Audit log

6 endpoints. Each needs an API key or OAuth token with the scope shown; the key already names its store, so paths start at /v1/store. Generated from the live contract; also in openapi.json.

Every change made in the store (dashboard and API keys), newest first (or by who, action or target)

GET/v1/store/audit-log

Or name the store: GET /v1/stores/{storeId}/audit-log

audit:readrole: audit:readlistStoreAudit

Parameters

actorusr_… | ak_… | nullquery
areastring | nullquery
actionstring | nullquery
fromstring | nullquery
tostring | nullquery
qstring | nullquery
targetTypestring | nullquery
targetIdstring | nullquery
sensitiveboolean | "true" | "false" | nullquery
actorKind"user" | "api_key" | nullquery
cursorstring | nullquery
limitinteger | stringquery
sort"time" | "actor" | "action" | "target"query
dir"asc" | "desc"query

Response ListStoreAuditResponse

itemsStoreAuditEntry[]required
nextCursorCursor | nullrequired
facetsStoreAuditFacetsrequired

Example

curl "https://api.shopfa.st/v1/store/audit-log" \
  -H "Authorization: Bearer $SHOPFAST_API_KEY"

const res = await fetch('https://api.shopfa.st/v1/store/audit-log', {
  method: 'GET',
  headers: {
    Authorization: `Bearer ${process.env.SHOPFAST_API_KEY}`,
  },
});
if (!res.ok) throw new Error((await res.json()).detail);
const data = await res.json();

import os, requests

res = requests.request(
    "GET",
    "https://api.shopfa.st/v1/store/audit-log",
    headers={"Authorization": f"Bearer {os.environ['SHOPFAST_API_KEY']}"},
)
res.raise_for_status()
data = res.json()

req, _ := http.NewRequest("GET", "https://api.shopfa.st/v1/store/audit-log", nil)
req.Header.Set("Authorization", "Bearer "+os.Getenv("SHOPFAST_API_KEY"))
res, err := http.DefaultClient.Do(req)

Try it with your key

API base URLAPI key or token

actorareaactionfromtoqtargetTypetargetIdsensitiveactorKindcursorlimitsortdir

Use a test key on a development store. The key stays in this tab (sessionStorage) and is sent only to the base URL above.

The filtered store audit log as CSV (up to 10,000 rows)

GET/v1/store/audit-log/export

Or name the store: GET /v1/stores/{storeId}/audit-log/export

audit:readrole: audit:readexportStoreAudit

Parameters

actorusr_… | ak_… | nullquery
areastring | nullquery
actionstring | nullquery
fromstring | nullquery
tostring | nullquery
qstring | nullquery
targetTypestring | nullquery
targetIdstring | nullquery
sensitiveboolean | "true" | "false" | nullquery
actorKind"user" | "api_key" | nullquery

Response ExportStoreAuditResponse

filenamestringrequired
csvstringrequired
rowsintegerrequired

Example

curl "https://api.shopfa.st/v1/store/audit-log/export" \
  -H "Authorization: Bearer $SHOPFAST_API_KEY"

const res = await fetch('https://api.shopfa.st/v1/store/audit-log/export', {
  method: 'GET',
  headers: {
    Authorization: `Bearer ${process.env.SHOPFAST_API_KEY}`,
  },
});
if (!res.ok) throw new Error((await res.json()).detail);
const data = await res.json();

import os, requests

res = requests.request(
    "GET",
    "https://api.shopfa.st/v1/store/audit-log/export",
    headers={"Authorization": f"Bearer {os.environ['SHOPFAST_API_KEY']}"},
)
res.raise_for_status()
data = res.json()

req, _ := http.NewRequest("GET", "https://api.shopfa.st/v1/store/audit-log/export", nil)
req.Header.Set("Authorization", "Bearer "+os.Getenv("SHOPFAST_API_KEY"))
res, err := http.DefaultClient.Do(req)

Try it with your key

API base URLAPI key or token

actorareaactionfromtoqtargetTypetargetIdsensitiveactorKind

Use a test key on a development store. The key stays in this tab (sessionStorage) and is sent only to the base URL above.

