CreatedBy missing when submitted trough API


I want to create some audit logs using the afterCreate lifecycle but I am missing the createdBy in the event.result.
Even when I create an entry trough the API using an Admin role frontend user’s bearer token, the createdBy in the strapi admin panel is empty.

Why is this?

If I’m correct, the only way I can tackle the audit log issue now (need to track WHO did it) is by using middleware as the middleware has the request info with the user.

Is this all correct or am I missing something?