Audit logs

📘
This endpoint is in Beta.

Overview

The Audit Logs endpoint provides structured event data that allows you to monitor access activity within your Spark Hire Recruit account. Logs can be pulled into your SIEM or any other external monitoring solution.

Audit coverage spans the full access layer of the application. Events include successful and failed sign-in attempts, password reset requests and completions, user invitations and signups, role assignments and changes, company-level permission updates, and updates to API access for integrations.

All audit events are returned in a consistent JSON format designed for indexing, correlation, and long-term retention in external systems. Common attributes are provided in a flat structure of SIEM Common Information Model (CIM). These include: a timestamp, actor details, event type, and relevant context to support security investigations.

Audit logs data is retained and available for the past 30 days.

Request

GET https://api.comeet.co/audit-logs

Request query parameters:

Parameter	Type	Optional	Description
time_last_updated:after	string	optional	Return logs for which the time_last_updated is AFTER the provided time. time_last_updated:after=2018-01-01T12:50:50
event_types	string	optional	Comma separated list of event types
actions	string	optional	Comma separated list of actions

Actions

Action	Event type	Description
user_login	authentication	User login event status is `success` or `failed`
reset_password_request	authentication	User requests to reset password
password_changed	authentication	User successfully reset password
sso_integration_changed	authentication	SSO integration was configured / modified / activated / deactivated
support_accessed	authentication	This event indicates that a support user, a teammate from Sparkhire, signed up and accessed the account
user_invited	user	User invited another user as a teammate to Recruit
user_signed_up	user	Invited user has signed up
user_status_changed	user	When the user is deactivated/reactivated
user_role_changed	user	Changes made to user's roles
permission_changed	company	Changes made to company-wide permission settings
integration_status_changed	integration	Integration was activated
candidate_file_downloaded	data_export	The candidate's resume or other file was downloaded
exported_csv	data_export	User exported one or more CSV reports
candidate_file_uploaded	candidate	User uploads a file to the candidate card
candidate_file_deleted	candidate	User deleted a file from candidate card

Response

Response structure

Common attributes are provided in a flat structure of SIEM Common Information Model (CIM).

Attribute	Description
timestamp	Time of event in the following format: 2025-12-03T08:15:22Z
event_id	Unique ID of the event
event_type	Type of the event as listed in the list of actions above
action	Action name as listed in the table above, e.g. `user_login`
status	Outcome of the action, e.g. success/failed
user	Recruit user email address
user_id	Recruit user id
src_ip	Recruit user IP address
http_user_agent	Recruit user agent information
metadata	Contextual information for the specific event, e.g. `login_type`

User login

metadata

Attribute	Value
login_type	One of the following: `sso` `password` `linkedin` `google`
error	A short explanation in case of failure

Example

{
  "event_id": "user_login_45.F61",
  "event_type": "authentication",
  "timestamp": "2025-12-03T08:15:22Z",
  "action": "user_login",
  "status": "success",
  "user": "[email protected]",
  "user_id": "A8.G09",
  "src_ip": "198.51.100.12",
  "http_user_agent": "Mozilla/5.0",
  "metadata": {
    "login_type": "sso",
    "error": null
  }
}

Reset password request

metadata

N/A

Example

{
  "event_id": "reset_password_request_45.F61",
  "event_type": "authentication",
  "timestamp": "2025-12-03T08:15:22Z",
  "action": "reset_password_request",
  "status": "success",  
  "user": "[email protected]",
  "user_id": "A8.G09",
  "src_ip": "198.51.100.12",
  "http_user_agent": "Mozilla/5.0",  
  "metadata": { }
}

Password changed

Metadata

N/A

Example

{
  "event_id": "password_changed_45.F61",
  "event_type": "authentication",
  "timestamp": "2025-12-03T08:15:22Z",
  "action": "password_changed",
  "status": "success",
  "user": "[email protected]",
  "user_id": "A8.G09",
  "src_ip": "198.51.100.12",
  "http_user_agent": "Mozilla/5.0",
  "metadata": {}
}

User invited

Metadata

Attribute	Value
invited_user_email	Recruit user email

Example

{
  "event_id": "user_invited_45.F61",
  "event_type": "user",
  "timestamp": "2025-12-03T08:15:22Z",
  "action": "user_invited",
  "status": "success",
  "user": "[email protected]",
  "user_id": "A8.G09",
  "src_ip": "198.51.100.12",
  "http_user_agent": "Mozilla/5.0",
  "metadata": {
    "invited_user_email": "[email protected]"
  }
}

