This feature is only available in the Enterprise version
Audit
List audit logs
Return workspace activity for your organization: who did what, when, and on which resource.
GET/audit/logs
An audit log is one workspace action: who did it, when, and which resource they touched. Cloud writes a row when someone uses the dashboard, a Cloud API key, the proxy, or a Custom App.
This endpoint lists those rows for the authenticated organization, newest first. To review the same activity in the dashboard, open Settings > Audit logs.
api_key_id is present when the actor used an API key. acting_app is present when a Custom App performed the action, or when the row is an app lifecycle event such as install or launch.
This endpoint requires the Cloud audit:read scope.
Enterprise authentication
Send these requests to https://api.cloud.blnkfinance.com on Blnk Cloud. On a self-hosted Enterprise deployment, send them to ENTERPRISE_PUBLIC_URL.
Pass an Enterprise API key, or an OAuth access token, in the X-blnk-key header. Create the key in Enterprise API keys, or issue a token with Enterprise OAuth.
This credential comes from the Cloud or Enterprise workspace. A Core API key belongs to the Core instance.
X-blnk-keystringrequiredheader
Enterprise API key, or an OAuth access token.
Query parameters
pageintegerquery
Page number. Defaults to 1. Values less than 1 are treated as 1.
page_sizeintegerquery
Audit logs to return. Defaults to 10. Values less than 1 are treated as 10.
actionstringquery
Substring of the action label on the log. Case-insensitive. For example: action=Ledger matches Ledger Created and Ledger Updated.
Supported values
Labels that match
Ledger
Ledger Created, Ledger Updated
Balance
Balance Created, Balance Updated
Transaction
Transaction Created, Transaction Retrieved
Identity
Identity Created, Identity Updated
Reconciliation
Reconciliation Started, Instant Reconciliation Started
Matching Rule
Matching Rule Created, Matching Rule Updated
External Data
External Data Uploaded
Alert
Alert assigned, Alert escalated
App
App Installed, App Launched, App Deleted
Domain
Domain verified, Domain removed
Deployment
Deployment created, Deployment destroy initiated
performed_bystringquery
User id stored on the log as performed_by_id (user_...). Exact match. Do not pass the display name in performed_by.
instanceIdstringquery
Audit logs whose instance_id is this Cloud instance (instance_...). This is a filter, not a routing param.
ledgerIdstringquery
Audit logs whose ledger_id is this ledger (ldg_...).
balanceIdstringquery
Audit logs whose balance_id is this balance (bln_...).
transactionIdstringquery
Audit logs whose transaction_id is this transaction (txn_...).
identityIdstringquery
Audit logs whose identity_id is this identity (idt_...).
reconciliationIdstringquery
Audit logs whose reconciliation_id is this reconciliation (recon_...).
anomalyIdstringquery
Audit logs whose anomaly_id is this alert.
doc_idstringquery
Audit logs whose doc_id is this document.
appIdstringquery
Audit logs whose app_id is this app (app_...).
installedAppIdstringquery
Audit logs whose installed_app_id is this install (instapp_...).
appNamestringquery
Case-insensitive substring of app_name on the log.
domain_namestringquery
Audit logs whose domain_name is this workspace domain. domain is an alias for the same filter.
Response
Rows include every resource id field. Unrelated ids come back as empty strings. These fields are omitted when empty: api_key_id, deployment_id, domain_name, email, acting_app, and performed_by_id.
dataarray
Audit log rows for the current page, newest first.
Log properties
audit_log_idstring
Unique id of this row (audit_...).
actionstring
Activity label, such as Deployment destroy initiated, Transaction Created, or App Launched.
performed_bystring
Display name of the actor (FirstName LastName). Falls back to the user id when Cloud cannot resolve the name.
performed_by_idstring
User id of the person who performed the action (user_...). Pass this value as performed_by to filter. Omitted when the log has no user.
api_key_idstring
Cloud API key that performed the action (apikey_...). Omitted when the actor did not use a key.
created_attimestamp
When the action occurred, in UTC.
instance_idstring
Related Cloud instance (instance_...). Empty when the action is not tied to an instance.
deployment_idstring
Related managed deployment (deploy_...). Omitted when the action is not about a deployment.
ledger_idstring
Related ledger (ldg_...). Empty when unused.
balance_idstring
Related balance (bln_...). Empty when unused.
transaction_idstring
Related transaction (txn_...). Empty when unused.
identity_idstring
Related identity (idt_...). Empty when unused.
reconciliation_idstring
Related reconciliation (recon_...). Empty when unused.
anomaly_idstring
Related alert id. Empty when unused.
doc_idstring
Related document id. Empty when unused.
app_idstring
Related app (app_...). Empty when unused.
installed_app_idstring
Related install (instapp_...). Empty when unused.
app_namestring
App display name stored on the row. Empty when unused.
domain_namestring
Workspace domain this action is about. Present on domain verification and join events.
emailstring
Email stored on the row, such as a pending invite revoked during domain join. Omitted when unused.
acting_appobject
Present when a Custom App performed the action, or when the row already stores app ids from an install or launch. Use name and logo_url to show the app next to performed_by.
Acting app properties
app_idstring
App id (app_...).
namestring
App display name.
slugstring
App slug, such as fee-engine.
logo_urlstring
App logo URL. Empty when none is set, or when Cloud fell back to the stored row.
installed_app_idstring
Installed app id (instapp_...). Omitted when Cloud cannot resolve the install.
from_audit_snapshotboolean
true when the app is no longer in the registry and Cloud filled name from this log row. Treat logo_url as a placeholder when it is empty.
paginationobject
Page info for this request.
Pagination properties
current_pageinteger
Page you requested. The default request returns 1.
page_sizeinteger
Rows on this page. The default request returns 10.
totalinteger
Total rows that match the filters, before pagination.
