User Audit Report Specification

DocsCurrentLast updated: December 12th 2023, @ 7:52:50 am


Note: Do not use this report in place of any official reports for taxation or corporate governance purposes.

Use the User Audit report to track actions performed by users on your PayPal account. The report currently includes activities related to money movements and funding instruments completed on the PayPal website. You, or an administrative user you designate, can access the report in the reporting portal on the PayPal website. You can filter the report using date ranges, types of activities, action performed by, and by IDs, such as transaction, invoice, case, and payout IDs. You can also provide the permission Access user audit report to a secondary user for viewing the audit report.

Access audit report

Complete the following steps to access the User Audit report:

  1. Log in to PayPal with your username and password.
  2. Click the Reports tab.
  3. Select User audit from the left navigation.

Generate report

The User Audit report can contain data for three years in a single request. To limit the data returned, you can generate a report for a specific range of dates and filter for specific activity criteria. Complete the following steps to specify a range of dates and apply a specific activity filter to the returned data:

  1. Specify a starting and an ending date for the range. Specifying a date range limits the number of transactions provided in the report.

    • Only transactions from January 1, 2019 are available in this version of the report.
    • The report will include information from 00:00:00 AM on the start date to 23:59:59 PM on the final date selected in your account’s time zone. The time zone is indicated in the account settings.
  2. Select an activity filter from the user activity filter.

  3. Click Create Report.

Search for transaction

Complete the following steps to search for specific transaction IDs:

  1. Specify a transaction ID, invoice ID, or case ID in the Enter reference ID field.
  2. Click Create Report.

Search for user actions

Complete the following steps to generate a report for all actions performed by a specific user:

  1. Enter the first name, last name, or login ID of a user in the Enter name field.
  2. Click Create Report.

Report specifications

Character encoding

The report’s character encoding is UTF-8 (8-bit UCS/Unicode Transformation Format).

Report format

The following formats are available for the User Audit report:

  • Inline View
  • Comma-Separated Value (CSV)

A User Audit report in CSV format can contain a maximum of 150,000 records. If the report contains more than 150,000 records, the report is split across multiple files and compiled into a .zip file.

Note: We're improving the report and will continue working to add additional fields and records. Follow the recommendations in the Integration Guidelines section of this document to help ensure your integration does not break with future report enhancements.

Inline view

When you click Create Report, the report is generated and displayed on the screen. This is referred to as the inline view of the report. If an error occurs, you should re-enter your selections and try to create the report again.

Note: The report might not include records created in the previous 5 minutes before you generate the report.

The following fields are available in the report:

  • Date and Time
  • Activity
  • Action
  • Action Performed By
  • Reference ID
  • Details
  • Currency – Available for transactions completed on April 8, 2019 and later.
  • Net Amount – Available for transactions completed on April 8, 2019 and later.
  • Login ID
  • User Status
  • Login method

Comma-Separated Value (CSV)

The filename of the .csv report follows the following naming convention: AUDIT-<from_date_range>-<to-date-range>.CSV

Examples:

  • Single file: AUDIT-YYYYMMDD-YYYYMMDD.csv
  • Multiple files: AUDIT-YYYYMMDD-YYYYMMDD_1.csv, AUDIT-YYYYMMDDYYYYMMDD_2.csv
  • Multiple files, zipped: AUDIT-YYYYMMDD-YYYYMMDD.zip

In the previous examples:

  • MM is two-digit month of the year.
  • DD is the two-digit day of the month.
  • YYYY is the four-digit year.

Field specifications

Download fields data

The following download fields are available in the User Audit report. The column names below reflect the column names in the report, which contain details for each activity. Position refers to the order of columns.

PositionColumn nameData typeData description
1DateTimestringThe localized initiated date of the activity, in a format based on the user’s country. For example, in the U.S., the format is MM/DD/YYYY where:
  • MM is two-digit month of the year.
  • DD is the two-digit day of the month.
  • YYYY is the four-digit year.
2ActivitystringThe following financial activities are included in the report:
  • Withdraw money
  • Add money
  • Send money
  • Refund
  • Manage invoices
  • Payouts

The following non-financial activities are included in the report:
  • Manage users
  • Funding instruments
  • Manage login
3ActionstringThe action performed by the user who logged into PayPal.
4Action Performed BystringName of the user who logged into PayPal and performed the action.
5Reference IDstringReference ID is the unique id identifying the financial activity.
For non-financial activity, this field is blank.
6DetailsstringThis field provides detailed information on the action performed by user who logged into PayPal, for the nonfinancial activities. This field provides additional information on the action performed by user who logged into PayPal, for the financial activities.
7CurrencystringThe currency code for the amount displayed in the Net Amount column.

