9.2The Operations page

The Operations page is the operations log. Open it from the navigation: select Monitoring on the navigation rail (the panel it opens is headed Observability), then Operations. Its address is /dashboard/operations.

When operations are waiting for approval, the Operations menu item shows a red badge with the number waiting ("Operations awaiting approval: N"). Failures are not counted in the badge; they stand out on the page itself.

Which directory the log shows

The log follows the workspace directory, the directory named in the console's top bar (see Chapter 4, Working in the console). There is no separate directory filter on this page: to read another directory's operations, switch the workspace. By default the page also shows platform rows (the ones tagged System), because changes to roles, keys or policies concern every directory's administrators.

Layout of the page

The page has four parts, from top to bottom.

The header line says what the log holds and what is waiting. When your role holds operations:approve it reads, for example, "Everything requested through the console, the API and agents · 3 waiting on you"; select the waiting count to show only the waiting operations. When nothing is waiting it reads "nothing is waiting on you".

The stat bar beside it shows how many operations match the current filters, and how many of those succeeded, are waiting, were rejected and failed (Cancelled appears when there are any). The stat bar is also the status filter: select a count to show only that status, and select it again to show every status. The counts always cover every status, so you can see the mix while one status is selected. Export next to it downloads the log (see 9.10).

The toolbar and the filters below it narrow what is shown (see 9.3.1). At its right end, "50 of 1,204 shown" tells you how many of the matching operations are on the page so far.

The list shows every operation, newest first, grouped under a heading for each day ("Today · 5 Oct 2026", "Yesterday · …", then the date) with the number of operations that day. Each line has these columns:

Operations that need attention stand out: a waiting operation has an amber background and a failure that nobody has dismissed has a red one. The reason is printed under the line itself: the error code and message for a failure, the rejection message for a rejected request, and the reason it is held for a waiting one.

Older operations load by themselves as you scroll towards the end of the list. The line at the bottom reads "Newest first · older operations load as you scroll", with a Load older link, and "that is everything for these filters" once all of them are shown.

Tip: The page refreshes itself as operations happen, through the live operations stream. New operations appear at the top and decisions update the line they belong to, without losing your place in the list.

9.3.1 Filtering the log

The toolbar holds the filters you use most:

To filter the log by a custom time range:

1. 1In the time-range list, select Custom….
2. 2In the row that appears, set From and To (local date and time).
3. 3Select Apply filters.

More filters opens a panel with four columns:

The lists in the panel come from the log itself, limited to the rows you may see: you are offered the people, keys, operations and error codes that actually occur, not everything that exists.

To choose operations to filter on:

1. 1Select More filters, then select the Operation box.
2. 2Type part of an operation's name, its command name or an area such as "groups". The suggestions are grouped by area (for example Active Directory Users or Platform — Roles). Each shows whether it is a Change or a Read, and how many times it occurs in the log.
3. 3Select an operation to add it. Repeat for more; up to 20 single operations can be chosen.
4. 4To take a whole area at once, select Select all beside the area's heading. The area becomes one chip, such as "All of Active Directory Groups", and covers every operation in it.
5. 5To remove a choice, select × on its chip, or press Backspace in the empty box.

Active filters are listed under the toolbar as chips, for example "Commands", "Last 7 days" or "By ana@example.com". Select × on a chip to remove that filter alone, or Clear all to return the page to how it opens, still scoped to the workspace directory. Every filter in use has a chip, including filters that arrived with a link and have no control of their own.

The address keeps the filters. Every filter is written into the page's address as you set it, so you can bookmark a filtered view, send it to a colleague, or come back to it with the browser's Back button. A named range such as Last 7 days stays relative: opened tomorrow, it shows the seven days before tomorrow.

Some filters usually arrive with a link from another screen:

• From Connected agents, the link to an agent's activity opens the log filtered to that one agent session (the chip reads "One connected agent's session"). In that case the log shows the agent's rows in the directory the agent was granted, even if that is not your workspace directory. See Chapter 13, AI agents (MCP server).
• A link with a requester filter shows one person's operations.
• A link with ?operationId= opens one operation's detail directly (see 9.4.3).

The All operations → link at the foot of a Change history panel on another screen opens this page (see 9.3.3).

9.3.2 The operation detail

Select any line to open it in place. The expanded line shows who requested it and the role they acted as, the command name, the full distinguished name of the target, how long it took, when it was requested, how it arrived, and the impact summary where one was recorded. It also offers:

• Open full record, which opens the operation's detail window, described below;
• Copy request id, which copies the operation's id, for a support ticket or the REST API;
• Approve and Reject for a waiting operation, and Dismiss for a failure, when your role holds operations:approve (see 9.4).

Select the line again to close it. A waiting operation can also be opened by a link (see 9.4.3). In the detail window, press Escape or the close button to close it.

The header shows the action (Create, Update or Delete), the operation's name, the System tag for a platform change, and the status.

The body shows:

For a directory operation, next to the target:

• Copy copies the distinguished name to the clipboard.
• Open in Directory → opens the Directory Browser on that object. It is offered only when the operation succeeded, it was not a delete, and you may use the Directory Browser (ad:directory:read and the Directory Browser licence module). In every other case the object might not exist, so the link is not shown. See Chapter 6, Directory Browser.

For a platform change, Changed record reads "A change to this platform's own settings. Nothing in a directory was modified." followed by the record's name or id.

If the operation failed, a red banner shows the error code and message.

What changed

When the platform captured attribute values, the detail ends with a table of them. Its heading tells you what kind of record it is:

For an update, the table opens on what changed, with a count such as "2 changed". Select Show all N attributes to include the unchanged values, and Show only what changed to go back. If nothing moved, the table reads "Nothing changed — every value was already as requested."

Note: Platform changes never record secrets. A replaced password or client secret is recorded as the fact that it changed, not its value.

The approval timeline

For any operation that went through approval, the detail shows an Approval card with up to three steps:

1. 1Requested: who requested it and when.
2. 2Decision — [status]: for a decided request, "Approver [email] · decided [time]"; for a waiting one, "Expires [time]" or "Not yet decided". Any result message, such as the expiry message, appears beneath. While the operation waits and your role holds operations:approve, this step carries the Approve & Execute and Reject buttons.
3. 3Executed: shown when the approved operation ran successfully, with its duration.

9.3.3 Object history

The log is also the source of each object's change history. In the Directory Browser, an object's history panel shows the operations that touched it, matched on both its objectGUID and its distinguished name, so the history survives a rename. Several administration screens (directory connections, users, roles, API keys, Directory Policies, notification rules, MCP tools) show a Change history panel built the same way from the operations about that record, with an All operations → link to this page. These panels are described with their screens in the relevant chapters.