Skip to content

Workflow History

The audit trail for one workflow, as JSON: who did what, when, from which IP address and over which channel — including the electronic-signature consent captured from each signer.

Two related things are not this endpoint:

  • The sealed evidence report — GET /workflow/v1/evidence-report/{workflowId} returns the same story as an HTML document intended to be kept or printed. See Completion.
  • The cryptographic detail of each signature — certificates, algorithms, validity — is Signature details.

Use this endpoint when you want the timeline as data rather than as a document.

Endpoint summary

Method Path Summary
GET /workflow/v1/{workflowId}/history Envelope metadata plus the chronological activity list

Who can read it

Caller Allowed
The workflow owner Always
A recipient on the workflow Yes, once the workflow has left DRAFT
A recipient, workflow still DRAFT No — OPERATION_IS_NOT_ALLOWED
Anyone, on a self-sign workflow they do not own No — INVALID_WORKFLOW_OWNER

Request

GET /workflow/v1/887/history

locale is accepted as a query parameter but currently has no effect — see the note at the end of this page.

Response

{
  "metadata": {
    "workFlowName": "Supplier agreement",
    "workflowId": "887",
    "dateCreated": "2026-08-12 09:04:11",
    "dateSent": "2026-08-12 09:20:03",
    "timeZone": "Europe/Istanbul",
    "documentName": ["supplier-agreement.pdf"],
    "documentRecipients": [
      {
        "documentName": "supplier-agreement.pdf",
        "recipients": [
          { "name": "Ayşe Yılmaz", "email": "ayse@example.com", "status": "SIGNED" }
        ]
      }
    ],
    "status": "COMPLETED",
    "statusDate": "2026-08-14 10:41:55",
    "holder": "Mert Demir",
    "flowType": "ORDERED"
  },
  "activities": [
    {
      "time": "2026-08-12 09:20:03",
      "userName": "Mert Demir",
      "ipAddress": "203.0.113.11",
      "accessChannel": "web",
      "action": "Sent",
      "activity": "Mert Demir sent the document",
      "status": "SENT",
      "consent": null
    },
    {
      "time": "2026-08-14 10:41:55",
      "userName": "Ayşe Yılmaz",
      "ipAddress": "198.51.100.7",
      "accessChannel": "mobile",
      "action": "Signed",
      "activity": "Ayşe Yılmaz signed the document",
      "status": "SIGNED",
      "consent": {
        "recipientName": "Ayşe Yılmaz",
        "recipientEmail": "ayse@example.com",
        "ipAddress": "198.51.100.7",
        "accessChannel": "mobile",
        "source": "SIGNING_PAGE",
        "evidence": "CHECKBOX",
        "textHash": "9f2c…",
        "text": "I agree to sign this document electronically…",
        "userAgent": "Mozilla/5.0 …"
      }
    }
  ]
}

Metadata

Field Meaning
workFlowName, workflowId The envelope
dateCreated, dateSent dateSent is empty while the workflow is still a draft
timeZone The timezone the timestamps are rendered in
documentName Every file in the envelope
documentRecipients Per document, the recipients and their current status
status, statusDate Current envelope status and when it was reached
holder Whose turn it is now
flowType SELF, ORDERED, UNORDERED or SURVEY — see Signing order

Activities

One row per event, oldest first. action is the short label (Sent, Opened, Signed, Declined, Comment added); activity is the readable sentence the UI prints.

consent is populated only on the row where a signer accepted the electronic-signature disclosure. It carries the verbatim text they were shown and a hash of it, which is what makes the consent evidential rather than a claim. It is null on every other row.

Two things the timeline deliberately collapses

  • One "Created" row per envelope, not per file. A multi-document upload produces one DOCUMENT_UPLOADED activity per file; only the earliest is returned, because the timeline is envelope-level.
  • Assistant routing rows are hidden. An assistant's internal routing entries carry no action label, so rendering them produced a phantom "opened the document" line dated before the assistant had opened anything. Their real actions still appear, attributed to the person they act for.

locale has no effect yet

The endpoint accepts a locale query parameter, but the service hardcodes en and never reads the override. Activity sentences come back in English regardless of what is passed. Send it if you like — it is harmless — but do not rely on it for a localized audit report.