> ## Documentation Index > Fetch the complete documentation index at: https://docs.symmetry.com/llms.txt > Use this file to discover all available pages before exploring further. # Audit log reference > Retrieve the auditLogs array from an I-9 submission and look up any eventName. Covers the request, the fields on each entry, and the complete audit event catalog. Each I-9 submission includes a detailed audit trail. The `auditLogs` array provides a time-stamped record of key actions taken by both the employee and the employer’s authorized representative throughout the I-9 process. Audit logs are automatically generated for every Form I-9 and E-Verify case, ensuring a reliable record of status changes, verifications, and interactions. You can retrieve all audit details for a specific I-9 submission by making a GET request to the `/employers/{employerId}/employees/{employeeId}/submissions/{submissionId}` endpoint. For what the trail captures and where administrators view it in the embedded experience, see [Audit Trail](/i9/compliance-and-audit-readiness/audit-events). ## Sample request ```bash theme={null} curl --location 'https://api.symmetry.com/i9/v1/employers/123456-b29d-75cf-a308-15ca267af31c/employees/123456-86d6-7447-aa2a-6a14c063273a/submissions/118' \ --header 'Authorization: Bearer ••••••' ``` ### Path parameters | Element | Type | Description | | :------------- | :------ | :-------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `employerId` | string | **Required**. The unique identifier of the employer. | | `employeeId` | string | **Required**. The unique identifier of the employee who completed the I-9. | | `submissionId` | integer | **Required**. The unique identifier of the employee's I-9 submission. Retrieved from the `/employers/{employerId}/employees/{employeeId}/submissions` endpoint. | ## Response A successful response contains the `auditLogs` array within the `submission` object. For brevity, we've included a sample audit log array below. For more information on all details returned from this endpoint and the complete view of the `submissions` object, [read more here](/i9/getting-started/retrieve-completed-data#submission-object). ```json theme={null} { "submission": { "auditLogs": [ { "eventName": "employee_submission_created", "eventTitle": "null", "details": {}, "request": { "url": "https://symmetry.workbright.com/i9_submission", "referrer": "https://symmetry.workbright.com/forms/i9/submission/new", "remoteIp": "2600:4040:2975:dd00:7427:1036:8e9:12fc", "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36", "serverName": "symmetry.workbright.com" }, "userType": "EMPLOYEE", "serverTimestamp": "2025-05-28T10:49:10-04:00" }, { "eventName": "employee_submit_location", "eventTitle": "null", "details": { "action": "event", "controller": "i9/remote_countersign" }, "request": { "url": "https://symmetry.workbright.com/rc/3f8f816a-dc4d-4f53-9ae2-7d386d2d96a8/event", "referrer": "https://symmetry.workbright.com/i9_remote_countersign", "remoteIp": "2600:4040:2975:dd00:7427:123:123:12fc", "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36", "serverName": "symmetry.workbright.com" }, "serverTimestamp": "2025-05-28T10:52:49-04:00" } ] ... } } ``` ### Audit logs array Each audit log object within the array represents an action taken on the submission. | Element | Type | Description | | :---------------- | :---------------- | :------------------------------------------------------------------------------------------ | | `eventName` | string | Name of the event. [See full list below](#audit-events). | | `eventTitle` | string | Not used | | `details` | object | Information related to the specific event | | `request` | object | Metadata about the HTTP request that triggered the audit event | | `userType` | string | User type who triggered the event (`EMPLOYEE`, `ADMIN`) | | `serverTimestamp` | string, date-time | Timestamp of when the event occurred based on the time zone of the server. ISO 8601 format. | ## Audit events Below is the complete list of audit events (`eventName`) captured within the application: | `eventName` | Description | Actor | | :---------------------------------------------------------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :------------------------ | | `admin_countersign` | Admin has countersigned Section 2 of Form I-9 | Admin | | `admin_reverify_cancelled` | Admin has canceled reverification of the employee's Form I-9 through the Authorized Representative Supplement B Reverification (Reverify) workflow | Admin | | `admin_reverify_created` | Admin has requested reverification of the employee's Form I-9 through the Authorized Representative Supplement B Reverification (Reverify) workflow | Admin | | `admin_update_additional_info` | Admin has updated the additional information field in Section 2 on Form I-9 | Admin | | `admin_update_documentation` | Admin has updated the documentation title (including removing Receipt), document number, issuing authority, and/or expiration date previously submitted in Section 2 on Form I-9 | Admin | | `authorized_representative_qr_scan` | Authorized