ZATCA Audit Trail
The Audit Trail records every ZATCA action taken in the ERP: who did it, when, from which address, what changed and what came back. It exists because e-invoicing is a regulated process, and a regulator's question about a particular invoice is much easier to answer from a log than from memory.
What is recorded
| Column | Meaning |
|---|---|
| Date | When it happened. |
| User | Who did it. |
| Action | What was done — generating a CSR, onboarding, validating an invoice, submitting one, changing settings. |
| Entity Type / Entity ID | What it was done to: an invoice, a certificate, the settings. |
| Status | Success, Warning, Failed or Error. |
| IP Address | Where the action came from. |
Changes keep the old and the new value, so a settings change shows what it was before as well as after.
Action types
| Group | Covers |
|---|---|
| Certificate Upload | Keys and certificates going in. |
| Submit Invoice | Documents sent to ZATCA. |
| Status Update | Answers coming back and status changes. |
| Settings Update | Configuration changes. |
Filters
Filter by date range, user, action and status. Summary Statistics gives Total Actions and the breakdown by outcome, which is the quickest way to see whether a bad afternoon was one problem repeated or several different ones.
Using it
| Question | How to answer it |
|---|---|
| Why did this invoice fail? | Filter to the entity id. The raw ZATCA response is logged. |
| Who changed the environment? | Filter action to settings updates. Old and new values are kept. |
| Did anything go wrong overnight? | Filter status to Failed or Error for the date range. |
| When did we onboard? | The onboarding action, with what came back. |
The full raw response from ZATCA is logged, not just our reading of it. When a message is unclear or a support conversation needs evidence, that raw text is what to send — it is what ZATCA's own systems said, in their words.