---
title: "List audit events"
method: GET
path: "/auditlog_events"
tags: ["Audit"]
---

# List audit events

`GET /auditlog_events`

This API returns a list of all the audit log events that match the given filters.

**Note**: Not every single change in the system is audited. Currently the audited entities include:

| Object     | Action                    | Notes |
|------------|---------------------------|-------|
| customer   | form create/update/delete |       |
| customer   | api create/update/delete  |       |
| customer   | csv import                |       |
| register   | form create/update/delete |       |
| outlet     | form create/update/delete |       |
| csv import | init                      | Tracks CSV import requests and includes data about the import type (customer, product) and the CSV file line count. |
| product*   | create/update/delete      | All actions on products. |
| security   | terms_accepted, signin, signout, change_email, change_password, reset_password_confirm, user_switching_succes, user_switching_denied, new_personal_token, update_personal_token, delete_personal_tokenss, issue_oauth_token ||
| vend_consignment | insert/update | Receiving, creating and editing purchase orders as well as inventory counts. |
| vend_consignment_product | insert/update | Changes to the products in a purchase order. Such as creating purchase orders. |
| timeclock | clockin/clockout | Clock event where a user either clocked in or clocked out. |

### Filters
- The from and to filters require a full isoformat date, for example `?from=2020-02-03T00:00:00&to=2020-02-05T23:59:59`.

🔒 Requires: `audit:read` scope

## Query parameters

- `page_size` string
- `offset` string
- `from` string
- `to` string
- `order` string
- `user_id` string
- `type` string

## Response `200`

The response if the API call is successful.

- object
  - `data` AuditLogEvent[]
    - `action` 'insert' | 'update' | 'delete' — The type of the action performed on the object.
    - `created_at` string, date-time — The timestamp indicating when the event was persisted to the audit log.
    - `data` union — An object in JSON format representing the new values of the attributes that were changed by the event.
      - object
      - object[]
    - `entity_id` string — The id of the object involved in the event
    - `id` string — Autogenerated object identifier.
    - `ip_address` string, ipv4 — The ip address from which the request causing the event originated.
    - `occurred_at` string, date-time — The timestamp indicating when the action causing the event occurred.
    - `old_data` object — An object in JSON format representing the old values of the attributes that were changed by the event.
    - `type` string — The type of the object involved in the event. This may be something like "security" for security events or the name of the table the action was performed on, like "vend_customer".
    - `user_agent` string — User agent of the http client which submitted the request.
    - `user_id` string — The `id` of the user executing the action registered by this event.

---

[API](https://skmtc.net/lightspeedhq/apis/api-2026-07.md) · [All operations](https://skmtc.net/lightspeedhq/apis/api-2026-07/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lightspeedhq/api-2026-07/revisions/72d4ceb46dbb/schema)