User signed up

Metadata

N/A

Example

{
  "event_id": "user_signed_up_45.F61",
  "event_type": "user",
  "timestamp": "2025-12-03T08:15:22Z",
  "action": "user_signed_up",
  "status": "success",
  "user": "[email protected]",
  "user_id": "A8.G09",
  "src_ip": "198.51.100.12",
  "http_user_agent": "Mozilla/5.0",
  "metadata": {}
}

User status changed

Triggered when a user’s account status changes. User details may be unavailable if the change is initiated by SSO.

Metadata

Attribute	Value
affected_user_id	Affected recruit user ID
affected_user	Affected Recruit user (email address)
status	deactivate /reactivate
initiated_by	Indicates who initiated the change: user / sso

Example

{
  "event_id": "user_status_changed_45.F61",
  "event_type": "user",
  "timestamp": "2025-12-03T08:15:22Z",
  "action": "user_status_changed",
  "status": "success",
  "user": "[email protected]",
  "user_id": "A8.G09",
  "src_ip": "198.51.100.12",
  "http_user_agent": "Mozilla/5.0",
  "metadata": {
      "affected_user_id": "B4.C21",
      "affected_user": "[email protected]",
      "status": "deactivate",
      "initiated_by": "user"

  }
}

{
  "event_id": "user_status_changed_45.F61",
  "event_type": "user",
  "timestamp": "2025-12-03T08:15:22Z",
  "action": "user_status_changed",
  "status": "success",
  "metadata": {
      "affected_user_id": "B4.C21",
      "affected_user": "[email protected]",
      "status": "deactivate",
      "initiated_by": "sso"

  }
}

User role changed

Metadata

Attribute	Value
affected_user_id	Affected recruit user ID
affected_user	Affected Recruit user (email address)
result_of	The action that lead to the change
context	`company` or `location`
locations	In case the context is `location`, comma-separate list of location names
change_type	`added` or `removed`
role	string of the role name

Example

{
  "event_id": "user_role_changed_45.F61",
  "event_type": "user",
  "timestamp": "2025-12-03T08:15:22Z",
  "action": "user_role_changed",
  "status": "success",
  "user": "[email protected]",
  "user_id": "A8.G09",
  "src_ip": "198.51.100.12",
  "http_user_agent": "Mozilla/5.0",
  "metadata": {
    "affected_user_id": "B4.C21",
    "affected_user": "[email protected]",
    "result_of": "User role reassigned",
    "context": "company",
		"change_type": "added",
    "role": "admin",
  }
}

Permission changed

Metadata

Attribute	value
permission_name	Permission name
permission_level	`position` or `company`
before_change	Description or comma separated list of roles
after_change	Description or comma separated list of roles

Example

{
  "event_id": "permission_changed_45.F61",
  "event_type": "company",
  "timestamp": "2025-12-03T08:15:22Z",
  "action": "permission_changed",
  "status": "success",
  "user": "[email protected]",
  "user_id": "A8.G09",
  "src_ip": "198.51.100.12",
  "http_user_agent": "Mozilla/5.0",
  "metadata": {
    "permission_name": "can_export_data",
    "permission_level": "company",
    "before_change": "owner,admin,recruiter",
    "after_change": "owner,admin"
  }
}

SSO Integration changed

Metadata

Attribute	Value
sso_provider_name	SSO provider name, for example: Okta
user_action	The action that was done by the user, one of: activated / deactivated / configured / modified Note that activated actually means that the SSO was enforced on all employees.

