---
title: "List audit events"
method: GET
path: "/audit-events"
tags: ["audit"]
---

# List audit events

`GET /audit-events`

## Request

- Base URL: `https://api.smartrecruiters.com/audit-api/v201910`
- URL: `https://api.smartrecruiters.com/audit-api/v201910/audit-events`
- Auth: one of:
  - API key in header `x-smarttoken`
  - OAuth 2
    - Authorization code: `https://www.smartrecruiters.com/identity/oauth/allow`
    - Token URL: `https://api.smartrecruiters.com/identity/oauth/token` scopes: `audit_events_read`

The `ADMINISTRATOR` role is required to access the Audit API. Data collected via the Audit API will be retained at least 26 months. When `eventDateAfter` and `eventDateBefore` are not set, by default, the time range is set to the last 7 days. Below is the list of the events that are currently exposed in the API:
* **USER_ACCOUNT_ACTIVATED** - user account has been activated, user can now login to the system
* **USER_ACCOUNT_CREATED** - user account has been created, in order to log in to the system account has to be activated first
* **USER_ACCOUNT_DEACTIVATED** - user account has been deactivated, logging possibility disabled for the user
* **USER_ACCOUNT_UPDATED** - user account has been modified
* **USER_AUTHENTICATION_INVALID_CREDENTIALS** - user authentication failed due to invalid credentials.
Additional context represents the type of the authentication method:
```json
context: {
    authenticationType: "PASSWORD"
}
```
* **USER_AUTHENTICATION_SUCCESS** - user authentication succeeded
Additional context represents the type of the authentication method:
```json
context: {
    authenticationType: "PASSWORD",
    officeName: "string" //Optional
}
```
* **USER_PASSWORD_CHANGED** - user password has been changed
* **USER_PASSWORD_RESET** - user password has been reset
* **USER_ROLE_CHANGED** - user role has been changed,
Additional context represents previous and current role of the user:
```json
context: {
    currentRole: "RESTRICTED",
    previousRole: "STANDARD"
}
```
* **USER_API_KEY_RENEWED** - user api-key has been renewed
* **USER_LOGOUT** - user has been logged out from the platform
Additional context represents the source of the logout:
```json
context: {
    source: 'string'
}
```
* **CREDENTIALS_CREATED** - api-key or OAuth credentials has been renewed
* **CREDENTIALS_CHANGED** - api-key or OAuth credentials has been modified
* **CREDENTIALS_REVOKED** - api-key or OAuth credentials has been modified
Additional context represents credential type:
```json
context: {
    credentialType: "string"
}
```
* **SEARCH** - user performed search
For entityType CANDIDATE additional context represents candidate search event:
```json
context: {
    keyword: [
        "test"
    ],
    jobTitles: [
        "Freelancer",
        "Software Engineer"
    ],
    jobNames: [
        "Java Developer, San Francisco"
    ],
    companies: [
        "SmartRecruiters"
    ],
    schools: [
        "University of Science and Technology"
    ]
```
* **JOB_DELETED** - job was deleted
Additional context represents the deleted job:
```json
context: {
    jobName: "string",
    jobRefNumber: "string"
}
```
* **HIRING_TEAM_MEMBER_ADDED** - a new member was added to the hiring team of the job
Additional context represents the new member:
```json
context: {
    userId: "string",
    roleId: "string",
    roleName: "string"
}
```
* **HIRING_TEAM_MEMBER_REMOVED** - a member was removed from the hiring team of the job
Additional context represents the removed member:
```json
context: {
    userId: "string"
}
```
* **HIRING_TEAM_ROLE_UPDATED** - role of one of the hiring team members was updated
Additional context represents previous and current role of the updated member:
```json
context: {
    userId: "string",
    previousRoleId: "string",
    previousRoleName: "string",
    currentRoleId: "string",
    currentRoleName: "string"
}
```
* **APPROVAL_DELEGATION_FROM_USER_CREATED** - a user created an approval delegation
* **APPROVAL_DELEGATION_FROM_USER_CANCELLED** - a user cancelled an approval delegation
* **APPROVAL_DELEGATION_TO_USER_CREATED** - an approval delegation to a user (a delegate) has been created
* **APPROVAL_DELEGATION_TO_USER_CANCELLED** - an approval delegation to a user (a delegate) has been created

