> ## Documentation Index > Fetch the complete documentation index at: https://docs.flowpayroll.ai/llms.txt > Use this file to discover all available pages before exploring further. # List changes to who has access > Needs permission user:read. Every change to who can reach what in your account, newest first: access given (`Granted`), a different role (`RoleChanged`) and access taken away (`Removed`), on one organisation, an organisation group or the whole account. Each change names the person or API token, `roleBefore` and `roleAfter`, who made it (`actor`), when, and the `requestId` that made it. `source` is `Administration` for a change made in an account and `Platform` for one FlowPayroll made; a `Platform` removal has no `actor`. `?principalId=` narrows the list to one person (`USER#…`) or API token (`M2M#…`), as the other lists show them (400 `invalid_principal_id` otherwise). Paginated: `pageSize` (default 25, at most 100) and `paginationToken`; follow the token until it is absent. Changes are listed here for 13 months, and kept in write-once storage for 7 years. ## OpenAPI ````yaml /api-reference/specs/administration.json get /access-changes openapi: 3.0.4 info: title: Administration API description: >- Manage your Flow Payroll account: the organisations it owns, the people who can sign in to it, the API tokens it holds, its brand, and a feed of recent administration activity. Every resource is scoped to the account your credentials belong to, so no request ever names a customer and the `X-Org-Id` header is not used. version: v1 servers: - url: https://api.sandbox.flowpayroll.ai/v1/administration security: - X-Auth-Token: [] tags: - name: Customer description: >- Your account: the customer every other resource on this API belongs to. Read it and rename it. - name: Organisations description: >- The organisations your account owns or manages: list them with headcounts and your access to each, get one in full, add one or several at a time, see everybody who can reach one, and read which of its data an outside system manages. - name: Organisation groups description: >- Named sets of your organisations, such as the clients one team looks after. Give a person or API token a group, and they reach every organisation in it, including ones added later. - name: Users description: >- The people who can sign in to your account: list, invite (one or many), resend invitations, and manage each person's direct grants and account-wide access. - name: Roles description: >- What people and API tokens can do where they have access: the built-in roles, roles of your own, and the default role. Only Administrator can be given today. - name: API tokens description: >- The client credentials your integrations authenticate with: create (the secret is shown once), rename, rotate, revoke, and manage which organisations each token reaches. - name: Branding description: >- Your white-label brand: edit a draft, publish it, upload its files, and set a company logo for each organisation. - name: Activity description: >- Recent administration actions in your account, and every change to who has access, newest first. - name: SCIM description: >- SCIM 2.0 provisioning: your identity provider adds, updates, suspends and removes your account's people, and gives them account-wide roles. paths: /access-changes: get: tags: - Activity summary: List changes to who has access description: >- Needs permission user:read. Every change to who can reach what in your account, newest first: access given (`Granted`), a different role (`RoleChanged`) and access taken away (`Removed`), on one organisation, an organisation group or the whole account. Each change names the person or API token, `roleBefore` and `roleAfter`, who made it (`actor`), when, and the `requestId` that made it. `source` is `Administration` for a change made in an account and `Platform` for one FlowPayroll made; a `Platform` removal has no `actor`. `?principalId=` narrows the list to one person (`USER#…`) or API token (`M2M#…`), as the other lists show them (400 `invalid_principal_id` otherwise). Paginated: `pageSize` (default 25, at most 100) and `paginationToken`; follow the token until it is absent. Changes are listed here for 13 months, and kept in write-once storage for 7 years. operationId: GetAccessChanges parameters: - name: principalId in: query schema: type: string - name: pageSize in: query schema: type: string - name: paginationToken in: query schema: type: string responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/AccessChangeListResponseResponseBody' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/ObjectResponseBody' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ObjectResponseBody' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ObjectResponseBody' components: schemas: AccessChangeListResponseResponseBody: type: object properties: message: $ref: '#/components/schemas/MessageWithTokenResponse' content: $ref: '#/components/schemas/AccessChangeListResponseContentResponse' validationIssues: type: array items: $ref: '#/components/schemas/ValidationIssue' nullable: true additionalProperties: false ObjectResponseBody: type: object properties: message: $ref: '#/components/schemas/MessageWithTokenResponse' content: $ref: '#/components/schemas/ObjectContentResponse' validationIssues: type: array items: $ref: '#/components/schemas/ValidationIssue' nullable: true additionalProperties: false MessageWithTokenResponse: type: object properties: text: type: string token: type: string tokenArguments: type: array items: $ref: '#/components/schemas/ValidationIssueArgument' nullable: true additionalProperties: false AccessChangeListResponseContentResponse: type: object properties: data: $ref: '#/components/schemas/AccessChangeListResponse' metadata: $ref: '#/components/schemas/ContentMetadataResponse' additionalProperties: false ValidationIssue: type: object properties: field: type: string reason: type: string reasonToken: type: string reasonTokenArguments: type: array items: $ref: '#/components/schemas/ValidationIssueArgument' nullable: true additionalProperties: false ObjectContentResponse: type: object properties: data: {} metadata: $ref: '#/components/schemas/ContentMetadataResponse' additionalProperties: false ValidationIssueArgument: type: object properties: name: type: string value: {} additionalProperties: false AccessChangeListResponse: type: object properties: accessChanges: type: array items: $ref: '#/components/schemas/AccessChangeResponse' paginationToken: type: string description: >- Null on the last page. Also at `content.metadata.paginationToken`, which to prefer. nullable: true additionalProperties: false description: A page of access changes, newest first. ContentMetadataResponse: type: object properties: dateFormat: type: string dateTimeFormat: type: string paginationToken: type: string nullable: true additionalProperties: false AccessChangeResponse: type: object properties: accessChangeId: type: string description: The change's identifier. type: enum: - Granted - RoleChanged - Removed type: string description: '`Granted` (no access there before), `RoleChanged` or `Removed`.' principalId: type: string description: The person (`USER#…`) or API token (`M2M#…`) whose access changed. principalType: enum: - Person - ApiToken type: string description: '`Person` or `ApiToken`.' scope: $ref: '#/components/schemas/AccessChangeScopeResponse' roleBefore: type: string description: >- The role before the change, such as `administrator`; null when it was granted. nullable: true roleAfter: type: string description: The role after the change; null when it was removed. nullable: true actor: type: string description: >- Who made the change: a person's email address, an API token's client id, or an operator; null when FlowPayroll made it (`source` is `Platform`) and nothing says by whom. nullable: true source: enum: - Administration - Platform type: string description: >- `Administration` when somebody in an account made it here; `Platform` when FlowPayroll made it outside this API. occurredDate: type: string description: When it happened, ISO 8601 UTC. requestId: type: string description: >- The request that made the change (`Request-Id`), for support; null when none was known. nullable: true additionalProperties: false description: >- One change to somebody's access: who made it, to whom, where, and the role before and after. AccessChangeScopeResponse: type: object properties: type: enum: - Organisation - OrganisationGroup - Account type: string description: >- `Organisation`, `OrganisationGroup` or `Account` (every organisation of the account). id: type: string description: The organisation, the organisation group or the account. additionalProperties: false description: What changed access reaches. securitySchemes: X-Auth-Token: type: apiKey description: FlowPayroll JWT (raw token, no Bearer prefix) name: X-Auth-Token in: header ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.