Lightspeed Commerce Audit API

openapi: 3.2.0
info:
  contact:
    email: x-series.api@lightspeedhq.com
    name: Lightspeed Developer Relations
    url: https://developers.retail.lightspeed.app
  description: Lightspeed Retail (X-Series) API.
  license:
    name: Apache 2.0
    url: http://www.apache.org/licenses/LICENSE-2.0.html
  termsOfService: https://developers.lightspeedhq.com/terms
  title: 2026-07 Audit API
  version: 2026-07
servers:
- url: https://{domain_prefix}.retail.lightspeed.app/api/2026-07
  variables:
    domain_prefix:
      default: example
      description: Domain prefix of the store to be operated on
security:
- bearerAuth: []
tags:
- description: Audit and security operations
  name: Audit
paths:
  /auditlog_events:
    get:
      description: 'This API returns a list of all the audit log events that match the given filters.


        **Note**: Not every single change in the system is audited. Currently the audited entities include:


        | Object     | Action                    | Notes |

        |------------|---------------------------|-------|

        | customer   | form create/update/delete |       |

        | customer   | api create/update/delete  |       |

        | customer   | csv import                |       |

        | register   | form create/update/delete |       |

        | outlet     | form create/update/delete |       |

        | csv import | init                      | Tracks CSV import requests and includes data about the import type (customer, product) and the CSV file line count. |

        | product*   | create/update/delete      | All actions on products. |

        | security   | terms_accepted, signin, signout, change_email, change_password, reset_password_confirm, user_switching_succes, user_switching_denied, new_personal_token, update_personal_token, delete_personal_tokenss, issue_oauth_token ||

        | vend_consignment | insert/update | Receiving, creating and editing purchase orders as well as inventory counts. |

        | vend_consignment_product | insert/update | Changes to the products in a purchase order. Such as creating purchase orders. |

        | timeclock | clockin/clockout | Clock event where a user either clocked in or clocked out. |


        ### Filters

        - The from and to filters require a full isoformat date, for example `?from=2020-02-03T00:00:00&to=2020-02-05T23:59:59`.


        🔒 Requires: `audit:read` scope'
      operationId: GetAuditLogEvents
      parameters:
      - description: The size for a single page of results. By default 100 events will be returned.
        in: query
        name: page_size
        schema:
          maxLength: 100
          type: string
      - description: The number of objects to skip.
        in: query
        name: offset
        schema:
          maxLength: 0
          type: string
      - description: The lower limit for the `occurred_at` attribute. to be included in the response. The date and time from needs to be in isoformat.
        in: query
        name: from
        schema:
          type: string
      - description: The upper limit for the `occurred_at` attribute. to be included in the response. The date and time from needs to be in isoformat.
        in: query
        name: to
        schema:
          type: string
      - description: The sorting order for the results. Sorting is done by the `occurred_at` parameter. The default order is descending.
        in: query
        name: order
        schema:
          type: string
      - description: The `id` of the user to filter the events by.
        in: query
        name: user_id
        schema:
          type: string
      - description: The `type` of the events to be filtered for the response.
        in: query
        name: type
        schema:
          type: string
      responses:
        '200':
          content:
            Insert of product example:
              example:
                action: insert
                created_at: '2020-01-15T00:18:53Z'
                data:
                  active: 1
                  adjustment: 0.2
                  adjustment_type: MARKUP
                  attributed_cost: 0
                  brand_id: 02dcd191-aeba-11e9-f336-ff6699785796
                  created_at: '2020-01-15 00:18:52'
                  default_display_price: 0
                  description: my product description
                  handle: 02dcd191-aeba-11ea-f336-372c9c03224a
                  has_inventory: 1
                  has_variants: 0
                  id: 02dcd191-aeba-11ea-f336-372c9c078432
                  is_composite: 0
                  name: productaroo-131852
                  product_type_id: 02dcd191-aeba-11ea-f336-372c9c1b0b56
                  retail_price: 0.87
                  retail_tax: 0
                  retailer_id: 02dcd191-ae2b-11e9-f336-cd2e6d82a87b
                  sku: '10032'
                  source: USER
                  supply_price: 0
                  tax_id: 02dcd191-ae2b-11e9-f336-cd2e6d864598
                  updated_at: '2020-01-15 00:18:52'
                  variant_name: productaroo-131852
                entity_id: 02dcd191-aeba-11ea-f336-372c9c078432
                id: '1217239695299842048'
                ip_address: 14.1.34.16
                occurred_at: '2020-01-15T00:18:52Z'
                old_data: {}
                type: vend_product
                user_agent: vend/api-testing/0.0.1
                user_id: 02dcd191-ae2b-11e9-f336-cd2e6d8a5806
            application/json:
              schema:
                properties:
                  data:
                    items:
                      $ref: '#/components/schemas/AuditLogEvent'
                    type: array
                type: object
          description: The response if the API call is successful.
      summary: List audit events
      tags:
      - Audit
  /security_events:
    get:
      description: 'This API returns a list of all the security log events **for the current user**. If you want a list of all the security events for all users please use the auditlog_events with filter type == "security". See the auditlog_events API in the beta documentation for more information.


        🔒 Requires: `audit:read` scope'
      operationId: get-security_events
      responses:
        '200':
          content:
            Security signin example:
              example:
                action: signin
                created_at: '2020-01-29T22:26:18Z'
                id: '1222647183683117056'
                ip_address: 14.1.34.16
                occurred_at: '2020-01-29T22:26:18Z'
                type: security
                user_agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36
                user_id: 02dcd191-ae2b-11e9-f336-cd2e6d8a5806
            application/json:
              schema:
                properties:
                  event:
                    $ref: '#/components/schemas/AuditLogEvent'
                type: object
          description: OK
      summary: List security events for current user
      tags:
      - Audit
components:
  schemas:
    AuditLogEvent:
      description: The structure of the event and security event model
      properties:
        action:
          description: The type of the action performed on the object.
          enum:
          - insert
          - update
          - delete
          type: string
        created_at:
          description: The timestamp indicating when the event was persisted to the audit log.
          format: date-time
          type: string
        data:
          description: An object in JSON format representing the new values of the attributes that were changed by the event.
          oneOf:
          - type: object
          - items:
              type: object
            type: array
        entity_id:
          description: The id of the object involved in the event
          maxLength: 36
          type: string
        id:
          description: Autogenerated object identifier.
          type: string
        ip_address:
          description: The ip address from which the request causing the event originated.
          format: ipv4
          maxLength: 64
          type: string
        occurred_at:
          description: The timestamp indicating when the action causing the event occurred.
          format: date-time
          type: string
        old_data:
          description: An object in JSON format representing the old values of the attributes that were changed by the event.
          type: object
        type:
          description: The type of the object involved in the event. This may be something like "security" for security events or the name of the table the action was performed on, like "vend_customer".
          maxLength: 64
          type: string
        user_agent:
          description: User agent of the http client which submitted the request.
          maxLength: 500
          type: string
        user_id:
          description: The `id` of the user executing the action registered by this event.
          maxLength: 36
          type: string
      title: Audit Log Event
      type: object
      x-examples:
        example-1:
          action: insert
          created_at: '2019-08-24T14:15:22Z'
          data: {}
          entity_id: string
          id: string
          ip_address: 192.168.0.1
          occurred_at: '2019-08-24T14:15:22Z'
          old_data: {}
          type: string
          user_agent: string
          user_id: string
  securitySchemes:
    bearerAuth:
      description: Bearer Token for API authentication.
      scheme: bearer
      type: http
externalDocs:
  description: List of tz database time zones
  url: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones