User Activity Log

This endpoint returns a paginated audit trail of authorization control events associated with a given user. Each record captures the type of action performed, the previous value, the new value, and the actor who made the change. Use this endpoint to monitor changes to spend rules, payment cards, subprofiles, financial accounts, and other controlled resources.

Endpoint

GET /api/authorizationControls/USERID/activity

Authentication

Bearer token required. Obtain via:

POST https://api.banking.netevia.dev/api/auth/v2

Include in header: Authorization: Bearer {token} Token lifetime: 10 minutes. Refresh via POST /api/auth/refresh.

When to use

Use this endpoint when you need to audit changes made to a user's authorization controls — for example, to review who modified spend limits, blocked merchant categories, updated payment card statuses, or changed subprofile access. It is also useful for compliance reporting and detecting unauthorized configuration changes on business accounts.

Path Parameters

Query Parameters

Response

200 OK

Envelope fields:

Record fields (records[]):

activityType enum values:

{
  "totalCount": 3,
  "errorMessage": null,
  "cursor": null,
  "records": [
    {
      "performedBy": "2024-11-15T10:32:00Z",
      "activityType": "SpendRules_AmountLimits",
      "oldValue": "500.00",
      "newValue": "1000.00"
    },
    {
      "performedBy": "2024-11-14T08:15:22Z",
      "activityType": "PaymentCard_Status",
      "oldValue": "SUSPENDED",
      "newValue": "ACTIVE"
    },
    {
      "performedBy": "2024-11-12T14:05:10Z",
      "activityType": "Teams_Subprofile_PaymentCard",
      "oldValue": null,
      "newValue": "XXXX-XXXX-XXXX-7890"
    }
  ]
}

Error Codes

Common Mistakes

• Passing a non-integer value for userId, count, or skip will result in a 400 error — all three must be valid int32 values.
• Omitting pagination parameters is valid (defaults apply), but if totalCount exceeds 50 you must increment skip by count on each subsequent request to page through all records.
• The performedBy field is typed as date-time in the schema and represents a timestamp, not a user identifier — do not treat it as a user name or ID.
• This endpoint is scoped to authorization control events only; it does not return a general transaction history or login activity log.

Related Endpoints

• GET /api/authorizationControls/USERID — Retrieve the current authorization controls configuration for a user.
• POST /api/authorizationControls/USERID — Create or update authorization controls for a user.
• GET /api/authorizationControls/USERID/spendRules — Retrieve active spend rules attached to a user.

Example

curl -X GET "https://api.banking.netevia.dev/api/authorizationControls/98765/activity?count=25&skip=0" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json"