Get upload change history

Returns blame audit rows for one upload (newest first). Requires read permission on the upload.

Authorization

bearerAuth

AuthorizationBearer <token>

In: header

Path Parameters

id*string

Response Body

`application/json`

curl -X GET "https://example.com/v1/uploads/497f6eca-6276-4993-bfeb-53cbbbba6f08/history"

[
  {
    "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
    "action": "string",
    "user_id": "a169451c-8525-4352-b8ca-070dd449a1a5",
    "user_name": "string",
    "created_at": "2019-08-24T14:15:22Z",
    "changes": [
      {
        "field": "string",
        "old": null,
        "new": null
      }
    ]
  }
]

{
  "status": 400,
  "code": "uploads.invalid_file_extension",
  "message": "Invalid file extension"
}

{
  "status": 401,
  "message": "Unauthorized",
  "code": "common.unauthorized",
  "class": "business"
}

{
  "status": 403,
  "message": "No access to the record",
  "code": "common.rbac_no_rec_access",
  "class": "business"
}

{
  "status": 404,
  "code": "uploads.record_not_found",
  "message": "Record not found"
}

{
  "status": 429,
  "message": "Rate limit for 203.0.113.7 to /v1/uploads exceeded.",
  "code": "rate_limits_m.exceeded",
  "class": "temporary",
  "retryable": true
}

{
  "status": 500,
  "message": "Internal server error",
  "code": "common.server_error",
  "class": "business"
}

{
  "overall_status": "unhealthy",
  "message": "Service is shutting down",
  "timestamp": "2026-08-27T15:04:05Z"
}

Authorization

Path Parameters

Response Body

200application/json

400application/json

401application/json

403application/json

404application/json

429application/json

500application/json

503application/json

Example invalidFileExtension

Example invalidDocumentType

Example invalidUploadInput

Example fileTooLarge

rbac.CanCallAPIv0 denied the endpoint grant — the helper's default code

The tenant's licence does not cover the uploads module

The handler's own record-level check — the common case

Example uploadNotFound

Example customerNotFound

The per-user or per-IP limit for this endpoint

The same refusal from common/rbac — the code is a raw English string, not a key

Graceful shutdown — LifecycleMiddleware, root router, not the envelope

ensureCacheAvailable could not reach the auth cache — the envelope

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`