Skip to main content

​
Audit log

The audit log in the admin tool (Settings → Audit log) records what happens in your organisation: configuration changes, webhook deliveries, GDPR exports, and every request your integrations make to the Management API and the Public API.

​
What is recorded for API requests

Every request that can be tied to your organisation gets one entry, whether it succeeds or fails:
  • Time, method and endpoint, for example GET /v1/management/prescriptions/<prescription_uid>.
  • The requested path. Query parameter names are kept; their values never are.
  • The API key that made the request: its identifier, never its secret.
  • Outcome and status code. For a failed request, the error response your integration received (up to 2,000 characters).
  • Client IP address, user agent and duration.
  • An execution ID that RxScale support can use to find the request in our logs.
Each API entry has one of these events:

​
Failed attempts

Two kinds of rejected requests are recorded as API authentication failed:
  • A request with the identifier of one of your API keys but the wrong secret (401).
  • A request with a valid API key that lacks the required permission (403).
A request with a missing, malformed or unknown API key cannot be tied to an organisation, so it does not appear in your audit log. A request rejected by rate limiting (429) is not recorded either.
Anyone who knows one of your API key identifiers can cause failed-attempt entries. Repeated failed attempts for a key usually mean an integration has the wrong secret, or that someone is trying to guess it. If in doubt, replace the key.

​
What is never recorded

  • Request bodies.
  • Query parameter values. Search terms can contain patient data.
  • Response bodies of successful requests.
  • API key secrets.
  • Credentials in a request path, such as a waiting room queue ID. They are replaced by [REDACTED].

​
Retention

Configuration changes, webhook deliveries and GDPR exports are kept as before.

​
Timing and completeness

Entries usually appear within a few seconds of the request. Recording never makes an API request fail, so in rare cases, such as an infrastructure outage, an entry can be missing.

​
Filtering

The audit log shows the last 7 days by default. You can filter by type, event, outcome, API key and date range. When more than 10,000 entries match, you can page through the newest 10,000; narrow the filters to reach older ones.