# Search your Bitwarden audit log and check leavers in plain English

> Turn raw Bitwarden activity records into readable history you can search by person, date and action, then save what matters as evidence.

- Workflow type: app
- Services: Bitwarden, Google Sheets, Jira Service Management
- Categories: Engineering, Operations
- Published: 2026-08-16

## What it does

- Search your organization's password manager activity by person, date range and action type, with every row written as a plain sentence instead of raw codes
- See who did what to which collection or group, with people and items shown by their real names rather than internal ID strings
- Open a full timeline for any person, or run a leaver check that shows everything someone touched in their last thirty days before you sign off their offboarding
- Save the rows you care about to a Google Sheet as an evidence pack, and raise a follow up ticket in Jira Service Management with the timeline written into it

## What you'll need

- A Bitwarden organization on a Teams or Enterprise plan, since activity history is not kept on Free or Families plans
- An owner level Bitwarden login, so the app can read your organization's activity, people, groups and collections
- A Google account with a spreadsheet where evidence packs get saved
- A Jira Service Management project where follow up tickets are raised

## Prompt

Build me an investigation console over my Bitwarden organization's event log. Bitwarden's built in reporting only lets me scroll a date range, and the event types come back as integer codes while actors and targets come back as GUIDs, so the screen is useless as it stands. The entire point of this app is to turn that raw log into readable history I can actually search.

The main view is a search over List Events with filters for member, date range and event type. Render every row as a plain English sentence with its timestamp, for example "Priya Nair viewed an item in the Finance collection" or "Tom Reilly was removed from the Engineering group". Keep the underlying event type code available in a details panel for anyone who wants it, but never let it be the primary thing on screen.

To make those rows readable, load List Members, List Groups and List Collections when the app opens and build lookup maps from id to display name. Resolve the acting user id to a real person with their name and email, and resolve the target id to a collection name, group name or member name depending on which field the event carries. Maintain a mapping from Bitwarden's integer event type codes to human phrasing, covering at least logins and failed logins, item created, updated, deleted and viewed, password viewed, collection and group changes, member invited, confirmed, updated, revoked, restored and removed, and policy updates. When an id cannot be resolved because the object was deleted, say so plainly, for example "a collection that no longer exists", rather than falling back to a bare id.

From any row I want to open a per person timeline. Clicking the actor opens a view scoped to that one person, showing their events in chronological order across whatever date range I pick, with a summary at the top: how many events, which collections and groups they touched, and when they were first and last active.

Add a leaver check mode. I pick someone whose status is revoked, or who no longer appears in the member list at all, and the app shows me everything they touched in their final thirty days of activity, ending at their last recorded event. Highlight the things that deserve a second look, such as password views, item exports, unusual bursts of item access and collection membership changes, so I can sign off their offboarding with confidence. Let me change the thirty day window to match our policy.

Let me select rows anywhere in the app with checkboxes and save the selection as an evidence pack to a Google Sheet using Append Values. Each appended row should carry the timestamp, the resolved actor name and email, the readable event description, the resolved target, the underlying event type code, and the device or IP address when the event includes one. Ask me which spreadsheet and tab to append to, and confirm how many rows were written.

From that same selection, let me raise a follow up ticket in Jira Service Management using Create Customer Request, with the timeline written into the description as a readable chronological list. Include who the investigation is about and the date range it covers, let me edit the summary and description before anything is created, and show me the resulting ticket key afterwards.

Two Bitwarden constraints need to be handled in the interface rather than hidden. First, only 367 days can be queried in a single date range even though the data is retained indefinitely, so validate my date range and tell me plainly when I have asked for more than that. Second, List Events pages through a continuationToken that comes back null on the last page, so page through it automatically and show loading progress rather than silently returning only the first page. On top of that, client side events take about a minute to reach the server, so whenever my range includes the last few minutes, show a small notice that the most recent minutes may still be catching up.

This is a pull tool, something I open when I have a specific question, so do not frame it as a digest or an alerting surface. It must never write anything back to Bitwarden. Note somewhere in the app that event logs require a Teams or Enterprise Bitwarden organization.

## How to customize

- Change the leaver check window from thirty days to whatever your offboarding policy asks for
- Choose which columns land in the evidence pack spreadsheet, and which tab they get added to
- Pick the project and request type used for follow up tickets, and how much of the timeline goes into them
- Decide which kinds of activity count as noteworthy, so routine sign ins can stay hidden by default

## FAQ

### Does this work with a free Bitwarden account?

No. Bitwarden only keeps organization activity history on Teams and Enterprise plans, so the app needs one of those. On a Free or Families account there is no activity log to search.

### How far back can I search?

Bitwarden keeps your activity history indefinitely, but a single search can only cover 367 days at a time. The app checks the dates you pick and tells you when a range is too wide, so you can split it into shorter searches.

### Why does the last few minutes of activity sometimes look incomplete?

Bitwarden apps on phones and laptops send their activity up to the server roughly once a minute, so the newest events can lag slightly behind. Whenever your search includes the last few minutes, the app shows a short notice that recent activity may still be arriving.

### Can I use this to sign off someone's offboarding?

Yes, that is what leaver check mode is for. You pick someone who was revoked or removed, and the app lays out everything they touched in their final thirty days, highlighting the moments worth a second look before you close out their departure.

### Does it change anything in my password manager?

No. The app only reads from Bitwarden. The only things it writes are the evidence rows you choose to save into your spreadsheet and the follow up tickets you choose to raise.

### What makes this different from a daily security summary?

A summary gets pushed to you every morning whether or not you need it. This is the opposite: a console you open when you have a specific question, and search until you have your answer.

Use this prompt in General Input: https://www.generalinput.com/prompts/search-your-bitwarden-audit-log-and-check-leavers-in-plain-english