get/v1/admin/applications/{id}/timeline

Everything that happened to one application

Operation: adminApplicationTimeline
Authentication: API key

The ops view: every lifecycle moment, the internal reads, and every message we sent or failed to send. The applicant-facing route is the same history with the internal actions left out — the allow-list lives in `services/timeline`, so a new audit action is private until somebody decides otherwise.

Request

Parameters

idpathrequiredstring

Responses

200The application and its history, oldest first.

application_idstringrequired

referencestringrequired

statusstringrequired

one of: draftawaiting_paymentpaidsubmittedunder_reviewapprovedrejectedcancelledexpired

timelineobject[]required

400The request body or query failed validation.

errorobjectrequired

401No key, an unknown key, a revoked key, or a key whose tenant is not active. All four return an identical body on purpose: distinguishing them would let a caller discover which partners we have.

errorobjectrequired

403`projects:write` is required. No partner key is ever issued this scope.

errorobjectrequired

404Not found, or not yours. A resource belonging to another tenant answers 404 rather than 403, because 403 would confirm the record exists.

errorobjectrequired

Example

curl

curl -X GET https://api.haavisa.com/v1/admin/applications/<id>/timeline \
  -H "Authorization: Bearer $HAAVISA_API_KEY"

More in Admin

Something unclear? The eligibility guide explains the model behind the answers; the errors guide covers the envelope.