# Audit trail events

You can get raw audit trail events for your employees using request below. HTTP status 200 in response confirms availability of our API.

Note that that request should be authorized with headers mentioned above.

GET /resources/auditTrailEvents

Copy
curl -X GET \
  'https://api.sumsub.com/resources/auditTrailEvents'

Events are always sorted by ts in descending order.

Мах number of events per request is 20000.

# REQUEST ARGUMENTS

Name	Type	Required	Description
subjectName	String	No	The name of the subject for which events are received. If the name is not specified, events are received for all subjects on the key.
activity	String	No	If specified, only events with this activity will be in the response
from	String	No	From what date/time events are received (format `yyyy-MM-dd HH:mm:ss`, e.g. 2022-10-01 12:05:00). If it's not specified - events are received from yesterday.
to	String	No	To what date/time events are received (format `yyyy-MM-dd HH:mm:ss`, e.g. 2022-10-01 12:15:00). If it's not specified - events are received up to now.
limit	Integer	No	Max number of events in one request. Can't be more than 20000. By default is 10.
offset	Integer	No	Allows to skip the `offset` events before beginning to return the events. By default is 0.

Response body contains a JSON payload with a list of events. For example:

Copy
{
  "items": [
    {
      "ts": "2022-10-06 08:23:28.715",
      "clientId": "sample_key",
      "activity": "subject:loggedIn:dashboard:success",
      "subjectName": "[email protected]",
      "ip": "5.64.19.63",
      "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,like Gecko) Chrome/106.0.0.0 Safari/537.36 Edg/106.0.1370.34",
      "xClientId": "dashboard",
      "correlationId": "req-7ae0a875-1d06-1234-b266-8fe2a24f22fa",
      "applicantId": "",
      "externalUserId": "",
      "imageId": "",
      "description": ""
    },
    {
      "ts": "2022-10-05 06:37:58.858",
      "clientId": "sample_key",
      "activity": "subject:loaded:applicantList",
      "subjectName": "[email protected]",
      "ip": "46.109.67.83",
      "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,like Gecko) Chrome/105.0.0.0 Safari/537.36",
      "xClientId": "dashboard",
      "correlationId": "req-afea91b7-21e7-1234-98fb-ebe4d2867df6",
      "applicantId": "",
      "externalUserId": "",
      "imageId": "",
      "description": "cnt=10"
    }
  ],
  "totalItems": 2
}

# Event fields

Name	Type	Optional	Description
ts	String	No	Date/time
clientId	String	No	Key
activity	String	No	Event type
subjectName	String	No	The subject who has executed an action
ip	String	No	IP from which an event was detected
userAgent	String	Yes	userAgent from which an event was detected
xClientId	String	Yes	API / dashboard / SDK
correlationId	String	No	Internal id for investigation nearby requests
applicantId	String	Yes	An applicant ID
externalUserId	String	Yes	An applicant ID on the client side
imageId	String	Yes	A document id
description	String	Yes	Some additional information

# Possible event types:

Name	Description
subject:loggedIn:dashboard:success	Successful login
subject:loggedIn:dashboard:failure	Failed login
subject:loggedOut:dashboard	Logout
subject:loaded:applicant	Loading an applicant
subject:loaded:applicantList	Loading an applicant list
subject:exported:applicantCsvList	Downloading list of applicants in csv format
subject:downloaded:docImage	Downloading a doc from an applicant
subject:changed:applicant	Changing an applicant