List Activity Log Entries
GET/api/storefront/instances/:id/activity-log
Paginated activity recorded against this instance: order imports, sales-order creation and updates, cancellations and refusals, payments, shipment pushes, mapping holds, and the instance-level bulk actions.
This endpoint currently requires session authentication; Personal Access Token scope support is in progress.
Subjects covered. Entries against this instance's store orders, this instance's product listings, and the connection itself — instance-level entries such as a bulk archive or restore are recorded against the connection, and omitting them silently dropped a whole class of activity from the log. subject_type reads StorefrontOrder, StorefrontProductListing or StorefrontIntegrationInstance.
Query parameters (there are no others, and no sort):
per_page— default 10, clamped to 1–100. A value below 1 becomes 1, above 100 becomes 100.page— default 1.filter[search]— contains match overdescription,eventand the recorded properties.filter[event]— contains match, not exact, so a broad category narrows to this channel's specific verbs. Events recorded:imported,held_for_mapping,sku_order_created,sku_order_updated,sku_order_deleted,sku_order_cancelled,cancelled_on_store,cancellation_rejected,payment_recorded,payment_pushed,fulfillment_submitted,orders_archived,orders_unarchived.filter[source]— matches entries whose properties carry that source:sweep,skuorstore.filter[batch_uuid]— matches entries whose properties carry that batch identifier; the drill-down from one grouped bulk row to the entries behind it.
Ordering is fixed: newest first (by entry id). There is no sort parameter.
The response is a standard page envelope; each entry carries id, description, event, subject_type (the short name), subject_id, properties, causer_name (null for anything the scheduler did) and created_at.
Authentication: Bearer token (session or PAT).
Request
Responses
- 200
- 401
- 403
- 404
- 429
OK
Response Headers
Unauthenticated — the bearer token is missing, revoked, expired, or malformed. Never retry automatically; fix the credential. See the Errors guide.
Forbidden — the token lacks a required scope, the endpoint is not available to API tokens, or the user behind the token lacks the permission. A human must adjust the token scopes or user permissions; do not retry.
Not found — no record with the given identifier (or the route does not exist). Verify the ID before retrying.
Rate limited — platform limit is 1,000 requests/min; individual tokens may carry lower limits. Honor the Retry-After header before retrying. See the Rate Limits guide.