Note: Available for transactions completed on April 8, 2019 and later.

For non-financial activities, this field is blank.
8Net amountstringThe net amount of the transaction (usually Gross - Fee), in the case of financial activities.

Note: Available for transactions completed on April 8, 2019 and later.

For non-financial activities, this field is blank.
9Login IDstringLogin ID of the user who logged into PayPal and performed the action.
10User statusstringThe account status of the user who performed the action. Shows whether the user account is still active or not. Refer to the Action Performed By column for the user’s name.
11Login methodstringHow the user logged in to their account. Possible values:
  • Single sign on
  • User ID and password

Activity field mapping specifications

Withdraw money

Dual control actions are available from November 5, 2019.

Column nameData description
ActivityThe value of this field is Withdraw money.
ActionThe action is Requested if dual control is not opted-in for the account for withdraw money flow by the merchant.

The following actions are supported for the withdraw money flow if dual control is opted-in for the account, by the merchant:
  • Withdraw money initiated
  • Withdraw money approved
  • Withdraw money rejected
  • Withdraw money cancelled
DetailsThis field is blank if dual control is not opted-in for the account for withdraw money flow, by the merchant.

The following additional information is provided for the withdraw money flow if dual control is opted-in for the account, by the merchant:
  • For action Withdraw money initiated, details field shows approval is required for this action if not approved.
  • For action Withdraw money rejected details field shows user who requested this action and the requested date and time.
  • For Withdraw money cancelled, details field shows the requested date and time.
Reference IDThe withdraw money transaction ID.
CurrencyThe currency code for the amount (displayed in the Net Amount column) of the withdraw money transaction.

Note: Available for transactions completed on April 8, 2019 and later.
Net amountThe net amount of the withdraw money transaction (usually Gross-Fee).

Note:
  • Requested - Available for transactions completed on April 8, 2019 and later.
  • Dual control actions - Available for transactions completed on October 16, 2019 and later.

Add money

Dual control actions are available from November 5, 2019.

Column nameData description
ActivityThe value of this field is Add money.
ActionThe action is Requested if dual control is not opted-in for the account for add money flow by the merchant.

The following actions are supported for the add money flow if dual control is opted-in for the account, by the merchant:
  • Add money initiated
  • Add money approved
  • Add money rejected
  • Add money cancelled
DetailsThis field is blank if dual control is not opted-in for the account for add money flow, by the merchant.

The following additional information is provided for the add money flow if dual control is opted-in for the account, by the merchant:
  • For action add money initiated, details field shows approval is required for this action if not approved.
  • For action add money rejected details field shows user who requested this action and the requested date and time.
  • For add money cancelled, details field shows the requested date and time.
Reference IDThe add money transaction ID.
CurrencyThe currency code for the amount (displayed in the Net Amount column) of the add money transaction.

Note: Available for transactions completed on April 8, 2019 and later.
Net amountThe net amount of the add money transaction (usually Gross-Fee).

Note:
  • Requested - Available for transactions completed on April 8, 2019 and later.
  • Dual control actions - Available for transactions completed on October 16, 2019 and later.

Refund

Column nameData description
ActivityThe value of this field is Refunds.
ActionThe action is Requested.
Reference IDThe refund transaction ID.
DetailsThis field includes the merchant's invoice ID if it exists.
CurrencyThe currency code for the amount (displayed in the Net Amount column) of the refund transaction.

Note: Available for transactions completed on April 8, 2019 and later.
Net amountThe net amount of the refund transaction (usually Gross-Fee).

Note: Available for transactions completed on April 8, 2019 and later.

Manage invoices

Column nameData description
ActivityThe value of this field is Manage invoices.
ActionSupported actions for the manage invoices activity include sent, recorded payment, recorded refund, and cancelled.
Reference IDThe invoice ID.
DetailsFor the Manage invoices activity and the Sent action, in the scenario of batch invoice, the value of this field is This invoice is sent as part of batch invoice (batch invoice ID). This field also includes the merchant’s invoice ID if it exists.
CurrencyThe currency code for the amount (displayed in the Net Amount column) of the refund transaction.

