# Account activity API

> Read the account's history (who created a token, changed a rule, signed in or deleted a bucket, and when) and the catalog of event types that can appear in it.

Source: https://www.apitraffic.io/docs/api-reference/activity

Every change to an account is recorded in its history: tokens created and revoked, rules changed, members invited, buckets deleted, support access granted. These operations read that history, the same one the **History** tab in the app shows, and the catalog of event types it can contain. See [Account history](https://www.apitraffic.io/docs/account/activity-log) for the app, and the [event reference](https://www.apitraffic.io/docs/webhooks/reference) for each event's fields.

> **Note:** Delivery of these events to an endpoint you register is coming soon. Until then, to act on account activity, read it from this API, for example on a schedule, and keep the latest `occurredAt` you have processed.

**Permissions:** any member, or a `user` or `administrator` API token. Billing events (the `billing` category, and `account.overage_toggled`) are returned to the account owner only; everyone else, and every API token, gets the history without them, and a catalogue without them.

## List account activity

`GET https://api.apitraffic.io/v1/accounts/{accountSid}/activity`

Returns the account's history, newest first.

### Path parameters

- **accountSid (path, string, required)**:
  The account identifier.

### Query parameters

- **category (query, string)**:
  Only one category: `account`, `billing`, `bucket`, `data`, `integration`, `security`, `support` or `team`.

- **action (query, string)**:
  Only one event type, for example `security.api_token_created`. See [Get activity catalog](#get-activity-catalog).

- **severity (query, string)**:
  `info`, `notice` or `critical`.

- **actorUserSid (query, string)**:
  Only what this user did.

- **targetSid (query, string)**:
  Only events about this object, for example a bucket or token sid.

- **startTime (query, string)**:
  Only events at or after this time (ISO 8601).

- **endTime (query, string)**:
  Only events at or before this time.

- **limit (query, integer, default 50)**:
  Events to return, 1 to 200.

- **offset (query, integer, default 0)**:
  Events to skip, for the next page.

### Response

- **total (number, required)**:
  Events matching the filters.

- **limit (number, required)**:
  The limit applied, and `offset` the offset.

- **records (object[], required)**:
  The events.

**event**

- **sid (string)**: The event's identifier (`act_…`), also given as `id`.

- **type (string)**: The event type, also given as `action`, for example `security.api_token_created`.

- **category (string)**: The category.

- **severity (string)**: `info`, `notice` or `critical`.

- **summary (string | null)**: A readable sentence, for example `API token Deploy pipeline was created`.

- **actor (object)**: Who did it: `type` (`user`, `api_token`, `staff`, `system` or `integration`), `sid`, `label` (the name at the time), `currentName` and `currentEmail` (the user as they are now), and `impersonatedBy` and `impersonatedByUserSid` for a support session.

- **target (object | null)**: What it was about: `type`, `sid` and `label`.

- **data (object)**: Event-specific detail. See the [event reference](https://www.apitraffic.io/docs/webhooks/reference).

- **ipAddress (string | null)**: Where the request came from, and `userAgent` what made it. Both are `null` for ApiTraffic support.

- **requestId (string | null)**: The request that caused it.

- **source (string | null)**: Where it came from.

- **visibility (string)**: Always `customer` here.

