Audit Entries API
List audit entries
List all audit entries for an account:
GET /audit_lines
Response
status: 200 OK[
{
"id": 354217,
"action": "update",
"created_at": "2017-01-21T14:47:11-06:00",
"created_by": {
"id": 156,
"name": "Ellen Brown",
"account": {
"id": "widget",
"name": "Widget International"
}
},
"audited": "project",
"project": {
"id": 7497,
"subject": "Digital Operations Center (DOC)"
}
},
{
"id": 354216,
"action": "create",
"created_at": "2017-01-21T14:46:47-06:00",
"created_by": {
"id": 128,
"name": "Howard Tanner",
"account": {
"id": "widget",
"name": "Widget International"
}
},
"audited": "request",
"request": {
"id": 70486,
"subject": "Unable to access SAP"
}
},
"..."
]
The response contains these fields by default. Filtering and pagination are available to reduce/limit the collection of audit entries.
Collection Fields
By default the following fields will appear in collections of Audit Entries:
action auditable audited created_at created_by id
Filtering
Filtering is available for the following fields:
id created_at
Sorting
By default a collection of Audit Entries is sorted descending by id.
A collection filtered on created_at is sorted descending by created_at instead, and by id after that.
The two orders differ only for an audit entry with a created_at older than that of an audit entry created before it, for example an imported audit entry.
Use sort=-id to retrieve a collection filtered on created_at in the order in which the audit entries were created.
The following fields are accepted by the ?sort= parameter:
id created_at
Sort on the field you filter on. A collection filtered on one field and sorted on the other can take too long to retrieve
for an account with many audit entries. Such a request is answered with a 400 Bad Request response with the message
Unable to complete request, retrieving data took too much time.
Sorting ascending by id with only a lower bound on created_at, for example ?sort=id&created_at=>2026-10-01T00:00:00Z
to retrieve the audit entries created since a previous retrieval, is the exception: it starts at the first audit entry
created after that bound, and stays fast.
Get a single audit entry
GET /audit_lines/:id
Response
status: 200 OK{
"id": 354217,
"action": "update",
"created_at": "2017-01-21T14:47:11-06:00",
"created_by": {
"id": 156,
"name": "Ellen Brown",
"account": {
"id": "widget",
"name": "Widget International"
}
},
"audited": "project",
"project": {
"id": 7497,
"subject": "Digital Operations Center (DOC)"
},
"changes": {
"justification": [
"compliance",
"correction"
]
}
}
The response contains these fields.
Fields
- action
- Readonly enum — The Action field indicates the type of transactions that caused the audit entry to be generated. Possible values are:
-
create: Createupdate: Updatedestroy: Destroyinfo: Info
- auditable
- Readonly reference — A reference to the record for which the audit entry was generated. The field name in the response matches the value of the
auditedfield (e.g. whenauditedisrequest, the reference is returned asrequest). - audited
- Readonly enum — The Audited field contains the record type name of the record for which the audit entry was generated.
- changes
- Readonly hash — The old and the new value of each field that was set or changed by the transaction that caused the audit entry to be generated. Only available when getting a single audit entry, not included in collection listings.
- created_at
- Readonly datetime — The date and time at which the audit entry was created.
- created_by
- Readonly reference to Person — The Created by field is set to the person who caused the audit entry to be generated.
- id
- Readonly integer — The unique ID of the audit entry.
- user
- Readonly reference to Person — The User field is set to the person whose session was used to cause the audit entry to be generated. This is usually the same person as the one in the Created by field, but can be different when a support user performed the action using an impersonation session.