Activity log

Every change made in your account is recorded: who made it, what they did, the thing they did it to, when, and the address and client it came from. Open it at Settings → Activity, or read it with GET /v1/activity — from a signed-in dashboard session, never with an API key (see Who can read it).

It answers the questions an account with more than one person in it starts asking: who created this API key, who changed this price list, who voided that invoice, and who has been trying to sign in.

What is recordedCopy Anchor Link

One record per change, written for you rather than by you — there is nothing to switch on, and no call to make.

• Who. A colleague by the name on their account, or an API key by the name you gave it. Never the key itself: a key's value is not stored anywhere we can read it back. Changes nobody asked for — a renewal that came due, an invoice a billing run issued — are recorded as System, with no address and no request id, because there was no request.
• What. A fixed action name of the form <resource>.<verb> — customer.create, price_list.update, invoice.void, api_key.revoke, auth.sign_in_failed. The name is part of the API's contract and does not change when a route does.
• On what. The customer, domain, invoice or key the change was made to.
• When, from where (the address the call came from and the client it named), and the request id, which is the same id our support team quotes back to you.
• Before and after, for a settings or price change: only the fields that moved.
• Whether it happened. ok for a change that went through, denied for a sign-in that was refused or a colleague whose role did not allow it, error for one that failed on our side.

Sign-ins and failed sign-ins are in the same list, so a run of failures against one login reads in place next to what that login has done.

What is never recordedCopy Anchor Link

No API key value, no password, no two-factor secret, no SMS message body. Those are stripped before a record is written, not filtered when it is read, so there is no copy of them anywhere in the log to leak later.

Who can read itCopy Anchor Link

The owner, admin and finance roles (audit.read in the permission table). It is not a read every role holds: a settings or invoice change carries billing and money detail in its before-and-after, so support and read-only, which cannot see the wallet or your invoices, cannot see it here either.

No API key can read it, whatever its level: a key is the account's credential rather than a person's, and it is routinely handed to a third-party integration — while these records name your colleagues, their addresses and the clients they signed in from. A key that asks for it is refused with a 403 and insufficient_key_permissions. This is the same rule that keeps your colleague list itself out of a key's reach.

Our own support staff can read your activity log when you have asked us to look into something. Every one of those reads is itself recorded, permanently, in our internal staff audit log, naming the person who read it.

How long it is keptCopy Anchor Link

Thirteen months. A scheduled job removes anything older every hour, so the log always covers the same month last year and no more than that. Export anything you need to keep for longer — the Activity page saves what you are looking at as a CSV, and GET /v1/activity pages through the same list.

Over the APICopy Anchor Link

GET /v1/activity is read with a signed-in dashboard session — the Activity page is itself the caller — and not with an API key, so there is no curl recipe for it here: a Bearer key is answered with a 403 (see Who can read it).

Newest first, cursor-paged like every other list. Narrow it with action for one exact action, resource for everything that happened to one kind of thing, actorId for one colleague or one key, actorKind for everything done by people, by keys or by us (system), outcome, and from/to for a period. The full response shape is in the API reference.

What an API key itself has done is still readable by a key: that is GET /v1/assistant-activity (activity.read), which lists what keys and assistants did on the account and carries no colleague's name, address or before-and-after at all.