Read the operator audit log

GET/operator/audit-log

Authorization

AuthorizationBearer token (JWT) · headerrequired

JWT issued by the external IdP via the OAuth 2.0 authorization-code flow (Kinde in production; a simulator in test). The client obtains it and sends it as a Bearer token on every authenticated call. Sarvex's services verify it — issuer, audience, signature (IdP JWKS), expiry — and read identity and tenant from its claims. Sarvex does not issue or revoke these tokens. merchant_id/store_id are read from the verified claims (and the merchant→store mapping), never from the URL. The operator scope is required for /operator/*. Operators acting on a specific merchant pass the X-Operate-As header, which is recorded in the audit log.

Scopes:operator

Query parameters

cursorstring

Opaque pagination cursor from the previous page's page.cursor.

limitinteger

Maximum items per page.

min 1 · max 100 · default: 25

target_merchant_idstring

Responses

200

Audit entries.

dataaudit_entry[]required

Show properties

Array of audit_entry

entry_idstring

operator_user_idstring

target_merchant_idstring

actionstring

detailobject

occurred_atstring<date-time>

pagepagerequired

Show properties

cursorstring | nullrequired

has_morebooleanrequired

403

Authenticated but not permitted (e.g. non-operator on an operator route).

errorobjectrequired

Show properties

codestringrequired

messagestringrequired

detailsobject | null

Try it

Server

Base URLCustom base URLOverrides the selected server when set.

Authorization

Bearer token (JWT)Remember on this deviceInclude my values in samples

Parameters

cursorqueryOpaque pagination cursor from the previous page's `page.cursor`.limitqueryMaximum items per page.target_merchant_idquery

Request

curl -X GET "https://api.sarvex.example.com/v1/operator/audit-log" \
  -H "Authorization: Bearer YOUR_TOKEN"

const response = await fetch("https://api.sarvex.example.com/v1/operator/audit-log", {
  method: "GET",
  headers: {
    "Authorization": "Bearer YOUR_TOKEN"
  }
});

import requests

response = requests.get(
    "https://api.sarvex.example.com/v1/operator/audit-log",
    headers={
        "Authorization": "Bearer YOUR_TOKEN"
    },
)

Response

{
  "data": [
    {
      "entry_id": "string",
      "operator_user_id": "string",
      "target_merchant_id": "string",
      "action": "remediation.apply",
      "detail": {},
      "occurred_at": "2019-08-24T14:15:22Z"
    }
  ],
  "page": {
    "cursor": "string",
    "has_more": true
  }
}

{
  "error": {
    "code": "string",
    "message": "string",
    "details": {}
  }
}