  Additional context represents approval delegation event's details:

  ```json

  context: {
      originalApproverId: "string",
      delegateApproverId: "string",
      startDate: date,
      endDate: date
  }

  ```

* **JOB_APPROVAL_REQUESTED** - a job approval was requested
Additional context represents approval modified event's details:
```json
comment: {
  text: 'string',
  authorId: 'string',
  date: 'string',

}
context: {
    comments: [comment]
}
```
* **JOB_APPROVAL_APPROVED** - a job approval was approved
Additional context represents approval modified event's details:
```json
comment: {
  text: 'string',
  authorId: 'string',
  date: 'string',

}
context: {
    comments: [comment]
}
```
* **JOB_APPROVAL_REJECTED** - a job approval was rejected
Additional context represents approval modified event's details:
```json
comment: {
  text: 'string',
  authorId: 'string',
  date: 'string',

}
context: {
    comments: [comment]
}
```
* **JOB_APPROVAL_ABANDONED** - a job approval was abandoned
Additional context represents approval modified event's details:
```json
comment: {
  text: 'string',
  authorId: 'string',
  date: 'string',

}
context: {
    comments: [comment]
}
```
* **OFFER_APPROVAL_APPROVED** - an offer approval was approved
* **OFFER_APPROVAL_REJECTED** - an offer approval was rejected
* **OFFER_APPROVAL_ABANDONED** - an offer approval was abandoned

  Additional context represents approval event's details.
  `type` is one of the values:
    * sequential - consent of every approver is required, approval requests are sent one by one in a defined order.
    * parallel -  all approvers can approve at the same time.

  `decisionMode` is one of the values:
    * all - consent of every approver is required
    * any - consent of a single approver is enough

```json
decision: {
  decidedOn: integer,
  decision: 'string',
  decidedBy: 'string',
  userId: 'string'
}
context: {
  approvalRequestId: 'string'
  approvers: [decision]
  type: 'string',
  decisionMode: 'string'
}
```
* **JOB_APPROVAL_STEP_APPROVED** - a job approval step was approved by author
* **JOB_APPROVAL_STEP_REJECTED** - a job approval step was rejected by author
Additional context represents approval step modified event's details:
```json
context: {
    approver: 'string'
    comment: 'string'
}
```
* **JOB_APPROVAL_STEP_SKIPPED** - an author skipped approver for a job approval step
* **OFFER_APPROVAL_STEP_APPROVED** - an offer approval step was approved by author
* **OFFER_APPROVAL_STEP_REJECTED** - an offer approval step was rejected by author
* **OFFER_APPROVAL_STEP_SKIPPED** - an author skipped approver for an offer approval step

  Additional context represents approval step modified event's details:

```json
context: {
    approvalRequestId: "string"
    approver: "string",
    reasonId: "string",
    comment: "string"
}
```
* **JOB_APPROVAL_STEP_DELEGATED** - job approval step was delegated to new approver
* **OFFER_APPROVAL_STEP_DELEGATED** - job approval step was delegated to new approver

  Additional context represents approval step delegated event's details:

```json
context: {
    approvalRequestId: "string"
    originalApproverId: "string",
    delegateApproverId: "string"
}
```
* **OFFER_ACCEPTED** - offer was accepted. Returns viaIntegration which is set to true if offer was accepted via third party integration like Docusign
```json
context: {
    viaIntegration: "boolean"
}
```
* **OFFER_DECLINED** - offer was declined. Returns viaIntegration which is set to true if offer was accepted via third party integration like Docusign
```json
context: {
    viaIntegration: "boolean"
}
```
* **CANDIDATE_PERSONAL_DATA_MODIFIED** - Candidate personal data were modified. Only Web Application actions are audited. Event doesn't cover Customer API. Personal data covers:
    * First Name
    * Last Name
    * E-mail
    * Phone
    * Location
    * Phone Number
    * Social Links (Skype Id, Indeed Id, Twitter account, LinkedIn profile, Facebook profile, Websites)
* **CANDIDATE_PROFILE_MODIFIED** - Candidate profile data were modified. Only Web Application actions are audited. Event doesn't cover Customer API and Mobile application.
* **CANDIDATE_DELETED** - Candidate was deleted. The authorType property can be used to distinguish deletion nature. Following values are possible:
    * USER - candidate was deleted by user
    * SYSTEM - candidate was deleted by compliance mechanism (due to retention period end or lack of consent)
    * CANDIDATE - candidate deleted oneself

