openapi: 3.1.0
info:
  title: Accounting subpackage_auditLog API
  version: 1.0.0
servers:
- url: https://api.merge.dev/api
- url: https://api-eu.merge.dev/api
- url: https://api-ap.merge.dev/api
tags:
- name: subpackage_auditLog
paths:
  /api/v1/audit-log/:
    get:
      operationId: list
      summary: List audit log events
      description: Retrieves a paginated list of audit log events for the organization. Events are ordered by creation time, with the most recent first.
      tags:
      - subpackage_auditLog
      parameters:
      - name: created_after
        in: query
        description: Filter events created on or after this date (ISO 8601)
        required: false
        schema:
          type: string
          format: date-time
      - name: created_before
        in: query
        description: Filter events created on or before this date (ISO 8601)
        required: false
        schema:
          type: string
          format: date-time
      - name: event_type
        in: query
        description: Filter by event type
        required: false
        schema:
          $ref: '#/components/schemas/ApiV1AuditLogGetParametersEventType'
      - name: page
        in: query
        description: A page number within the paginated result set.
        required: false
        schema:
          type: integer
      - name: page_size
        in: query
        description: Number of results to return per page.
        required: false
        schema:
          type: integer
      - name: user_id
        in: query
        description: Filter by user ID
        required: false
        schema:
          type: string
          format: uuid
      - name: Authorization
        in: header
        description: Token-based authentication with required prefix "Bearer"
        required: true
        schema:
          type: string
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedAuditLogEventPublicList'
components:
  schemas:
    AuditLogEventPublic:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier for the audit log event
        user_name:
          type: string
          description: Name of the user who performed the action
        user_email:
          type: string
          description: Email of the user who performed the action
        role:
          type:
          - string
          - 'null'
          description: Role of the user at the time of the action
        ip_address:
          type: string
          description: IP address from which the action was performed
        event_type:
          type: string
          description: Type of audit event (e.g., TOOL_PACK_CREATED, USER_UPDATED)
        event_description:
          type: string
          description: Human-readable description of the event
        created_at:
          type: string
          format: date-time
          description: Timestamp when the event occurred
      required:
      - id
      - user_name
      - user_email
      - role
      - ip_address
      - event_type
      - event_description
      - created_at
      title: AuditLogEventPublic
    ApiV1AuditLogGetParametersEventType:
      type: string
      enum:
      - ALLOWED_CALLBACK_ORIGIN_CREATED
      - ALLOWED_CALLBACK_ORIGIN_DELETED
      - API_LOGS_SEARCHED
      - API_LOG_DETAIL_VIEWED
      - APPLICATION_CREDENTIAL_CREATED
      - APPLICATION_CREDENTIAL_DELETED
      - APPLICATION_CREDENTIAL_UPDATED
      - AUDIT_LOG_EXPORTED
      - BILLING_PAYMENT_METHOD_ADDED
      - BILLING_PAYMENT_METHOD_UPDATED
      - BILLING_PLAN_CHANGED
      - BILLING_SUBSCRIPTION_CANCELLED
      - CHAT_SESSION_CREATED
      - CHAT_SESSION_ENDED
      - CONNECTOR_DELETED
      - CONNECTOR_IMPORTED
      - CONNECTOR_UPDATED
      - CREDENTIAL_CREATED
      - CREDENTIAL_DELETED
      - CREDENTIAL_EXPORTED
      - CREDENTIAL_EXPORT_FAILED
      - CREDENTIAL_EXPORT_KEY_REGISTERED
      - CREDENTIAL_EXPORT_KEY_REVOKED
      - CREDENTIAL_UPDATED
      - DEFAULT_RESOURCES_CREATED
      - GIT_SETTINGS_CREATED
      - GIT_SETTINGS_DELETED
      - GIT_SETTINGS_UPDATED
      - INBOUND_WEBHOOK_SETTINGS_UPDATED
      - LINK_CONFIGURATION_UPDATED
      - LOGIN_FAILED
      - LOGIN_SUCCESS
      - LOGOUT
      - MFA_ADMIN_RESET
      - MFA_DEVICE_CHANGED
      - MFA_DISABLED
      - MFA_ENABLED
      - MFA_REQUIRED_DISABLED
      - MFA_REQUIRED_ENABLED
      - MFA_VERIFICATION_FAILED
      - OUTBOUND_WEBHOOK_CREATED
      - OUTBOUND_WEBHOOK_DELETED
      - OUTBOUND_WEBHOOK_UPDATED
      - OUTBOUND_WEBHOOK_VERIFICATION_KEY_REFRESHED
      - PRODUCTION_API_KEY_REGENERATED
      - REGISTERED_USER_CREATED
      - REGISTERED_USER_DELETED
      - ROLE_CREATED
      - ROLE_DELETED
      - ROLE_UPDATED
      - SCIM_DEFAULT_ACCESS_UPDATED
      - SCIM_GROUP_ACCESS_UPDATED
      - SCIM_GROUP_CREATED
      - SCIM_GROUP_DELETED
      - SCIM_GROUP_UPDATED
      - SCIM_TOKEN_CREATED
      - SCIM_TOKEN_REVOKED
      - SCIM_USER_ACCESS_UPDATED
      - SCIM_USER_DEPROVISIONED
      - SCIM_USER_PROVISIONED
      - SCIM_USER_REACTIVATED
      - SCIM_USER_UPDATED
      - SECURITY_RULE_CREATED
      - SECURITY_RULE_DELETED
      - SECURITY_RULE_UPDATED
      - SSO_LOGIN_NOT_REQUIRED
      - SSO_LOGIN_REQUIRED
      - SSO_LOGIN_REQUIRED_OFF
      - SSO_LOGIN_REQUIRED_ON
      - SSO_PROVIDER_CREATED
      - SSO_PROVIDER_DELETED
      - SSO_PROVIDER_UPDATED
      - TEST_API_KEY_CREATED
      - TEST_API_KEY_DELETED
      - TOOL_CALL_LOGS_SEARCHED
      - TOOL_CALL_LOG_DETAIL_VIEWED
      - TOOL_PACK_CREATED
      - TOOL_PACK_DELETED
      - TOOL_PACK_UPDATED
      - USER_CREATED
      - USER_DISABLED
      - USER_ENABLED
      - USER_INVITATION_ACCEPTED
      - USER_INVITATION_CANCELLED
      - USER_INVITED
      - USER_PASSWORD_RESET
      - USER_UPDATED
      title: ApiV1AuditLogGetParametersEventType
    PaginatedAuditLogEventPublicList:
      type: object
      properties:
        count:
          type: integer
        next:
          type:
          - string
          - 'null'
          format: uri
        previous:
          type:
          - string
          - 'null'
          format: uri
        results:
          type: array
          items:
            $ref: '#/components/schemas/AuditLogEventPublic'
      required:
      - count
      - results
      title: PaginatedAuditLogEventPublicList
  securitySchemes:
    tokenAuth:
      type: http
      scheme: bearer
      description: Token-based authentication with required prefix "Bearer"