Enter at least two characters to search. Searching documentation… No matching sections. Try an endpoint, field or event name.
Activity log
View as MarkdownEverything done in the account, by people and by API keys, with the address it came from: the same log the dashboard shows owners and admins. It holds sign-ins and members' IP addresses, so reading it takes activity:read, a sensitive permission that full access never includes.
On this page
The activity object
| Field | Type | Description |
|---|---|---|
id
string
|
string | The id of the entry. |
object
"activity"
|
"activity" | The kind of object. |
action
string
|
string | What happened, one of the actions below. |
description
string
|
string | The action in words, such as "Created a coupon". |
actor
string|null
|
string|null | Who did it: a person's name, or "API key" and the key's name for something done through the API or the MCP server. Null when the platform did it. |
subject
string|null
|
string|null | What it was about, in words a person recognises: a key's name, an invoice number, a coupon code. |
properties
object
|
object | Details worth keeping, such as what an address or a key's permissions were before a change. Never a secret. |
ip_address
string|null
|
string|null | The address the request came from. |
mode
"live" | "test" | null
|
"live" | "test" | null | The mode it happened in. Null for what belongs to no mode, such as a sign-in or a new member. |
created_at
string
|
string | When it happened, as an ISO 8601 timestamp in UTC. |
Endpoints
-
GET
/v1/activityThe log, newest first: the key's mode and what belongs to no mode. Narrow it with ?action= (an action, or sensitive for everything touching access or wallets), ?person=, ?q= (a subject or the start of an IP address), ?from= and ?to= (YYYY-MM-DD). Needs activity:read.
Example: list what touched access or wallets
Copy failed. Select the code and copy it manually.
curl 'https://api.velirapay.com/v1/activity?action=sensitive' \
--fail-with-body --silent --show-error --max-time 30 \
-H "Authorization: Bearer ${VELIRAPAY_API_KEY:?Set VELIRAPAY_API_KEY}" \
-H 'Accept: application/json'
<?php
use VeliraPay\VeliraPayClient;
require __DIR__.'/vendor/autoload.php';
$apiKey = getenv('VELIRAPAY_API_KEY') ?: throw new RuntimeException('Set VELIRAPAY_API_KEY.');
$velirapay = new VeliraPayClient($apiKey, baseUrl: 'https://api.velirapay.com');
$activity = $velirapay->activity->list(['action' => 'sensitive']);
echo json_encode($activity, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES | JSON_THROW_ON_ERROR), PHP_EOL;
use VeliraPay\Laravel\Facades\VeliraPay;
$activity = VeliraPay::activity()->list(['action' => 'sensitive']);
const secretKey = process.env.VELIRAPAY_API_KEY;
if (!secretKey) throw new Error('Set VELIRAPAY_API_KEY.');
const response = await fetch('https://api.velirapay.com/v1/activity?action=sensitive', {
headers: {
Authorization: `Bearer ${secretKey}`,
Accept: 'application/json',
},
redirect: 'error',
signal: AbortSignal.timeout(30_000),
});
if (!response.ok) {
throw new Error(`VeliraPay ${response.status}: ${await response.text()}`);
}
const activity = response.status === 204 ? null : (await response.json()).data;
console.log(JSON.stringify(activity, null, 2));
import json
import os
import requests
api_key = os.environ["VELIRAPAY_API_KEY"]
response = requests.get(
"https://api.velirapay.com/v1/activity",
headers={
"Authorization": f"Bearer {api_key}",
"Accept": "application/json",
},
params={"action": "sensitive"},
timeout=(5, 30),
allow_redirects=False,
)
if not 200 <= response.status_code < 300:
raise RuntimeError(f"VeliraPay {response.status_code}: {response.text}")
activity = None if response.status_code == 204 else response.json()["data"]
print(json.dumps(activity, indent=2))
using System;
using System.Net;
using System.Net.Http;
using System.Net.Http.Headers;
using System.Text.Json;
var secretKey = Environment.GetEnvironmentVariable("VELIRAPAY_API_KEY")
?? throw new InvalidOperationException("Set VELIRAPAY_API_KEY.");
using var client = new HttpClient(new HttpClientHandler { AllowAutoRedirect = false })
{
Timeout = TimeSpan.FromSeconds(30),
};
using var request = new HttpRequestMessage(HttpMethod.Get, "https://api.velirapay.com/v1/activity?action=sensitive");
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", secretKey);
request.Headers.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
using var response = await client.SendAsync(request);
var responseBody = await response.Content.ReadAsStringAsync();
if (!response.IsSuccessStatusCode)
{
throw new HttpRequestException($"VeliraPay {(int)response.StatusCode}: {responseBody}");
}
JsonElement? activity = null;
if (response.StatusCode != HttpStatusCode.NoContent)
{
using var document = JsonDocument.Parse(responseBody);
activity = document.RootElement.GetProperty("data").Clone();
}
Console.WriteLine(activity?.GetRawText() ?? "null");
Copy failed. Select the code and copy it manually.
