> For the complete documentation index, see [llms.txt](https://docs.cipp.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cipp.app/user-documentation/tenant/manage/history.md).

# History

This timeline shows the actions CIPP has taken against the selected tenant, most recent first, covering the last five days by default. It is useful for working out why a policy did not apply, or confirming when a setting was enforced and by whom.

Only entries recorded against this tenant appear here. CIPP's own platform-level activity is not included.

## Timeline Entries

Each entry on the timeline carries the following.

| Element       | Description                                                                                                                         |
| ------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
| Date and time | When the action was recorded, shown to the left of the timeline in 24-hour time.                                                    |
| Severity      | A coloured marker and chip naming the severity of the entry.                                                                        |
| API           | The CIPP function that recorded the entry, which is usually the quickest way to identify what was running.                          |
| IP            | The source address the action came from, where one was recorded.                                                                    |
| Message       | What happened. Messages longer than 256 characters are shortened, with **Show more** and **Show less** to expand and collapse them. |
| User          | The account that carried out the action, where one was recorded. Entries from scheduled or automated runs may not name a user.      |

## Severity Levels

Entries are returned for the severities below. Info, Warning and Error are colour-coded on the timeline. Critical and Alert are shown with a neutral marker, with the severity itself named on the chip.

| Severity       | Description                                                          |
| -------------- | -------------------------------------------------------------------- |
| Info           | Normal activity, recorded for reference.                             |
| Warn / Warning | Something completed but not cleanly, or a condition worth attention. |
| Error          | The action failed.                                                   |
| Critical       | A failure treated as more serious than a standard error.             |
| Alert          | Raised by CIPP's alerting rather than by a direct action.            |

## Loading More History

**Load More** extends the range by a further seven days each time it is used, and the button names the total it will show next. The range always runs back from today, so extending it re-reads the whole period rather than paging further back.

{% hint style="info" %}
The Load More button appears below the timeline only once there is at least one entry to show. Where a tenant has had no activity in the last five days, the page reports that no logs were found and the range cannot be extended from here.
{% endhint %}

## Page Actions

| Action       | Description                                          |
| ------------ | ---------------------------------------------------- |
| Refresh Data | Re-reads the timeline for the range currently shown. |

***

## Feature Requests / Ideas

We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.cipp.app/user-documentation/tenant/manage/history.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.