User Audit Report Specification

DOCSCurrent

Last updated: Sept 24th, 4:14pm

Note: Do not use this report in place of any official reports for taxation or corporate governance purposes.

Use the User Audit report to track actions performed by users on your PayPal account. The report currently includes activities related to money movements and funding instruments completed on the PayPal website. You, or an administrative user you designate, can access the report in the reporting portal on the PayPal website. You can filter the report using date ranges, types of activities, action performed by, and by IDs, such as transaction, invoice, case, and payout IDs. You can also provide the permission

1Access user
2        audit report

to a secondary user for viewing the audit report.

Access audit report

Complete the following steps to access the User Audit report:

Click the Reports tab.

Select User audit from the left navigation.

Generate report

The User Audit report can contain data for three years in a single request. To limit the data returned, you can generate a report for a specific range of dates and filter for specific activity criteria. Complete the following steps to specify a range of dates and apply a specific activity filter to the returned data:

Specify a starting and an ending date for the range. Specifying a date range limits the number of transactions provided in the report.
- Only transactions from January 1, 2019 are available in this version of the report.
- The report will include information from 00:00:00 AM on the start date to 23:59:59 PM on the final date selected in your account’s time zone. The time zone is indicated in the account settings.

Select an activity filter from the user activity filter.

Click Create Report.

Search for transaction

Complete the following steps to search for specific transaction IDs:

Specify a transaction ID, invoice ID, or case ID in the Enter reference ID field.

Click Create Report.

Complete the following steps to generate a report for all actions performed by a specific user:

Enter the first name, last name, or login ID of a user in the Enter name field.

Click Create Report.

Report specifications

Character encoding

The report’s character encoding is UTF-8 (8-bit UCS/Unicode Transformation Format).

Report format

The following formats are available for the User Audit report:

Inline View

Comma-Separated Value (CSV)

A User Audit report in CSV format can contain a maximum of 150,000 records. If the report contains more than 150,000 records, the report is split across multiple files and compiled into a .zip file.

Note: We're improving the report and will continue working to add additional fields and records. Follow the recommendations in the Integration Guidelines section of this document to help ensure your integration does not break with future report enhancements.

Inline view

When you click Create Report, the report is generated and displayed on the screen. This is referred to as the inline view of the report. If an error occurs, you should re-enter your selections and try to create the report again.

Note: The report might not include records created in the previous 5 minutes before you generate the report.

The following fields are available in the report:

Date and Time

Activity

Action

Action Performed By

Reference ID

Details

Currency – Available for transactions completed on April 8, 2019 and later.

Net Amount – Available for transactions completed on April 8, 2019 and later.

Login ID

User Status

Login method

Comma-Separated Value (CSV)

The filename of the .csv report follows the following naming convention: AUDIT-<from_date_range>-<to-date-range>.CSV

Examples:

Single file: AUDIT-YYYYMMDD-YYYYMMDD.csv

Multiple files: AUDIT-YYYYMMDD-YYYYMMDD_1.csv, AUDIT-YYYYMMDDYYYYMMDD_2.csv

Multiple files, zipped: AUDIT-YYYYMMDD-YYYYMMDD.zip

In the previous examples:

MM is two-digit month of the year.

DD is the two-digit day of the month.

YYYY is the four-digit year.

Field specifications

Download fields data

The following download fields are available in the User Audit report. The column names below reflect the column names in the report, which contain details for each activity. Position refers to the order of columns.

Position	Column name	Data type	Data description
1	DateTime	string	The localized initiated date of the activity, in a format based on the user’s country. For example, in the U.S., the format is `MM/DD/YYYY` where: `MM` is two-digit month of the year. `DD` is the two-digit day of the month. `YYYY` is the four-digit year.
2	Activity	string	The following financial activities are included in the report: Withdraw money Add money Send money Refund Manage invoices Payouts The following non-financial activities are included in the report: Manage users Funding instruments Manage login
3	Action	string	The action performed by the user who logged into PayPal.
4	Action Performed By	string	Name of the user who logged into PayPal and performed the action.
5	Reference ID	string	`Reference ID` is the unique id identifying the financial activity. For non-financial activity, this field is blank.
6	Details	string	This field provides detailed information on the action performed by user who logged into PayPal, for the nonfinancial activities. This field provides additional information on the action performed by user who logged into PayPal, for the financial activities.
7	Currency	string	The currency code for the amount displayed in the Net Amount column. Note: Available for transactions completed on April 8, 2019 and later. For non-financial activities, this field is blank.
8	Net amount	string	The net amount of the transaction (usually Gross - Fee), in the case of financial activities. Note: Available for transactions completed on April 8, 2019 and later. For non-financial activities, this field is blank.
9	Login ID	string	Login ID of the user who logged into PayPal and performed the action.
10	User status	string	The account status of the user who performed the action. Shows whether the user account is still active or not. Refer to the Action Performed By column for the user’s name.
11	Login method	string	How the user logged in to their account. Possible values: Single sign on User ID and password

Activity field mapping specifications

Withdraw money

Dual control actions are available from November 5, 2019.

