Getting started

The Auditmark API lets external systems read and write your organization's data. If you are looking for how to use the admin app itself, the guides cover that. All integration work targets the service API, versioned at /v1. Its base URL is https://api.auditmark.io/v1.

Authentication

Every request to /v1 requires an organization API key sent as a bearer token in the Authorization header. You create and revoke keys in the admin app, not through the API. See Authentication and API keys for how to create a key and attach it to requests.

What the API exposes

The service API covers your organization's shared resources. Each group below maps to one or more endpoint families in the reference.

Resolving member identities

An inspection refers to people by user id: created_by, assigned_approver_id, every entry in participants, every approval, and every sign-off. GET /v1/inspections/{inspection_id} returns a members object alongside those fields, keyed by user id, so you do not have to pull the whole roster and join it yourself.

{
  "created_by": "9f1c8a42-...",
  "assigned_approver_id": "7d30b155-...",
  "participants": [
    { "inspector_user_id": "4ab2f907-...", "status": "submitted" }
  ],
  "members": {
    "9f1c8a42-...": {
      "user_id": "9f1c8a42-...",
      "full_name": "Dana Levi",
      "position": "Operations lead",
      "role": "admin",
      "active": true,
      "email": "dana@example.com"
    },
    "4ab2f907-...": {
      "user_id": "4ab2f907-...",
      "full_name": "Sam Cohen",
      "position": "Field inspector",
      "role": "inspector",
      "active": true,
      "email": "sam@example.com"
    }
  }
}

A key can be missing, and that is not an error. A sign-off signed by someone outside your organization has no entry, because the directory resolves members only. Treat a missing key as normal and fall back to displaying the raw id.

Corrective-action identities are not in this object. A corrective action can be assigned to an external contractor who is not a member of your organization, so those records carry their own display names instead.

role is admin, inspector, approver, or api. The api value belongs to an API key: an inspection created through this API has a created_by that resolves to one.

active is false for a member who has been removed from the organization. Their entry still resolves, so an inspection from several years ago still names the inspector who ran it.

To resolve one user id on its own, call GET /v1/members/by-user/{user_id}. It returns the same object as an entry in members, and it takes the user id, the same identifier the fields above carry. Note that PATCH /members/{member_id} takes the membership id instead, which is a different value.

The interactive API reference in these docs lists every endpoint and lets you try calls directly. Calls you send from the reference are real: they run against your live organization data with the key you paste in, and there is no sandbox or test key. Endpoints that delete a record are documented in full but cannot be sent from the page. The OpenAPI description is published at https://api.auditmark.io/v1/openapi.json if you want to generate a client or import it into a tool like Postman.

What stays in the admin app

Some capabilities are deliberately outside the API key surface and are managed only in the admin app at app.auditmark.io:

An organization API key cannot create or revoke keys, manage webhook endpoints, or drive an AI call. AI features require a signed-in admin.

Where to go next