Activity Log API

Read your store's activity log: who changed what, how, and when, whether in
the dashboard or through the API. Every change a person or API key makes is
logged; only automatic changes, such as stock a checkout takes, stock a
refund puts back, and Easel's background jobs, are not. It is the same log
the dashboard shows under Settings › Activity and as the History on each
record's page.

Events are read-only. Easel records each one in the same transaction as the
change it describes and keeps it until the store is deleted; a correction is
a later event. Orders keep their own history, read with List Order
Events, and gift cards theirs in their
transactions, so an order's shipments and refunds and a gift card's
balance aren't repeated here.

Endpoints

• List Audit Events - GET /api/v1/audit-events/

List Audit Events

Retrieve a page of the store's activity log, newest first.

Endpoint: GET /api/v1/audit-events/

Scope Required: audit_events:read

Query Parameters

Events come newest first either way. The response reports has_more, which
is true when more events follow in the direction of travel: older ones, or
newer ones with before.

To read one product's history, pass its ID with its type:

GET /api/v1/audit-events/?entity_type=product&entity_id=pro_d0b6db728q6vrspbvbqg

Request

curl -X GET "https://studio.easel.engineering/api/v1/audit-events/?entity_type=product&limit=3" \
  -H "Authorization: Bearer your_api_key_here"

Response

Status: 200 OK

{
  "data": [
    {
      "id": "aud_d0b6db728q6vrsaud006",
      "entity": {
        "type": "product",
        "id": "pro_d0b6db728q6vrspbvbqg",
        "name": "Cozy Blanket"
      },
      "action": "edited",
      "actor": {
        "type": "api_key",
        "id": "api_devseedkey0000000001",
        "name": "Inventory sync"
      },
      "details": {
        "changes": [{ "field": "description" }]
      },
      "created_at": "2025-05-03T19:06:40Z"
    },
    {
      "id": "aud_d0b6db728q6vrsaud005",
      "entity": {
        "type": "product",
        "id": "pro_d0b6db728q6vrspbvbqg",
        "name": "Cozy Blanket"
      },
      "action": "edited",
      "actor": {
        "type": "user",
        "id": "usr_d0b6cu728q6vrspbvbag",
        "name": "Ada"
      },
      "details": {
        "changes": [{ "field": "stock", "from": "30", "to": "42" }],
        "variant": "Green, Small",
        "source": "inventory"
      },
      "created_at": "2025-05-03T19:05:00Z"
    },
    {
      "id": "aud_d0b6db728q6vrsaud004",
      "entity": {
        "type": "product",
        "id": "pro_d0b6db728q6vrspbvbqg",
        "name": "Cozy Blanket"
      },
      "action": "edited",
      "actor": { "type": "user", "id": null, "name": null },
      "details": {
        "changes": [{ "field": "price", "from": "2499", "to": "2999" }],
        "variant": "Green, Small"
      },
      "created_at": "2025-05-03T18:55:52Z"
    }
  ],
  "has_more": true
}

The last event was made by a dashboard user who has since been removed, so
its actor has no id or name.

Error Responses

Invalid parameter

Status: 400 Bad Request

A malformed after or before, both at once, an invalid limit, an
unknown entity_type, an entity_id without entity_type, or an actor
that isn't one of the store's users or API keys returns
INVALID_REQUEST_ERROR, with the offending parameter named in the error
message:

{
  "error": "Invalid 'entity_type' parameter: must be a kind of record the log holds",
  "code": "INVALID_REQUEST_ERROR"
}

Unknown cursor

Status: 404 Not Found

An after or before that names no event of the store:

{
  "error": "Resource not found",
  "code": "NOT_FOUND"
}

Audit Event Object

Entity Object

Actor Object

Entity Types

New entity types may be added, so ignore types you don't recognize.

