# OSHA 300 log (https://developers.asip.io/docs/queries/osha-300-log) Recordable cases on the OSHA 300 log at your establishments. Privacy cases read "Privacy Case", and names are never returned through an API key. > **Status: Available on request.** API keys, the read-only Data API, the MCP server (with an API key) and signed webhooks are live on app.asip.io. Developer access is off by default for every company: ask ASIP to enable it for yours (https://developers.asip.io/docs/how-to-get-access). One-click OAuth sign-in for AI connectors (claude.ai, ChatGPT, Copilot) is not available yet; use an API key. The changelog at https://developers.asip.io/docs/changelog says when each part becomes available. | | | | --------- | --------------------------------------------------------------------------------------------------------------------------------- | | Data API | `GET /api/v1/data/osha-300-log` and `GET /api/v1/data/osha-300-log/feed` ([endpoint reference](/docs/api-reference/osha-300-log)) | | MCP query | `query://asip/osha_300_log` | | Scope | `osha:read` | | Module | OSHA, switched on at the establishment (station) | | Filters | `cursor`, `limit`, `updatedSince`, `stationId` (list only) | | Order | `updatedAt`, then `id`: the feed delivers new **and changed** cases | ## Who can read it OSHA recordkeepers in an oversight role. The key's owner needs **both**: * an **oversight role**; and * one of the OSHA permissions **Manage OSHA recordkeeping**, **Determine OSHA recordability**, **Certify the annual OSHA 300A** or **Authorise and submit an OSHA ITA filing**. Anyone else gets `403 restricted`. The two OSHA permissions that deal with identities, **Place employee names on the OSHA 300 log** and access to the confidential identity list, never count here and are never carried by a key. Only cases determined **recordable** are listed, at the establishments in the owner's scope where the OSHA module is on. ## What each record carries | Field | Meaning | | ---------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `id`, `module`, `url` | The case's ASIP id, `osha`, and a link to it in ASIP. | | `caseNumber` | The OSHA case number (column A). | | `stationId`, `departmentId` | The establishment, and the department if there is one. | | `coveredYear` | The year of the log. | | `employeeName` | Column B. See [Names](#names) below. | | `employeeNameBasis` | Why `employeeName` holds what it holds. | | `isPrivacyCase` | `true` for a privacy case. | | `description` | Column F, the general description of the injury or illness. `null` for a privacy case with no reviewer description: ASIP never fills it from the safety report's narrative. | | `outcomeColumn` | Columns G to J: the most serious outcome. | | `caseTypeColumn` | Column M: the injury or illness type. | | `daysAway`, `daysRestricted` | Columns K and L, **as reported on the log**, capped at 180 days combined. | | `daysCapped` | `true` when the reported counts are capped below the days ASIP recorded. | | `status`, `createdAt`, `updatedAt` | The case's workflow state and times. | ### Names * **A privacy case always reads `"Privacy Case"`** in `employeeName`, with `employeeNameBasis` `privacy_case`, as 29 CFR 1904.29(b)(9) requires. This is true whoever is asking. * **Every other case has `employeeName: null` through an API key.** Placing a name on the log needs the permission **Place employee names on the OSHA 300 log**, which is never carried by a key, so `employeeNameBasis` says why the name is not there (normally `capability_not_held`). The other values of `employeeNameBasis` (`source_injured_person`, `no_source_report`, `no_identified_person`, `ambiguous_identified_person`, `name_not_recorded`, `source_unavailable`) explain a name ASIP placed or could not place; the full list is in the [endpoint reference](/docs/api-reference/osha-300-log). ## What is left out, and why * **The confidential identity list of privacy cases is never read** by this query, so it cannot reach a response, whatever the caller's role, a Company Super Admin's included. * **Employee names through a key**, as above. Names on the 300 log are placed by a person with that permission, inside ASIP. * The privacy request details (rule keys, when it was received, who recorded it, evidence), the source safety report id, the case facts, the exact uncapped day counts, and internal user and decision ids. OSHA case numbers appear only in the two OSHA queries, never in safety reports, CAPA or any other result. See [The Rulebook](/docs/rulebook#osha-case-numbers-outside-the-osha-log). ## Feed The feed is ordered by `updatedAt`, so a change to a case delivers it again. Like every feed, it stops 30 seconds behind the current time. See [Keeping in sync with /feed](/docs/api-reference#keeping-in-sync-with-feed). > **Warning:** ASIP supports recordkeeping; it does not certify it > > The log is your company's responsibility. Data from ASIP is an input to that work, checked by a > person, not a finished filing.