Audit log API

2 endpoints, generated from packages/core/openapi/v1.snapshot.json (OpenAPI 3.1.0, contract version 1.0). Conventions for lists, errors, money and authentication are on the API conventions page.

GET/api/v1/audit-events

Search the audit log

hr_admins do not see security-settings, SSO or payroll events; payroll_admins see payroll, compensation and bank events only.

Access

Permission audit_log:read

Parameters

Name	In	Type	Required
page	query	integer	no
pageSize	query	integer	no
sort	query	enum	no
actor Actor membership ID.	query	string (uuid)	no
action Exact action, or a prefix ending in `.` (e.g. `auth.`).	query	string	no
targetType	query	string	no
targetId	query	string	no
from	query	string (date)	no
to	query	string (date)	no

Responses

200 Success. object

• itemsarray of objectrequired

  • idstring (uuid)required
  • seqintegerrequired

    min -9007199254740991

  • atstring (date-time)required
  • actorTypeenumrequired

    one of "member", "system", "cli", "anonymous"

  • actorMembershipIdstring (uuid) or nullrequired
  • actorLabelstring | nullrequired
  • actionstringrequired
  • targetTypestringrequired
  • targetIdstring | nullrequired
  • targetLabelstring | nullrequired

    Human name of the target (member, employee, department…) when it still exists.

  • requestIdstring | nullrequired
  • ipstring | nullrequired
  • userAgentstring | nullrequired
  • diffany or nullrequired
  • metaany or nullrequired
• pageintegerrequired

  min -9007199254740991

• pageSizeintegerrequired

  min -9007199254740991

• totalintegerrequired

  min -9007199254740991

• 400 validation_failed
• 401 session_expired, session_revoked, unauthenticated
• 403 forbidden, mfa_enrolment_required

GET/api/v1/audit-events/export.csv

Export the audit log as CSV (same filters and visibility)

Access

Permission audit_log:export

Parameters

Name	In	Type	Required
actor Actor membership ID.	query	string (uuid)	no
action Exact action, or a prefix ending in `.` (e.g. `auth.`).	query	string	no
targetType	query	string	no
targetId	query	string	no
from	query	string (date)	no
to	query	string (date)	no

Responses

200 CSV file. text/csv

• 400 validation_failed
• 401 session_expired, session_revoked, unauthenticated
• 403 forbidden, mfa_enrolment_required