Error

A valid request URL is required to generate request examples

{
  "events": [
    {
      "type": "contact.signed_in",
      "method": "<string>",
      "ip": "<string>",
      "user_agent": "<string>",
      "sequence": 123,
      "created_at": "2023-11-07T05:31:56Z"
    }
  ]
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

Contacts (staff session)

One contact's authentication history

Requires customers:read. What happened to this account: every sign-in, how it happened and where from, newest first (100 most recent).

It is the answer to the support conversation that starts with “was that me?” — and it is what that conversation is read before: removing a contact’s second factor is possible from this surface (DELETE /v1/organization/contacts/{id}/two-factor), and the history is where you check whether the account has been behaving like its owner’s before weakening it.

ip and user_agent are attributes of the request a session was minted on: what the proxy left, and a string the caller chose. They are for a person to recognise their own device, never for an authorization decision.

Anonymous visitors never appear. The widget mints one on every page load, none of them is an account, and a history full of them is a history nobody reads.

GET

organization

contacts

{id}

auth-events

Error

A valid request URL is required to generate request examples

{
  "events": [
    {
      "type": "contact.signed_in",
      "method": "<string>",
      "ip": "<string>",
      "user_agent": "<string>",
      "sequence": 123,
      "created_at": "2023-11-07T05:31:56Z"
    }
  ]
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

Authorizations

Authorization

string

header

required

A staff session token, uk_st_…. Minted by sign-up, sign-in or the two-factor exchange.

Headers

X-Organization-Id

string

The organization the caller is acting on — the org_… code that appears in the panel URL. It identifies; the membership JOIN is what authorizes, so a forged code reads nothing. Absent, the session's default organization answers.

Path Parameters

string<uuid>

required

Query Parameters

environment

enum<string>

default:live

Which environment to act in. A view parameter, valid only on the staff surface — a machine credential never chooses its environment, it is resolved from the key.

Available options:

live,

test

Response

The history.

events

object[]

Show child attributes

Read a contact Merge two contacts

⌘I

Overview

Endpoints