The workspace's audit log: every recorded act with who did it, through which request, job or webhook, and what changed. Filter the list, read one operation with all its rows, and list the sources operations started from.
List audit events
Returns a paginated, filtered audit log for the calling organization. Replaces the old per-entity state-transition feed: every domain event lands in audit_events, with state.transitioned as one event_type among many. Default page size is 25, max 100.
query Parameters
limitPage size. Values above the server-side cap are clamped (standard default 50, cap 200; a few document-heavy lists use larger windows). Invalid values fall back to the default.
cursorOpaque continuation token from the previous response's pagination.cursor. Omit for the first page. Cursors are stateless and do not expire, but are only valid for the list and filters that produced them.
searchFree-text search, trimmed; empty searches nothing. A row matches when its actor's name, email, label or key prefix contains the term (case-insensitive), when the name it recorded for its record or its summary contains it (case-insensitive: an audience, a role or an API key by the name it had at the act), when it is filed under a record whose name or number the app's search matches (among the records the caller may read), when the term is the request id it was written in, or — for a UUID — when that id is the row's own, its operation's (correlation_id), its own entity or a record it is filed under; a trace id (32 hex digits) finds its operation's rows. Composes with every other filter.
entity_typeKeep only rows whose own entity is of one of these kinds, in the stored upper-case spelling (CUSTOMER, INVOICE, SUBSCRIPTION, …). Repeatable (?entity_type=INVOICE&entity_type=CREDIT_NOTE). The rows ABOUT an entity of a kind rows are filed under (AuditSubjectType) are subject_type and subject_id.
entity_idKeep only rows whose own entity has this UUID.
subject_typeWith subject_id: keep only what happened ABOUT this entity (a customer, a quote, a member, …) — its own rows and every row filed under it, whatever their entity (an invoice a subscription billed, a price of a product, a signing request of a quote). The rows the entity's Audit tab shows. Composes with every other filter.
subject_idThe subject subject_type names. Both are given or neither.
draft_version_idKeep only the catalog edits that landed in this working draft — the version that shipped them once it was published. Composes with the subject scope.
event_typeFilter by event type. Repeatable (?event_type=a&event_type=b) or comma-separated (?event_type=a,b).
setting_keysKeep only the rows that changed one of these settings: rows whose diff carries a setting change item (added, changed or removed) for one of the keys, whichever act carried it. Repeatable (?setting_keys=a&setting_keys=b) or comma-separated. What a settings section's History reads.
severityKeep only rows whose event type is declared at one of these severities: info, notice, warning, critical. Repeatable (?severity=warning&severity=critical). ANDs with event_type.
actor_typeFilter by actor type: user | api_key | system | job | webhook | customer | unknown. Repeatable or comma-separated: a row by any of them is kept.
actor_user_idFilter by acting user id. Repeatable or comma-separated: a row by any of them is kept.
trigger_kindKeep only the rows of operations started this way: api, portal, webhook, job, schedule, clock_advance, support or system. Repeatable (?trigger_kind=schedule&trigger_kind=clock_advance). A row whose operation recorded no trigger is not kept.
trigger_sourceKeep only the rows of operations started from one of these sources — a trigger's source as GET /audit-trigger-sources lists it (POST /v1/invoices/{id}/finalize, stripe, billing.period_due). Repeatable; ANDs with trigger_kind.
occurred_afterFilter by occurred_at >= timestamp (RFC3339)
occurred_beforeFilter by occurred_at <= timestamp (RFC3339)
sortOrdering: occurred_at, occurred_at:asc or occurred_at:desc. Omit for the default (occurred_at:desc, newest first). Any other value is rejected. A cursor is bound to the ordering that issued it, so changing this needs a fresh walk.
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
List audit events › Responses
OK
Get an audit operation
Returns one operation of the audit log — the request, job run, webhook or clock advance every row with this correlation_id belongs to: how it started, the operation that armed it, the operations it armed, and its rows in order, each naming the row of the event it is a consequence of.
path Parameters
idThe operation: the correlation_id its rows carry.
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
Get an audit operation › Responses
OK
List audit trigger sources
Returns the ways operations started in the workspace since a bound — each source (a request's method and route template, a webhook's provider, a job's topic) with its kind, how many operations started from it and when the latest did — most frequent first, at most 200. The options of the audit list's trigger_source filter.
query Parameters
sinceCount the operations started at or after this instant (RFC3339). Default: 90 days ago.
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
List audit trigger sources › Responses
OK