{
"data": [
{
"id": "5821",
"object": "activity",
"action": "api_key.created",
"description": "Created an API key",
"actor": "Jane Owner",
"subject": "Shop backend",
"properties": { "prefix": "vp_live_ab12", "permissions": ["charges:read", "charges:write"] },
"ip_address": "203.0.113.7",
"mode": "live",
"created_at": "2026-11-06T09:12:04.000000Z"
}
],
…
}
Actions
| Action | Description | Sensitive |
|---|---|---|
wallets.changed
|
Changed the payout wallets | Yes |
wallets.api_access_changed
|
Changed whether API keys and AI apps may change the payout wallets | Yes |
payment_settings.updated
|
Updated the payment settings | |
profile.updated
|
Updated the public profile | |
business_details.updated
|
Updated the business details | |
api_key.created
|
Created an API key | Yes |
api_key.updated
|
Changed an API key | Yes |
api_key.revoked
|
Revoked an API key | Yes |
webhook.created
|
Added a webhook endpoint | |
webhook.updated
|
Updated a webhook endpoint | |
webhook.deleted
|
Deleted a webhook endpoint | |
webhook.secret_rotated
|
Rotated a webhook signing secret | Yes |
member.invited
|
Invited a member | Yes |
member.joined
|
Joined the organization | Yes |
member.role_changed
|
Changed a member's role | Yes |
member.removed
|
Removed a member | Yes |
payment_link.created
|
Created a payment link | |
payment_link.updated
|
Changed a payment link | |
payment_link.archived
|
Archived a payment link | |
payment_link.restored
|
Restored a payment link | |
member.invitation_canceled
|
Canceled an invitation | Yes |
charge.payment_requested
|
Emailed a customer a payment request | |
webhook.disabled
|
Had a webhook endpoint switched off | Yes |
charge.canceled
|
Canceled a charge | |
charge.accepted
|
Accepted a charge as paid | |
refund.recorded
|
Recorded a refund | |
invoice.voided
|
Voided an invoice | |
plan.payment_started
|
Started paying for Pro in crypto | |
plan.subscription_canceled
|
Canceled the Pro subscription | |
plan.subscription_resumed
|
Resumed the Pro subscription | |
auth.signed_in
|
Signed in | |
auth.sign_in_failed
|
Could not sign in | Yes |
auth.password_changed
|
Changed their password | Yes |
auth.two_factor_enabled
|
Turned on two-factor authentication | Yes |
auth.two_factor_disabled
|
Turned off two-factor authentication | Yes |
auth.signed_out_elsewhere
|
Signed out of every other browser | Yes |
auth.two_factor_failed
|
Gave a wrong two-factor code | Yes |
auth.email_changed
|
Changed their email address | Yes |
auth.passkey_added
|
Added a passkey | Yes |
auth.passkey_removed
|
Removed a passkey | Yes |
coupon.created
|
Created a coupon | |
coupon.updated
|
Changed a coupon | |
coupon.deleted
|
Deleted a coupon | |
auth.app_connected
|
Connected an AI app | Yes |
auth.app_disconnected
|
Disconnected an AI app | Yes |
chat.connected
|
Connected chat notifications | |
chat.updated
|
Changed chat notifications | |
chat.removed
|
Disconnected chat notifications | |
chat.disabled
|
Had chat notifications switched off | Yes |
sanctions.matched
|
Received a payment from an address on the sanctions list | Yes |
sanctions.accepted
|
Accepted a payment from an address on the sanctions list | Yes |
sanctions.return_requested
|
Asked for a payment from an address on the sanctions list to be returned | Yes |
auth.social_connected
|
Connected an account to sign in with | Yes |
auth.social_disconnected
|
Disconnected an account they signed in with | Yes |