Ramp: Get audit log events — response body — data item

API reference · Contract 2026-10-27

SDK schema: Get audit log events — response body — data item

Field	Type	Presence	Description and constraints
$	object	Root
actor_details	Model	Required within parent	Expand Get audit log events — response body — data item actor details Additional details of the actor
actor_id	JSON	Required within parent
actor_id (anyOf 1)	string	Alternative	Unique identifier of the actor Format: uuid Read only: true
actor_id (anyOf 2)	null	Alternative
actor_type	string	Required within parent	The type of the actor that the audit log event is attributable to Known values: policy_agent, ramp, spend_request_agent, user
additional_details	JSON	Required within parent
additional_details (anyOf 1)	string	Alternative	Additional details of the audit log event
additional_details (anyOf 2)	null	Alternative
agent_details	JSON	Required within parent
agent_details (anyOf 1)	Model	Alternative	Expand Get audit log events — response body — data item agent details agent name Agent that executed the action for the user
agent_details (anyOf 2)	null	Alternative
event_details	Model	Required within parent	Expand Get audit log events — response body — data item event details Details of the audit log event
event_time	string	Required within parent	Timestamp of the audit log event Format: date-time
event_type	string	Required within parent	Type of the audit log event Known values: ABK agent blocked on user, ABK agent review requested, ABK agent schedule failed, ABK agent started, AI custom field config executed, AI spend anomaly review state changed, AI usage limits updated, Account closed, Account details previewed, Account details viewed, Account document downloaded, Account number deleted, Account number generated, Account number renamed, Account opened, Account renamed, Accounting ai auto mark ready, Accounting coding rules updated, Accounting fields updated, Accounting fixed asset changed, Accounting fixed asset class changed, Accounting lease changed, Accounting provider access changed, Accounting settings updated, Accounting split templates updated, Activated card, Added bill field, Added card acceptance policy, Added procurement field, Added user to funds, Added vendor field, Admin changed email, Admin changed phone, Agent access request resolved, Agent access requested, Agent created, Agent current version changed, Agent permissions updated, Agent version created, Agent version published, Amortization schedule updated, App Store app disconnected, Approval authority changed, Approval chain updated, Approval policy set as default, Approval step added, Approval step approved, Approval step rejected, Approval step skipped, Approval step terminated, Approved by manager, Approved card edit request with modifications, Approved card edit request, Approved funds edit request with modifications, Approved funds edit request, Approved new card request with modifications, Approved new card request, Approved procurement change request, Approved request for new funds with modifications, Approved request for new funds, Ascenda credit redeemed, Attendee split, Authorization letter downloaded, Automatic investment transfer canceled, Automatic rule management actions reviewed, Automation deleted, Bank account ACH details viewed, Bank account entity owner changed, Bank account sensitive details viewed, Bank account updated, Bank letter downloaded, Bill Pay setup progress updated, Bill created by AP coworker, Bill linked to PO, Bill linked to contract, Bill linked, Bill pay AP coworker questions answered, Bill pay accepted PDR bank account ownership match, Bill pay accepted sync for bank account from vendor network, Bill pay accepted sync for vendor card acceptance policy from vendor network, Bill pay accepted sync for vendor check mailing address from vendor network, Bill pay accepted sync for vendor information from vendor network, Bill pay accepted sync for vendor tax info from vendor network, Bill pay accounting manual user action, Bill pay accounting sync triggered, Bill pay accrual synced, Bill pay approval policy updated, Bill pay automatic card payment no longer eligible, Bill pay automatic card payment, Bill pay bank account updated, Bill pay batch payment initiated, Bill pay business vendor unlinked from vendor network, Bill pay card delivery, Bill pay check address update, Bill pay check tracking update, Bill pay deleted bill, Bill pay delivered payment, Bill pay dismissed fraud alert, Bill pay edited payee address, Bill pay edited payment method, Bill pay initiated payment refund, Bill pay mailed check payment, Bill pay marked as paid, Bill pay marked as unpaid, Bill pay matched transaction to bill, Bill pay matched transfer to bill, Bill pay payment failed, Bill pay payment posted, Bill pay payment reversal failed, Bill pay payment reversal posted, Bill pay payment reversal