Actions

• created - The record was made. For a payment or shipping key, the key
  was connected
• duplicated - The product was made as a copy of another, whose ID is in
  source_id and name in name
• edited - The record changed; each changed field is in changes
• deleted - The record was deleted. For a key, it was disconnected; for a
  store user, they were removed from the store
• invited - A person was invited to join the store's dashboard; the
  role they'll join with is in changes as role
• joined - The invited person accepted and joined the store; they are the
  event's actor
• replaced - A payment or shipping key was replaced with a new one, or a
  variant's digital file with another (part is digital_file, and
  changes holds the old and new file names)
• added and removed - A part of a record, named by part and name,
  was added or removed, such as a product's variant or a collection's tag
• moved - The record, or the part part and name say, moved one place
  up or down its list, as direction says
• hidden and unhidden - One of a product's reviews was hidden from
  shoppers or shown again (part is review)
• signed_in - A store user logged in to the dashboard with the passkey
  name names (part is passkey); they are the event's actor, in the
  store their session opened
• reset - Every passkey of a store user who lost theirs was removed at
  once (part is passkey), and they were logged out, by a teammate or
  by Easel's support. Passkeys belong to the person rather than a store,
  so each store they're on logs it
• redeemed - An Easel staff member used the store's support access code;
  they are the event's actor
• revoked - The store's owner ended its support access, or made a new
  code in its place
• voided - The support access code was guessed wrong too many times,
  so it no longer works; the actor is the staff member whose guess
  voided it
• ended - The Easel staff member ended their support access, done
  helping, or Easel's operator ended it as they removed the staff member's
  sign-in; the actor is whoever ended it
• expired - The support access code lapsed unused, or the access ran
  out; the actor is system
• taken_down and restored - Easel's staff removed content as illegal
  or against Easel's terms, or put it back (see Moderation).
  For a review or image, the entity is the store, and part is review or
  image, with an image's ID in name; reason says why
• billed - Easel's staff charged the store for its Easel plan on
  demand, rather than on its billing date; the actor is the staff member
• suspended and unsuspended - Easel's staff suspended the store for its
  content, or lifted the suspension; reason says why it was suspended

New actions may be added, so ignore actions you don't recognize.

Details

Each change's field names what changed, and from and to are its old
and new values as strings. Either is left out when the field was unset, and
both are left out for a field logged without its values, such as a product's
description, a site's logo, its postal address, or any of a customer's
fields. Values longer than 200 characters are cut short with …. Prices are
in the store's smallest currency unit, weights in grams, dates as
YYYY-MM-DD, images by their public IDs, and true or false settings are
true or false.

New fields may be added, so ignore fields you don't recognize.

Moderation

Easel hosts what your store publishes, so under the EU Digital Services Act
its staff review it and may remove content that's illegal or against
Easel's terms, or suspend the store. Each such decision is logged with the
platform actor naming the staff member, and the store's owners are
emailed a statement of the reasons; the dashboard lists them under
Settings › Activity › Easel decisions. Content Easel took down has its
taken_down_at set, the time it was taken down, and can't be published
or shown again through the API either; see each resource's errors.

Support Access

Easel's staff have no standing access to your dashboard. To let them in
to help, the store's owner makes an 8-digit code under Settings › Support
access and reads it to them. A staff member redeems it in Easel's
operator console, for your store only, within the hour, and may then use
your dashboard for the time the owner chose, until the owner revokes it.
They can't manage your team, API keys, payouts, billing, or exports.

Each change they make is logged with actor.type platform, naming the
staff member in actor.id and actor.name, and the access itself is
logged as a staff_access record from the code's creation to its end.

Personal Data

The log is kept as long as the store, past a customer's erasure, so it
holds no customer's personal data. A customer is named only by their ID,
their fields are logged as changed without their values, their addresses
are never described, and a review hidden or shown again isn't quoted.

Secrets

The log never holds a secret. A payment or shipping key's events say only
that it was connected (created), replaced, or disconnected (deleted),
and an API key's events never carry the key itself.