Every change to one product, order, role, member or setting, oldest first, with field-level differences

GET/v1/store/audit-log/timeline

Or name the store: GET /v1/stores/{storeId}/audit-log/timeline

audit:readrole: audit:readgetAuditTimeline

Parameters

targetTypestringqueryrequired
targetIdstringqueryrequired

Response AuditTimeline

targetobjectrequired
- typestringrequired
- idstringrequired
- labelstringrequired
entriesobject[]required
- idStoreAuditEntryIdrequired
- createdAtTimestamprequired
- actorStoreAuditActorrequired
- actionstringrequired
- areastringrequired
- summarystringrequired
- method"POST" | "PUT" | "PATCH" | "DELETE"required
- pathstringrequired
- targetobject | nullrequired
- detailsStoreAuditDetailsrequired
- ipstringrequired
- userAgentstringrequired
- beforeobject | nullrequired
- afterobject | nullrequired
- alertstringrequired
- via"ai" | "mcp" | nullrequired
- changesAuditFieldChange[]required

Example

curl "https://api.shopfa.st/v1/store/audit-log/timeline" \
  -H "Authorization: Bearer $SHOPFAST_API_KEY"

const res = await fetch('https://api.shopfa.st/v1/store/audit-log/timeline', {
  method: 'GET',
  headers: {
    Authorization: `Bearer ${process.env.SHOPFAST_API_KEY}`,
  },
});
if (!res.ok) throw new Error((await res.json()).detail);
const data = await res.json();

import os, requests

res = requests.request(
    "GET",
    "https://api.shopfa.st/v1/store/audit-log/timeline",
    headers={"Authorization": f"Bearer {os.environ['SHOPFAST_API_KEY']}"},
)
res.raise_for_status()
data = res.json()

req, _ := http.NewRequest("GET", "https://api.shopfa.st/v1/store/audit-log/timeline", nil)
req.Header.Set("Authorization", "Bearer "+os.Getenv("SHOPFAST_API_KEY"))
res, err := http.DefaultClient.Do(req)

Try it with your key

API base URLAPI key or token

targetTypetargetId

Use a test key on a development store. The key stays in this tab (sessionStorage) and is sent only to the base URL above.

How long the audit log keeps entries and which sensitive changes raise alerts

GET/v1/store/audit-log/settings

Or name the store: GET /v1/stores/{storeId}/audit-log/settings

audit:readrole: audit:readgetAuditSettings

Response AuditSettingsView

retentionDaysintegerrequired
alertsobject[]required
- kindAuditAlertKindrequired
- enabledbooleanrequired
oldestEntryAtTimestamp | nullrequired
entriesintegerrequired
lastPrunedAtTimestamp | nullrequired
alerts30dintegerrequired

Example

curl "https://api.shopfa.st/v1/store/audit-log/settings" \
  -H "Authorization: Bearer $SHOPFAST_API_KEY"

const res = await fetch('https://api.shopfa.st/v1/store/audit-log/settings', {
  method: 'GET',
  headers: {
    Authorization: `Bearer ${process.env.SHOPFAST_API_KEY}`,
  },
});
if (!res.ok) throw new Error((await res.json()).detail);
const data = await res.json();

import os, requests

res = requests.request(
    "GET",
    "https://api.shopfa.st/v1/store/audit-log/settings",
    headers={"Authorization": f"Bearer {os.environ['SHOPFAST_API_KEY']}"},
)
res.raise_for_status()
data = res.json()

req, _ := http.NewRequest("GET", "https://api.shopfa.st/v1/store/audit-log/settings", nil)
req.Header.Set("Authorization", "Bearer "+os.Getenv("SHOPFAST_API_KEY"))
res, err := http.DefaultClient.Do(req)

Try it with your key

API base URLAPI key or token

Use a test key on a development store. The key stays in this tab (sessionStorage) and is sent only to the base URL above.

