Audit log API
The Audit log API gives you information about admin actions users in your organization are taking in Flow. Use this information to understand who is making changes to your organization and when.
Permissions
Users calling the Audit log API must have the Metrics API permission as well as a valid and unique API key. To enable API permissions for users, you must have the Manage User Permissions permission. Learn more about administrative permissions and API keys in Flow.
Important: If a user does not have both the Metrics API permission and an API key, they can't use the Audit log API. If your user can't call the Audit log API, verify they have both the permission and a valid API key.
To enable the Metrics API permission for a user, make sure the permission is added to at least one role they are assigned to.
Calling the API
Call the API endpoint over standard HTTPS. Use any tool or programming language that can add the Authorization: Bearer <API Key> header.
Bearer must be added to the authorization header. It must be capitalized in all cURL requests.
The base URL for the API is: https://api.appfireflow.com/admin-audit-log/payload.
Each API key is allowed a maximum of 100 requests per minute to this endpoint.
Parameters
Parameter | Description | Example |
|---|---|---|
| Optional. Specifies the date range to look for actions in. Regardless of the inputted date range, Flow cannot return data for more than the trailing 6 months. After this point, logs are no longer retained. |
|
| Optional. Specifies which actions to return. Options are:
|
|
| Optional. Specifies the email of the user who performed the action. This is the email associated with their sign-in to Flow. |
|
| Optional. Choose which response field to sort by, and whether to sort in ascending or descending order. |
|
| Optional. Number of records returned per query. Defaults to 100. Maximum is 1000. |
|
| Optional. Number of records to skip before returning a record. Defaults to 0. |
|
Unlike in most Flow APIs, the users referenced in the Audit log API are account users, not apex users. While in many cases they share the same email address, ensure you’re using the account user email—the email used to log into Flow—when querying the API.
Example response
Field | Description |
|---|---|
| Time of the action in UTC. |
| Flow organization ID the action was taken in. |
| Flow organization identifier for the organization the action was taken in. Found in the URL of links to Flow. |
| Name of the user who took the action. |
| Email of the user who took the action. |
| Type of action taken. |
{
"datetime": "2024-11-20T09:19:52Z",
"org_id": "1234",
"org_slug": "engineering",
"user_name": "Stephanie Ventura",
"user_email": "stephanie-ventura@example.com",
"action": "CREATE_INTEGRATION"
}If you see actions performed by a Hidden support user that you don't recognize as part of your organization, they correspond to actions taken by members of your Flow account team on your behalf to assist you in issue resolution or organizational maintenance. If required for any reason, please reach out to your Flow contact for additional information on the individual accessing this user to make specific changes.