Team and Security
Audit log
A permanent record of who did what in your account, from people, API keys, AI assistants, the agent, connectors and scheduled jobs. Viewable on Team.
The audit log answers "who changed this, and when?". Every action that changes something in your account writes an entry: a person voiding an invoice, an API key creating a client, an AI assistant drafting an estimate, a store connector mirroring a refund, a scheduled job applying a late fee. Entries are written on every plan, from day one. Viewing them in the app and through the API is a Team feature.
How it works
- Every change is recorded. Every capability that changes data, every MCP tool that writes, and every background job that acts on your account writes an entry. There is no way to make a change without one.
- Append-only. Entries are never edited or deleted by anyone in your account. They are kept for the retention period published in our privacy policy.
- Written on every plan. On Free the entries are recorded but the screen is locked. If you upgrade to Team, you see your history from the start, not just from the day you upgraded.
- Secrets never appear. If an action changes a secret, such as an SMTP password or a connection key, the entry only says it was changed. The value itself is never stored in the log.
What an entry contains
| Field | What it tells you |
|---|---|
| Time | When the action happened (created_at). |
| Actor | Who or what acted (actor_type and actor_id), see the table below. |
| Action | The capability or job that ran, for example void_document, update_role or deactivate_member. |
| Target | What was acted on (target_type, target_id), for example a document or a role. |
| Business | The business the change belongs to, when there is one (business_id). |
| Changes | A before and after summary of the fields that changed (changes). For a role change this is the old and new list of permission keys. |
| Reason | The reason given, when the action asks for one, such as a void reason or a late-fee waiver reason. |
| Request | The request_id, IP address and user agent, so support can trace a single request. |
Actor types
actor_type | Meaning |
|---|---|
user | A person signed in to the web app. |
api_key | A call made with an API key, including the CLI. |
mcp_token | An AI assistant connected through the MCP server. |
agent | The built-in AI invoice agent. |
connector | A store connection, such as Shopify or WooCommerce, mirroring an order event. |
client | Your client, acting through a pay page, estimate page or the portal. |
system | A scheduled job, such as marking invoices overdue or running a recurring invoice. |
platform_support | Our support team, during a support session you granted. |
What gets logged
Some examples of entries you will see:
- Documents: create, edit, send, revise, void, credit note, delete a draft.
- Payments: record a payment, refund.
- Team: invitation sent or revoked, role or business scope changed, member deactivated, reactivated or removed.
- Roles: role created, edited, duplicated, reset to default or deleted, with old and new keys.
- Security: sign-in, sign-out, password change, two-factor turned on or off, new device, with time and IP.
- Settings, branding, connections, API keys, webhooks, billing and plan changes.
Support sessions
Our support team can only enter your account when you grant access for a set time. A banner shows while the session is active, it ends by itself when the time is over, and every action in it is written to the audit log with the actor type platform_support.
View the audit log
Open the audit log
You need a Team plan and a role that holds audit.view. The Owner and Admin have it by default, and you can add it to any custom role on Team.
Browse the newest entries first
Each row shows the actor, action, object and time.
Open an entry for the details
See the before and after summary, the reason, and the request id. Quote the request id when you contact support.
Through the API
GET /v1/audit-log returns entries newest first, with the standard cursor pagination. See Pagination and filters.
curl "https://api.freeinvoiceautomation.com/v1/audit-log?limit=50" \
-H "Authorization: Bearer $FIA_API_KEY"{
"data": [
{
"id": "0193f2c4-8e9f-7a0b-9c1d-2e3f4a5b6c7d",
"business_id": null,
"actor_type": "user",
"actor_id": "0193f2a1-1111-7a2b-8c3d-4e5f6a7b8c90",
"action": "update_role",
"target_type": "role",
"target_id": "0193f2a1-4d2e-7a10-8b3c-5e6f7a8b9c02",
"request_id": "req_0193f2c4-8e9f-7a0b",
"changes": {
"permissions": {
"before": ["documents.view", "documents.create", "documents.send"],
"after": ["documents.view", "documents.create"]
}
},
"reason": null,
"created_at": "2027-01-18T09:42:11Z"
}
],
"next_cursor": "eyJ0IjoiMjAyNy0wMS0xOFQwOTo0MjoxMVoifQ",
"has_more": true
}| Capability | Route | Permission | Plan |
|---|---|---|---|
| List the audit log | GET /v1/audit-log | audit.view | Team |
The audit log is read-only. There is no endpoint to change or remove an entry.
Plan differences
| Free | Team | |
|---|---|---|
| Entries written | Yes, for every change | Yes, for every change |
| Audit log screen | Locked, shown as a Team feature | Yes |
list_audit_log | feature_locked | Yes |
If a Team account moves back to Free, the audit log screen is hidden again, but entries keep being recorded. See Failed renewal and downgrade.
Why it matters
- Trust your team. See who sent, voided or refunded what, without asking around.
- Fix mistakes. The before and after summary shows exactly what changed.
- Answer disputes. When a client says they never received an invoice or a payment was never recorded, the log has the record.
- Check automations. Entries from API keys, MCP tokens, the agent and connectors are clearly marked, so you can tell people and software apart.
Errors
| Code | HTTP | When |
|---|---|---|
feature_locked | 403 | The account is on Free. |
permission_denied | 403 | Your role does not hold audit.view. |
scope_missing | 403 | The API key or MCP token lacks the audit.view scope. |