---
title: "Access logs"
description: "See who signed in to Guardian, and when."
product: "Guardian"
edition: "Classic"
type: "overview"
url: "https://docs.cloudhouse.com/guardian/classic/account/users/access-logs/"
---
# Access logs

The **Access Log** button (**Account** > **Manage Accounts** > **Users** > **Access Log**) on the **Users** page takes you to the Saved View for User Logins. A Saved View in Guardian lets you quickly access all events that fall into a specific category. For more information, see [Saved Views](https://docs.cloudhouse.com/guardian/classic/control/events/events/index.md#saved-views).

Applies to: `Guardian Classic`

On this page, you can view information on two types of access: user logins and API calls.

!!! note

    User logins and API calls are both considered 'User Logged In' event types in Guardian. For more information on events, see [Events](https://docs.cloudhouse.com/guardian/classic/control/events/events/index.md).

![Access log](https://docs.cloudhouse.com/guardian/classic/assets/images/guardian/account/access-log.png)

By default, the saved view for user logins page displays an overview of each access event. In the case of a user login, the user's email address and IP address are displayed, alongside the event's time stamp. In the case of an API call, the name of your Guardian organisation's service account is displayed.

!!! note

    If you have enabled the use of personal API keys in your Guardian organisation, the user's personal API key is displayed here instead of the organisation's service API key. For more information on personal API keys, see [API Keys](https://docs.cloudhouse.com/guardian/classic/account/organizations/organization-account-settings/index.md#api-keys).

To view more information on a login event, click an item to display the following fields:

**API**
:   Indicates whether the login was triggered by an API call. If 'True', the login was triggered by an API call. If 'False', the login was triggered by a user logging in to Guardian.

**api\_key**
:   Displays a preview of the API key used if the event was triggered by an API call. If the event was triggered by a user logging in to Guardian, 'null' is displayed.

**Email**
:   If the event was triggered by a user logging in to Guardian, the user's email is displayed. If the event was triggered by an API call, the name of the organisation's service account is displayed.

    !!! note

        If personal API keys are enabled, the user's email will still be displayed here even if the access event is the result of an API call. For more information on personal API keys, see [API Keys](https://docs.cloudhouse.com/guardian/classic/account/organizations/organization-account-settings/index.md#api-keys).

**ip\_address**
:   The IP address of the user's machine, from which access was obtained.

**secret\_used**
:   Indicates whether the API secret key was used. If 'True', the key was used. If 'False', the key was not used. If 'null', the access event is a user login.  Read-only API calls triggered as part of scheduled jobs do not require the use of a secret key. For example, regularly scheduled node scans do not require a secret key. However, triggering a node scan using an external API call does require a secret key.

**Success**
:   Indicates whether the access event was successful. If 'True', the access event was a success. If 'False', the access event was unsuccessful. False access events indicate either a failed API call or an unsuccessful user login.

    !!! note

        If single sign-on (**SSO**) is enabled in your Guardian instance, only successful user logins are displayed as part of the **User Logins** saved view. With SSO enabled, user credentials are authenticated by the SSO provider. As such, unsuccessful logins are not displayed in Guardian.

**User**
:   Indicates whether the login was triggered by a user. If 'True', the event was triggered by a user. If 'False', the event was triggered by an API call.

**Timestamp**
:   The specific date, time, and time zone of the login event.

From the **Access Log** page, you can also view actions configured to run upon user logins. For example, you might have an action configured to send an email letting you know when users log in to your Guardian instance. To view these actions, click the **Actions** tab. Here, you can also configure a new action by clicking **Add Action** in the top right corner. For more information on configuring actions in Guardian, see [Actions](https://docs.cloudhouse.com/guardian/classic/control/events/actions/actions/index.md).

![Access log actions](https://docs.cloudhouse.com/guardian/classic/assets/images/guardian/account/access-log-actions.png)