Audit

The immutable event log. Every create / update / delete in ContactFollowUp writes an audit row.

Audit rows are write-once and survive soft-delete of the source record. Use the audit log for compliance evidence, after-action debugging, and incident investigations. The full schema includes additional fields not surfaced here yet — they'll appear as the audit service exposes them.

GET/api/auditBearer token (ADMIN/MANAGER)

Query the audit log

Filter audit rows by user, action, and time window. ADMIN/MANAGER only.

Required scopes:audit.read

Query parameters

Name	Type	Description
`from`	`string`	ISO 8601 datetime — earliest, inclusive.
`to`	`string`	ISO 8601 datetime — latest, exclusive.
`userId`	`string`	Only rows for one actor user.
`action`	`string`	Exact action key — e.g. `contact.update`.
`limit`	`integer`	Default 200.

Responses

200 OKEntries.

example

{ "entries": [{
  "id": "au_8w4k2x…",
  "userId": "usr_8h2c3p…",
  "actorKind": "user",
  "action": "contact.create",
  "entityType": "Contact",
  "entityId": "cln1f8s7p…",
  "metadata": { "source": "api" },
  "createdAt": "2026-05-18T14:00:00Z"
}] }

Code samples

Shell

curl -X GET https://app.contactfollowup.com/api/audit \
  -H "Authorization: Bearer $HEARTHNOTE_TOKEN" \
  -H "Content-Type: application/json"