Audit

Add an overview of the Admin - Audit API here. This block is preserved across regenerations.

Endpoints

GET /api/v1/audit-logs

Query audit logs with optional filtering by actor, resource, time range, and event type

get

/audit-logs

Required scopes

This endpoint requires the following scopes:

Authorizations

X-API-KeystringRequired

Scoped secret API key — send an sk_live_… value (keys issued before the typed format carry a bare pk_<hex> prefix and are also secret; they still work). A publishable pk_live_…/pk_test_… key is browser-safe, carries no scopes, and is refused by every endpoint in this spec with publishable_key_not_allowed. Coarse scopes: read, commerce, admin (admin covers everything below). Narrow per-resource scopes: journeys|pages :read|write|publish|delete, productsets :read|write|publish|delete, components|rules :read|write|delete, context :read (read-only context tier), catalog :read|write-native. publish is never implied by write.

Query parameters

limitinteger · min: 1 · max: 100Optional

Max items to return (1–100, default 20)

Default: 20

offsetintegerOptional

Number of items to skip (default 0)

Default: 0

sortDirstring · enumOptional

Sort direction

Default: ascPossible values:

actorstringOptional

Filter by user ID (actor) who performed the action

resourceTypestringOptional

Filter by resource type (e.g. user, page, apiKey)

actionstringOptional

Filter by action substring (e.g. user.create, subscription)

sincestring · date-timeOptional

Return logs created at or after this ISO 8601 timestamp

untilstring · date-timeOptional

Return logs created at or before this ISO 8601 timestamp

Responses

200

Paginated list of audit log entries, newest first by default

application/json

An immutable record of a platform action

idstring · uuidOptional

userIdstring · uuid · nullableOptional

The user who performed the action (null for API key actions)

actionstringOptional

Namespaced action identifier (e.g. api.user.create)

resourceTypestring · nullableOptional

resourceIdstring · nullableOptional

detailsobjectOptional

Action-specific metadata

ipAddressstring · nullableOptional

createdAtstring · date-timeOptional

401

API key required

application/json

get/audit-logs

GET /api/v1/audit-logs HTTP/1.1
Host: api.peakcommerce.app
X-API-Key: YOUR_API_KEY
Accept: */*

{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "userId": "123e4567-e89b-12d3-a456-426614174000",
  "action": "text",
  "resourceType": "text",
  "resourceId": "text",
  "details": {},
  "ipAddress": "text",
  "createdAt": "2026-01-01T00:00:00.000Z"
}

Filtering, sorting (by createdAt), and pagination are applied in SQL, so the endpoint scales to tenants with very large audit histories — the server never loads the full table into memory. The action filter is a case-insensitive substring match (e.g. ?action=subscription matches subscription.create, subscription.cancel, etc.). since and until must be ISO 8601 timestamps; invalid values return 400 validation_failed. The response envelope reports pagination.total as the count of rows matching the filters, not the size of the returned page.