List audit events

Records who did what, from where, with which credential.

GETCopy URL: https://api.avvio.xyz/business/api/v1/payments/organizations/{orgId}/audit-events

GET/payments/organizations/{orgId}/audit-events

Open in explorer

curl

curl -s "$AVVIO_BASE_URL/payments/organizations/$AVVIO_ORG_ID/audit-events?action=payout.create" \
  -H "x-api-key: $AVVIO_API_KEY"

Node

const res = await fetch(`${process.env.AVVIO_BASE_URL}/payments/organizations/${process.env.AVVIO_ORG_ID}/audit-events?action=payout.create`, {
  headers: {
    'x-api-key': process.env.AVVIO_API_KEY,
  },
});
console.log(res.status, await res.json());

Python

import os
import requests

res = requests.get(
    f"{os.environ['AVVIO_BASE_URL']}/payments/organizations/{os.environ['AVVIO_ORG_ID']}/audit-events",
    headers={
        "x-api-key": os.environ["AVVIO_API_KEY"],
    },
    params={
        "action": "payout.create"
    },
)
print(res.status_code, res.json())

Try it

200OKResponse status200 OK400 Bad Request401 Unauthorized403 Forbidden429 Too Many Requests

{
  "data": [
    {
      "id": "9182",
      "action": "payout.create",
      "resourceType": "payout",
      "resourceId": "sbx_pay_7c1c0f2e-6d9b-4a3e-9d1a-2f4b8c9e0a11",
      "apiKeyPrefix": "avvio_live_7f3a",
      "actorUserId": null,
      "ip": "203.0.113.7",
      "requestId": "7d2f5e0a-3c4b-4e8a-9f1d-2b6c8a1e4f37",
      "outcome": "ok",
      "errorType": null,
      "createdAt": "2026-09-03T10:00:00.000Z"
    },
    {
      "id": "9181",
      "action": "payout.create",
      "resourceType": "payout",
      "resourceId": null,
      "apiKeyPrefix": "avvio_live_7f3a",
      "actorUserId": null,
      "ip": "203.0.113.7",
      "requestId": "3b9e1c72-5a4d-4f60-8e2b-9c1d7a0f5e48",
      "outcome": "error",
      "errorType": "PAYOUT_LIMIT_EXCEEDED",
      "createdAt": "2026-09-03T09:58:12.000Z"
    }
  ],
  "hasMore": true,
  "nextCursor": "9181"
}

Path parameters

• orgIdstringRequired

  The opaque organization id issued to you, normally CUID-shaped (for example cmsx…). It is not an org_-prefixed alias. Pass it unchanged in every organization-scoped path.

Query parameters

• cursorstringOptional

  A nextCursor from a previous page; rows strictly older than it.

• limitintegerOptionalDefaults to 50

  From 1 to 100. Defaults to 50.

• actionstringOptional

  One action, e.g. payout.create.

• resourceIdstringOptional

  Everything done to one payout, batch, approval, recipient, key or endpoint.

• apiKeystringOptional

  A key prefix. An unknown prefix is an empty page, not a 404.

• actorUserIdstringOptional
• createdAfterstring<date-time>Optional

  Inclusive, ISO-8601 with a timezone.

• createdBeforestring<date-time>Optional

  Inclusive, ISO-8601 with a timezone.

Behavior

It has one row per audited mutation on your organization (payouts created or canceled, batches, approvals decided, recipients changed, keys and webhook endpoints managed), recorded whether it succeeded or was refused. A refused attempt is as much of an audit record as a successful one.

Rows name the key by its prefix (apiKeyPrefix), which is how you named it in the dashboard; a dashboard action carries actorUserId instead. Exactly one of the two is set. requestId is the same value as the x-request-id header on that request and the requestId in any error body it returned.

A read-only key may read this; that is the point of a read-only key. Newest first, cursor on id. Retained for five years.

Responses

200Audit events, newest first.

Body

• dataarray of objectRequired
  Show 11 properties

  • idstringRequired

    Monotonic, and the cursor. A decimal string.

  • actionstringRequired

    payout.create, payout.cancel, payout_batch.create, payout_batch.confirm, payout_batch.cancel, payout_approval.approve, payout_approval.reject, recipient.create, recipient.update, recipient.delete, api_key.create, api_key.rotate, api_key.revoke, webhook_endpoint.create, webhook_endpoint.delete, webhook_endpoint.enabled, webhook_endpoint.rotate_secret, webhook_endpoint.replay, checkout_payment.refund, and the dashboard funding actions payout_funding.prepare, payout_funding.signing_claim, payout_funding.accept, payout_funding.confirm, payout_funding.refresh. New actions are added without a version.

