---
updatedAt: 2026-09-29T06:19:42.000Z
agentTools:
projectIndex: https://docs.sumsub.com/llms.txt
---
# Get audit trail events
This endpoint will be deprecated in the future.
Use the [new API method](ref:get-audit-trail-events) instead.
# Overview
The audit trail events method allows you to track and investigate actions that your employees perform in the Sumsub Dashboard. It can be used to monitor team activity, ensure compliance, and detect suspicious operations. This method is particularly useful when you need a detailed activity log for a specific employee, for example, during internal reviews or regulatory audits.
You can access audit trail data in the following ways:
* **API request** — supports the complete set of [event types](https://docs.sumsub.com/sumsub/reference/audit-trail-events#event-types), covering activities such as logins, applicant management actions, data downloads, exports, and more. You can filter results by employee, action type, and time range using **Query Params** when making a request. To understand how to interpret the API response, refer to the [Response explained](https://docs.sumsub.com/sumsub/reference/audit-trail-events#event-types) section.
* **Dashboard** — provides access to a limited activity log on the [Team → Activity log](https://cockpit.sumsub.com/checkus/settings/team/activityLog) page, showing team and permission management actions, such as creating or updating accounts, changing roles, and so on. You can filter results by date range and action type directly on the page. All other [event types](https://docs.sumsub.com/sumsub/reference/audit-trail-events#event-types) can only be provided through the API request.
### Attention
This feature is available at an additional cost. [Contact us to learn more](https://sumsub.com/contacts/).
### Note
- Events are always sorted by `ts` in a descending order.
- The maximum number of events per request is 20000.
# Required permissions
To use this method, your [app token](https://docs.sumsub.com/sumsub/docs/app-tokens) must have the **View statistics and analytics** [permission](https://docs.sumsub.com/sumsub/docs/user-roles#permissions).
# Response explained
The HTTP status `200` in the response confirms the availability of our API:
| Name | Type | Optional | Description |
| ---------------- | ------ | -------- | ------------------------------------------------------------ |
| `ts` | String | No | Date/time. |
| `clientId` | String | No | Unique identifier of you as our client in the Sumsub system. |
| `activity` | String | No | [Event type](https://docs.sumsub.com/sumsub/reference/audit-trail-events#event-types). |
| `subjectName` | String | No | Subject that executed the action. |
| `ip` | String | No | IP from which the event was detected. |
| `userAgent` | String | Yes | User agent from which the event was detected. |
| `xClientId` | String | Yes | API / Dashboard / SDK. |
| `correlationId` | String | No | Internal ID for investigating requests. |
| `applicantId` | String | Yes | Unique applicant identifier. |
| `externalUserId` | String | Yes | Unique applicant identifier on the client side. |
| `imageId` | String | Yes | Unique document identifier. |
| `description` | String | Yes | Additional information. |
# Event types
| Name | Description |
| :----------------------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `subject:loggedIn:dashboard:success` | User successfully logged in to the Dashboard. |
| `subject:loggedIn:dashboard:failure` | User failed to log in to the Dashboard. |
| `subject:loggedOut:dashboard` | User logged out of the Dashboard. |
| `subject:changed:applicant` | User changed the applicant profile. |
| `subject:loaded:applicant` | User loaded an applicant page in the Dashboard. |
| `subject:loaded:applicantList` | User loaded a page with a list of applicants in the Dashboard. Also can be an applicant page if `cnt=1`. |
| `subject:exported:applicantCsvList` | User exported the applicant list under filters as CSV. |
| `subject:exported:applicantActionCsvList` | User exported a list of applicant actions under filters as CSV. |
| `subject:downloaded:docImage` | User downloaded the image on the applicant page (by manually clicking the **Download** button only). There are other ways to download the image without triggering this event. |
| `subject:changed:applicantLevel` | User changed the applicant level settings. For example, created a new level, or deleted the existing one, changed the steps, and so on. |
| `subject:changed:questionnaire` | User changed the questionnaire settings. For example, added a new question or deleted the existing one. |