Column name	Data description
Activity	The value of this field is `Withdraw money`.
Action	The action is `Requested` if dual control is not opted-in for the account for withdraw money flow by the merchant. The following actions are supported for the withdraw money flow if dual control is opted-in for the account, by the merchant: `Withdraw money initiated` `Withdraw money approved` `Withdraw money rejected` `Withdraw money cancelled`
Details	This field is blank if dual control is not opted-in for the account for withdraw money flow, by the merchant. The following additional information is provided for the withdraw money flow if dual control is opted-in for the account, by the merchant: For action `Withdraw money initiated`, details field shows `approval is required for this action` if not approved. For action `Withdraw money rejected` details field shows `user who requested this action and the requested date and time`. For `Withdraw money cancelled`, details field shows `the requested date and time`.
Reference ID	The withdraw money transaction ID.
Currency	The currency code for the amount (displayed in the Net Amount column) of the withdraw money transaction. Note: Available for transactions completed on April 8, 2019 and later.
Net amount	The net amount of the withdraw money transaction (usually Gross-Fee). Note: `Requested` - Available for transactions completed on April 8, 2019 and later. `Dual control actions` - Available for transactions completed on October 16, 2019 and later.

Add money

Dual control actions are available from November 5, 2019.

Column name	Data description
Activity	The value of this field is `Add money`.
Action	The action is `Requested` if dual control is not opted-in for the account for add money flow by the merchant. The following actions are supported for the add money flow if dual control is opted-in for the account, by the merchant: `Add money initiated` `Add money approved` `Add money rejected` `Add money cancelled`
Details	This field is blank if dual control is not opted-in for the account for add money flow, by the merchant. The following additional information is provided for the add money flow if dual control is opted-in for the account, by the merchant: For action `add money initiated`, details field shows `approval is required for this action` if not approved. For action `add money rejected` details field shows `user who requested this action and the requested date and time`. For `add money cancelled`, details field shows `the requested date and time`.
Reference ID	The add money transaction ID.
Currency	The currency code for the amount (displayed in the Net Amount column) of the add money transaction. Note: Available for transactions completed on April 8, 2019 and later.
Net amount	The net amount of the add money transaction (usually Gross-Fee). Note: `Requested` - Available for transactions completed on April 8, 2019 and later. `Dual control actions` - Available for transactions completed on October 16, 2019 and later.

Refund

Column name	Data description
Activity	The value of this field is `Refunds`.
Action	The action is `Requested`.
Reference ID	The refund transaction ID.
Details	This field includes the merchant's invoice ID if it exists.
Currency	The currency code for the amount (displayed in the Net Amount column) of the refund transaction. Note: Available for transactions completed on April 8, 2019 and later.
Net amount	The net amount of the refund transaction (usually Gross-Fee). Note: Available for transactions completed on April 8, 2019 and later.

Manage invoices

Column name	Data description
Activity	The value of this field is `Manage invoices`.
Action	Supported actions for the manage invoices activity include sent, recorded payment, recorded refund, and cancelled.
Reference ID	The invoice ID.
Details	For the Manage invoices activity and the Sent action, in the scenario of batch invoice, the value of this field is `This invoice is sent as part of batch invoice (batch invoice ID)`. This field also includes the merchant’s invoice ID if it exists.
Currency	The currency code for the amount (displayed in the Net Amount column) of the refund transaction. Note: Available for transactions completed on April 8, 2019 and later.
Net amount	The net amount of the invoice (usually Gross-Fee). Note: Available for transactions completed on April 8, 2019 and later.

Payouts

Dual control actions are available from September 20, 2019.

