Audit Logs

2 API calls in this section.

List Audit Logs

Reporting, Audit & Webhooks / Audit Logs

GET/audit-logs

Retrieves a paginated list of audit logs with sorting, per-column filtering, and free-text search.

• Requires valid authentication token or API key

• Requires 'manage:operations:tenant' permission or system admin

Sorting (sort_by + sort_order)

• Supported columns: action, method, endpoint, actor_name, status_code, created_at, response_time_ms

• action sorts by endpoint; actor_name sorts by the joined user's full_name

• Default: created_at desc

Column filters (column_filters)

• URL-encoded JSON, AND semantics across all keys

• action: substring match across method+endpoint

• method: exact match (auto-uppercased)

• endpoint: case-insensitive substring match

• actor_name: case-insensitive substring match on the actor's full_name

• status_code: numeric equality

• created_at: { from?: string, to?: string } range; plain YYYY-MM-DD values are expanded to full UTC day bounds, and to is inclusive through the end of that day

Response fields

• user: joined actor (id, full_name)

• action: computed as "{method} {endpoint}"

• tenant: joined tenant (id, name)

• response_time_ms: existing handler duration

• time_distribution: flat JSON object of server-side durations in milliseconds. Keys are backend-controlled and end in _ms; a key is omitted when that stage did not execute. Nested totals such as handler_ms and delivery_list_logic_ms overlap with their child call timings and must not be summed.

Query parameters

Parameter	Type	Description
tenant_id	string	UUID of the tenant (required for tenant admins; system admins may omit to query across tenants) UUID of the tenant (required for tenant admins; system admins may omit to query across tenants)
page	string	Page number for pagination (default: 1) Page number for pagination (default: 1) Example: 1
limit	string	Number of items per page (default: 25, max: 200) Number of items per page (default: 25, max: 200) Example: 50
searchOptional	string	Free-text search across endpoint/method/ip_address/user_agent (optional) Free-text search across endpoint/method/ip_address/user_agent (optional)
sort_by	string	Column to sort by. Supported: action, method, endpoint, actor_name, status_code, created_at, response_time_ms (default: created_at) Column to sort by. Supported: action, method, endpoint, actor_name, status_code, created_at, response_time_ms (default: created_at) Example: created_at
sort_order	string	Sort direction: asc or desc (default: desc) Sort direction: asc or desc (default: desc) Example: desc
column_filters	string	URL-encoded JSON object with per-column filters (AND semantics). Supported keys: action (string), method (string), endpoint (string), actor_name (string), status_code (number), created_at ({ from?: string, to?: string }). Plain YYYY-MM-DD values are normalized to whole-day UTC bounds, so to stays inclusive through 23:59:59.999Z. Example: {"method":"GET","status_code":200,"created_at":{"from":"2026-05-01","to":"2026-05-11"}} URL-encoded JSON object with per-column filters (AND semantics). Supported keys: action (string), method (string), endpoint (string), actor_name (string), status_code (number), created_at ({ from?: string, to?: string }). Plain YYYY-MM-DD values are normalized to whole-day UTC bounds, so to stays inclusive through 23:59:59.999Z. Example: {"method":"GET","status_code":200,"created_at":{"from":"2026-05-01","to":"2026-05-11"}}
actor_idOptional	string	Filter by actor user ID (optional) Filter by actor user ID (optional)
start_dateOptional	string	Legacy date filter — start date YYYY-MM-DD (optional; prefer column_filters.created_at.from) Legacy date filter — start date YYYY-MM-DD (optional; prefer column_filters.created_at.from)
end_dateOptional	string	Legacy date filter — end date YYYY-MM-DD (optional; prefer column_filters.created_at.to) Legacy date filter — end date YYYY-MM-DD (optional; prefer column_filters.created_at.to)
endpointOptional	string	Filter by exact endpoint (optional; prefer column_filters.endpoint for partial match) Filter by exact endpoint (optional; prefer column_filters.endpoint for partial match)
endpoint_likeOptional	string	Filter by endpoint substring (case-insensitive, optional) Filter by endpoint substring (case-insensitive, optional)
methodOptional	string	Filter by HTTP method GET/POST/PUT/DELETE (optional; prefer column_filters.method) Filter by HTTP method GET/POST/PUT/DELETE (optional; prefer column_filters.method)
status_codeOptional	string	Filter by HTTP status code (optional; prefer column_filters.status_code) Filter by HTTP status code (optional; prefer column_filters.status_code)

Headers

Parameter	Type	Description
Authorization	string	Example: Bearer {{access_token}}
Content-Type	string	Example: application/json

Staging

Request

curl

1curl --globoff --request GET "https://staging-api.ondi.io/functions/v1/audit-logs?tenant_id=&page=1&limit=50&search=&sort_by=created_at&sort_order=desc&column_filters=" \2  --header "Authorization: Bearer ${ONDI_ACCESS_TOKEN}" \3  --header "Content-Type: application/json"

Response examples

200Success Response

Response body

json

1{2  "success": true,3  "message": "Audit Logs Retrieved Successfully",4  "audit_logs": [5    {6      "id": "audit-log-uuid",7      "endpoint": "/delivery/deliveries?page=1&limit=10",8      "method": "GET",9      "status_code": 200,10      "response_time_ms": 842,11      "time_distribution": {12        "middleware_auth_ms": 184.25,13        "auth_get_user_call_ms": 92.11,14        "auth_context_call_ms": 74.38,15        "delivery_main_query_call_ms": 113.47,16        "delivery_children_query_call_ms": 96.82,17        "delivery_response_serialize_ms": 3.14,18        "handler_ms": 842.19,19        "server_processing_ms": 1044.7220      }21    }22  ],23  "page": 1,24  "limit": 25,25  "total": 126}

Get Audit Log By Id

Reporting, Audit & Webhooks / Audit Logs

GET/audit-logs/{{audit_log_id}}

Retrieves a single audit log by id (tenant-scoped).

• Requires valid authentication token or API key

• Requires 'manage:operations:tenant' permission or system admin

Timing contract

• time_distribution is a flat JSON object containing backend-controlled server durations in milliseconds.

• Keys ending in _call_ms measure outbound service/database calls as observed by the Edge Function, including service and network time.

• Keys are omitted for stages that did not execute.

• Total/phase keys overlap with their component keys and must not be summed.

Path parameters

Parameter	Type	Description
audit_log_idRequired	string	Example: {{audit_log_id}}

Query parameters

Parameter	Type	Description
tenant_id	string	UUID of the tenant (only honored for system admins; otherwise inferred from auth context) UUID of the tenant (only honored for system admins; otherwise inferred from auth context)

Headers

Parameter	Type	Description
Authorization	string	Example: Bearer {{access_token}}
Content-Type	string	Example: application/json

Staging

Request

curl

1curl --globoff --request GET "https://staging-api.ondi.io/functions/v1/audit-logs/${AUDIT_LOG_ID}?tenant_id=" \2  --header "Authorization: Bearer ${ONDI_ACCESS_TOKEN}" \3  --header "Content-Type: application/json"

Response examples

200Success Response

Response body

json

1{2  "success": true,3  "message": "Audit Logs Retrieved Successfully",4  "audit_log": {5    "id": "audit-log-uuid",6    "response_time_ms": 842,7    "time_distribution": {8      "middleware_auth_ms": 184.25,9      "delivery_main_query_call_ms": 113.47,10      "handler_ms": 842.19,11      "server_processing_ms": 1044.7212    }13  }14}