Note: Available for transactions completed on April 8, 2019 and later.
Net amountThe net amount of the invoice (usually Gross-Fee).

Note: Available for transactions completed on April 8, 2019 and later.

Payouts

Dual control actions are available from September 20, 2019.

Column nameData description
ActivityThe value of this field is Payouts.
ActionThe action is Requested if dual control is not opted-in for the account for payout flow by the merchant.

The following actions are supported for the payout flow if dual control is opted-in for the account, by the merchant:
  • Payout initiated
  • Payout approved
  • Payout rejected
  • Payout cancelled
DetailsThis field is blank if dual control is not opted-in for the account for payout flow, by the merchant.

The following additional information is provided for the payout flow if dual control is opted-in for the account, by the merchant:
  • For action payout initiated, details field shows approval is required for this action if not approved.
  • For action payout rejected details field shows user who requested this action and the requested date and time.
  • For payout cancelled, details field shows the requested date and time.
Reference IDThe payout ID.
CurrencyThe currency code for the amount (displayed in the Net Amount column) of the payout transaction.

Note: Available for transactions completed on May 25, 2019 and later.
Net amountThe net amount of the payout transaction (usually Gross-Fee).

Note: Available for transactions completed on May 25, 2019 and later.

Send money

Available for transactions from November 5, 2019.

Column nameData description
ActivityThe value of this field is Send money.
ActionThe action is Requested if dual control is not opted-in for the account for Send money flow by the merchant.
DetailsThis field is blank if dual control is not opted-in for the account for send money flow by the merchant.
Reference IDThe send money transaction ID.
CurrencyThe currency code for the amount (displayed in the Net Amount column) of the send money transaction.

Note: Available for transactions completed on April 8, 2019 and later.
Net amountThe net amount of the send money transaction (usually Gross-Fee).

Note: Available for transactions completed on April 8, 2019 and later.

Manage users

Column nameData description
ActivityThe value of this field is Manage users.
ActionThe following actions are supported for the manage users activity:
  • Added user
  • User permissions updated
  • Account permission added
  • Account permission removed
DetailsFor Added user action, this field displays the name of the user added, login ID of the user added, and permissions assigned.

For User permissions updated action, this field displays the name of the user updated, login ID of the user updated, added permissions, and removed permissions.

For the Added account permission action, this field displays the name and login ID of the user who has been assigned the account access.

For Removed account permission action, this field displays the name and login ID of the user whose account access has been removed.

Funding instrument

Column nameData description
ActivityThe value of this field is Funding instrument.
ActionThe following actions are supported for the Funding instrument activity, if the merchant has not opted in for dual control:
  • Added bank account
  • Removed bank account
  • Confirmed bank account
  • Added card
  • Removed card
  • Confirmed card
  • Updated card
  • Set preferred payment method

The following actions are supported for the Funding instrument activity, if the merchant has opted in for dual control:
  • Add bank - initiated
  • Add bank - approved
  • Add bank - cancelled
  • Add bank – rejected
  • Remove bank - initiated
  • Remove bank - approved
  • Remove bank - cancelled
  • Remove bank - rejected
  • Add card - initiated
  • Add card - approved
  • Add card - cancelled
  • Add card - rejected
  • Remove card - initiated
  • Remove card - approved
  • Remove card - cancelled
  • Remove card - rejected
DetailsFor the bank-related add/remove actions, this field displays the last four digits of the bank number.

For the card-related actions:This field displays the last four digits of the card number in Add/Remove card action.

For updated card action, this field displays Attribute changed: ; Old value: ; New value: , where Attribute changed values can be billing address or expiration date.

For set preferred payment method action, this field displays the last four digits of the card number/ last four digits of the bank number set as preferred funding instrument.

The following additional information is provided for the funding instrument flow if dual control is opted-in for the account, by the merchant:
  • For bank/card related initiated actions, details field shows approval is required for this action if not approved.
  • For bank / card related rejected actions, details field shows user who requested this action and the requested date and time.
  • For bank/card related cancelled actions, details field shows the requested date and time.

Manage dispute

Available for transactions from November 8, 2019.

