Skip to main content

​
Audit Logs

Audit log entries record every significant action in the platform. They are immutable — once created, they cannot be edited or deleted. The audit trail is designed for regulatory compliance with FinCEN, OFAC, FCA, FATF, and EU AMLD5 requirements.

​
Resource fields

FieldTypeDescription
idstringUnique audit log identifier
event_typestringEvent type code. See event types
severitystringSeverity level: INFO, WARNING, ERROR
descriptionstringHuman-readable description of the event
old_valuestringPrevious value (for status changes, overrides)
new_valuestringNew value after the change
reasonstringJustification or notes for the action
case_tokenstringRelated case token
alert_tokenstringRelated alert token
entity_tokenstringRelated entity token
check_tokenstringRelated check token
actorobjectUser who performed the action (see Actor object)
approved_byobjectApproving user for four-eyes actions (see Actor object)
approved_atstringISO 8601 timestamp of approval
metadataobjectAdditional context data (varies by event type)
created_atstringISO 8601 timestamp of the event

​
Actor object

FieldTypeDescription
idstringUser identifier
namestringDisplay name (denormalized at write time)
emailstringEmail address (denormalized at write time)
Actor names and emails are stored at write time so they survive user deactivation. Historical audit records always show the name as it was when the action occurred.

​
Event types

​
Case events (5)

Event TypeSeverityDescriptionKey fields
CASE_CREATEDINFONew case createdcase_token, type, priority
CASE_STATUS_CHANGEINFOCase status transitionold_value, new_value
CASE_ASSIGNMENTINFOCase assigned to a usernew_value (assignee)
CASE_ESCALATIONWARNINGCase escalated to a managerreason, new_value (manager)
CASE_CLOSUREINFOCase closedreason (resolution notes)

​
Alert events (7)

Event TypeSeverityDescriptionKey fields
ALERT_CREATEDINFONew alert generatedalert_token, category, type
ALERT_ACKNOWLEDGEDINFOAlert claimed by analystactor
ALERT_RESOLVEDINFOAlert resolved with actionnew_value (action), reason (notes)
ALERT_FALSE_POSITIVEINFOAlert marked as false positivereason (justification)
ALERT_ESCALATEDWARNINGAlert escalated to managerreason, new_value (manager)
ALERT_ASSIGNMENTINFOAlert assigned to a usernew_value (assignee)
ALERT_AUTO_DISPOSITIONINFOAlert auto-disposed by AI pipelinereason (AI rationale)

​
Risk events (4)

Event TypeSeverityDescriptionKey fields
RISK_ASSESSMENT_CREATEDINFONew risk assessment initiatedcase_token, source
RISK_SCORE_CALCULATEDINFORisk dimensions scorednew_value (tier), metadata (scores)
RISK_TIER_OVERRIDEWARNINGAnalyst overrode calculated tierold_value, new_value, reason
RISK_ASSESSMENT_APPROVEDINFOAssessment approved by reviewerapproved_by, approved_at

​
Check events (4)

Event TypeSeverityDescriptionKey fields
CHECK_STATUS_CHANGEINFOCheck status transitionold_value, new_value
CHECK_WAIVEDWARNINGCheck waived by analystreason, actor
CHECK_REJECTEDWARNINGCheck result rejectedreason
CHECK_COMPLETEDINFOCheck execution completednew_value (result)

​
Document events (2)

Event TypeSeverityDescriptionKey fields
DOCUMENT_UPLOADEDINFODocument uploaded by client or analystmetadata (doc type)
DOCUMENT_REVIEWEDINFODocument reviewed (accepted or declined)new_value (decision)

​
Reviewer events (3)

Event TypeSeverityDescriptionKey fields
REVIEWER_ADDEDINFOReviewer assigned to alert or casenew_value (reviewer), role
REVIEWER_REMOVEDINFOReviewer removed from alert or caseold_value (reviewer)
REVIEWER_RESPONSEINFOReviewer approved or declinednew_value (decision)

​
Entity events (2)

Event TypeSeverityDescriptionKey fields
ENTITY_ADDEDINFOEntity added to a caseentity_token, role
ENTITY_REMOVEDINFOEntity removed from a caseentity_token

​
Other events (5)

Event TypeSeverityDescriptionKey fields
COMMENT_ADDEDINFOComment added to alert or casemetadata (comment type)
AUTO_ESCALATIONWARNINGSystem auto-escalated due to SLA breachreason, new_value
SLA_BREACHERRORSLA deadline passed without resolutioncase_token
BULK_OPERATIONINFOBulk action performed on multiple recordsmetadata (count, action)
AI_ANALYSISINFOAI research or analysis completedalert_token, metadata

​
Example

{
  "id": "log_001",
  "event_type": "ALERT_RESOLVED",
  "severity": "INFO",
  "description": "Alert resolved: Approve",
  "old_value": "Open",
  "new_value": "Resolved",
  "reason": "False positive confirmed. Matched entity is unrelated to subject.",
  "case_token": "cas_xyz789",
  "alert_token": "alt_001",
  "entity_token": "ent_ubo789",
  "check_token": null,
  "actor": {
    "id": "user_analyst01",
    "name": "Sarah Johnson",
    "email": "sarah@example.com"
  },
  "approved_by": null,
  "approved_at": null,
  "metadata": {
    "resolution_action": "Approve",
    "ai_confidence": 85,
    "false_positive_probability": 82
  },
  "created_at": "2026-02-16T11:30:00Z"
}
EndpointMethodDescription
GET /v1/audit-logsGETList audit logs with filters
GET /v1/cases/{token}/audit-logsGETList audit logs for a case
GET /v1/cases/{token}/audit-logs/exportGETExport audit logs as CSV

​
Filter parameters

ParameterTypeDescription
event_typestringFilter by event type code
severitystringFilter by severity: INFO, WARNING, ERROR
fromstringStart date (ISO 8601)
tostringEnd date (ISO 8601)
actor_idstringFilter by acting user
limitnumberResults per page (default 50, max 200)
cursorstringPagination cursor

​
See also