- **occurredAt (string)**: When it happened (ISO 8601), and `createdAt` when it was recorded.

```bash cURL
curl -G https://api.apitraffic.io/v1/accounts/acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa/activity \
  -H "Authorization: Bearer $APITRAFFIC_TOKEN" \
  --data-urlencode 'category=security' \
  --data-urlencode 'startTime=2026-10-01T00:00:00.000Z' \
  --data-urlencode 'limit=100'
```

```js Node.js
const accountSid = 'acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa';
const all = [];
for (let offset = 0; ; offset += 200) {
  const params = new URLSearchParams({ category: 'security', limit: '200', offset: String(offset) });
  const response = await fetch(`https://api.apitraffic.io/v1/accounts/${accountSid}/activity?${params}`, {
    headers: { Authorization: `Bearer ${process.env.APITRAFFIC_TOKEN}` },
  });
  const page = await response.json();
  all.push(...page.records);
  if (offset + page.records.length >= page.total || page.records.length === 0) break;
}
```

```json 200
{
  "total": 1,
  "limit": 100,
  "offset": 0,
  "records": [
    {
      "sid": "act_2uW3xY5zA7bC9dE2fG4hJ6kL8mN",
      "id": "act_2uW3xY5zA7bC9dE2fG4hJ6kL8mN",
      "accountSid": "acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa",
      "type": "security.api_token_created",
      "action": "security.api_token_created",
      "category": "security",
      "visibility": "customer",
      "severity": "critical",
      "actor": {
        "type": "user",
        "sid": "usr_2jL4kM6nB8vC1xZ3aS5dF7gH9qW",
        "label": "Jordan Lee",
        "currentEmail": "jordan@example.com",
        "currentName": "Jordan Lee",
        "impersonatedBy": null,
        "impersonatedByUserSid": null
      },
      "target": { "type": "api_token", "sid": "tkn_2rT5yU7iO9pA1sD3fG6hJ8kL4zX", "label": "Deploy pipeline" },
      "summary": "API token Deploy pipeline was created",
      "data": { "role": "user", "environmentSid": "prd7k2" },
      "requestId": null,
      "ipAddress": "198.51.100.24",
      "userAgent": "Mozilla/5.0",
      "source": null,
      "occurredAt": "2026-10-19T14:10:00.000Z",
      "createdAt": "2026-10-19T14:10:00.000Z"
    }
  ]
}
```

## Get activity catalog

`GET https://api.apitraffic.io/v1/accounts/{accountSid}/activity/catalog`

Returns every event type that can appear in an account's history, and the categories in use. Use it to build filters without hard-coding a list.

### Path parameters

- **accountSid (path, string, required)**:
  The account identifier.

### Response

- **events (object[], required)**:
  One entry per event type, sorted by category: `action`, `category`, `visibility`, `severity`, `targetType`, `label` (the summary template), `description` and `payload` (the fields in `data`, each with `type`, `required` and `description`).

- **categories (string[], required)**:
  The categories.

```bash cURL
curl https://api.apitraffic.io/v1/accounts/acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa/activity/catalog \
  -H "Authorization: Bearer $APITRAFFIC_TOKEN"
```

```js Node.js
const accountSid = 'acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa';
const response = await fetch(`https://api.apitraffic.io/v1/accounts/${accountSid}/activity/catalog`, {
  headers: { Authorization: `Bearer ${process.env.APITRAFFIC_TOKEN}` },
});
const { events, categories } = await response.json();
```

```json 200
{
  "events": [
    {
      "action": "security.api_token_created",
      "category": "security",
      "visibility": "customer",
      "severity": "critical",
      "targetType": "api_token",
      "label": "API token {target} was created",
      "description": "A new API token was minted.",
      "payload": {
        "role": { "type": "string", "required": true, "description": "The role the token carries." },
        "environmentSid": { "type": "string", "required": false, "description": "The environment the token is scoped to, if any." }
      }
    }
  ],
  "categories": ["account", "billing", "bucket", "data", "integration", "security", "support", "team"]
}
```

The example shows one of the event types.

## Errors

| Status | Code | Meaning |
| --- | --- | --- |
| `400` | `1000` | A parameter is invalid, for example `limit` above 200 or an unknown `severity`. |
| `403` | `2010` | The token belongs to another account, or is an `ingest` token. |

## Related

- [Account history](https://www.apitraffic.io/docs/account/activity-log):
    Read and filter the history in the app.

- [Event reference](https://www.apitraffic.io/docs/webhooks/reference):
    Every event type and its fields.