Skip to main content
GET
Get audit event by ID

Authorizations

X-API-KEY
string
header
required

Path Parameters

id
string
required

Audit event ID

Response

OK

actorId
string

ActorID is the ID of the user or system actor that triggered the event.

Example:

"a1b2c3d4-e5f6-4711-8899-aabbccddeeff"

actorRole
string

ActorRole is the normalized role of the actor (e.g. "admin", "staff"). Internal-only.

Example:

"admin"

actorType
enum<string>

ActorType identifies whether the actor is an internal user or a client user.

Available options:
internalUser,
clientUser
Example:

"internalUser"

apiKeyRef
string

APIKeyRef references the API key used for platform-API-sourced events. Internal-only.

Example:

"key_01HZX8K9P2"

automationId
string

AutomationID is the ID of the automation that triggered the event, when applicable.

Example:

"auto_01HZX8K9P2"

companyId
string

CompanyID is the ID of the company the actor belongs to, when the actor is a client user.

Example:

"c1d2e3f4-a5b6-4712-9988-ffeeddccbbaa"

context
object

Context carries event-specific metadata as arbitrary key/value pairs.

createdAt
string
creatorId
string
data
string
eventDescription
string

EventDescription is a human-readable description of the event.

Example:

"Client created"

eventDetails
string
Example:

"Updated billing address"

eventTextEntity
string
Example:

"Acme Corp"

eventTextPrefix
string

EventTextPrefix / EventTextEntity / EventDetails are computed at read time by FormatEvent (see event_formatter.go) and exposed to the internal audit log page and the CSV export so both render identical text. Not persisted, and tagged omitexternal — these are UI helpers, not part of the public platform API contract.

Prefix and Entity intentionally omit omitempty: FormatEvent sets one of them to "" on purpose for events like messageSent (entity is the linked label, no prefix). With omitempty the empty string would drop from the wire, the client would ?? back to eventDescription, and the row would render as Message sent "Message sent" instead of a single linked Message sent.

Example:

"Client"

eventType
enum<string>

EventType categorizes the event.

Available options:
userLoggedIn,
userLoggedOut,
userLoginSucceeded,
userLoginFailed,
passwordReset,
passwordChanged,
googleDelinked,
magicLinkSent,
workspaceMfaEnabled,
workspaceMfaDisabled,
clientCreated,
clientActivated,
clientUpdated,
clientDeleted,
clientInvited,
companyCreated,
companyUpdated,
companyCustomFieldsUpdated,
companyDeleted,
clientCustomFieldsUpdated,
fileCreated,
fileUpdated,
fileDeleted,
folderCreated,
folderUpdated,
folderDeleted,
linkCreated,
linkUpdated,
linkDeleted,
invoiceCreated,
invoiceInitiated,
invoicePaid,
invoiceUpdated,
invoiceDeleted,
invoiceVoided,
invoiceDownloaded,
refundRequested,
refundSucceeded,
refundFailed,
messageSent,
messageChannelCreated,
messageChannelDeleted,
taskCreated,
taskUpdated,
taskDeleted,
taskArchived,
taskCompleted,
paymentSucceeded,
paymentFailed,
subscriptionCreated,
subscriptionCancelled,
priceCreated,
productCreated,
productUpdated,
contractRequested,
contractCompleted,
contractDownloaded,
fileDownloaded,
fileBatchDownloaded,
fileBatchDeleted,
noteCreated,
noteUpdated,
noteDeleted,
internalUserCreated,
internalUserDeleted,
internalUserAccessLevelChanged,
internalUserClientVisibilitySet,
apiKeyCreated,
apiKeyDeleted,
formCreated,
formEdited,
formAssigned,
formResponseCompleted,
customEvent,
sessionStarted,
sessionEnded
Example:

"clientCreated"

id
string
identityId
string
ip
string

IP is the client IP address that triggered the event.

Example:

"203.0.113.42"

isSuperAdminTriggered
boolean

IsSuperAdminTriggered is set when the event originated from an Assembly super-admin proxy session (the admin signed in via /admin and is acting on behalf of a portal user). Hidden from external / platform-API consumers via omitexternal.

Example:

false

object
string
previousAttributes
object
ref
string
source
enum<string>

Source indicates where the event originated from.

Available options:
web,
platform,
automation,
system
Example:

"web"

updatedAt
string
userAgent
string

UserAgent is the User-Agent header of the request that triggered the event. UserAgent and IP are intentionally exposed to external consumers (no omitexternal tag). These fields contain PII; consumers are responsible for GDPR/CCPA compliance

Example:

"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)"