# Audit History

The audit history records every creation, modification and deletion performed on the entities of a brand (products, menus, customers, users, modules, restaurant openings/closings...). Use it to track who changed what and when, or to synchronize an external system with recent changes.

Access Flag Requirement

These endpoints require the `CAN_ACCESS_BRAND_HISTORY` access flag on the calling user. The requested `brandId` is verified against the rights of the authenticated user.

### `GET /history` - List Audit History

Retrieve the paginated audit history of a brand. brandId, limit and offset are required (a 400 validation error is returned otherwise). All other query parameters are optional filters.

#### Parameters

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| brandId | integer | Yes | The unique identifier of the brand (query parameter). |
| limit | integer | Yes | Maximum number of entries to return (query parameter). |
| offset | integer | Yes | Number of entries to skip (query parameter). |
| userId | integer | No | Filter by the ID of the user who performed the action (query parameter). |
| search | string | No | Free-text search on the entity name and the entity type (query parameter). To filter by user email, use the "user" parameter instead. |
| orderBy | string | No | Sort expression in the format "<field> <ASC\|DESC>", e.g. "created\_at DESC" (query parameter). |
| restaurantIds | string | No | Comma-separated list of restaurant IDs to filter on, e.g. "12,34" (query parameter). |
| entityType | string | No | Filter by entity type: GRANT, ENTRANCE\_FEE, PRICING\_RULE, PRODUCT, STEP, CATEGORY, MENU, CUSTOMER, CUSTOMERS\_IMPORT, CUSTOMERS\_UPDATE, USER, CHANNEL, CONSUMPTION\_MODE, ORDER, BRAND, RESTAURANT or MODULE (query parameter). |
| eventDate | string | No | Filter on the event date with a partial match, e.g. "2026-07-01" (query parameter). |
| entityName | string | No | Filter by entity name (query parameter). |
| user | string | No | Filter by the email of the user who performed the action (query parameter). |
| action | string | No | Filter by action: CREATE, UPDATE, DELETE, OPEN, CLOSE, DUPLICATE, ACTIVATE, DEACTIVATE, CANCEL, IMPORT or CONVERT (query parameter). |

#### Response

```json
{
  "status": 200,
  "code": "history_succeed",
  "message": "The history has been found.",
  "data": {
    "count": 128,
    "data": [
      {
        "historyId": "1f0c2a4e-6f3a-4a5b-9d2e-8c7b6a5d4e3f",
        "action": "UPDATE",
        "entityId": 34567,
        "entityName": "Cheeseburger",
        "entityType": "PRODUCT",
        "entityRawData": "{\"price\":950}",
        "brandId": 100,
        "userId": 4242,
        "userEmail": "manager@innovorder.com",
        "restaurantId": 200,
        "eventDate": "2026-07-01T10:15:00.000Z"
      }
    ]
  }
}
```

##### Response Properties

Every field in the example is listed below. Explicit requiredness is shown when the endpoint contract defines it.

| Property | Type | Example | Description |
| --- | --- | --- | --- |
| status | integer | 200 | HTTP status code returned by the API. |
| code | string | "history\_succeed" | Machine-readable application code for the result. |
| message | string | "The history has been found." | Human-readable result message. Do not use this value for program logic. |
| data | object | {…} | Endpoint-specific response payload. |
| data.count | integer | 128 | Total number of matching records. |
| data.data | array | \[…\] | Endpoint-specific response payload. |
| data.data\[\] | object | {…} | Endpoint-specific response payload. |
| data.data\[\].historyId | string | "1f0c2a4e-6f3a-4a5b-9d2e-8c7b6a5d4e3f" | Identifier of the associated history. |
| data.data\[\].action | string | "UPDATE" | The action value. |
| data.data\[\].entityId | integer | 34567 | Identifier of the associated entity. |
| data.data\[\].entityName | string | "Cheeseburger" | The entity name value. |
| data.data\[\].entityType | string | "PRODUCT" | The entity type value. |
| data.data\[\].entityRawData | string | "{\\"price\\":950}" | The entity raw data value. |
| data.data\[\].brandId | integer | 100 | Identifier of the brand. |
| data.data\[\].userId | integer | 4242 | Identifier of the user. |
| data.data\[\].userEmail | string | "manager@innovorder.com" | The user email value. |
| data.data\[\].restaurantId | integer | 200 | Identifier of the restaurant. |
| data.data\[\].eventDate | string | "2026-07-01T10:15:00.000Z" | Date or timestamp for event. |

### `GET /history/{historyId}` - Get Audit History Entry

Retrieve the detail of a single audit history entry by its identifier. The response is a computed detail view: it includes a field-by-field diff against the previous state of the entity (for the first recorded event, all fields appear with an undefined oldValue).

#### Parameters

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| historyId | string | Yes | The unique identifier (UUID) of the history entry. |

#### Response

```json
{
  "status": 200,
  "code": "audit_found",
  "message": "The audit has been found.",
  "data": {
    "auditName": "Cheeseburger",
    "auditType": "PRODUCT",
    "action": "UPDATE",
    "auditDate": "2026-07-01T10:15:00.000Z",
    "diff": [
      {
        "fieldName": "price",
        "oldValue": 990,
        "newValue": 950
      }
    ],
    "user": {
      "mail": "manager@innovorder.com",
      "id": 4242
    },
    "rawData": "{\"price\":950}"
  }
}
```

##### Response Properties

Every field in the example is listed below. Explicit requiredness is shown when the endpoint contract defines it.

| Property | Type | Example | Description |
| --- | --- | --- | --- |
| status | integer | 200 | HTTP status code returned by the API. |
| code | string | "audit\_found" | Machine-readable application code for the result. |
| message | string | "The audit has been found." | Human-readable result message. Do not use this value for program logic. |
| data | object | {…} | Endpoint-specific response payload. |
| data.auditName | string | "Cheeseburger" | The audit name value. |
| data.auditType | string | "PRODUCT" | The audit type value. |
| data.action | string | "UPDATE" | The action value. |
| data.auditDate | string | "2026-07-01T10:15:00.000Z" | Date or timestamp for audit. |
| data.diff | array | \[…\] | List of diff entries. |
| data.diff\[\] | object | {…} | Object containing diff fields. |
| data.diff\[\].fieldName | string | "price" | The field name value. |
| data.diff\[\].oldValue | integer | 990 | The old value value. |
| data.diff\[\].newValue | integer | 950 | The new value value. |
| data.user | object | {…} | Object containing user fields. |
| data.user.mail | string | "manager@innovorder.com" | The mail value. |
| data.user.id | integer | 4242 | The id value. |
| data.rawData | string | "{\\"price\\":950}" | The raw data value. |