Account activity API

Every change to an account is recorded in its history: tokens created and revoked, rules changed, members invited, buckets deleted, support access granted. These operations read that history, the same one the History tab in the app shows, and the catalog of event types it can contain. See Account history for the app, and the event reference for each event’s fields.

Note: Delivery of these events to an endpoint you register is coming soon. Until then, to act on account activity, read it from this API, for example on a schedule, and keep the latest occurredAt you have processed.

Permissions: any member, or a user or administrator API token. Billing events (the billing category, and account.overage_toggled) are returned to the account owner only; everyone else, and every API token, gets the history without them, and a catalogue without them.

List account activity #

GET https://api.apitraffic.io/v1/accounts/{accountSid}/activity

Returns the account’s history, newest first.

Path parameters #

• accountSid (path, string, required): The account identifier.

Query parameters #

• category (query, string): Only one category: account, billing, bucket, data, integration, security, support or team.

• action (query, string): Only one event type, for example security.api_token_created. See Get activity catalog.

• severity (query, string): info, notice or critical.

• actorUserSid (query, string): Only what this user did.

• targetSid (query, string): Only events about this object, for example a bucket or token sid.

• startTime (query, string): Only events at or after this time (ISO 8601).

• endTime (query, string): Only events at or before this time.

• limit (query, integer, default 50): Events to return, 1 to 200.

• offset (query, integer, default 0): Events to skip, for the next page.

Response #

• total (number, required): Events matching the filters.

• limit (number, required): The limit applied, and offset the offset.

• records (object[], required): The events.

event

• sid (string): The event’s identifier (act_…), also given as id.

• type (string): The event type, also given as action, for example security.api_token_created.

• category (string): The category.

• severity (string): info, notice or critical.

• summary (string | null): A readable sentence, for example API token Deploy pipeline was created.

• actor (object): Who did it: type (user, api_token, staff, system or integration), sid, label (the name at the time), currentName and currentEmail (the user as they are now), and impersonatedBy and impersonatedByUserSid for a support session.

• target (object | null): What it was about: type, sid and label.

• data (object): Event-specific detail. See the event reference.

• ipAddress (string | null): Where the request came from, and userAgent what made it. Both are null for ApiTraffic support.

• requestId (string | null): The request that caused it.

• source (string | null): Where it came from.

• visibility (string): Always customer here.

• occurredAt (string): When it happened (ISO 8601), and createdAt when it was recorded.

curl -G https://api.apitraffic.io/v1/accounts/acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa/activity \
  -H "Authorization: Bearer $APITRAFFIC_TOKEN" \
  --data-urlencode 'category=security' \
  --data-urlencode 'startTime=2026-10-01T00:00:00.000Z' \
  --data-urlencode 'limit=100'

const accountSid = 'acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa';
const all = [];
for (let offset = 0; ; offset += 200) {
  const params = new URLSearchParams({ category: 'security', limit: '200', offset: String(offset) });
  const response = await fetch(`https://api.apitraffic.io/v1/accounts/${accountSid}/activity?${params}`, {
    headers: { Authorization: `Bearer ${process.env.APITRAFFIC_TOKEN}` },
  });
  const page = await response.json();
  all.push(...page.records);
  if (offset + page.records.length >= page.total || page.records.length === 0) break;
}

{
  "total": 1,
  "limit": 100,
  "offset": 0,
  "records": [
    {
      "sid": "act_2uW3xY5zA7bC9dE2fG4hJ6kL8mN",
      "id": "act_2uW3xY5zA7bC9dE2fG4hJ6kL8mN",
      "accountSid": "acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa",
      "type": "security.api_token_created",
      "action": "security.api_token_created",
      "category": "security",
      "visibility": "customer",
      "severity": "critical",
      "actor": {
        "type": "user",
        "sid": "usr_2jL4kM6nB8vC1xZ3aS5dF7gH9qW",
        "label": "Jordan Lee",
        "currentEmail": "[email protected]",
        "currentName": "Jordan Lee",
        "impersonatedBy": null,
        "impersonatedByUserSid": null
      },
      "target": { "type": "api_token", "sid": "tkn_2rT5yU7iO9pA1sD3fG6hJ8kL4zX", "label": "Deploy pipeline" },
      "summary": "API token Deploy pipeline was created",
      "data": { "role": "user", "environmentSid": "prd7k2" },
      "requestId": null,
      "ipAddress": "198.51.100.24",
      "userAgent": "Mozilla/5.0",
      "source": null,
      "occurredAt": "2026-10-19T14:10:00.000Z",
      "createdAt": "2026-10-19T14:10:00.000Z"
    }
  ]
}

Get activity catalog #

GET https://api.apitraffic.io/v1/accounts/{accountSid}/activity/catalog

Returns every event type that can appear in an account’s history, and the categories in use. Use it to build filters without hard-coding a list.

Path parameters #

• accountSid (path, string, required): The account identifier.

Response #

• events (object[], required): One entry per event type, sorted by category: action, category, visibility, severity, targetType, label (the summary template), description and payload (the fields in data, each with type, required and description).

• categories (string[], required): The categories.

curl https://api.apitraffic.io/v1/accounts/acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa/activity/catalog \
  -H "Authorization: Bearer $APITRAFFIC_TOKEN"

const accountSid = 'acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa';
const response = await fetch(`https://api.apitraffic.io/v1/accounts/${accountSid}/activity/catalog`, {
  headers: { Authorization: `Bearer ${process.env.APITRAFFIC_TOKEN}` },
});
const { events, categories } = await response.json();

{
  "events": [
    {
      "action": "security.api_token_created",
      "category": "security",
      "visibility": "customer",
      "severity": "critical",
      "targetType": "api_token",
      "label": "API token {target} was created",
      "description": "A new API token was minted.",
      "payload": {
        "role": { "type": "string", "required": true, "description": "The role the token carries." },
        "environmentSid": { "type": "string", "required": false, "description": "The environment the token is scoped to, if any." }
      }
    }
  ],
  "categories": ["account", "billing", "bucket", "data", "integration", "security", "support", "team"]
}

The example shows one of the event types.

Errors #

Related #

• Account history: Read and filter the history in the app.

• Event reference: Every event type and its fields.