Example

{
  "event_id": "sso_integration_changed_45.F61",
  "event_type": "authentication",
  "timestamp": "2025-12-03T08:15:22Z",
  "action": "sso_integration_changed",
  "status": "success",
  "user": "[email protected]",
  "user_id": "A8.G09",
  "src_ip": "198.51.100.12",
  "http_user_agent": "Mozilla/5.0",  
  "metadata": {
    "sso_provider_name": "Okta",
    "user_action": "activated"
  }
}

Support user signup

This event indicates that a support user, a teammate from Sparkhire, signed up and accessed the account

Metadata

Attribute	Value
reason	A short verbal explanation of why the support user needed to access the account. It may include links to the internal Sparkhire systems, such as Zendesk.
approver	The person (usually the name of an account member) who approved Sparkhire members to access the account

Example

{
  "event_id": "user_login_45.F61",
  "event_type": "authentication",
  "timestamp": "2025-12-03T08:15:22Z",
  "action": "support_accessed",
  "status": "success",
  "user": "support_user" // This one have a fixed value
  "user_id": "A8.G09",
  "src_ip": "198.51.100.12",
  "http_user_agent": "Mozilla/5.0",
  "metadata": {
    "reason": "To check issue reported with candidate 5541231" ← free text
    "approver": "David Gold" ← free text
  }
}

Integration status changed

Metadata

Attribute	Value
integration_name	Recruit integration name, for example, `Microsoft Teams`
integration_uid	Unique identifier of the integration
user_action	The action that was done by the user, one of: activated / deactivated / modified
error (optional)	The error that explains the failure (if failed)

Example

{
  "event_id": "integration_status_changed_45.F61",
  "event_type": "integration",
  "timestamp": "2025-12-03T08:15:22Z",
  "action": "integration_status_changed",
  "status": "success",
  "user": "[email protected]",
  "user_id": "A8.G09",
  "src_ip": "198.51.100.12",
  "http_user_agent": "Mozilla/5.0",  
  "metadata": {
    "integration_name": "Microsoft Teams",
    "integration_uid": "12.4AB", 
    "user_action": "activated"
  }
}

Candidate file downloaded

Metadata

Attribute	Value
file_name	Name of file
file_type	cv / attachment
recruit_id	Candidate unique ID

Example

{
  "event_id": "candidate_file_downloaded_45.F61",
  "event_type": "data_export",
  "timestamp": "2025-12-03T08:15:22Z",
  "action": "candidate_file_downloaded",
  "status": "success",
  "user": "[email protected]",
  "user_id": "A8.G09",
  "src_ip": "198.51.100.12",
  "http_user_agent": "Mozilla/5.0",
  "metadata": {
    "file_name": "steve_marron_cv.pdf",
    "file_type": "cv",
    "recruit_id": "19E.98"
  }
}

Exported CSV

Metadata

Attribute	value
report_names	Comma-separated list of exported report names
position_uid (optional)	If the exported report is candidate_list, then this field will be added, indicating the position

Example

{
  "event_id": "exported_CSV_45.F61",
  "event_type": "data_export",
  "timestamp": "2025-12-03T08:15:22Z",
  "action": "exported_csv",
  "status": "success",
  "user": "[email protected]",
  "user_id": "A8.G09",
  "src_ip": "198.51.100.12",
  "http_user_agent": "Mozilla/5.0",
  "metadata": {
    "report_names": "monthly_hires,candidate_statistics_december,candidate_roles_changed,teammates_report,candidates_list",
    "position_uid": "B2.F17"
  }
}

Candidate file uploaded

Metadata

Attribute	Value
file_name	Name of file
file_type	cv / attachment
error (optional)	Short explanation if the action failed
recruit_id	Candidate unique ID

Example

{
  "event_id": "candidate_file_downloaded_45.F61",
  "event_type": "candidate",
  "timestamp": "2025-12-03T08:15:22Z",
  "action": "candidate_file_uploaded",
  "status": "failed",
  "user": "[email protected]",
  "user_id": "A8.G09",
  "src_ip": "198.51.100.12",
  "http_user_agent": "Mozilla/5.0",
  "metadata": {
    "file_name": "steve_marron_cv.pdf",
    "file_type": "cv",
    "error": "File includes DDE",
    "recruit_id": "19E.98"
  }
}

Candidate file deleted

Metadata

Attribute	Value
file_name	Name of file
file_type	cv / attachment
recruit_id	Candidate unique ID

{
  "event_id": "candidate_file_deleted_45.F61",
  "event_type": "candidate",
  "timestamp": "2025-12-03T08:15:22Z",
  "action": "candidate_file_deleted",
  "status": "failed",
  "user": "[email protected]",
  "user_id": "A8.G09",
  "src_ip": "198.51.100.12",
  "http_user_agent": "Mozilla/5.0",
  "metadata": {
    "file_name": "cover_letter.pdf",
    "file_type": "attachment",
    "recruit_id": "19E.98"
  }
}