succeeded, Bill pay recurrence info changed for recurring series, Bill pay rejected PDR bank account ownership match, Bill pay rejected sync for bank account from vendor network, Bill pay rejected sync for vendor card acceptance policy from vendor network, Bill pay rejected sync for vendor check mailing address from vendor network, Bill pay rejected sync for vendor information from vendor network, Bill pay rejected sync for vendor tax info from vendor network, Bill pay retried payment, Bill pay returned funds, Bill pay submission policy updated, Bill pay unmatched transfer from bill, Bill unlinked from PO, Bill unlinked from contract, Bill unlinked, Billing bank account updated, Billing config updated, Billing group primary business changed, Blank canvas workflow execution updated, Blank canvas workflow pause status updated, Booking action by travel agency, Booking request approval policy updated, Bookkeeping agent browser control changed, Bookkeeping agent response stopped, Briefing subscription created, Brokerage order updated, Browser login changed, Business bank account added, Business bank account changed, Business bank account removed, Business communication preferences changed, Cancel revision request, Canceled physical card request, Cancelled by customer, Cancelled by ramp, Card delivered, Card offer accepted, Card offer declined, Card payment initiated (audit), Card payment initiated, Cash Manager settings updated, Cash agent recommendation updated, Cash app rerun started, Cash application agent action, Cash manager recommendation reviewed, Cashback redeemed, Cellular ledger balance adjusted, Change order workflow restarted due to change order request modification, Changed bank account on bill, Changed card holder, Changed funds user, Check PDF downloaded, Checking Account terms accepted, Close task restored, Combined contracts with this contract, Communication sent, Complete revision, Compliance flag updated, Contract linked to card transaction, Contract unlinked from card transaction, Counterparty created, Counterparty details changed, Counterparty details configuration changed, Counterparty details configuration created, Counterparty details deleted, Created accounting split line item, Created card, Created fund from purchase order, Created merchant error, Created unrecognized charge, Created, Debit settings updated, Default product access updated, Deleted bill field, Deleted card acceptance policy, Deleted procurement field, Deleted vendor field, Deleted, Demoted co-owner to member, Detached funds from spend program, Developer API client deleted, Developer API client secret rotated, Direct Bank connection added, Direct Bank credentials activated, Direct Bank credentials saved, Document labeled, Document updated, Docusign envelope updated, Dormant funds automation changed, Draft provenance recorded, Draft vendor changed by AP coworker, Draft vendor created, Draft vendor deleted, Draft vendor published, Duplicate payment review confirmed, Earn account opened, Edited bill field, Edited card acceptance policy, Edited contract tracking setting, Edited custom field, Edited procurement field, Edited spend allocation request, Edited spend intent, Edited tin, Edited vendor field, Edited wallet automation, Email updated, Emailed purchase order, Employee policy signed, Entity created, Entity deleted, Exception given from dispute resolution, Exception given from repayment, Exception request approved, Exception request cancelled, Exception request denied, Exception requested, External agent credential rotated, External agent key created, External agent key revoked, External agent key updated, External agent wallet execution changed, External ticket created asana, External ticket created jira, External ticket created linear, External ticket created zendesk, Flex fee redeemed, Flexible limits default changed, Flight change receipt regenerated, Forecast custom input added, Forecast custom input deleted, Forecast custom input updated, Forecast settings updated, Fraud Omni investigation started, Funds activated from reissued virtual card, Funds attached to invite, Generated renewal brief for contract, Governed change applied, Governed change became stale, Governed change rejected, Governed change submitted for review, Governed changes turned off, Governed changes turned on, HRIS integration setting updated, IP allowlist updated, Identity locked, Identity unlocked, Impersonation upgraded to read-write, Incentive offer enrolled, Initiated digital wallet provisioning (audit), Internal bank transfer link changed, Internal impersonation upgraded to read-write, International payment initiated, Investment Account closed, Investment Account opened, Investment Account renamed, Investment Account terms accepted, Investment Account updated, Ironclad workflow updated, Issued funds, Item receipt accounting sync, Journal entry batch retry requested, Large