Skip to main content

​
Audit Trail

Every decision, status change, override, escalation, and automated action in the Zenoo platform is recorded in an immutable audit trail. The audit trail is designed for regulatory compliance with FinCEN (5-year retention), OFAC (10-year), FCA, FATF, and EU AMLD5 requirements.

​
Immutability

Audit log entries cannot be edited or deleted after creation. This is enforced at the platform level via a validation rule that rejects all update operations on existing records. Only inserts are permitted.
Audit log records are immutable by design. The API does not support updating or deleting audit entries. Attempting to do so returns a 403 Forbidden error.

​
Event types

The audit trail captures 32 event types across seven categories:

​
Case events

Event TypeSeverityDescription
CASE_CREATEDINFONew case created
CASE_STATUS_CHANGEINFOCase status transition
CASE_ASSIGNMENTINFOCase assigned to a user
CASE_ESCALATIONWARNINGCase escalated to a manager
CASE_CLOSUREINFOCase closed with resolution notes

​
Alert events

Event TypeSeverityDescription
ALERT_CREATEDINFONew alert generated
ALERT_ACKNOWLEDGEDINFOAlert claimed by analyst
ALERT_RESOLVEDINFOAlert resolved with action and notes
ALERT_FALSE_POSITIVEINFOAlert marked as false positive
ALERT_ESCALATEDWARNINGAlert escalated to manager
ALERT_ASSIGNMENTINFOAlert assigned to a user
ALERT_AUTO_DISPOSITIONINFOAlert auto-disposed by AI pipeline

​
Risk events

Event TypeSeverityDescription
RISK_ASSESSMENT_CREATEDINFONew risk assessment initiated
RISK_SCORE_CALCULATEDINFORisk dimensions scored
RISK_TIER_OVERRIDEWARNINGAnalyst overrode calculated risk tier
RISK_ASSESSMENT_APPROVEDINFORisk assessment approved by reviewer

​
Check events

Event TypeSeverityDescription
CHECK_STATUS_CHANGEINFOCheck status transition
CHECK_WAIVEDWARNINGCheck waived by analyst with reason
CHECK_REJECTEDWARNINGCheck result rejected
CHECK_COMPLETEDINFOCheck execution completed

​
Document events

Event TypeSeverityDescription
DOCUMENT_UPLOADEDINFODocument uploaded by client or analyst
DOCUMENT_REVIEWEDINFODocument reviewed (accepted or declined)

​
Reviewer events

Event TypeSeverityDescription
REVIEWER_ADDEDINFOReviewer assigned to alert or case
REVIEWER_REMOVEDINFOReviewer removed from alert or case
REVIEWER_RESPONSEINFOReviewer approved or declined

​
Other events

Event TypeSeverityDescription
ENTITY_ADDEDINFOEntity added to a case
ENTITY_REMOVEDINFOEntity removed from a case
COMMENT_ADDEDINFOComment added to alert or case
AUTO_ESCALATIONWARNINGSystem auto-escalated due to SLA breach
SLA_BREACHERRORSLA deadline passed without resolution
BULK_OPERATIONINFOBulk action performed on multiple records
AI_ANALYSISINFOAI research or analysis completed

​
Querying the audit trail

​
Get audit logs for a case

curl -X GET "https://api.zenoo.com/v1/cases/cas_xyz789/audit-logs?limit=50" \
  -H "Authorization: Bearer your-api-key"

​
Filter by event type

curl -X GET "https://api.zenoo.com/v1/audit-logs?event_type=CASE_ESCALATION&limit=25" \
  -H "Authorization: Bearer your-api-key"

​
Filter by date range

curl -X GET "https://api.zenoo.com/v1/audit-logs?from=2026-01-01T00:00:00Z&to=2026-02-01T00:00:00Z" \
  -H "Authorization: Bearer your-api-key"

​
Response format

{
  "data": [
    {
      "id": "log_001",
      "event_type": "ALERT_RESOLVED",
      "severity": "INFO",
      "description": "Alert resolved: Approve",
      "old_value": "Open",
      "new_value": "Resolved",
      "reason": "False positive confirmed by AI research.",
      "case_token": "cas_xyz789",
      "alert_token": "alt_001",
      "actor": {
        "id": "user_analyst01",
        "name": "Sarah Johnson",
        "email": "sarah@example.com"
      },
      "created_at": "2026-02-16T11:30:00Z"
    }
  ],
  "meta": {
    "total": 18,
    "page": { "cursor": "eyJ...", "has_more": true }
  }
}

​
Compliance export

Export the full audit trail for a case as CSV for regulatory filing: 
curl -X GET "https://api.zenoo.com/v1/cases/cas_xyz789/audit-logs/export?format=csv" \
  -H "Authorization: Bearer your-api-key" \
  -o "audit-trail-cas_xyz789.csv"
The CSV includes all fields: timestamp, event type, severity, description, old/new values, actor name, and actor email. Actor names are denormalized at write time so they survive user deactivation.

​
Design principles

PrincipleImplementation
ImmutabilityValidation rule rejects all edits on existing records
CompletenessEvery service method logs to the audit trail
Non-blockingAudit failures never break parent transactions
DenormalizationActor names stored at write time for historical accuracy
RetentionConfigurable retention period (default 10 years)
Four-eyesApproval actions record both maker and checker

​
Next steps