  • resourceTypestringRequired
  • resourceIdstring | nullRequired

    The payout, batch, approval, recipient, key or endpoint id. Null when the request was refused before one existed.

  • apiKeyPrefixstring | nullRequired

    The key's prefix as you named it. Null for a dashboard action.

  • actorUserIdstring | nullRequired

    The dashboard user. Null for an API-key action.

  • ipstring | nullRequired
  • requestIdstring | nullRequired

    The x-request-id of that request, also the requestId in its error body.

  • outcomestringRequired
    Allowed values:okerror
  • errorTypestring | nullRequired

    The error type when outcome is error. Never a body, never a bank field.

  • createdAtstring<date-time>Required
• hasMorebooleanRequired
• nextCursorstring | nullRequired

Errors

• 400

  VALIDATION_ERROR: a cursor that is not one we issued, or a malformed instant.

• 401

  The key was refused. Nothing ran.

  • UNAUTHORIZED: missing, invalid or revoked, or a key on a route that does not accept one.
  • KEY_EXPIRED: the key passed the expiry it was issued with. Issue a new one; an expired key cannot be rotated.
  • KEY_IP_NOT_ALLOWED: the key is pinned to source addresses and this request came from another.
• 403

  A valid key that may not make this call. Nothing ran.

  • FORBIDDEN: the key belongs to a different organization.
  • ACCOUNT_BLOCKED: API access for your organization is suspended, and every key is refused until we lift it. Contact support.
• 429

  Too many requests. The default ceiling is 100 requests per minute per API credential on a 60-second window. High-volume payout and reconciliation routes declare a 600/minute override, and batch submission a 30/minute ceiling. A separate 2,000/minute per-source-IP abuse ceiling always applies.

  Obey Retry-After; it is in seconds and is authoritative. A 429 means the request was refused before the handler ran. Retry reads normally; retry an idempotent mutation with its same Idempotency-Key.

Error body · Error

• typestringRequired

  Stable machine-readable code.

• detailstringRequired

  What went wrong, in a sentence. Always a string, so detail.toLowerCase() is safe.

  More

  This is the field to read on BAD_REQUEST and PROVIDER_REJECTED, where the type alone does not name the condition.

• messagestringRequired

  The same text as detail, kept for integrations written before detail existed. Read detail.

• resolutionstringOptional

  What to do about it, when there is a specific answer. It is not on every error (it is absent on BAD_REQUEST, NOT_FOUND, PAYOUT_NOT_CANCELABLE and DESTINATION_ACCOUNT_NOT_FOUND), so treat it as optional and fall back to detail.

• statusintegerRequired

  HTTP status, repeated in the body.

• statusCodeintegerRequired

  The same value as status, kept for integrations written before status existed. Read status.

• requestIdstringRequired

  Quote this to support and we can find the exact request. Also sent as the x-request-id response header, which is the only place it appears on a successful response. Success bodies do not carry it. Send your own x-request-id on the request and we use it, so your trace and ours share one identifier; otherwise we mint one.

• errorsarray of stringOptional

  Present on VALIDATION_ERROR; names each field that failed.

• originalIdempotencyKeystringOptional

  On DUPLICATE_REQUEST_DETECTED only. Send the request again with this to receive the original payout instead of making a second one. Without it there is no way to recover except by risking a double payment.

• originalPayoutIdstringOptional

  On DUPLICATE_REQUEST_DETECTED only. The payout the first request created.

• originalBatchIdstringOptional

  On a batch DUPLICATE_REQUEST_DETECTED. The run the first request created.

• originalRequestIdstringOptional

  On a 409 PAYOUT_OUTCOME_UNKNOWN replay. The requestId of the call whose outcome is unknown; quote it to support.

• existingRecipientIdstringOptional

  On BANK_ACCOUNT_ALREADY_LINKED. The recipient in your organization that already holds this account.

• existingMethodIdstringOptional

  On BANK_ACCOUNT_ALREADY_LINKED. The payment method on that recipient.

Branch on type, never on the status or the message. Every error type is listed with what to do about it.

Avvio Partner Payouts · Audit · operation listAuditEvents

Try it: List audit events

GET https://api.avvio.xyz/business/api/v1/payments/organizations/{orgId}/audit-events

API key Required

Test keys only. Sent as x-api-key through this site's proxy to the Avvio API, never saved, and cleared when you close this dialog.

orgId pathRequired

cursor queryOptional

limit queryOptional

action queryOptional

resourceId queryOptional

apiKey queryOptional

actorUserId queryOptional

createdAfter queryOptional

createdBefore queryOptional

Send request