit trail of user activity and configuration changes.</p></td></tr><tr><td><p><b>wd_service</b></p></td><td><p>The Workday Extend service for the user activity logs.</p> <p>Value: <code>identity</code></p></td></tr></tbody></table><br/>

Audit logs are stored for the last 30 days. You can download the audit logs every 30 days if a longer retention period is needed.