The storage activity log records what happened to the files and folders in Celigo Storage — who did it, when, and from where. It covers every source that can reach storage, so you can answer "who deleted this file" or "did my partner collect the order file" without knowing which surface the operation came through. The log starts recording when this feature is released and earlier activity isn't available, since nothing is backfilled. Reads are included: downloading a file is recorded, not only changing one.
Note: The log starts recording when this feature is released for your account. Activity from before then isn't available, because existing history isn't backfilled.
Activity log and audit log
integrator.io keeps two separate logs, and each owns a different kind of event. An operation is recorded in one or the other, never both.
| Log | Records | Where to find it |
|---|---|---|
| Storage activity log | Operations on files and folders, from every source, including reads | Resources > File storage > Activity |
| Platform audit log | Configuration changes, including file server and account settings | Account > Audit log |
Sources
Every entry records the source the operation arrived through. Use the source to tell a person's action from a machine's.
- UI — The File storage page.
- API — The storage REST API, and flow steps that read or write storage files.
- CLI — The command-line interface.
- MCP — A file an MCP server publishes as a resource, or the Celigo MCP server.
- Ora — A file read or written through Ora.
- File server — An account-holder connected over SFTP. The actor is the partner account name.
- System — An operation integrator.io performed itself, such as creating or deleting the folder that belongs to an integration. The user is whoever's action triggered it.
Note: A flow's entries show the source as API and the account owner as the user. The entry does not identify which flow ran the operation.
Actions
Each entry carries one action. The action never says whether the item was a file or a folder — the log shows that separately — so Create always means a folder, because files are uploaded rather than created. A folder create appears as Create folder in the Action column.
| Action | Means |
|---|---|
| Login | A sign-in on a file server account. File server only. Covers every successful sign-in, and every failed sign-in to an account that exists, with the reason it failed. |
| Download | Bytes read from a file, from any source — a browser download, an SFTP get, a flow reading a file, or an API fetch. |
| Query | A storage query execution. |
| Upload | File bytes written. Replacing an existing file is an Upload that records the overwrite and the previous size. |
| Create | A folder created. |
| Update | Metadata edited in place, such as a description. A rename is recorded as an Update, with the previous and new name. |
| Move | A file or folder moved to another folder. |
| Copy | A file copied. The entry is recorded on the new file. |
| Merge | A folder merged into another. Recorded once, on the destination folder. |
| Delete | Sent to the recycle bin. |
| Restore | Brought back from the recycle bin. |
| Purge | Permanently removed. |
What an entry contains
The grid shows seven columns.
- Time — When the operation happened (timestamp).
- Source — Where it came from.
- User — Who performed it. For a file server operation, the partner account name.
- Action — What was done.
- Name — The file or folder, shown as its name and the name of the folder holding it. The entry is tied to the item's internal ID, so it stays accurate after a rename or a move. An item that has been purged shows its ID instead of a name.
- IP address — The caller's address, where the source has one. Always present for file server activity.
- Details — Information specific to the action. Select View on a row to open that entry's details as JSON. A row with no details shows a dash.
What Details holds, by action
| Action | Details |
|---|---|
| Upload |
bytes and overwrite. A replaced file has overwrite set to true and previousBytes, its size before. |
| Download |
size and linkExpiresIn, how many seconds the link stays valid. A folder downloaded as a .zip file adds fileCount, and size is the total. |
| Create |
_parentId, the folder it was created in. |
| Update | Only what changed: previousName and newName for a rename, previousDescription and newDescription for a description edit. |
| Move |
_previousParentId and _newParentId, plus previousName and newName if the move also renamed the item, and bulk set to true on each entry of a bulk move. |
| Copy |
_sourceId, the original file; _destinationParentId; and bytes. |
| Merge | Nothing. |
| Delete |
name, the item's name when it was deleted. |
| Restore |
_parentId, where it landed, plus previousName and newName if it came back under a new name. |
| Purge |
bytes for a file. Nothing for a folder. |
| Query |
sql, the statement as it was submitted. |
| Login |
method, either password or publickey, and success, plus reason on a failed sign-in. |
One entry per action
The log records what you did, not the work integrator.io did to carry it out.
- Renaming or moving a folder is one entry, however many items are inside it.
- Deleting a folder is one entry on the folder.
- Downloading a folder as a .zip file is one entry on the folder, recording how many files it held and their total size. The files inside get no entries of their own.
- A bulk move is an exception: it records one Move entry for each item moved, each marked as part of a bulk operation.
What is not recorded
- Listings and searches — Browsing a folder or searching for a file leaves no entry, on any source.
- Refused operations — An operation that permissions blocked leaves no entry. The log records what happened, not what was attempted.
- Operations that failed partway — An abandoned upload or a rolled-back copy writes nothing.
- Sign-ins the file server can't attribute to an account — A sign-in is recorded only when the file server can tell which account it was. A username that doesn't exist, a key the account doesn't have, a connection stopped by a lockout or a rate limit, and a sign-in attempted while the file server is turned off all leave no entry. A missing entry therefore doesn't prove the account-holder never tried: a mistyped username produces the same silence, including a username typed without the identifier suffix.
- Which files a query read — A query is one entry holding the statement, with no target, so filtering by a file name does not return the queries that read it.
- Whether downloaded bytes arrived — A Download entry means a download link was issued. The log cannot tell whether the file was then fetched.
- File previews — Previewing a file is not yet recorded.
Who can see activity
Access follows the same folder access you have elsewhere in Celigo Storage. You see activity for the folders you can see, and an API token restricted to specific storage paths returns activity only for those paths and everything beneath them.
File server credentials cannot read the log at all, including activity in their own home folder, so an account-holder never sees it.
How far back you can see activity
You can see the last one, two, or three years of activity, depending on your license — the same window as your platform audit log. The window is the same for every source and every action.
| License | How far back |
|---|---|
| Standard, trial, and free | 1 year |
| Professional | 2 years |
| Enterprise | 3 years |
View and filter activity
- Go to Resources, and then select File storage.
- Select Activity, next to Files. The File activity grid opens.
- Narrow the results using the filters on the Time, Source, User, Action, and Name column headings. You can sort by Time.
- To follow one item, filter by Name. The filter lists the names in the results already loaded, and choosing one shows every entry for that item, not only the entries that were loaded.
- To see an entry's details, select View on that row. The details open as JSON.
- To see everything recorded for one item without opening the grid first, find it on the File storage page, select Actions, and then select View activity. On a folder this shows activity on the folder itself, not on the files inside it.
- To keep a copy, select Download. The file is a CSV and carries the filters you have applied.