Skip to main content
The audit log records every change made in your partner: by your members in the dashboards, by your API keys and by AllRide staff. Use it to answer “who turned off this voucher set?” or “which key created these links?”, and as evidence for your own compliance checks.

​
What is recorded

Every state change made through the dashboards or the API is written to the audit log in the same transaction as the change itself, for example:
  • catalog settings (provider and voucher set toggles, positions, references), redemption entities (create, update, block, unblock, erase), Redemption Links, voids of redemptions;
  • email OTP settings, the SMTP configuration and email templates;
  • members, groups, permissions, partner settings, API keys, webhook endpoints and their secrets, the IP allowlist, custom domains, workspace branding and single sign-on;
  • billing account and contact changes, payment methods and Price Acceptances (reads are not recorded).
Not recorded, because another record already covers them:
  • redemptions made with API keys or on landing pages, and redemption entities created inside such a redemption: the redemption itself is the record (list them with List redemptions);
  • webhook deliveries: they have their own delivery log;
  • stock changes of voucher sets.
Each entry shows the changed fields as [before, after] pairs in metaData. Secrets (API key secrets, webhook secrets, the SMTP password), bearer values such as Redemption Link tokens and personal data (a redemption entity’s refId, displayName, email and metadata) appear only as ••••, so the log never keeps data you later erase. Actions by AllRide staff (for example when AllRide activates your API access) appear with the actor {"type": "admin-user", "id": null, "label": "AllRide"}.

​
Reading the audit log

Read it in the dashboards or with List audit events and Get an audit event. Both need view-audit, which you can delegate to API keys.
Filters: actionType, entityType, entityId, actor.type, actor.id and createdAt (gt, gte, lt, lte); the newest entries come first. Without filter[createdAt][gte] the list covers the last 90 days; a window longer than the retention (24 months) answers 400 data-failed-validation with property filter[createdAt], the constraint invalid-filter and params.maxMonths 24. For a complete file, page through the list as described in Downloading large lists.

​
Retention

Audit entries are kept for 24 months and then deleted. They cannot be changed or deleted earlier, neither by you nor by AllRide. Erasing a redemption entity does not remove audit entries, which is why they never hold its personal data.