transfer initiated, Left funds, Legal agreement accepted, Legal entity updated, Linked funds to spend program, Locked access to funds, Locked card, Login methods updated, Managed portfolio transfer updated, Manager updated, Manual redemption redeemed, Mark as accidental, Mass payout initiated, Matched purchase order to transaction, Matched transaction to purchase order, Memo updated, Merged vendors, Name updated hris, Name updated, New vendor approval policy updated, New virtual card issued for currency migration, Nightly bank sync setting changed, Notification sent due to change order request modification, Notification sent due to purchase order request modification, Passkey created, Passkey deleted, Passkey removal request denied, Password reset required, Password reset user, Password updated user, Payback cancelled, Payback payment failed, Payback payment manually paid, Payback payment retried, Payback payment succeeded, Payback request approved by user, Payback request cancelled by manager, Payback request rejected by user, Payback requested by manager, Payback triggered by user, Payee linked to accounting, Payment run action, Payment run updated, Payment to new counterparty, Payment updated, Phone change request reviewed, Phone change request superseded, Phone change requested, Phone updated, Points exchange redeemed, Policy agent suggestion feedback submitted, Post spend approval policy updated, Preview mode entered, Procurement unmatched purchase order from transaction, Procurement unmatched transaction from purchase order, Procurement agent run completed, Procurement change request approval policy updated, Procurement send global form, Procurement submit global form response, Procurement vendor onboarding submitted, Procurement vendor onboarding triggered, Product access granted, Product access revoked, Program entity restrictions changed, Promoted member to co-owner, Purchase order accounting sync created vendor, Purchase order accounting sync failed, Purchase order accounting sync success, Purchase order accrual lines updated, Purchase order accrual synced, Purchase order delivery acknowledged, Question created, Question deleted, Question updated, RFX clarification answered, RFX clarification question submitted, RFX close date changed, RFX closed, RFX collaborator added, RFX collaborator removed, RFX created, RFX graded, RFX publish approval rejected, RFX published, RFX response deadline changed, RFX response redacted, RFX response submitted, RFX returned to draft, RFX submitted for publish approval, RFX vendor accepted, RFX vendor added, RFX vendor contact changed, RFX vendor declined, RFX vendor removed, Receipt created, Receipt deleted, Receipt downloaded for transfer, Receipt matched, Refund cleared, Refund paid, Reimbursement bank account updated, Reimbursement field changed, Reimbursement from user, Reimbursement marked as unsynced, Reimbursement policy agent suggestion feedback submitted, Reimbursement submitted, Reimbursement to user, Reimbursements disabled, Reimbursements enabled, Reissued card, Rejected card edit request, Rejected funds edit request, Rejected new card request, Rejected procurement change request, Rejected request for new funds, Reminded to approve items, Reminded to upload missing items, Removed user from funds, Repayment accounting sync success, Request revision, Requested an edit to these funds, Requested new card, Requested new funds, Reset offline card PIN, Resolved by ramp, Review needed, Reviewed by ramp, Role updated, Router API key status changed, Router spend limit changed, SFTP Authentication Failed, SFTP Authentication IP and Username Matched, SFTP Configuration Changed, SSO certificate updated, SSO domain DNS verification challenge created, SSO domain DNS verification changed, SSO domain-sharing request resolved, SSO provider created, SSO provider deleted, SSO provider domains updated, SaaS fee redeemed, Separation of duties disabled, Separation of duties enabled, Set member limit on shared fund, Shortfall coverage updated, Smart OCR provenance recorded, Snowflake connection configuration changed, Snowflake connection created, Snowflake connection removed, Snowflake connection scope changed, Sourcing event created, Sourcing event status changed, Spend allocation change request approval policy updated, Spend approved, Spend outcome recorded, Spend rejected, Spend request approval policy updated, Spend settings updated, Stack connector updated, Status updated by intake agent, Status updated, Strict MFA setting updated, Submission policy updated, Submitted procurement change request, Synced draft policy from workflow, Tango gift card redeemed, Temporarily unlocked access to funds, Terminated card, Terminated funds, Test, Third party risk management vendor review updated, This contract was combined with another contract, Ticket approvers updated, Ticket assignee updated, Ticket