Column nameData description
ActivityThe value of this field is Manage dispute.
ActionThe following actions are supported for the Disputes flow:
  • Appealed case
  • Accepted case
  • Escalated case
  • Made offer
  • Acknowledged return
  • Provided evidence
  • Sent message
  • Provided supporting information
  • Created case
  • Canceled case
  • Updated case
DetailsThis field contains the transaction ID, merchant’s invoice ID (if it exists), the transaction amount and currency related to the case.
Reference IDThe case ID.
CurrencyThe currency code for the amount (displayed in the Net Amount column) of the dispute transaction.

Note: Available for transactions completed on April 8, 2019 and later.
Net amountThe net amount of the case (usually Gross-Fee).

Integration guidelines

Following these best practices will help limit broken integrations as PayPal continues to update this report to include additional activities, actions, rows, and columns.

  1. Your integration should be independent of the number of columns or order of columns in this report.
  2. Your integration should not be based on a static list of values for any column. More values may be added in the future for any column and your integration should be extensible when new values are added.
  3. Your integration should consider the format of the detail column for each activity and action because the format of the detail column changes for every activity and its action.
  4. The content of the .csv file is localized per the language selection on the PayPal website.

Frequently asked questions

What is the scope of User Audit report?

The User Audit report includes activities related to money movements, user permissions, disputes, and funding instruments done on the PayPal website. The following financial activities are within the scope of this report:

  • Withdraw funds: Transaction to withdraw funds from a PayPal account triggered from the PayPal website. The dual control actions are also included.
  • Add money: Transaction to add money from a PayPal account triggered from the PayPal website. The dual control actions are also included.
  • Refunds: Refund transaction triggered from the PayPal website.
  • Invoices: Invoice-related actions triggered from the PayPal website.
  • Manage user: Add user, editing permissions triggered for an account from the PayPal website. Manage user activities also include PayPal account linking and unlinking to any user from the PayPal website.
  • Funding instrument: Add Bank/Card, Remove Bank/Card, Confirm Bank/Card, Update card and Set Preferred activities triggered from the PayPal website. Dual control actions are also included for add/remove bank account or card.
  • Payouts: Transaction to pay multiple PayPal accounts, triggered from the PayPal website with or without dual controls.
  • Send Money: Transfer money to a person as family /friends or for goods/services triggered from the PayPal website.
  • Disputes: Appealed case, Accepted case, Escalated case, Made offer, Acknowledged return, Provided evidence, Sent message, Provided supporting information, Created case, Cancelled case, Updated case triggered from PayPal website

Are changes expected in this report?

In order to expand the audit capabilities across PayPal products and platforms, we'll continue to update this report with new activities, actions, rows, and columns. We may also update some existing records to align them better with this evolving audit experience.

How can we provide feedback?

Click the Feedback link on the User Audit report in the PayPal site. Your feedback will help us refine this report.

Is this report available as an SFTP report?

This report is available only as an online report on the PayPal website. Please provide Feedback to let us know if you need an SFTP report.

Is there an API that provides the user audit details?

This report is available only on the PayPal website. Please provide Feedback to let us know if you need API support.

Can I give access to this report to all other users on the account?

This report is available only to the admin user of the PayPal account by default. Admin user can assign Access user audit report permission to secondary user for getting access to the report.

Version history

Pub. DateVersionDescription of Changes
Feb 20221.1Spec change: Added the Login action to ‘Manage login’.
May 20201.0General availability of the report. Spec change: Added the new actions, Updated card and Set preferred payment method, for the ‘Funding instrument’ activity.
Nov 20190.3Spec change: Reformatted specifications: Added new Activity section.

Added new values for the Activity column:
  • Dual controls for Funding Instruments, Payout, Add money and Withdraw Funds
  • Send Money
  • Disputes

Added note to merchants about Update profile action.
Apr 20190.2Spec change: Added new columns:
  • Currency
  • Net Amount
  • User Status

Added new Payout value for the Activity.

Content-only change: Updated descriptions for Transaction ID and Details columns.
Jan 20190.1Initial pilot release.

Effective date for spec changes

DateChanges
May 7, 2019Updated card
Set preferred payment method
Nov 7, 2019Send money
Nov 8, 2019Disputes
Sept 20, 2019Dual control actions: Payout
Nov 5, 2019Dual control actions: Withdraw funds
Dual control actions: Add money
Nov 6, 2019Dual control actions: Funding instruments
Apr 8, 2019Currency
Net amount
User status
May 25, 2019Payout

See also