Audit events

The tenant's audit trail in one list: every change (who changed what, when, the row before and after, and why) and every logged read.

Needs audit:read. An admin reads it, Aleta does, and so does a user whose groups give the audit module (see groups); an API key reads as its owner. Anyone else gets 403 forbidden. A reader who does not see every client (anyone but an admin or Aleta) gets only the changes on custody accounts, cash accounts, lenses and clients they can see, and no reads. The trail is kept for 7 years, in whole calendar months.

The event

idstring

Stable identifier. A UUID.

kindstring

change (a write) or access (a read). The reads are the ones the Aleta apps log and, through this API, every successful GET of your data, as a read. resource_type is the route's resource in its v1 name (custody_account, client, lens, ...) and resource_id is the first id in the path. A report file download (GET /v1/reports/{id}/download) is logged as a read of reports; its resource_id is the report's id. Reading this list is not logged, and the query string is never kept.

occurred_atstring

ISO 8601 timestamp, UTC.

actionstring

For a change create, update, delete, archive, unarchive, lock, unlock, publish, ...; for an access read, export, download, ...

resource_type, resource_idstring or null

What it was about, in the v1 name (cash_account, custody_account, entity, asset, custodian_authority, ...). A resource with no v1 name is shown as stored. An access names the resource, and its id when the read had one.

actorobject

{kind, user_id, credential_id, owner_user_id, role}; the fields a kind does not have are null. kind is person with the user_id; machine for an API key, with its credential_id and the user it acts as in owner_user_id (a machine user acting as itself has its user_id); aleta when Aleta acted (its fleet key or a staff seat), with the staff role and never who (no ids, and the person's id, e-mail and name are taken out of before and after); or system (sync, calculation, migration). An asset's history shows the same actor.

before, afterobject or null

The row as it was and became. null on an access, on a create (before) or delete (after), and on a redacted change.

changesobject[]

{field, before, after} per top-level field that changed.

reasonstring or null

Why, when the write was given one.

request_idstring or null

The request's x-request-id.

outcomestring

success, failure or denied.

redactedboolean

true when personal data was erased (GDPR): before and after are then null.

List audit events

curl -G https://api.aleta.ai/v1/audit-events \
  -H "Authorization: Bearer {access_token}" \
  -d resource_type=custodian_authority

{
  "data": [
    {
      "id": "0199f2a1-0d4e-7b10-8c2d-4e5f6a7b8c9d",
      "kind": "change",
      "occurred_at": "2026-10-18T08:05:00.000000Z",
      "action": "update",
      "resource_type": "custodian_authority",
      "resource_id": "0199f2a0-7c1e-7a40-9d1b-3c5e8f0a2b11",
      "actor": { "kind": "aleta", "user_id": null, "credential_id": null, "owner_user_id": null, "role": "aleta_internal" },
      "before": { "status": "awaiting_aleta" },
      "after": { "status": "active" },
      "changes": [{ "field": "status", "before": "awaiting_aleta", "after": "active" }],
      "reason": "the first file ran",
      "request_id": "6f1c2d3e-4a5b-4c6d-8e7f-90a1b2c3d4e5",
      "outcome": "success",
      "redacted": false
    }
  ],
  "next_cursor": null,
  "limit": 100
}