audit-events

Who did what and when, for the actions that change money or access: API keys created, rotated and revoked; members invited, changed and removed; plan versions published; webhook endpoints created, changed, deleted and their secrets rolled; customers blocked and unblocked; credit notes and refunds; the operator's invoice actions; payment provider accounts connected, replaced, removed and made the default; the tenant's status and settings. Each entry has the actor (a person, an API key, the operator or the system), the target, a one-line summary with no secret in it, a small detail object, the address and the request id. The log is append-only: the database refuses any change to an entry. It is read from several services and merged; when one does not answer, incomplete is true and unavailable_sources names it. Needs the permission audit:read (an admin key has it; the read_only role does not). A person who is a viewer of the account may not read it.

{
  "events": [
    {
      "id": "0192f0b4-6f6e-7c3a-9a3e-6a1f2b3c4d5e",
      "tenant_id": "string",
      "account_id": "string",
      "actor_type": "user",
      "actor_id": "string",
      "actor_email": "string",
      "action": "api_key.created",
      "target_type": "string",
      "target_id": "string",
      "summary": "string",
      "detail_json": "string",
      "before_hash": "string",
      "after_hash": "string",
      "source_ip": "string",
      "request_id": "string",
      "create_time": "2026-11-03T10:15:00Z"
    }
  ],
  "next_page_token": "string",
  "incomplete": false,
  "unavailable_sources": [
    "plans"
  ]
}

curl -X GET https://YOUR-API-ADDRESS/v1/audit-events \
  -H "Authorization: Bearer $PAYRUDDER_API_KEY"

The same filter as listAuditEvents, one line per entry with the columns id, create_time, tenant_id, account_id, actor_type, actor_id, actor_email, action, target_type, target_id, summary, detail (JSON), before_hash, after_hash, source_ip, request_id. A cell that starts with =, +, - or @ gets a leading ', so a spreadsheet does not run it. An export that cannot read every service fails with 503 audit.unavailable rather than leave entries out. Needs audit:read.

curl -X GET https://YOUR-API-ADDRESS/v1/audit-events/export \
  -H "Authorization: Bearer $PAYRUDDER_API_KEY"