# Get intelligent audit trail digest with grouped insights

> 🔒 **Private label — [contact sales](mailto:sales@boyahq.com).** Requires a private-label entitlement on your API client.

Get intelligent audit trail digest with grouped insights

Endpoint: GET /audit-trail/digest
Version: 2.0.0
Security: oauth2ClientCredentials

## Query parameters:

  - `page` (number)
    Page number for underlying events

  - `limit` (number)
    Number of events to analyze (max 1000)

## Header parameters:

  - `business_id` (string, required)
    Business identifier for the request

## Response 200 fields (application/json):

  - `groups` (array, required)
    Grouped audit events with insights

  - `groups.id` (string, required)
    Unique group identifier
    Example: group-0

  - `groups.type` (string, required)
    Group type
    Enum: "insight", "session", "activity"

  - `groups.priority` (string, required)
    Priority level
    Enum: "high", "normal", "low"

  - `groups.title` (string, required)
    Brief title describing what happened
    Example: Multiple Login Attempts

  - `groups.summary` (string, required)
    One-sentence summary for executives
    Example: Faith logged in 4 times within 8 minutes

  - `groups.timestamp` (string, required)
    ISO timestamp of most recent event
    Example: 2026-02-05T14:30:45.000Z

  - `groups.insight` (string, required)
    Natural language explanation with context and assessment
    Example: This pattern may indicate connection issues or automated testing. No security concerns detected - same IP and location.

  - `groups.confidence` (number, required)
    Confidence score (0-1)
    Example: 0.85

  - `groups.actors` (array, required)
    Actors involved in this group
    Example: ["Faith","Rob"]

  - `groups.location` (string)
    Location (human-readable)
    Example: Kenya

  - `groups.events` (array, required)
    Events in this group

  - `groups.events.time` (string, required)
    Event time (HH:MM:SS format)
    Example: 14:30:45

  - `groups.events.action` (string, required)
    Human-readable action description
    Example: Logged in to the dashboard

  - `groups.events.ip` (string)
    IP address
    Example: 129.222.187.88

  - `groups.events.subscription` (string)
    Subscription ID
    Example: sub_123

  - `groups.events.investment` (string)
    Investment ID
    Example: inv_456

  - `groups.events.details` (string)
    Additional details
    Example: Amount: KES 5,000

  - `groups.events.note` (string)
    Warning or observation note
    Example: Different IP from previous login

  - `groups.events.count` (number)
    Event count for grouped actions
    Example: 2

  - `stats` (object, required)
    Aggregate statistics

  - `stats.totalEvents` (number, required)
    Total events in digest
    Example: 15

  - `stats.uniqueUsers` (number, required)
    Number of unique users
    Example: 3

  - `stats.topAction` (string, required)
    Most common action type
    Example: Investment queries

  - `stats.timeSpan` (string, required)
    Time span covered
    Example: 24 hours

  - `stats.byType` (object, required)
    Event counts by record type

  - `stats.byType.ACTIVITY` (number)
    Activity event count

  - `stats.byType.MODIFICATION` (number)
    Modification event count

  - `stats.byType.CREATION` (number)
    Creation event count

  - `stats.byType.DELETION` (number)
    Deletion event count

  - `stats.byPerson` (object, required)
    Event counts by person
    Example: {"Rob":8,"Faith":5}