* **CANDIDATE_PROFILE_OPENED** - Candidate profile was opened by user. Only Web Application actions are audited. Event doesn't cover Customer API and Mobile application.
* **CANDIDATE_EEO_FILLED** - Missing Candidate EEO informations were filled by user.
* **CANDIDATE_PROFILE_UPDATED_DUE_TO_MERGE** - candidate profile updated due to merge.
Additional context with id of duplicated candidate profile:
```json
context: {
    mergedProfileId: "string"
}
```
* **CANDIDATE_DELETED_DUE_TO_MERGE** - candidate profile deleted due to merge.
Additional context with id of master candidate profile:
```json
context: {
    masterProfileId: "string"
}
```
* **CANDIDATE_TAGS_MODIFIED** - candidate tags have been modified. It means that tags have been added, replaced or deleted from the profile.

  The additional context contains the `tags` that are assigned to the candidate after the successful operation.

  ```json

  context: {
      tags: "string"
  }

  ```

* **APPLICATION_PROPERTIES_UPDATED** - application properties updated.
Additional context with id of updated properties:
```json
context: {
    updatedPropertiesIds: "string",
    updatedPropertiesKeys: "string"
}
```
* **APPLICATION_SOURCE_MODIFIED** - community or job application source has been changed.

  The additional context contains the old and new source identifier after the successful operation.

  ```json

  context: {
      previousSource: "string",
      nextSource: "string"
  }

  ```

* **ONBOARDING_STATUS_UPDATED** - onboarding status updated. Please note that for this event, the application ID must be used as the entity_id parameter for the Audit API. The candidate ID will not work in this case.
Additional context with ids of values:
```json
context: {
    fromValueId: "string",
    toValueId: "string"
}
```
* **JOB_APPLICATION_CREATED** - job application created. Currently, we are auditing only actions undertaken by an employee.
Additional context with ids of values:
```json
context: {
    currentStatus: "string"
}
```
* **JOB_APPLICATION_STATE_MODIFIED** - job application state modified. Currently, we are auditing only actions undertaken by an employee or system user.
Additional context with ids of values:
```json
context: {
    currentStatus: "string",
    currentStep: "string", //optional, might not be returned if lack of configured step
    previousStatus: "string",
    previousStep: "string" //optional, might not be returned if lack of configured step
}
```
* **LRSC_CONSENT_GIVEN** - Consent for data exchange within LinkedIn Recruiter System Connect integration was given.
* **OAUTH_APPLICATION_ACCESS_GRANTED** - Access to OAuth application was granted to given user.
Additional context represents grant's details:
```json
context: {
    applicationId: "string",
    applicationName: "string",
    startDate: "date-time",
    endDate: "date-time"
}
```
JOB_PROPERTY_* events audit changes from both Web Application on Job Field Settings page and Configuration API unless otherwise indicated.
* **JOB_PROPERTY_CREATED** - a job property was created.
* **JOB_PROPERTY_ACTIVATED** - a job property was activated.
* **JOB_PROPERTY_DEACTIVATED** - a job property was deactivated.
* **JOB_PROPERTY_UPDATED** - a job property was updated.
Additional context represents current and previous job property:
```json
property: {
  id: "string",
  label: "string",
  category: "string",
  active: boolean,
  visible: boolean,
  required: boolean
}
context: {
    currentProperty: property,
    previousProperty: property
}
```
* **JOB_PROPERTY_UPDATED_VALUES** - _(deprecated)_ will continue to be emitted until March 2027. Use **JOB_PROPERTY_UPDATED_VALUES_PARTITIONED** instead. For big bulk updates, this event might not be emitted. In such cases, only **JOB_PROPERTY_UPDATED_VALUES_PARTITIONED** events will be available. Values in a job property were updated. Only actions from the Web Application (UI) were audited within this event.
Additional context:

 ```json

 value: {
   id: "string",
   label: "string",
   archived: boolean
 }

 context: {
     currentValues: [value],
     previousValues: [value]
 }

