Skip to main content

Auditing and the initiator field

AgencyMax keeps an audit trail of changes to agency data. Because integrations usually call the APIs with a client token rather than a user token, the access token alone doesn't say which person made a change.

That's why many write operations, especially in the Agency Management API, require an initiator in the request body:

{
  "agentCode": "A1001",
  "type": "LIFE",
  "jurisdiction": "US-TX",
  "identifier": "TX-998877",
  "isResidentCertification": true,
  "isVerified": false,
  "initiator": "jsmith@acme-agency.com"
}

What to send​

  • The username or email of the person who started the change in your system, where there is one.
  • For automated processes with no user, a stable, descriptive system name, such as crm-nightly-sync.

The value is stored with the change and returned as lastModifiedBy on resources that expose it. It also appears in AgencyMax audit history.

Guidelines​

  • Don't send one generic value such as api for every change. It makes the audit trail useless when someone asks "who changed this?"
  • Don't put secrets or other sensitive data in initiator.
  • If initiator is missing on an operation that requires it, you get a 400 validation error.