Discord Audit Log Action Decoder
The Discord API returns audit log entries as numeric action types, so a raw log or bot payload tells you an event happened without telling you what it was. This decoder maps every action type number to its meaning, the entity it affects, and the permission a moderator needed to trigger it.
| Action ID | API Name | Trigger Event Description | Category |
|---|
How to use the Audit Log Action Decoder
- Enter an audit log action type number, or browse the full list.
- Read the decoded event name, target entity, and required permission.
- Cross-reference the executor ID with the ID Lookup tool if you need a timestamp.
Investigating Rogue Admin & Bot Attacks
- Filter by Action Type: In Server Settings > Audit Log, filter for
Member Ban Add (22),Channel Delete (12), orRole Delete (32)to isolate destructive events. - Identify the Actor: The left side of every log entry shows the exact user or bot account that authorized the action.
- Immediate Containment: Remove the actor's highest role immediately, or kick the compromised bot from Server Settings > Integrations.
Reading audit log entries and what they do not tell you
The audit log records administrative actions with a numeric action type, an executor, a target, and optional change data. Working from the API or a logging bot's raw output means seeing those numbers rather than names, and the numbering is grouped: guild updates in the low numbers, channel actions in the tens, member actions in the twenties, roles in the thirties, and later ranges for integrations, threads, and automod.
Two limits matter for investigations. Entries are retained for 90 days, so anything older is gone regardless of your permissions. And the log records the action, not the intent or the content: a bulk message delete entry tells you a moderator deleted 40 messages in a channel, never what those messages said. Reconstructing content requires a separate logging bot that stored it at the time.
Viewing the audit log requires the View Audit Log permission, and it is worth restricting. The log exposes the full administrative history of the server, including role changes and bans, which is more than most moderator roles need. Pair it with a logging bot for the detail the audit log omits, and keep both scoped to the same trusted group.
Common problems and fixes
- An action has no audit log entry
Not every event is logged, and entries older than 90 days are purged. Message edits and normal deletions by the author are never recorded. - The executor shows as a bot
The bot performed the action on someone's behalf. Check the bot's own command logs to identify who instructed it. - You cannot open the audit log
It requires the View Audit Log permission, which is commonly restricted to administrators.
Frequently asked questions
How long are Discord audit logs stored?
Discord stores audit log records for up to 90 days.
What is action type 20 in Discord audit logs?
Action 20 is MEMBER_KICK (a member was kicked by a moderator or bot).
What is action type 22 in Discord audit logs?
Action 22 is MEMBER_BAN_ADD (a member was banned from the server).
Can audit log entries be deleted or edited by admins?
No. Discord audit logs are permanent immutable records that cannot be modified or deleted by server owners or staff.
How long does Discord keep audit logs?
90 days. There is no way to extend this, so a logging bot is required for a longer history.
Does the audit log show deleted message content?
No. It records that a deletion happened and by whom, never what was deleted.
Can audit log entries be deleted?
No. Entries cannot be removed or edited by anyone, including the server owner.