 ```

* **JOB_PROPERTY_UPDATED_VALUES_PARTITIONED** - values in a job property were updated. This is the replacement for **JOB_PROPERTY_UPDATED_VALUES**. Only actions from the Web Application (UI) are audited. Every event includes `aggregationId` in context. For small updates, single event is emitted; for high-volume updates the system emits multiple events with partitioned value sets. When multiple events are emitted for one operation, use the same `aggregationId` to merge them into a single logical update.
Additional context:

  ```json

  value: {
    id: "string",
    label: "string",
    archived: boolean
  }

  context: {
      aggregationId: "string",
      currentValues: [value],
      previousValues: [value]
  }

  ```

* **JOB_PROPERTY_UPDATED_VALUE** - a job property value was updated (changed label, (un)archived). Only actions from Configuration API are audited. These actions from UI are audited within JOB_PROPERTY_UPDATED_VALUES (until March 2027) and JOB_PROPERTY_UPDATED_VALUES_PARTITIONED events.
Additional context represents updated current and previous value:
```json
context: {
    currentValue: value,
    previousValue: value
}
```
* **JOB_PROPERTY_ADDED_VALUE** - a value was added to a job property. Only actions from Configuration API are audited. These actions from UI are audited within JOB_PROPERTY_UPDATED_VALUES (until March 2027) and JOB_PROPERTY_UPDATED_VALUES_PARTITIONED events.
Additional context represents added value:
```json
 context: {
    value: [value]
 }
 ```

* **JOB_PROPERTY_ARCHIVED_VALUE** - a job property value was archived. Only actions from Configuration API are audited. These actions from UI are audited within JOB_PROPERTY_UPDATED_VALUES (until March 2027) and JOB_PROPERTY_UPDATED_VALUES_PARTITIONED events.
Additional context represents archived value id:
```json
context: {
    valueId: "string"
}
```
* **JOB_PROPERTY_DEPENDENT_PROPERTIES_UPDATED** - job property dependents were updated.
Additional context represents updated dependent properties:
```json
context: {
    currentDependents: ["string"],
    previousDependents: ["string"]
}
```
* **JOB_PROPERTY_DEPENDENT_VALUES_UPDATED** - job property dependent values were updated.
Additional context represents added or updated dependent values:
```json
dependentValue: {
  "parent": {
    "id": "string",
    "label": "string"
  },
  "values": [value],
  "valuesIds": ["string"]
}

context: {
    dependentId: "string",
    currentDependentValues: [dependentValue],
    previousDependentValues: [dependentValue]
}
```
* **JOB_PROPERTY_DEPENDENT_VALUES_MODIFIED** - job property dependent values were modified
Additional context represents modified dependent values:

 ```json

context: {
  dependentId: "string",
  modifications: {
    "valuesSet": {
      "string": ["string"]
    },
     "valuesAppended": {
       "string": ["string"]
     },
     "valuesRemoved": {
      "string": ["string"]
    },
     "parentValuesWithAllValuesSet": ["string"],
     "clearedOtherParentValues": boolean
  },
}
```

* **JOB_PROPERTIES_CHANGED** - job details has changed (job fields edited on job)
```json
fieldValue: {
  "fieldId": "string",
  "value": "string"
}
context: {
  "previousProperties": [fieldValue],
  "currentProperties": [fieldValue]
}
```
* **POSITION_UPDATED** - when position is updated
* **POSITION_DELETED** - when position is deleted
* **POSITION_CREATED** - when position is created
* **POSITION_ASSIGNED** - when position is assigned
* **CANCEL_NOT_FILLED_POSITION** - when not filled position is cancelled
```json
position: {
  id: 'string',
  positionId: 'string',
  status: 'string',
  openDate: 'date',
  targetStartDate: 'date',
  type: 'string'
}
context: {
  previous: position,
  current: position
}
```
* **JOB_AD_CREATED** - when job ad is created
```json
location: {
  country: 'string'
  countryCode: 'string'
  regionCode: 'string'
  region: 'string'
  city: 'string'
  address: 'string'
  postalCode: 'string'
  longitude: 'string'
  latitude: 'string'
  manual: boolean
}
compensation: {
  currency: 'string',
  min: 'number',
  max: 'number',
  period: 'string'
}
jobAd: {
  id: 'string',
  title: 'string',
  visibility: 'string',
  creatorId: 'string',
  modifierId: 'string',
  createDate: 'string',
  location: location,
  sections: 'string',
  languageId: 'string',
  applyUrl: 'string'
  compensation: compensation
}
context: {
  jobAd: jobAd
}
```
* **JOB_AD_UPDATED** - when job ad is updated
```json

  context: {
    previous: jobAd,
    current: jobAd
  }

