Audit events

The log files returned by the Audit Logs API contain audit events. Each event records who (the actor) did what (the action) to what (the target), together with the outcome of the action and some request context.

This page describes the event structure and lists the event types. The authoritative, machine-readable reference is the schema endpoint below — it always matches the events your log files actually contain. New event types, fields and values may be added over time, so parsers should ignore any they don't recognize.

Machine-readable schema

GET https://app.flourish.studio/api/audit-logs/schema

Returns an OpenAPI document describing the full event structure: every event type, its fields, and their allowed values. It uses the same audit_log:read bearer authentication as the rest of the API, and is useful for building or validating a log parser.

Event structure

Every audit event has the following top-level fields:

Field	Type	Description
id	string	Unique ID of the audit event.
timestamp	integer	When the event occurred, as a Unix timestamp in milliseconds.
actor	object	Who performed the action. actor.type is USER, ANONYMOUS, SYSTEM or FLOURISH_CUSTOMER_SUPPORT.
target	object	What the action was performed on. target.target_type is USER, COMPANY or RESOURCE.
action	object	What was done, including a type field (see Event types) and per-type detail fields.
outcome	object	Whether the action succeeded. outcome.result is PERMITTED, DENIED, RESOURCE_NOT_FOUND, FAILED or UNKNOWN.
context	object	Request context, such as the actor's IP address.

All IDs are strings. Events recorded before November 2026 may contain company_id and key_id (in a COMPANY_API_KEY actor), resource_id (AUTHORIZATION_CHECKED) and api_key_id (API_ACCESSED) as JSON numbers, so read IDs as strings.

Event types

The action.type field identifies the event type:

Event type	Triggered when
ADMINISTRATION	A company admin changes company settings, manages users, or creates or deletes API tokens.
AI_REQUEST_MADE	A user submits resource data to an external AI model. No content from the request is captured.
API_ACCESSED	A user manages API keys or SDK tokens.
AUTHENTICATION_ATTEMPTED	A user logs in or out, or an unauthenticated request tries to access a protected resource.
AUTHORIZATION_CHECKED	A permission check is made.
DATA_DOWNLOADED	Visualization data is read over HTTP (CSV, JSON or the Live API), or the Audit Logs API is called.
DATA_UPLOADED	A user uploads data to a visualization.
FILE_UPLOADED	An upload URL is created for a file asset (images, videos, audio, JSON, 3D models).
LIVE_DATA_UPDATED	Live or external data is updated for a visualization.
NETWORK_PORT_BOUND	The Flourish server process binds its internal HTTP port at startup (recorded once per audit-enabled company).
PAGE_LOADED	A user loads a page in Flourish.
PREVIEW_URL_LOADED	A preview or embed URL is accessed.
RESOURCE_CHANGED	A user modifies a visualization or story.
RESOURCE_CREATED	A user creates a new resource.
RESOURCE_DELETED	A user deletes a visualization or story.
RESOURCE_DOWNLOADED	A user exports a visualization or story as offline HTML, or a story as video.
RESOURCE_DUPLICATED	A user duplicates a resource.
RESOURCE_PUBLISHED	A user publishes or unpublishes a visualization or story.
RESOURCE_RESTORED	A previously soft-deleted resource is restored — typically after a user's account deletion is reversed.
RESOURCE_REVIEWED	A user performs approval workflow actions.
RESOURCE_SHARED	A user changes the company access level for a visualization or story.
TEMPLATE_CHANGED	A user performs company template management actions.
USER_CHANGED	A user modifies their own profile or settings.

Most event types carry extra detail fields beyond type — for example, ADMINISTRATION events include the setting that changed plus its old and new values. The schema endpoint documents every field of every event type.

Example event

A company admin creating an audit log API token produces an event like this:

{
  "id": "3849ef51-ca85-4028-bae3-1b8de3ee5738",
  "timestamp": 1704070800123,
  "actor": {
    "type": "USER",
    "id": "1234",
    "display_name": "Jane Doe",
    "email": "jane.doe@example.com",
    "company": { "id": "5678", "display_name": "Acme Team" },
    "company_role": "ADMIN"
  },
  "target": {
    "target_type": "COMPANY",
    "company": { "id": "5678", "display_name": "Acme Team" }
  },
  "action": {
    "type": "ADMINISTRATION",
    "setting_type": "API_TOKEN_CREATED",
    "new_value": "{\"id\":42,\"name\":\"SIEM export\",\"scopes\":[\"audit_log:read\"]}"
  },
  "outcome": { "result": "PERMITTED" },
  "context": {
    "ip_address": "192.0.2.123"
  }
}

If you'd rather not work with the raw logs or the API, your Flourish support contact can provide your logs instead.