> ## Documentation Index
> Fetch the complete documentation index at: https://docs-consumer.voucher.allride.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit log

> See who changed what in your partner, through the dashboard or the API, and when.

The audit log records every change made in your partner: by your members in the dashboards, by your API keys and by AllRide staff. Use it to answer "who turned off this voucher set?" or "which key created these links?", and as evidence for your own compliance checks.

## What is recorded

Every state change made through the dashboards or the API is written to the audit log in the same transaction as the change itself, for example:

* catalog settings (provider and voucher set toggles, positions, references), redemption entities (create, update, block, unblock, erase), Redemption Links, voids of redemptions;
* email OTP settings, the SMTP configuration and email templates;
* members, groups, permissions, partner settings, API keys, webhook endpoints and their secrets, the IP allowlist, custom domains, workspace branding and single sign-on;
* billing account and contact changes, payment methods and Price Acceptances (reads are not recorded).

Not recorded, because another record already covers them:

* redemptions made with **API keys** or on landing pages, and redemption entities created inside such a redemption: the redemption itself is the record (list them with [List redemptions](https://docs-consumer.voucher.allride.io/api-reference/consumer-redemptions-list.md));
* webhook deliveries: they have their own [delivery log](https://docs-consumer.voucher.allride.io/webhooks/retries-and-logs.md#delivery-logs);
* stock changes of voucher sets.

Each entry shows the changed fields as `[before, after]` pairs in `metaData`. Secrets (API key secrets, webhook secrets, the SMTP password), bearer values such as Redemption Link tokens and personal data (a redemption entity's `refId`, `displayName`, `email` and `metadata`) appear only as `••••`, so the log never keeps data you later erase.

Actions by AllRide staff (for example when AllRide activates your API access) appear with the actor `{"type": "admin-user", "id": null, "label": "AllRide"}`.

## Reading the audit log

Read it in the dashboards or with [List audit events](https://docs-consumer.voucher.allride.io/api-reference/partner-audit-events-list.md) and [Get an audit event](https://docs-consumer.voucher.allride.io/api-reference/partner-audit-events-get.md). Both need `view-audit`, which you can delegate to API keys.

```bash theme={null}
curl -G "$VOUCHER_API_BASE_URL/partner/v1/audit-events" \
  -H "Authorization: Bearer $VOUCHER_API_KEY" \
  --data-urlencode "filter[entityType]=redemption-link" \
  --data-urlencode "filter[createdAt][gte]=2026-10-01T00:00:00Z" \
  --data-urlencode "filter[createdAt][lt]=2026-11-01T00:00:00Z"
```

```json theme={null}
{
  "data": {
    "data": [
      {
        "id": 25069,
        "resource": "audit-event",
        "createdAt": "2026-10-22T07:10:02Z",
        "actor": { "type": "partner-user", "id": 4069, "label": "ops@example.com" },
        "actionEn": "Redemption link revoked",
        "actionDe": "Einlöselink widerrufen",
        "actionType": "update",
        "entityType": "redemption-link",
        "entityId": "31069",
        "providerPartnerId": null,
        "consumerPartnerId": 1069,
        "metaData": { "status": ["active", "revoked"] },
        "eventData": { "eventId": "b4e2d3c5-6f70-4b8c-9dae-1f203b4c5d6e", "eventType": "redemption-link-revoked" },
        "_links": {
          "self": { "href": "https://api.voucher.allride.io/partner/v1/audit-events/25069", "type": "application/json" }
        }
      }
    ],
    "page": 1,
    "perPage": 25,
    "totalPages": 1,
    "total": 1
  }
}
```

| Field | Meaning |
| - | - |
| `actor` | Who made the change: a member (`partner-user`, labelled with the email), an API key (`api-key`, labelled with its name), AllRide (`admin-user`) or the platform itself (`system`). |
| `actionEn`, `actionDe` | A readable description in English and German. |
| `actionType`, `entityType`, `entityId` | What kind of change it was and which resource it affected. |
| `consumerPartnerId`, `providerPartnerId` | Which side of your partner the change belongs to. A partner that is both provider and consumer sees both kinds of entries and can tell them apart by these fields. |
| `metaData` | The changed fields as `{"field": [before, after]}`. |

Filters: `actionType`, `entityType`, `entityId`, `actor.type`, `actor.id` and `createdAt` (`gt`, `gte`, `lt`, `lte`); the newest entries come first. Without `filter[createdAt][gte]` the list covers the **last 90 days**; a window longer than the retention (24 months) answers `400 data-failed-validation` with `property` `filter[createdAt]`, the constraint [`invalid-filter`](https://docs-consumer.voucher.allride.io/errors/catalog#invalid-filter) and `params.maxMonths` `24`. For a complete file, page through the list as described in [Downloading large lists](https://docs-consumer.voucher.allride.io/guides/pagination.md#downloading-large-lists).

## Retention

Audit entries are kept for **24 months** and then deleted. They cannot be changed or deleted earlier, neither by you nor by AllRide. Erasing a redemption entity does not remove audit entries, which is why they never hold its personal data.

## Related

* [Members and groups](https://docs-consumer.voucher.allride.io/workspace/members-and-groups.md)
* [Pagination, filtering and sorting](https://docs-consumer.voucher.allride.io/guides/pagination.md)
* [Permissions and scopes](https://docs-consumer.voucher.allride.io/guides/permissions.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.