List email delivery audit
Every recorded change to this store’s provider connections, sending domains and suppression list, newest first. APPEND-ONLY: this platform holds no permission to update or delete a row, so a mistake can only be contradicted by a later entry. actor IS THE API KEY ID for a change made through this API and a dashboard user id for one made by a person, which is how you tell an integration’s writes from your merchant’s own. It is opaque: compare it, do not parse it. A WRITE THAT CHANGED NOTHING RECORDS NOTHING. Re-adding an address that is already suppressed leaves the row alone and appends no entry, so a redelivering webhook does not fill the trail with lines about a change it did not make. entity_id names the changed row in its own terms: the provider name, the domain, or the suppressed ADDRESS, which is why this feed sits behind the same grant as the suppression list. This is NOT /api/v1/events, which is the platform-wide audit over a different table. These are the three email-delivery entities and nothing else.
Authorizations
A secret API key. Publishable keys cannot reach this API. A key may carry an expiry, and an expired key is refused exactly like an unknown one, with a 401 that names no reason; check the key's expires_at in the dashboard rather than inferring it from a response. When a merchant rolls a key's secret they choose a grace window of up to 3 days, and for its duration BOTH the new secret and the one it replaced authenticate, so an integration moves over on its own deploy schedule instead of at the instant the button is pressed. Move before the window closes: after it, the old secret is refused. Nothing else about this contract moves with a roll. The key keeps its id and its scopes, so the only thing an integration updates is the credential itself.
Query Parameters
Restrict the page to changes against one kind of thing. A value outside the enum is a 400 rather than an empty page, which would read as "nothing changed".
provider_connection, domain_registration, suppression Exact match on the recorded verb (add, upsert, register, set_status, delete, remove). It is NOT validated against a closed set, because the verbs are written by whichever part of the platform records the change and the list grows; an unknown value returns an empty page rather than a 400. Treat an action you do not recognise as "something changed" rather than failing.
Rows per page. Out of range is a 400 rather than a silent clamp, so a client asking for more than 100 learns it did not get it.
1 <= x <= 100The next_cursor from the previous page. Opaque: decode nothing from it and construct nothing by hand, since its encoding is not part of this contract. Omit it to read the first page.