```
* **JOB_AD_DELETED** - when job ad is deleted
```json

  context: {
    jobAdId: 'string',
    employeeId: 'string'
  }

```
* **ONBOARDING_PROCESS_DELETED** - when an Onboarding Process is deleted from SmartOnboard
```json

  context: {
    deletionReason: 'string'
  }

```
* **CUSTOMER_REPORT_DOWNLOADED** - when a report is downloaded Additional context with ids of values:
```json

  context: {
      reportFileId: 'string',
      reportId: 'string'
  }

```
* **COMPANY_HIRING_TEAM_ROLE_CREATED** - a new hiring team role was created
Additional context represents the new hiring team role:
```json
context: {
    id: 'string',
    name: 'string',
    active: boolean,
    defaultRole: boolean,
    jobAccessConfiguration: object,
    applicationAccessConfiguration: object
}
```
* **COMPANY_HIRING_TEAM_ROLE_UPDATED** - a hiring team role was updated
Additional context represents the hiring team role before and after the update:
```json
context: {
    before: {
        id: 'string',
        name: 'string',
        active: boolean,
        defaultRole: boolean,
        jobAccessConfiguration: object,
        applicationAccessConfiguration: object
    },
    after: {
        id: 'string',
        name: 'string',
        active: boolean,
        defaultRole: boolean,
        jobAccessConfiguration: object,
        applicationAccessConfiguration: object
    }
}
```
* **COMPANY_HIRING_TEAM_ROLE_DELETED** - a hiring team role was deleted
Additional context represents the deleted hiring team role:
```json
context: {
    id: 'string',
    name: 'string',
    active: boolean,
    defaultRole: boolean,
    jobAccessConfiguration: object,
    applicationAccessConfiguration: object
}
```
* **COMPANY_HIRING_TEAM_ROLE_ACTIVATION_CHANGED** - a hiring team role was activated or deactivated
Additional context represents the activation status before and after the change:
```json
context: {
    id: 'string',
    before: boolean,
    after: boolean
}
```
* **EMPLOYEE_FLAG_SET** - employee flag was manually set for a candidate
* **EMPLOYEE_FLAG_REMOVED** - employee flag was manually removed from a candidate
* **EMPLOYEE_BADGE_ASSIGNED** - employee badge was assigned to a candidate
* **EMPLOYEE_BADGE_REMOVED** - employee badge was removed from a candidate
* **WEB_SSO_CONFIGURATION_UPDATED** - web sso configuration was updated
Additional context represents web sso configuration settings:
```json
context: {
    previousEnableWebSso: boolean,
    currentEnableWebSso: boolean,
    currentCertificateFingerprint: "string",
    previousCertificateFingerprint: "string",
    currentIdentityProviderUrl: "string",
    previousIdentityProviderUrl: "string",
    currentNameIDFormat: "string",
    previousNameIDFormat: "string",
    currentEnableStrictReplayAttackProtection: boolean,
    previousEnableStrictReplayAttackProtection: boolean
}
```
* **MFA_LOGIN_STEP_STARTED** - an MFA challenge was initiated for the user during login
* **MFA_OTP_GENERATED** - a one-time password was generated and sent to the user
Additional context represents the factor type used:
```json
context: {
    factorType: "EMAIL"
}
```
* **MFA_OTP_LOGIN_SUCCESS** - user successfully verified a one-time password during login
Additional context represents the factor type used:
```json
context: {
    factorType: "EMAIL"
}
```
* **MFA_OTP_LOGIN_FAILED** - user failed to verify a one-time password during login
Additional context represents the factor type used:
```json
context: {
    factorType: "EMAIL"
}
```
* **MFA_OTP_LOGIN_ATTEMPTS_EXCEEDED** - the maximum number of failed OTP verification attempts was reached during login
Additional context represents the factor type used:
```json
context: {
    factorType: "EMAIL"
}
```
* **MFA_RECOVERY_CODES_GENERATED** - new recovery codes were generated for the user
* **MFA_RECOVERY_CODE_LOGIN_SUCCESS** - user successfully verified a recovery code during login
* **MFA_RECOVERY_CODE_LOGIN_FAILED** - user failed to verify a recovery code during login
* **MFA_RECOVERY_CODE_LOGIN_ATTEMPTS_EXCEEDED** - the maximum number of failed recovery code verification attempts was reached during login
* **MFA_AUTH_APP_CONFIGURATION_SETUP_SUCCESS** - user successfully configured an authenticator app
* **MFA_AUTH_APP_CONFIGURATION_SETUP_FAILED** - user failed to configure an authenticator app
* **MFA_AUTH_APP_CONFIGURATION_REMOVED** - user removed their authenticator app configuration
* **MFA_COMPANY_CONFIGURATION_UPDATED** - company-level MFA configuration was updated
Additional context represents the updated configuration:
```json
context: {
    factorType: "EMAIL",
    mode: "ENABLED"
}
```

