---
title: "List mutation audit rows for one customer"
method: GET
path: "/accountant/companies/{customerId}/audit-logs"
tags: ["Accountant Portal"]
---

# List mutation audit rows for one customer

`GET /accountant/companies/{customerId}/audit-logs`

## Request

- Base URL: `https://api.medianfi.com/api/v1`
- URL: `https://api.medianfi.com/api/v1/accountant/companies/{customerId}/audit-logs`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-API-Key`

Accountant-scoped read of `audit_logs` for journal entries, business events, GL periods, and explicitly requested reconciliation events. Other entity types are rejected with 422. Newest first. Requires assignment to the customer (403 otherwise). This lists rows that were written; it does not create the missing journal-create trail (#1986).

## Query parameters

- `limit` integer
- `entityTypes` string

## Response `200`

Newest-first audit rows

- object
  - `success` boolean, required
  - `data` AuditLogEntry[], required
    - `id` string, required
    - `companyId` string, nullable
    - `userId` string, nullable
    - `actorPrincipalType` 'human' | 'service' | 'worker' | 'system' | 'unknown' | 'null', nullable, required: Persisted provenance. Null legacy attribution is unknown, not system.
    - `actorId` string, nullable, required: Resolved principal UUID or server-owned worker/system identifier.
    - `actorApiKeyId` string, uuid, nullable, required: Verified credential ID; never an API key secret.
    - `action` string, required
    - `entityType` string, required
    - `entityId` string, required
    - `changes` object, nullable
    - `createdAt` string, date-time, required

## Other responses

- `401`: Authentication required
- `403`: Insufficient permissions or not a company member
- `422`: Request failed validation

---

[API](https://skmtc.dev/medianfi/apis/median-api.md) · [All operations](https://skmtc.dev/medianfi/apis/median-api/llms.txt) · [OpenAPI document](https://skmtc.dev/medianfi/apis/median-api/revisions/20090ea32b0d?raw)