| `subject:changed:globalSettings` | User changed the global settings. For example, recognition settings or allowed duplicates. |
| `subject:changed:flow` | User changed the flow settings. For example, added, updated, or deleted any flow in the UI in: **Integrations** -> **Customizations**. |
| `subject:changed:licenseKey` | User changed license key. For example, created, updated, or deleted the license key in the UI in: **Integrations** -> **Global Settings** -> **Source Keys**. |
| `subject:changed:poaStepSettings` | User changed the PoA step settings. For example, created, updated, or deleted settings in the UI in: **Integrations** -> **Global Settings** -> **User verification** -> **Proof of Address**. |
| `subject:changed:dictionary` | User changed one of the dictionaries (MobileSDK, WebSDK, Common, and so on). For example, created or updated dictionary in the UI in: **Integrations** -> **SDK Translations**. |
| `subject:changed:paymentMethodDefinitions` | User changed payment methods settings. For example, created, updated, or deleted one of the payment method definitions in the UI in: **Integrations** -> **Payment methods**. |
| `subject:modified:workflowRevision` | User changed the workflow revision in the UI in: **Integrations** -> **Applicant workflows**. |
| `subject:published:workflowRevision` | User published the workflow revision in the UI in: **Integrations** -> **Applicant workflows**. |
| `subject:archived:workflowRevision` | User archived the workflow revision in the UI in: **Integrations** -> **Applicant workflows**. |
| `subject:changed:autoCheck` | User changed auto check settings. For example, created, updated or deleted auto check in the UI in: **Admin Area** -> **Auto-checks**. |
| `subject:created:appToken` | User created an app token in the UI in: **Dev space** -> **App tokens**. |
| `subject:deleted:appToken` | User deleted app token in the UI in: **Dev space** -> **App tokens**. |
| `subject:modified:user` | Modify parameters for the user. |
| `subject:deleted:user` | Delete user. |
| `subject:opened:singleTransaction` | User opened a specific transaction — for example, from the **Transactions** page in the Dashboard or via a direct link. |
| `subject:opened:transactionTable` | User opened a list of transactions — for example, the **Transactions** page or the **Transactions** tab on the Applicant page in the Dashboard. |
| `subject:reset:password` | Password has been reset via the Dashboard or link. |
| `subject:modified:2fa` | Modify 2-factor authentication key into the system. |
| `subject:downloaded:report` | User downloaded the report. |
# OpenAPI definition
```json
{
"openapi": "3.1.0",
"info": {
"title": "sumsub-api",
"version": "1.0"
},
"servers": [
{
"url": "https://api.sumsub.com"
}
],
"components": {
"securitySchemes": {
"sec0": {
"type": "apiKey",
"name": "X-App-Token",
"in": "header",
"x-default": ""
}
}
},
"security": [
{
"sec0": []
}
],
"paths": {
"/resources/auditTrailEvents/": {
"get": {
"summary": "Get audit trail events",
"description": "This endpoint will be deprecated in the future.
Use the [new API method](https://docs.sumsub.com/sumsub/reference/get-audit-trail-events) instead.",
"operationId": "audit-trail-events",
"parameters": [
{
"name": "subjectName",
"in": "query",
"description": "The name of the subject for which events are received. If the name is not specified, the events are received for all subjects on the key.",
"schema": {
"type": "string"
}
},
{
"name": "activity",
"in": "query",
"description": "If specified, only the events with this activity will be in the response.",
"schema": {
"type": "string"
}
},
{
"name": "from",
"in": "query",
"description": "Date/time events are received (`yyyy-MM-dd HH:mm:ss`, for example, 2022-10-01 12:05:00). If not specified, the events are received the day before.",
"schema": {
"type": "string"
}
},
{
"name": "to",
"in": "query",
"description": "To the date/time events are received (`yyyy-MM-dd HH:mm:ss`, for example, 2022-10-01 12:15:00). If not specified, the events are received up to the present moment.",
"schema": {
"type": "string"
}
},
{
"name": "limit",
"in": "query",
"description": "The maximum number of events per request. Cannot be more than 20000. By default is 10.",
"schema": {
"type": "string",
"default": "10"
}
},
{
"name": "offset",
"in": "query",
"description": "Allows to skip the offset events before beginning to return the events. By default is 0.",
"schema": {
"type": "string",
"default": "0"
}
}
],
"deprecated": false
}
}
},
"x-readme": {
"headers": [],
"explorer-enabled": true,
"proxy-enabled": true
},
"x-readme-fauxas": true
}
```