Column name	Data description
Activity	The value of this field is `Payouts`.
Action	The action is `Requested` if dual control is not opted-in for the account for payout flow by the merchant. The following actions are supported for the payout flow if dual control is opted-in for the account, by the merchant: `Payout initiated` `Payout approved` `Payout rejected` `Payout cancelled`
Details	This field is blank if dual control is not opted-in for the account for payout flow, by the merchant. The following additional information is provided for the payout flow if dual control is opted-in for the account, by the merchant: For action `payout initiated`, details field shows `approval is required for this action` if not approved. For action `payout rejected` details field shows `user who requested this action and the requested date and time`. For `payout cancelled`, details field shows `the requested date and time`.
Reference ID	The payout ID.
Currency	The currency code for the amount (displayed in the Net Amount column) of the payout transaction. Note: Available for transactions completed on May 25, 2019 and later.
Net amount	The net amount of the payout transaction (usually Gross-Fee). Note: Available for transactions completed on May 25, 2019 and later.

Send money

Available for transactions from November 5, 2019.

Column name	Data description
Activity	The value of this field is `Send money`.
Action	The action is `Requested` if dual control is not opted-in for the account for Send money flow by the merchant.
Details	This field is blank if dual control is not opted-in for the account for send money flow by the merchant.
Reference ID	The send money transaction ID.
Currency	The currency code for the amount (displayed in the Net Amount column) of the send money transaction. Note: Available for transactions completed on April 8, 2019 and later.
Net amount	The net amount of the send money transaction (usually Gross-Fee). Note: Available for transactions completed on April 8, 2019 and later.

Manage users

Column name	Data description
Activity	The value of this field is `Manage users`.
Action	The following actions are supported for the `manage users` activity: `Added user` `User permissions updated` `Account permission added` `Account permission removed`
Details	For `Added user` action, this field displays the name of the user added, login ID of the user added, and permissions assigned. For `User permissions updated` action, this field displays the name of the user updated, login ID of the user updated, added permissions, and removed permissions. For the `Added account permission` action, this field displays the name and login ID of the user who has been assigned the account access. For `Removed account permission` action, this field displays the name and login ID of the user whose account access has been removed.

Funding instrument

Column name Data description

Activity The value of this field is Funding instrument.

Action

Column name	Data description
Activity	The value of this field is `Funding instrument`.
Action	The following actions are supported for the Funding instrument activity, if the merchant has not opted in for dual control: `Added bank account` `Removed bank account` `Confirmed bank account` `Added card` `Removed card` `Confirmed card` `Updated card` `Set preferred payment method` The following actions are supported for the Funding instrument activity, if the merchant has opted in for dual control: `Add bank - initiated` `Add bank - approved` `Add bank - cancelled` `Add bank – rejected` `Remove bank - initiated` `Remove bank - approved` `Remove bank - cancelled` `Remove bank - rejected` `Add card - initiated` `Add card - approved` `Add card - cancelled` `Add card - rejected` `Remove card - initiated` `Remove card - approved` `Remove card - cancelled` `Remove card - rejected`
Details	For the bank-related add/remove actions, this field displays the last four digits of the bank number. For the card-related actions:This field displays the last four digits of the card number in Add/Remove card action. For updated card action, this field displays `Attribute changed: ; Old value: ; New value:`, where `Attribute changed` values can be billing address or expiration date. For set preferred payment method action, this field displays the last four digits of the card number/ last four digits of the bank number set as preferred funding instrument. The following additional information is provided for the funding instrument flow if dual control is opted-in for the account, by the merchant: For bank/card related initiated actions, details field shows `approval is required for this action` if not approved. For bank / card related rejected actions, details field shows `user who requested this action and the requested date and time`. For bank/card related cancelled actions, details field shows `the requested date and time`.

The following actions are supported for the Funding instrument activity, if the merchant has not opted in for dual control:

Added bank account

Removed bank account

Confirmed bank account

Added card

Removed card

Confirmed card

Updated card

Set preferred payment method

The following actions are supported for the Funding instrument activity, if the merchant has opted in for dual control:

Add bank - initiated

Add bank - approved

Add bank - cancelled

Add bank – rejected

Remove bank - initiated

Remove bank - approved

Remove bank - cancelled

Remove bank - rejected

Add card - initiated

Add card - approved

Add card - cancelled

Add card - rejected

Remove card - initiated

Remove card - approved

Remove card - cancelled

Remove card - rejected

Details

For the bank-related add/remove actions, this field displays the last four digits of the bank number.

For the card-related actions:This field displays the last four digits of the card number in Add/Remove card action.

For updated card action, this field displays

Attribute changed: ; Old value: 
                    ; New value:

, where Attribute changed values can be billing address or expiration date.

For set preferred payment method action, this field displays the last four digits of the card number/ last four digits of the bank number set as preferred funding instrument.

The following additional information is provided for the funding instrument flow if dual control is opted-in for the account, by the merchant:

For bank/card related initiated actions, details field shows approval is required for this action if not approved.

