# Reporting and audit data

> Pull delivery and membership data through the API, export Message reports and the Audit log as CSV from BloomText, and read audit events through the API.

Source: https://www.bloomtext.com/developers/api/reporting-and-audit/

What your organization can pull for its own reporting, an audit or a legal request, without asking BloomText: what the API returns, what Owners and IT export from BloomText, and the audit events API.

| You need | Where | Who |
| --- | --- | --- |
| Every text sent to patients and whether it arrived | [`GET /patient-messages`](#delivery-reporting) or [Message reports](#message-reports) | A key with `messages.read`, or Owners and IT |
| Who was added to or removed from an organization | [`GET /member-events`](#membership-changes) | A key with `members.read` |
| Who signed in, opened a chat, exported or changed something | [Audit log](#audit-log) | Owners and IT |
| The same audit events, in your own tools | [Audit events API](#audit-events-api) | A key with `audit.read` |

## Through the API

Each call reads one organization. A key that reaches several organizations names one with `org_id`; list them with [`GET /orgs`](https://www.bloomtext.com/developers/api/reference/list-orgs/). See [Organizations a key reaches](https://www.bloomtext.com/developers/api/api-keys/#organizations-a-key-reaches).

### Delivery reporting

[`GET /patient-messages`](https://www.bloomtext.com/developers/api/reference/list-patient-messages/) returns patient messages in a time range, each with its delivery status. Narrow it with `q`: `is:failed`, `is:undelivered`, `is:rejected` (BloomText didn't send it, for example because the patient opted out), `is:queued`, `is:sent` or `is:delivered`.

```bash filename="Request"
curl -G https://api.bloomtext.com/v1/patient-messages \
  -H "Authorization: Bearer $BLOOMTEXT_API_KEY" \
  --data-urlencode "org_id=$ORG_ID" \
  --data-urlencode 'after=2026-10-01' \
  --data-urlencode 'before=2026-11-01' \
  --data-urlencode 'q=is:failed'
```

Follow `next_cursor` to read the whole range; see [Pagination](https://www.bloomtext.com/developers/api/pagination/). Each message's `delivery` says what happened and, for a text that didn't arrive, why. See [Delivery status](https://www.bloomtext.com/developers/api/send-messages/#delivery-status) and [Search messages](https://www.bloomtext.com/developers/api/search/).

### Membership changes

[`GET /member-events`](https://www.bloomtext.com/developers/api/reference/list-member-events/) lists who was added, approved or removed in an organization, newest first, and who did it: a person, `API key: <name>`, or `Okta directory` for changes Directory Sync made. Use it to check what a provisioning sync or Okta did. See [Manage members](https://www.bloomtext.com/developers/api/members-api/#see-what-changed).

## In BloomText, for Owners and IT

Your account's Owners and IT people export these from **Settings → Account**, across every organization on the account. Neither has an API endpoint; for delivery data in your own tools, use [`GET /patient-messages`](#delivery-reporting).

### Message reports

The **Reports** tab lists every text your organizations sent to patients and whether it reached the patient's phone, with its organization, team, source (**Staff**, **API** with the key's name, **Campaign**, or **Automatic**) and status. It covers up to 30 days across all organizations, or up to 90 days for one. **Export CSV** downloads up to 50,000 texts. It never shows or exports message text. BloomText turns Reports on per account. See [Message reports](https://www.bloomtext.com/how-to/admin/message-reports/) in the admin help.

### Audit log

The **Audit** tab records who did what: sign-ins and failed sign-ins, chat views, exports, and changes to members, teams, settings and patient records. Changes an API key made show as **API key: HR sync**. **Download CSV** holds up to 12 months and 10,000 events per file. Events are kept for six years, and message text is never recorded. BloomText turns the audit log on per account, and recording starts that day. See [Audit log](https://www.bloomtext.com/how-to/security/audit-log/) in the admin help.

## Audit events API

> Your BloomText team turns this on for your account. [Request access](https://calendly.com/tyler-bloom/bloomtext-homepage-demo-request?utm_campaign=api-access&utm_content=audit-events)

[`GET /audit-events`](https://www.bloomtext.com/developers/api/reference/list-audit-events/) returns the audit log's events for one organization, newest first, so a SIEM or compliance tool can collect them on a schedule. It takes the audit log's filters: a time range with `after` and `before`, a person, actions and a patient. It needs a key with the `audit.read` scope.

Each event names its action with the same dotted name the audit log's CSV uses, grouped as in the log:

| Group | Actions |
| --- | --- |
| Sign-ins | `user.signed_in`, `user.sign_in_failed`, `user.signed_out`, `support.signed_in`, `support.signed_out` |
| Chat views | `chat.viewed` |
| Exports | `chat.exported`, `members.exported`, `sms_logs.exported`, `audit_log.exported` |
| Members and teams | `member.role_changed`, `member.added`, `member.removed`, `team.member_added`, `team.member_removed`, `member.password_reset`, `member.moved`, `member.deleted` |
| Settings | `org.setting_changed`, `audit_log.turned_on`, `audit_log.turned_off` |
| Patients | `patient.created`, `patient.updated`, `patient.archived`, `patient.restored`, `patients.imported`, `patient.deleted`, `patient.account_deleted`, `message.deleted` |

```bash filename="Request"
curl -G https://api.bloomtext.com/v1/audit-events \
  -H "Authorization: Bearer $BLOOMTEXT_API_KEY" \
  --data-urlencode "org_id=$ORG_ID" \
  --data-urlencode 'after=2026-10-01' \
  --data-urlencode 'action=chat.viewed'
```

Like the audit log, events hold labels only, never message text or a patient's field values. See [The Audit event object](https://www.bloomtext.com/developers/api/reference/audit-event-object/).

## Related

- [Security and BAA](https://www.bloomtext.com/developers/api/security-and-baa/)
- [Manage members](https://www.bloomtext.com/developers/api/members-api/)
- [Read messages](https://www.bloomtext.com/developers/api/read-messages/)