Read access log

Returns the compliance log: who signed in, who changed configuration, who read personal data or a credential, and what data left the platform, newest first. Requires Reseller, Super User, or Super User Read Only scope. A Reseller sees only entries about data in the domains of its territory.

Choose the entries with event-category. Without it you get sign-ins and sign-outs (session) from the last 7 days. Send access, disclosure, or all for data reads and disclosures. Sign-in and change entries carry fewer fields: the filters marked "access and disclosure entries only" do not apply to them.

Two common questions. "What did this account read" is by-user with a date range. "Who read this record" is record-id with target-object. Add credential=yes to see every read that returned a secret.

Data subjects are listed, not filterable. Each entry names the people whose data it disclosed in data-subjects. To find who accessed data about one person, contact support.

What counts as a disclosure depends on the regime. actor-tier records where the reader sat relative to the data, and exclude removes categories. A HIPAA accounting of disclosures is exclude=own-organisation. GDPR excludes nothing.

Access entries are read from at most the 6 most recent months of the date range. Every page you read is itself recorded in the log. GET /accesslog/count returns the number of matching entries as {"total": N}.

Bearer Token

Provide your bearer token in the

Authorization

header when making requests to protected resources.

Example:

Authorization: Bearer ********************

application/json

The matching entries, newest first. An empty array when none match. Sign-in and change entries have no event-category, id, or access fields.

Bodyapplication/json

curl --location 'https://awqacore01.crexendocloud.com/ns-api/v2/accesslog?datetime-start=2026-09-01T00%3A00%3A00+00%3A00&datetime-end=2026-09-30T23%3A59%3A59+00%3A00&by-ip=192.0.2.10&action-type=download&target-domain=example.com&target-object=cdr&target-host=core1.example.com&target-user=1001&by-client=portal&by-domain=example.com&event-category=access%2Cdisclosure&exclude=own-organisation&record-id=018f7a2c4e898b3a9c1d3a4f7e8b9c2d&actor-tier=reseller&by-scope=Office%20Manager&schema-version=1.1&part2-covered=yes&hipaa-covered=yes&gdpr-covered=yes&credential=yes&recipient=sftp.example.com&by-user=1001&mask-chain=1001%40example.com&ticket-reference=TICKET-1042&limit=undefined&start=undefined&auditlog-details=callqueue' \ --header 'Authorization: Bearer <token>'

[ { "id": 48212, "timestamp-datetime": "2026-09-02T02:00:00+00:00", "event-category": "disclosure", "by-user": "*", "by-domain": "example.com", "by-ip": "192.0.2.10", "by-client": "cdr-schedule", "by-scope": "Office Manager", "mask-chain": "", "action-type": "export", "target-object": "cdr", "target-domain": "example.com", "target-user": "", "target-host": "core1.example.com", "record-id": "daily-calls", "query-parameters": {}, "result-count": 140, "data-subjects": [ "1001", "1002", "15555550101" ], "data-subjects-count": 3, "actor-tier": "self", "part2-covered": 0, "hipaa-covered": 1, "gdpr-covered": 0, "credential": 0, "recipient": "sftp.example.com", "ticket-reference": "", "schema-version": "1.1" }, { "id": 48211, "timestamp-datetime": "2026-09-01T14:30:00+00:00", "event-category": "access", "by-user": "1001", "by-domain": "example.com", "by-ip": "192.0.2.10", "by-client": "portal", "by-scope": "Office Manager", "mask-chain": "", "action-type": "search", "target-object": "cdr", "target-domain": "example.com", "target-user": "", "target-host": "core1.example.com", "record-id": "", "query-parameters": { "datetime-start": "2026-09-01T00:00:00+00:00", "number": "<REMOVED>" }, "result-count": 2, "data-subjects": [ "1002", "15555550100" ], "data-subjects-count": 2, "actor-tier": "self", "part2-covered": 0, "hipaa-covered": 1, "gdpr-covered": 0, "credential": 0, "recipient": "", "ticket-reference": "", "schema-version": "1.1" } ]

Request

Responses