For bank / card related rejected actions, details field shows user who requested this action and the requested date and time.

For bank/card related cancelled actions, details field shows the requested date and time.

Manage dispute

Available for transactions from November 8, 2019.

Column name	Data description
Activity	The value of this field is `Manage dispute`.
Action	The following actions are supported for the Disputes flow: `Appealed case` `Accepted case` `Escalated case` `Made offer` `Acknowledged return` `Provided evidence` `Sent message` `Provided supporting information` `Created case` `Canceled case` `Updated case`
Details	This field contains the transaction ID, merchant’s invoice ID (if it exists), the transaction amount and currency related to the case.
Reference ID	The case ID.
Currency	The currency code for the amount (displayed in the Net Amount column) of the dispute transaction. Note: Available for transactions completed on April 8, 2019 and later.
Net amount	The net amount of the case (usually Gross-Fee).

Integration guidelines

Following these best practices will help limit broken integrations as PayPal continues to update this report to include additional activities, actions, rows, and columns.

Your integration should be independent of the number of columns or order of columns in this report.

Your integration should not be based on a static list of values for any column. More values may be added in the future for any column and your integration should be extensible when new values are added.

Your integration should consider the format of the detail column for each activity and action because the format of the detail column changes for every activity and its action.

The content of the .csv file is localized per the language selection on the PayPal website.

Frequently asked questions

What is the scope of User Audit report?

The User Audit report includes activities related to money movements, user permissions, disputes, and funding instruments done on the PayPal website. The following financial activities are within the scope of this report:

Withdraw funds: Transaction to withdraw funds from a PayPal account triggered from the PayPal website. The dual control actions are also included.

Add money: Transaction to add money from a PayPal account triggered from the PayPal website. The dual control actions are also included.

Refunds: Refund transaction triggered from the PayPal website.

Invoices: Invoice-related actions triggered from the PayPal website.

Manage user: Add user, editing permissions triggered for an account from the PayPal website. Manage user activities also include PayPal account linking and unlinking to any user from the PayPal website.

Funding instrument: Add Bank/Card, Remove Bank/Card, Confirm Bank/Card, Update card and Set Preferred activities triggered from the PayPal website. Dual control actions are also included for add/remove bank account or card.

Payouts: Transaction to pay multiple PayPal accounts, triggered from the PayPal website with or without dual controls.

Send Money: Transfer money to a person as family /friends or for goods/services triggered from the PayPal website.

Disputes: Appealed case, Accepted case, Escalated case, Made offer, Acknowledged return, Provided evidence, Sent message, Provided supporting information, Created case, Cancelled case, Updated case triggered from PayPal website

Are changes expected in this report?

In order to expand the audit capabilities across PayPal products and platforms, we'll continue to update this report with new activities, actions, rows, and columns. We may also update some existing records to align them better with this evolving audit experience.

How can we provide feedback?

Click the Feedback link on the User Audit report in the PayPal site. Your feedback will help us refine this report.

Is this report available as an SFTP report?

This report is available only as an online report on the PayPal website. Please provide Feedback to let us know if you need an SFTP report.

Is there an API that provides the user audit details?

This report is available only on the PayPal website. Please provide Feedback to let us know if you need API support.

Can I give access to this report to all other users on the account?

This report is available only to the admin user of the PayPal account by default. Admin user can assign Access user audit report permission to secondary user for getting access to the report.

Version history

Pub. Date	Version	Description of Changes
Feb 2022	1.1	Spec change: Added the `Login` action to ‘Manage login’.
May 2020	1.0	General availability of the report. Spec change: Added the new actions, `Updated card` and `Set preferred payment method`, for the ‘Funding instrument’ activity.
Nov 2019	0.3	Spec change: Reformatted specifications: Added new `Activity` section. Added new values for the Activity column: Dual controls for Funding Instruments, Payout, Add money and Withdraw Funds Send Money Disputes Added note to merchants about `Update profile` action.
Apr 2019	0.2	Spec change: Added new columns: Currency Net Amount User Status Added new Payout value for the Activity. Content-only change: Updated descriptions for Transaction ID and Details columns.
Jan 2019	0.1	Initial pilot release.

Effective date for spec changes

Date	Changes
May 7, 2019	Updated card Set preferred payment method
Nov 7, 2019	Send money
Nov 8, 2019	Disputes
Sept 20, 2019	Dual control actions: Payout
Nov 5, 2019	Dual control actions: Withdraw funds Dual control actions: Add money
Nov 6, 2019	Dual control actions: Funding instruments
Apr 8, 2019	Currency Net amount User status
May 25, 2019	Payout