Organization audit trail
Read the organization's append-only activity log — who did what, and when, across the organization.
The audit trail is an append-only record of significant actions taken within the organization: key rotations, member changes, routing edits, and more. These endpoints back the Dashboard's audit screen.
Entries are never edited or deleted, which is what makes the trail trustworthy for compliance and incident review. Filter by actor, action, or time window to reconstruct exactly what happened.
These endpoints power the Tokeflow Dashboard UI at the organization level. They are session-authenticated (JWT bearer) — the token comes from signing in to the Dashboard, not from an sk_/pk_ API key. Requests also carry the x-organization-id header, and the signed-in user must be a member of that organization.
Endpoints
GET/api/v1/org/audit-trail
Auth: Dashboard session (JWT bearer). Organization membership required.
List audit trail entries for the organization.
Query parameters
| Field | Type | Required | Description |
|---|---|---|---|
entity_type | string | No | Filter by entity type (e.g., merchant, merchant_connector, routing_profile, api_key) |
action | string | No | Filter by action (e.g., created, updated, deleted, activated, deactivated) |
actor_id | string | No | Filter by actor ID (user or API key) |
merchant_id | string | No | Narrow the organisation trail to a single merchant. The organisation scope still applies, so a merchant outside it matches nothing. |
start_date | string | No | Filter from this date (ISO 8601 format) |
end_date | string | No | Filter until this date (ISO 8601 format) |
limit | number | No | Number of records to return. Default 20, min 1, max 100. |
offset | number | No | Number of records to skip. Default 0, min 0. |
Example request
curl -G https://api.tokeflow.com/api/v1/org/audit-trail \
-H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9…" \
-H "x-organization-id: org_4b21e7c3" \
--data-urlencode "entity_type=merchant_connector" \
--data-urlencode "action=created" \
--data-urlencode "actor_id=string" \
--data-urlencode "merchant_id=mrc_1"GET/api/v1/org/audit-trail/merchant
Auth: Dashboard session (JWT bearer). Organization membership required.
List audit trail entries for the selected merchant.
Query parameters
| Field | Type | Required | Description |
|---|---|---|---|
entity_type | string | No | Filter by entity type (e.g., merchant, merchant_connector, routing_profile, api_key) |
action | string | No | Filter by action (e.g., created, updated, deleted, activated, deactivated) |
actor_id | string | No | Filter by actor ID (user or API key) |
merchant_id | string | No | Narrow the organisation trail to a single merchant. The organisation scope still applies, so a merchant outside it matches nothing. |
start_date | string | No | Filter from this date (ISO 8601 format) |
end_date | string | No | Filter until this date (ISO 8601 format) |
limit | number | No | Number of records to return. Default 20, min 1, max 100. |
offset | number | No | Number of records to skip. Default 0, min 0. |
Example request
curl -G https://api.tokeflow.com/api/v1/org/audit-trail/merchant \
-H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9…" \
-H "x-organization-id: org_4b21e7c3" \
--data-urlencode "entity_type=merchant_connector" \
--data-urlencode "action=created" \
--data-urlencode "actor_id=string" \
--data-urlencode "merchant_id=mrc_1"Errors
Errors use the standard envelope. The most common cases here:
| HTTP | Meaning |
|---|---|
400 | Invalid parameters or a state that does not allow this operation. |
401 | Missing, expired, or invalid Dashboard session token. |
403 | Authenticated, but the signed-in user lacks access to this entity. |
404 | The record does not exist or is not visible to this entity. |