User Activity Log

This endpoint returns a paginated audit trail of authorization control events associated with a given user. Each record captures the type of action performed, the previous value, the new value, and the actor who made the change. Use this endpoint to monitor changes to spend rules, payment cards, subprofiles, financial accounts, and other controlled resources.

Endpoint

GET /api/authorizationControls/{userId}/activity

Authentication

Bearer token required. Obtain via:

POST https://api.banking.netevia.dev/api/auth/v2

Include in header: Authorization: Bearer {token} Token lifetime: 10 minutes. Refresh via POST /api/auth/refresh.

When to use

Use this endpoint when you need to audit changes made to a user's authorization controls — for example, to review who modified spend limits, blocked merchant categories, updated payment card statuses, or changed subprofile access. It is also useful for compliance reporting and detecting unauthorized configuration changes on business accounts.

Path Parameters

Parameter	Type	Required	Description
userId	integer (int32)	Yes	The unique identifier of the user whose activity log is being retrieved.

Query Parameters

Parameter	Type	Required	Description
count	integer (int32)	No	Number of records to return per page. Defaults to `50`.
skip	integer (int32)	No	Number of records to skip for pagination. Defaults to `0`.

Response

200 OK

Envelope fields:

Field	Type	Description
totalCount	integer	Total number of activity records available for this user.
errorMessage	string \| null	Error message if the request partially failed; otherwise `null`.
cursor	string \| null	Pagination cursor for fetching the next page of results; may be `null`.
records	array \| null	List of audit activity records. See record fields below.

Record fields (records[]):

Field	Type	Description
performedBy	string (date-time)	Timestamp of when the action was performed.
activityType	string (enum)	The type of authorization control action. See activity type values below.
oldValue	string \| null	The previous value before the change was applied; `null` if not applicable.
newValue	string \| null	The new value set by the action; `null` if not applicable.

activityType enum values:

Value	Description
`AdminPanel_ModuleAccess`	Module access configuration changed via admin panel.
`AdminPanel_Localization`	Localization settings changed via admin panel.
`AdminPanel_UserAccess`	User access permissions changed via admin panel.
`AdminPanel_FAQ`	FAQ content updated via admin panel.
`AdminPanel_TicketTopic`	Support ticket topic changed via admin panel.
`AdminPanel_MCC`	Merchant Category Code settings changed via admin panel.
`Teams_Department`	Department record created or updated.
`Teams_Subprofile`	Subprofile (authorized user) created or updated.
`Teams_Subprofile_Restore`	Subprofile restored after removal.
`Teams_Subprofile_Department`	Subprofile department association changed.
`Teams_Subprofile_Address`	Subprofile address updated.
`Teams_Subprofile_Phone`	Subprofile phone number updated.
`Teams_Subprofile_FinancialAccount`	Subprofile linked to or unlinked from a financial account.
`Teams_Subprofile_PaymentCard`	Subprofile linked to or unlinked from a payment card.
`PaymentCard`	Payment card created or updated.
`PaymentCard_Name`	Payment card name changed.
`PaymentCard_Pin`	Payment card PIN changed.
`PaymentCard_Status`	Payment card status changed (e.g., activated, suspended, closed).
`PaymentCard_Order`	Payment card order placed.
`FinancialAccount`	Financial account created or updated.
`SpendRules_AmountLimits`	Per-transaction spend limit updated.
`SpendRules_AmountLimitMonthly`	Monthly spend limit updated.
`SpendRules_AtmDailyLimit`	ATM daily withdrawal limit updated.
`SpendRules_MerchantCategory`	Allowed merchant category list updated.
`SpendRules_MerchantCategory_Blocked`	Blocked merchant category list updated.
`SpendRules_MerchantCountry`	Allowed merchant country list updated.
`SpendRules_MerchantCountry_Blocked`	Blocked merchant country list updated.
`SpendRules_Detach`	A specific spend rule detached from a card or account.
`SpendRules_Detach_All`	All spend rules detached from a card or account.

{
  "totalCount": 3,
  "errorMessage": null,
  "cursor": null,
  "records": [
    {
      "performedBy": "2024-11-15T10:32:00Z",
      "activityType": "SpendRules_AmountLimits",
      "oldValue": "500.00",
      "newValue": "1000.00"
    },
    {
      "performedBy": "2024-11-14T08:15:22Z",
      "activityType": "PaymentCard_Status",
      "oldValue": "SUSPENDED",
      "newValue": "ACTIVE"
    },
    {
      "performedBy": "2024-11-12T14:05:10Z",
      "activityType": "Teams_Subprofile_PaymentCard",
      "oldValue": null,
      "newValue": "XXXX-XXXX-XXXX-7890"
    }
  ]
}

Error Codes

Code	When it happens
400	`userId` is missing, not a valid integer, or `count`/`skip` values are negative.
401	Token missing, expired, or invalid.
403	Insufficient permissions to view this user's activity log.
404	No user found with the specified `userId`.
500	Internal server error.

Common Mistakes

Passing a non-integer value for userId, count, or skip will result in a 400 error — all three must be valid int32 values.
Omitting pagination parameters is valid (defaults apply), but if totalCount exceeds 50 you must increment skip by count on each subsequent request to page through all records.
The performedBy field is typed as date-time in the schema and represents a timestamp, not a user identifier — do not treat it as a user name or ID.
This endpoint is scoped to authorization control events only; it does not return a general transaction history or login activity log.

Related Endpoints

GET /api/authorizationControls/{userId} — Retrieve the current authorization controls configuration for a user.
POST /api/authorizationControls/{userId} — Create or update authorization controls for a user.
GET /api/authorizationControls/{userId}/spendRules — Retrieve active spend rules attached to a user.

Example

curl -X GET "https://api.banking.netevia.dev/api/authorizationControls/98765/activity?count=25&skip=0" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json"

200Success