User Activity gives you one row for each history event recorded in the ledger - who did what, and when - across every transactional record (bills, invoices, bank transactions, journals, manual journals, credit notes, payments, purchase orders, quotes, bank transfers, pre-payments, over-payments and contacts). Each event is joined to the Xero user who performed it, so you can see both the raw actor name and the resolved user (their email, name and organisation role) wherever the actor could be matched.
Use this data area for control and fraud-risk checks: segregation of duties (the same person both creating and approving a record), after-hours or weekend posting, bulk or high-velocity posting by a single actor, activity by users who have since been deleted, and posting by API or system actors rather than a named person. The resolved user is empty when the actor could not be matched - a deleted user, an API or bot such as xero-api, or an external user - which is itself a useful signal. History coverage and which event types appear depend on the ledger, with Xero being the richest source.
The AI will only look back at 12 months' worth of data.
Key Properties:
SourceLink: A unique key for this history event itself (the history-row identifier, prefixed by entity kind - for example "history/bill/1"). This identifies the activity row, not the record it relates to.
EntityType: The kind of record this activity relates to - one of Bill, Invoice, BankTransaction, Journal, ManualJournal, CreditNote, Payment, PurchaseOrder, Quote, BankTransfer, PrePayment, OverPayment or Contact.
EntitySourceLink: A link back to the target record itself (it matches that record's own SourceLink, such as a Bill or Invoice). Use it to follow a user-activity event back to the underlying transaction. It is empty for entity types that do not expose a link (such as business or tenant history).
Timestamp: The date and time the event was recorded in the ledger. This is the event time (not the transaction date) and is the field used for after-hours, time-clustering and velocity checks.
HistoryType: The type of event - common values are Created, Edit, Approved, Paid, Voided, Deleted and Sent. The ledger may emit other values, so treat the list as open-ended.
MessageText: A human-readable description of what changed, as recorded by the ledger (for example "Changed Due Date" or "Bill created"). On edits there is one row per changed field, so this is useful for keyword-based checks.
ActionedByUserName: The raw actor name as recorded against the event. It is always present and may be a display name, an email, or a system identifier such as "xero-api". Use this to spot bot, API or system activity when the resolved user is empty.
ActionedByUser: The resolved Xero user who performed the action, matched by email or full name. This can be empty when the actor could not be matched (a deleted user, an API or bot, or an external user) - which is itself a signal.
User
EmailAddress: The email address of the resolved user - a stable way to group or count activity by actor.
FirstName: The given name of the resolved user.
LastName: The family name of the resolved user.
FullName: The full display name of the resolved user.
OrganisationRole: The user's Xero organisation role - typical values are STANDARD, ADVISOR, FINANCIALADVISER, MANAGEDCLIENT, INVITED, CASHBOOKCLIENT, READONLY and PAYROLLADMIN.
IsSubscriber: Whether this user is the billing subscriber of the Xero organisation.
IsDeleted: Whether this user has been removed from the organisation - useful for flagging activity by deleted users.
UserCreatedDate: When the user was added to the organisation (not the activity time - that is the Timestamp).
📝 Example Alerts
Alert me when the same person both created and approved a bill (segregation of duties breach).
Alert me when a bill or invoice is created or edited outside business hours (before 7am or after 7pm).
Alert me when one user posts more than 50 transactions in a single day.
Alert me when a transaction is created or edited by a user who has since been deleted from the organisation.
Alert me when a manual journal is posted by an API or system actor rather than a named user.