Why did this Opportunity move? (User vs Automation vs Webhook)
Goal: Identify what changed, when, and who/what caused it (User, internal automation, or external webhook/integration).
Option 1: Opportunity ID Shortcut (Fastest)
Go to Opportunities and open the specific Opportunity card.
In the popup, look at the bottom-left for the Opportunity ID (e.g.,
TwKhr1...).Click the ID link.
→ This should auto-open the Audit Log already filtered to that record.→ And you can see "Action" and "Done By" columns for the activity
Option 2: Manual Audit Search (If shortcut isn’t available)
Go to Settings → Audit Logs.
On the top columns, set:
Module:
OpportunitiesAction:
Updated
Paste the Opportunity ID (e.g.,
TwKhr1k4qNwHXZwZVzDW) into Document ID.If no results appear:
Clear Document ID
Use a Date Range around when the move happened
Search and locate the Opportunity update entry manually
Option 3: Identify the Cause (User vs Automation vs Webhook)
On the relevant audit entry, click the Eye icon (Preview).
Interpret the “actor/source” fields:
How to classify the cause
Named User (e.g., “John Doe”) → Manual change by that user
“System” / blank user / service-looking user → Internal workflow/automation
“API” / “Integration” / app name → External webhook / third-party integration
What to look for in the log entry
Confirm the exact field change: Stage (or “High Level”) from X → Y
Capture:
Timestamp
Actor (User/System/API)
Source/App (if shown)
Old Value → New Value
What to capture
Which tag(s) changed: Added: X, Y / Removed: Z
Timestamp + Actor + Source/App
Any related field change that explains the tags (e.g., lifecycle/status updates)
Escalation notes (when it’s not obvious)
If it says API/Integration: ask for the integration name and correlate the timestamp with any integration/webhook runs.
If it says System: check what automations are configured to update stage (workflows, rules, routing, etc.) around that time.