Every recorded action on the caller's account, newest first — the audit trail

GET /audit

Each entry names the action (the event tag), the actor who caused it (user for a person, system for a worker such as webhook ingestion or the reconciliation sweep, app for an installed app acting under its own token), the entity it concerns, when it happened, and the originating service and journal sequence. Entries are derived from the services' append-only journals, so the trail is immutable by construction: nothing here can be edited or deleted, and a correction appears as a new entry. Filters (all optional, combined with AND): actor matches an actor id (or user/system/app for a whole class), action is an exact event tag or a prefix like inventory., entityId is a document/SKU/party id (an order's facts match the parties the order named), service names a journal, from/to bound occurredAt as [from, to). The trail is paged, back to the account's first fact: limit is the page size (default 200, max 1000), and next, while older entries remain, is the cursor for the next page — a cursor rather than an offset, so facts landing mid-read never shift a page; 400 AuditCursorInvalid for a cursor this service did not issue. Every request first reads each journal forward from where the service last read it, with the caller's own token, so the trail is current and a journal that refuses the caller (or cannot be reached) is named in unavailable and its facts are left out. Scoped to the caller's organization — there is no cross-organization view.

Access

Requires activity:read.

How scopes come from roles: Scopes and roles. Getting a token: Authentication and app tokens.

AI agent tool

Agents call this as audit_trail (Audit: Activity trail), in the audit toolset. It only reads.

Connecting an agent: AI agents.

Example

curl

curl -X GET 'https://audit.getmanifold.io/audit?entityId=psn_01a1588a-0c41-7d2e-9a10-3b5c6d7e8f90&from=2026-10-20T00%3A00%3A00.000Z&to=2026-10-20T09%3A10%3A00.000Z&limit=50' \
  -H "Authorization: Bearer $MANIFOLD_TOKEN"

JavaScript (fetch)

const response = await fetch("https://audit.getmanifold.io/audit?entityId=psn_01a1588a-0c41-7d2e-9a10-3b5c6d7e8f90&from=2026-10-20T00%3A00%3A00.000Z&to=2026-10-20T09%3A10%3A00.000Z&limit=50", {
  method: "GET",
  headers: { Authorization: `Bearer ${process.env.MANIFOLD_TOKEN}` },
});
if (!response.ok) throw new Error(`${response.status}: ${await response.text()}`);
const answer = await response.json();

Response · 200 · application/json

{
  "entries": [
    {
      "eventId": "evt_01a1588a-0c41-7d2e-9a10-000000000042",
      "txId": "tx_01a1588a-0c41-7d2e-9a10-000000000042",
      "tenantId": "org_01a1586e-f9f6-7a8b-9c7d-6e5f4a3b2c1d",
      "service": "crm-manager",
      "sequence": 42,
      "action": "crm.company-contact-set",
      "actor": {
        "_tag": "user",
        "id": "usr_01a15889-fa80-7b11-8c22-3d4e5f6a7b8c"
      },
      "occurredAt": "2026-10-20T09:06:00.000Z",
      "entity": {
        "kind": "person",
        "id": "psn_01a1588a-0c41-7d2e-9a10-3b5c6d7e8f90"
      },
      "related": [
        {
          "kind": "company",
          "id": "cmp_01a1588a-1f02-7a3b-8c4d-5e6f7a8b9c0d"
        }
      ],
      "detail": {
        "companyId": "cmp_01a1588a-1f02-7a3b-8c4d-5e6f7a8b9c0d",
        "personId": "psn_01a1588a-0c41-7d2e-9a10-3b5c6d7e8f90",
        "title": "Purchasing manager",
        "main": true
      }
    },
    {
      "eventId": "evt_01a1588a-0c41-7d2e-9a10-000000000041",
      "txId": "tx_01a1588a-0c41-7d2e-9a10-000000000041",
      "tenantId": "org_01a1586e-f9f6-7a8b-9c7d-6e5f4a3b2c1d",
      "service": "crm-manager",
      "sequence": 41,
      "action": "crm.person-created",
      "actor": {
        "_tag": "user",
        "id": "usr_01a15889-fa80-7b11-8c22-3d4e5f6a7b8c"
      },
      "occurredAt": "2026-10-20T09:00:00.000Z",
      "entity": {
        "kind": "person",
        "id": "psn_01a1588a-0c41-7d2e-9a10-3b5c6d7e8f90"
      },
      "related": [],
      "detail": {
        "reference": "checkout:5521",
        "personId": "psn_01a1588a-0c41-7d2e-9a10-3b5c6d7e8f90",
        "emailKey": "593c82fc1f2944d758cdd3ba99d3846467ec3417f394e5f47c7410b939a0a83c",
        "profile": "v1.QmFzZTY0IGNpcGhlcnRleHQgb2YgdGhlIHByb2ZpbGU=",
        "tags": [
          "trade"
        ],
        "roles": [
          "customer"
        ],
        "taxExempt": false,
        "emailMarketing": "subscribed",
        "smsMarketing": "not-subscribed"
      }
    }
  ],
  "unavailable": []
}

The panel writes this call in other languages. It does not send it: Manifold's APIs do not take calls from a web page on another site, so run the call from your own code or terminal. The whole API as OpenAPI: audit-log.openapi.json. Base URL https://audit.getmanifold.io.

Errors

Every refusal is a status and a JSON body whose _tag names it. A refused call changes nothing.

`400`

Refusal	What it means	What to do
`AuditCursorInvalid` cursor	The cursor is not one this service gave out.	Pass back the `next` of the page before.

`401`

Refusal	What it means	What to do
`Unauthorized` reason	The token is missing, expired or not one Manifold issued.	Get a fresh token and send the call again.
`TokenAlreadyUsed` tokenId	A single-use app token was already spent.	Mint a new token for this call.

`402`

Refusal	What it means	What to do
`SubscriptionRequired` status	The organization's subscription has lapsed, so writes are refused.	An owner settles billing. Reads still work meanwhile.

`403`

Refusal	What it means	What to do
`TenantRequired` userId	The token names no organization.	Choose the organization, then get a new token.
`ScopeRequired` required	The token's roles do not grant the scope this call needs.	Ask an owner or admin for a role that grants it.

`409`

Refusal	What it means	What to do
`MirroredFromSource` source	This area is fed by your source system until the organization goes live.	Make the change in the source system, or go live first.

`503`

Refusal	What it means	What to do
`RequestLogUnavailable` tokenId, reason	The service could not record the request, so it did nothing.	Try again shortly.

How refusals work everywhere: Errors.