List events
The store’s audit log: who changed what, newest first. It is a RECORD OF WRITES for compliance and support, not a delivery mechanism, and reading it is not a substitute for subscribing to webhooks. ITS NAMES ARE NOT WEBHOOK TOPICS. ?action= takes the dotted spelling this log uses (promotion.created, store.reindexed) and those values are REFUSED by POST /api/v1/webhook-endpoints, which takes the slashed WebhookTopic spelling (products/created, orders/paid) and refuses everything else. The two vocabularies are disjoint, they are not translations of each other, and neither route accepts the other’s values. Read the WebhookTopic schema for the subscribable set; there is no route that lists this log’s actions, because it records whatever the writes of the day produced rather than a closed set. resource_type and resource_id are the join back into the resource that changed, and both are null on a row about the store itself.
Authorizations
A secret API key. Publishable keys cannot reach this API. A key may carry an expiry, and an expired key is refused exactly like an unknown one, with a 401 that names no reason; check the key's expires_at in the dashboard rather than inferring it from a response. When a merchant rolls a key's secret they choose a grace window of up to 3 days, and for its duration BOTH the new secret and the one it replaced authenticate, so an integration moves over on its own deploy schedule instead of at the instant the button is pressed. Move before the window closes: after it, the old secret is refused. Nothing else about this contract moves with a roll. The key keeps its id and its scopes, so the only thing an integration updates is the credential itself.
Query Parameters
Narrows the list to rows matching this action. Omit it for every row. This route reads no query parameter beyond the ones listed here: an unrecognised one is a 400 rather than being ignored, and so is the same parameter sent twice.
Narrows the list to rows matching this actor_type. Omit it for every row. This route reads no query parameter beyond the ones listed here: an unrecognised one is a 400 rather than being ignored, and so is the same parameter sent twice.
Narrows the list to rows matching this created_at_max. Omit it for every row. This route reads no query parameter beyond the ones listed here: an unrecognised one is a 400 rather than being ignored, and so is the same parameter sent twice.
Narrows the list to rows matching this created_at_min. Omit it for every row. This route reads no query parameter beyond the ones listed here: an unrecognised one is a 400 rather than being ignored, and so is the same parameter sent twice.
Narrows the list to rows matching this resource_id. Omit it for every row. This route reads no query parameter beyond the ones listed here: an unrecognised one is a 400 rather than being ignored, and so is the same parameter sent twice.
Narrows the list to rows matching this resource_type. Omit it for every row. This route reads no query parameter beyond the ones listed here: an unrecognised one is a 400 rather than being ignored, and so is the same parameter sent twice.
Rows per page. Out of range is a 400 rather than a silent clamp, so a client asking for more than 100 learns it did not get it.
1 <= x <= 100The next_cursor from the previous page. Opaque: decode nothing from it and construct nothing by hand, since its encoding is not part of this contract. Omit it to read the first page.