Representative displayed scannable QR code for the Employee to scan to indicate they are in the same location in lieu of geolocation access to continue with the Authorized Representative Countersign workflow | Authorized Representative | | `authorized_representative_submit_location_failed` | Authorized Representative has denied access to device location to proceed with Authorized Representative Countersign workflow | Authorized Representative | | `authorized_representative_auth_rep_certify_identity` | Authorized Representative has certified their identity and attested to not being the same individual as the Employee completing Form I-9 | Authorized Representative | | `authorized_representative_indicated_document_mismatch` | Authorized Representative has submitted their responses on the document review attestation and has indicated the document(s) do not meet the attestation statement for Section 2 of Form I-9 | Authorized Representative | | `authorized_representative_reset_document_review` | Authorized Representative has reset the document review process to update responses on the document review attestation for Section 2 of Form I-9 | Authorized Representative | | `authorized_representative_reverify_certify_identity` | Authorized Representative has certified their identity and attested to not being the same individual as the Employee completing Supplement B Reverification of Form I-9 | Authorized Representative | | `authorized_representative_reverify_qr_scan` | Authorized Representative displayed scannable QR code for the Employee to scan to indicate they are in the same location in lieu of geolocation access to continue with the Authorized Representative Supplement B Reverification workflow | Authorized Representative | | `authorized_representative_reverify_submit_document_review` | Authorized Representative has submitted their responses on the document review attestation for Supplement B Reverification of Form I-9 | Authorized Representative | | `authorized_representative_submit_countersign` | Authorized Representative has countersigned Section 2 of Form I-9 | Authorized Representative | | `authorized_representative_submit_document_review` | Authorized Representative has submitted their responses on the document review attestation for Section 2 of Form I-9 | Authorized Representative | | `authorized_representative_submit_document_verify` | Authorized Representative has confirmed their responses on the document review attestation in preparation to countersign Form I-9 | Authorized Representative | | `authorized_representative_submit_location` | Authorized Representative has given access to device location to proceed with Authorized Representative Countersign workflow | Authorized Representative | | `authorized_representative_submit_reverify` | Authorized Representative has signed Supplement B Reverification of Form I-9 | Authorized Representative | | `deferred_ssn_updated` | The employee previously indicated that they were awaiting SSN upon submission of Section 1, and has now provided the missing SSN | Employee | | `employee_qr_scan` | Employee displayed scannable QR code for the Authorized Representative to scan to indicate they are in the same location in lieu of geolocation access to continue with the Authorized Representative Countersign workflow | Employee | | `employee_reset` | Employee has reset the Authorized Representative phone number to re-initiate Authorized Representative Countersign workflow | Employee | | `employee_reverify_qr_scan` | Employee displayed scannable QR code for the Authorized Representative to scan to indicate they are in the same location in lieu of geolocation access to continue with the Authorized Representative Reverify workflow | Employee | | `employee_reverify_reset` | Employee has reset the Authorized Representative phone number to re-initiate Authorized Representative Reverify workflow | Employee | | `employee_reverify_submit_auth_rep_phone` | Employee has provided the Authorized Representative phone number to initiate Authorized Representative Reverify workflow | Employee | | `employee_reverify_submit_location` | Employee has given access to device location to proceed with Authorized Representative Reverify workflow | Employee | | `employee_reverify_submit_location_failed` | Employee has denied access to device location to proceed with Authorized Representative Reverify workflow | Employee | | `employee_submission_created` | Form I-9 Section 1 was signed | Employee | | `employee_submit_auth_rep_phone` | Employee has provided the Authorized Representative phone number to initiate Authorized Representative Countersign workflow | Employee | | `employee_submit_location` | Employee has given access to device location to proceed with Authorized Representative Countersign workflow | Employee | | `employee_submit_location_failed` | Employee has denied access to device location to proceed with Authorized Representative Countersign workflow | Employee | | `admin_update_supplement_b_info` | Admin has completed Supplement B indicating either Reverification, Rehire, and/or Rename (action in Log Entry) | Admin |