openapi: 3.0.3
info:
  title: Everflow Network API - Audit Log
  description: >
    Endpoint for searching audit operations in the Everflow network.
    For security and audit details, see the [Security Settings guide](https://helpdesk.everflow.io/customer/how-to-best-utilize-security-settings).
  version: 1.0.0
servers:
  - url: https://api.eflow.team/v1
tags:
  - name: Audit Log
paths:
  /networks/auditoperations:
    post:
      summary: Search Audit Operations
      tags:
        - Audit Log
      parameters:
        - name: page
          in: query
          required: false
          schema:
            type: integer
            default: 1
          description: The page number of results to return. Defaults to 1.
        - name: page_size
          in: query
          required: false
          schema:
            type: integer
            default: 50
          description: The number of operations per page. Defaults to 50.
        - name: order_field
          in: query
          required: false
          schema:
            type: string
          description: Field to order results by (e.g. `time_operation`).
        - name: order_direction
          in: query
          required: false
          schema:
            type: string
            enum:
              - asc
              - desc
          description: Direction to order results in. Used with `order_field`.
        - name: relationship
          in: query
          required: false
          schema:
            type: string
            enum:
              - service
          description: >
            Pass `service` to populate `relationship.service` on each operation
            with the name of the platform service that performed the change
            (e.g. "Update Offer").
      requestBody:
        required: true
        content:
          application/json:
            example:
              filters:
                object_type: "NetworkEmployeeEntity"
                object_ids: []
                from: "2026-05-28"
                to: "2026-07-23"
                include_related_objects: true
                timezone_id: 80
                employee_ids:
                  - 249
                auth_types:
                  - "jwt"
              search_terms: []
            schema:
              type: object
              required:
                - filters
              properties:
                filters:
                  type: object
                  required:
                    - from
                    - to
                    - timezone_id
                  description: Filters for narrowing the audit results.
                  properties:
                    from:
                      type: string
                      description: Start date for the audit search (YYYY-MM-DD).
                    to:
                      type: string
                      description: End date for the audit search (YYYY-MM-DD).
                    timezone_id:
                      type: integer
                      description: >
                        Timezone ID for interpreting the date range. See the
                        [timezones metadata endpoint](/api-reference/get-metatimezones)
                        for the list of timezone IDs.
                    object_type:
                      type: string
                      description: >
                        Filter by the entity type that was modified, using the
                        platform entity class name (e.g. `NetworkEmployeeEntity`
                        for employees, `NetworkOfferEntity` for offers).
                        Unrecognized values are ignored.
                    object_ids:
                      type: array
                      items:
                        type: integer
                      description: >
                        Filter by the IDs of the modified objects. Used together
                        with `object_type`.
                    employee_ids:
                      type: array
                      items:
                        type: integer
                      description: Filter to operations performed by these employee IDs.
                    auth_types:
                      type: array
                      items:
                        type: string
                      description: >
                        Filter by the authentication method used when the change
                        was made. Values include `jwt` (platform UI session) and
                        `everxchange`.
                    include_related_objects:
                      type: boolean
                      description: Whether to include operations on objects related to the filtered objects.
                search_terms:
                  type: array
                  items:
                    type: object
                  description: Reserved. The platform UI always sends an empty array.
      responses:
        "200":
          description: ""
          content:
            application/json:
              schema:
                type: object
                properties:
                  operations:
                    type: array
                    items:
                      type: object
                      properties:
                        network_audit_id:
                          type: integer
                          description: Unique audit operation ID.
                        change_id:
                          type: integer
                          description: ID of the associated change record, or 0 if none.
                        employee_name:
                          type: string
                          description: Name of the employee who performed the operation ("Last, First").
                        time_operation:
                          type: integer
                          description: Unix timestamp of when the operation occurred.
                        operation_type:
                          type: string
                          description: The type of operation performed (e.g. `insert`, `update`, `patch`).
                        user_ip:
                          type: string
                          description: IP address the operation was performed from.
                        user_agent:
                          type: string
                          description: User agent of the client that performed the operation.
                        auth_type:
                          type: string
                          description: Authentication method used (e.g. `jwt`, `everxchange`).
                        portal:
                          type: string
                          description: The portal the operation was performed from (e.g. `network`, `affiliate`).
                        relationship:
                          type: object
                          description: >
                            Related data requested via the `relationship` query
                            parameter. Empty when no relationships are requested.
                          properties:
                            service:
                              type: string
                              description: >
                                Name of the platform service that performed the
                                change (e.g. "Update Offer"). Present when
                                `relationship=service` is passed.
                  paging:
                    type: object
                    properties:
                      page:
                        type: integer
                        description: Current page number.
                      page_size:
                        type: integer
                        description: Number of operations per page.
                      total_count:
                        type: integer
                        description: Total number of operations matching the filters.
      security:
        - API Key: []
components:
  securitySchemes:
    API Key:
      description: The Everflow API key generated from the Control Center > Security.
      in: header
      name: X-Eflow-Api-Key
      type: apiKey