Audit log

The audit log is an append-only record of changes in an organization. Every mutation emits an event, and the audit log stores those events as entries with a timestamp, an action, the entity touched and the actor responsible.

In the admin

The audit log lives under System → Audit log.

1. Use the Action filter to show create, update or delete entries, or all.
2. Use the Entity filter to narrow to one entity type, such as product, category or member.
3. Each row shows Timestamp, Action, Entity, ID and Actor. Click a row to expand the recorded event payload.

The page loads the most recent 200 entries, and the Entity list is built from the entity types present in those entries. Use the API to look further back.

With the API

GET /v1/audit-log returns entries newest first in the standard list envelope (data, limit, offset, hasMore).

Query parameter	Meaning
entity_type	For example product, variant, api_key, connector.sync
entity_id	One entity’s UUID, for its full history
action	create, update or delete
since	ISO 8601 date-time; entries at or after it
limit / offset	Default 100, max 500

curl 'https://api.minipim.com/v1/audit-log?entity_type=product&entity_id=0b8c5d3a-…&limit=50' \
  -H 'Authorization: Bearer pim_…'

Each entry has entityType, entityId, action, actorType, actorId, actorLabel, changes and createdAt.

What gets recorded

• Actor type is user (someone in the admin or using a session), api_key, connector (a sync or inbound webhook), or system.
• actorLabel is the user’s name, or their email if no name is set, for user entries. It is resolved when you read the log, so renaming a person updates their history. Other actor types show no label in the admin, just the type and the start of the id.
• changes holds the event payload under after, such as changed_fields, a slug or a name. It records what changed, not the before and after values of every field.
• Action is derived from the event name. For example, attached, assigned and added count as create; detached, revoked and removed count as delete; roles_updated and completed count as update.

Rules and limits

• The log is per organization and cannot be edited through the API.
• A failed mutation writes no entry: the audit row is saved in the same transaction as the change.
• Events whose verb is not a create, update or delete are skipped, for example media.uploaded and connector.webhook.received. Attaching an uploaded file to a product is recorded (media.attached).
• Connector pulls record one connector.sync entry for the whole sync rather than one per imported product.
• For an api_key entry, actorId is normally the id of the user who created the key, not the key’s own id.
• Wipe catalog keeps the audit log. Deleting the organization removes it, after exporting it with the rest of the data. See Organization settings.
• Audit query parameters are snake_case (entity_type, entity_id), unlike the rest of the API.
• Entries made by a member stay in the log after that member is removed.

To react to changes as they happen rather than reading the log, use webhooks.