status updated, Totp authenticator created, Totp authenticator deleted, Totp authenticator updated, Transaction added to trip, Transaction approval policy updated, Transaction approval regeneration requested, Transaction cleared, Transaction entity changed, Transaction fraud label deleted, Transaction fraud status changed, Transaction linked to contract, Transaction marked as unsynced, Transaction missing item reminder event, Transaction paid, Transaction receipt updated, Transaction removed from trip, Transaction submission policy exemption event, Transaction unlinked from contract, Transfer created, Transfer initiated, Transferred ownership of funds, Travel booking manually matched to transaction, Travel integration settings updated, Travel policy selection updated, Trip changed, Trip question answered, Unarchived funds, Undid marking transaction as accidental, Unlocked access to funds, Unlocked card temporarily, Unlocked card, Unmark as accidental, Updated card program, Updated card, Updated funds, Updated policy to include Guest, Updated spend program, Updated workflow to include Guest, User accepted invite, User assigned by external firm, User assigned through external firm merge, User created, User deactivated, User deleted, User invited, User locked, User logged out of all sessions, User logged out, User login, User merchant allowlist updated, User previewed, User reactivated, User undeleted, User unlocked, Vendor Network connection migrated, Vendor Network updates enabled, Vendor added to group, Vendor awarded, Vendor credit action, Vendor edit approval policy updated, Vendor hold released, Vendor imported from erp, Vendor management vendor added to managed list, Vendor management vendor removed from managed list, Vendor management agreement deleted document, Vendor management agreement deleted, Vendor management agreement linked document, Vendor management agreement linked purchase order, Vendor management agreement notification type switched, Vendor management agreement reminder sent, Vendor management agreement status changed, Vendor management agreement unlinked document, Vendor management agreement unlinked purchase order, Vendor management agreement uploaded document, Vendor management edited agreement field, Vendor management expansion request status changed, Vendor management vendor network invite sent, Vendor memory file setting updated, Vendor parent set, Vendor parent unset, Vendor payment approval policy updated, Vendor placed on hold, Vendor portal merge suggestion declined, Vendor portal merged, Vendor portal purchase order invoice updated, Vendor profile access created, Vendor profile access denied, Vendor profile access edited, Vendor profile access email sent, Vendor profile access requested, Vendor profile access revoked, Vendor profile all documents downloaded, Vendor profile document downloaded, Vendor removed from group, Vendor sync failure, Viewed sensitive card details, Violation from manager, Violation from rule, Violation from user, Virtual card reissued, Voided check downloaded, WBX approval approved, WBX approval attachment added, WBX approval attachment removed, WBX approval fields updated, WBX approval opened, WBX approval rejected, WBX approver approved, WBX approver rejected, WBX policy created, WBX policy deleted, WBX policy draft discarded, WBX policy draft published, WBX policy draft started, WBX policy renamed, WBX policy workflow generated from draft, WBX request admin approved entire workflow, WBX request archived, WBX request attachment added, WBX request attachment removed, WBX request created, WBX request deleted, WBX request fields updated, WBX request submitted, Wallet redeemed, Workflow restarted due to purchase order request modification, Workflow updated Read only: true
id	string	Required within parent	Unique identifier for the audit log event Format: uuid
primary_reference	JSON	Required within parent
primary_reference (anyOf 1)	Model	Alternative	Expand Get audit log events — response body — data item primary reference id, label, resource name, url Metadata of the primary object referenced by the audit log event
primary_reference (anyOf 2)	null	Alternative
user_details	JSON	Required within parent
user_details (anyOf 1)	Model	Alternative	Expand Get audit log events — response body — data item user details actor type user User details of the audit log event. Usually the same as actor details if present unless an agent acts on behalf of a user.
user_details (anyOf 2)	null	Alternative

Referenced models: Get audit log events — response body — data item agent details agent name, Get audit log events — response body — data item user details actor type user, Get audit log events — response body — data item actor details, Get audit log events — response body — data item event details, Get audit log events — response body — data item primary reference id, label, resource name, url