## Query parameters

- `eventDateAfter` string, date-time
- `eventDateBefore` string, date-time
- `eventName` string[]
- `authorType` string[]
- `authorId` string
- `entityType` string[]
- `entityId` string
- `nextPageId` string
- `limit` integer

## Response `200`

A single page of audit events

- Events
  - `nextPageId` string: Unique identifier for the next page of events
  - `limit` integer: Number of audit events that were requested
  - `content` Event[]
    - `id` string: Unique identifier of the event
    - `eventName` string: Name of the event
    - `eventDate` string, date-time: Timestamp when _the thing_ represented by the event actually happened
    - `authorType` 'USER' | 'SUPPORT_USER' | 'SYSTEM': Type of the author who generated the event
    - `authorId` string: Unique identifier of the author
    - `entityType` 'USER' | 'CANDIDATE' | 'APPLICATION' | 'OFFER' | 'JOB' | 'COMPANY' | 'JOB_PROPERTY' | 'JOB_AD' | 'CREDENTIAL' | 'REPORT_FILE' | 'ONBOARDING_PROCESS' | 'WEB_SSO_CONFIGURATION': Type of the entity that the event is related to
    - `entityId` string: Unique identifier of the entity that the event is related to
    - `context` EventContext
      - `aggregationId` string: Identifies events that belong to the same logical operation. Used to merge partitioned JOB_PROPERTY_UPDATED_VALUES_PARTITIONED events when multiple are emitted.
      - `authenticationType` 'PASSWORD' | 'API_KEY' | 'WEB_SSO' | 'AUTH_TOKEN' | 'SUPPORT_ACCESS'
      - `currentRole` 'ADMINISTRATOR' | 'EMPLOYEE' | 'EXTENDED' | 'RESTRICTED' | 'STANDARD'
      - `previousRole` 'ADMINISTRATOR' | 'EMPLOYEE' | 'EXTENDED' | 'RESTRICTED' | 'STANDARD'
      - `officeName` string
      - `previousEnableWebSso` boolean
      - `currentEnableWebSso` boolean
      - `currentCertificateFingerprint` string
      - `previousCertificateFingerprint` string
      - `currentIdentityProviderUrl` string
      - `previousIdentityProviderUrl` string
      - `currentNameIDFormat` string
      - `previousNameIDFormat` string
      - `currentEnableStrictReplayAttackProtection` boolean
      - `previousEnableStrictReplayAttackProtection` boolean
      - `factorType` 'EMAIL' | 'AUTH_APP': MFA factor type
      - `mode` 'ENABLED' | 'DISABLED': MFA mode for company configuration

## Other responses

- `403`: Audit events access forbidden. ADMINISTRATOR role is required.

---

[API](https://skmtc.dev/smartrecruiters/apis/audit-api.md) - [All operations](https://skmtc.dev/smartrecruiters/apis/audit-api/llms.txt) - [OpenAPI document](https://skmtc.dev/smartrecruiters/apis/audit-api/revisions/6e7161c1f14c?raw)