Audit log of the key's organization (server API)

GET

/v1/audit_events

curl --request GET \
  --url https://api.tryyoursize.com/v1/audit_events \
  --header 'Authorization: Bearer <token>'

• Production (test and live mode are chosen by the key)

Key scopes: audit:read. A secret key (sk_) has every scope; a restricted key (rk_) needs the scopes listed.

The audit log of the secret key’s organization, newest first. Same filters as the Studio listing (no CSV). Secret keys (sk_) and restricted keys (rk_) with the audit:read scope.

Authorizations

• SecretKey

Parameters

Query Parameters

cursor

string

action

string

actor

string

Actor_type:actor_id

store_id

string format: uuid

Only events of this store

target

string

Target_type or target_type:target_id, e.g. api_key:

from

string format: date-time

Events at or after this time

to

string format: date-time

Events before this time

limit

integer

>= 1 <= 200

Page size (default 50, at most 200; ignored by the CSV export)

Responses

200

OK

Media typeapplication/json

object

events

required

Array<object>

One append-only audit row. Never secrets or shopper data.

object

id

required

string format: uuid

organization_id

string format: uuid

store_id

string format: uuid

actor_type

required

string

Allowed values: user api_key partner_user staff system shopify

actor_id

required

string

actor_label

string

on_behalf_of

string format: uuid

action

required

string

target_type

string

target_id

string

metadata

object

key

additional properties

any

ip

string

user_agent

string

request_id

string

created_at

required

string format: date-time

next_cursor

string

Example

{
  "events": [
    {
      "actor_type": "user"
    }
  ]
}

400

Invalid request

Media typeapplication/json

Every error has this shape. error is a human-readable message, status the HTTP status. code is stable and machine-readable; doc_url links its explanation; request_id identifies the request (also in the X-Request-ID response header): quote it to support.

object

error

required

string

status

required

integer

code

Stable error code, e.g. invalid_request, unauthorized, reauth_required, payment_required, forbidden, not_found, conflict, unprocessable, rate_limited, internal_error, not_implemented, unavailable, invalid_api_version, idempotency_key_in_use, idempotency_key_reused, invalid_idempotency_key, handle_expired, handle_invalid.

string

doc_url

string format: uri

request_id

string

Example

{
  "code": "not_found",
  "doc_url": "https://docs.tryyoursize.com/api/errors/#not_found"
}

401

Missing or invalid credentials

Media typeapplication/json

Every error has this shape. error is a human-readable message, status the HTTP status. code is stable and machine-readable; doc_url links its explanation; request_id identifies the request (also in the X-Request-ID response header): quote it to support.

object

error

required

string

status

required

integer

code

Stable error code, e.g. invalid_request, unauthorized, reauth_required, payment_required, forbidden, not_found, conflict, unprocessable, rate_limited, internal_error, not_implemented, unavailable, invalid_api_version, idempotency_key_in_use, idempotency_key_reused, invalid_idempotency_key, handle_expired, handle_invalid.

string

doc_url

string format: uri

request_id

string

Example

{
  "code": "not_found",
  "doc_url": "https://docs.tryyoursize.com/api/errors/#not_found"
}