Skip to main content

​
What is recorded

Every change made through the dashboard or the API is recorded: voucher sets, change requests, vouchers (batch creates, revocations, every reveal), uploads, schedules, stock alert rules, members, groups, settings, API keys, webhook endpoints and replays, IP allowlist entries, branding. Security events appear too, for example security.ip-denied when a request was refused by your IP allowlist. Not recorded as audit events: plain reads, webhook delivery attempts (see the delivery log) and stock recalculations. Idempotent replays write nothing. Each event has:

​
Reading the audit log

GET /partner/v1/audit-events needs view-audit (delegable to API keys):
  • Filters: actionType, entityType, entityId, actor.type, actor.id, createdAt; newest first.
  • Without filter[createdAt][gte] the last 90 days are searched; a window longer than 24 months → 400 data-failed-validation with property filter[createdAt], constraint invalid-filter and params.maxMonths 24.
  • To keep a copy, page through the list with perPage=100 (Downloading large lists).

​
Retention

Audit events are kept for 24 months, then deleted. Download them (page through the list) if you need them longer.