Change the audit log retention and alerts (owner only)

PUT/v1/store/audit-log/settings

Or name the store: PUT /v1/stores/{storeId}/audit-log/settings

audit:writerole: audit:writeupdateAuditSettings

Body

retentionDaysintegerrequired
alertsobject[]required
- kind"payout_destination" | "api_key_created" | "role_change" | "member_removed" | "ownership_transfer" | "access_policy" | "fraud_rules" | "webhook_endpoint" | "audit_settings"required
- enabledbooleanrequired

Response AuditSettingsView

retentionDaysintegerrequired
alertsobject[]required
- kindAuditAlertKindrequired
- enabledbooleanrequired
oldestEntryAtTimestamp | nullrequired
entriesintegerrequired
lastPrunedAtTimestamp | nullrequired
alerts30dintegerrequired

Example

curl -X PUT "https://api.shopfa.st/v1/store/audit-log/settings" \
  -H "Authorization: Bearer $SHOPFAST_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "retentionDays": 30,
  "alerts": [
    {
      "kind": "payout_destination",
      "enabled": false
    }
  ]
}'

const res = await fetch('https://api.shopfa.st/v1/store/audit-log/settings', {
  method: 'PUT',
  headers: {
    Authorization: `Bearer ${process.env.SHOPFAST_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "retentionDays": 30,
    "alerts": [
      {
        "kind": "payout_destination",
        "enabled": false
      }
    ]
  }),
});
if (!res.ok) throw new Error((await res.json()).detail);
const data = await res.json();

import os, requests

res = requests.request(
    "PUT",
    "https://api.shopfa.st/v1/store/audit-log/settings",
    headers={"Authorization": f"Bearer {os.environ['SHOPFAST_API_KEY']}"},
    json={
      "retentionDays": 30,
      "alerts": [
        {
          "kind": "payout_destination",
          "enabled": False
        }
      ]
    },
)
res.raise_for_status()
data = res.json()

req, _ := http.NewRequest("PUT", "https://api.shopfa.st/v1/store/audit-log/settings", strings.NewReader(`{
  "retentionDays": 30,
  "alerts": [
    {
      "kind": "payout_destination",
      "enabled": false
    }
  ]
}`))
req.Header.Set("Authorization", "Bearer "+os.Getenv("SHOPFAST_API_KEY"))
req.Header.Set("Content-Type", "application/json")
res, err := http.DefaultClient.Do(req)

Try it with your key

API base URLAPI key or token

Body

Use a test key on a development store. The key stays in this tab (sessionStorage) and is sent only to the base URL above.

The filtered store audit log as JSON lines with snapshots (up to 10,000 rows)

GET/v1/store/audit-log/export.json

Or name the store: GET /v1/stores/{storeId}/audit-log/export.json

audit:readrole: audit:readexportStoreAuditJson

Parameters

actorusr_… | ak_… | nullquery
areastring | nullquery
actionstring | nullquery
fromstring | nullquery
tostring | nullquery
qstring | nullquery
targetTypestring | nullquery
targetIdstring | nullquery
sensitiveboolean | "true" | "false" | nullquery
actorKind"user" | "api_key" | nullquery

Response ExportStoreAuditJsonResponse

filenamestringrequired
jsonstringrequired
rowsintegerrequired

Example

curl "https://api.shopfa.st/v1/store/audit-log/export.json" \
  -H "Authorization: Bearer $SHOPFAST_API_KEY"

const res = await fetch('https://api.shopfa.st/v1/store/audit-log/export.json', {
  method: 'GET',
  headers: {
    Authorization: `Bearer ${process.env.SHOPFAST_API_KEY}`,
  },
});
if (!res.ok) throw new Error((await res.json()).detail);
const data = await res.json();

import os, requests

res = requests.request(
    "GET",
    "https://api.shopfa.st/v1/store/audit-log/export.json",
    headers={"Authorization": f"Bearer {os.environ['SHOPFAST_API_KEY']}"},
)
res.raise_for_status()
data = res.json()

req, _ := http.NewRequest("GET", "https://api.shopfa.st/v1/store/audit-log/export.json", nil)
req.Header.Set("Authorization", "Bearer "+os.Getenv("SHOPFAST_API_KEY"))
res, err := http.DefaultClient.Do(req)

Try it with your key

API base URLAPI key or token

actorareaactionfromtoqtargetTypetargetIdsensitiveactorKind

Use a test key on a development store. The key stays in this tab (sessionStorage) and is sent only to the base URL above.