Get Audit Event

Beta
GET/v1/core/audit-events/{id}

This endpoint is idempotent. Learn more

Returns an audit event by ID.

idstring

Audit event ID.

include[]optional arrayenumValues:actorchangesmetadata

Sub-objects to expand in the response. When omitted, sub-objects are returned as null.

idstring

Audit event ID.

objectstringenumValues:audit_event

Resource type identifier.

actionstringenumValues:createupdatedelete

Mutation type.

resource_typestringenumValues:accountactorentity

Resource type of the audited entity.

resource_idstring

Audited resource ID.

actorobjectExpandablenullable

Actor who performed the mutation.

idstring

Actor ID.

objectstringenumValues:actor

Resource type identifier.

typestringenumValues:userapi_keyagent

Actor type.

namestringnullable

Display name.

handlestringnullable

Human-readable handle (email for users, redacted value for API keys, slug for agents).

roleobjectnullable

Assigned role.

Always returned as null in this endpoint.
changesobjectExpandablenullable

Field-level changes recorded for this event.

objectstringenumValues:list

Object type for AuditFieldChange list

page_infoobject

Pagination metadata for AuditFieldChange list

next_cursorstringnullable

Cursor to fetch the next page, null if no more pages.

prev_cursorstringnullable

Cursor to fetch the previous page, null if on the first page.

has_next_pageboolean

Whether more results exist after this page.

has_prev_pageboolean

Whether results exist before this page.

dataarray of object

Array of AuditFieldChange resources in this page

fieldstring

Name of the changed field.

old_valueobject

Previous value as a JSON fragment. Null for creation events.

new_valueobject

New value as a JSON fragment. Null for deletion events.

metadataobjectExpandable

Arbitrary JSON metadata for the mutation (e.g. reason, source, tags).

request_idstringnullable

Originating HTTP request ID.

idempotency_keystringnullable

Idempotency key of the originating request.

source_ipstringnullable

Originating client IP address.

occurred_atstring (date-time)

When the audited mutation occurred.

created_atstring (date-time)

When the audit event record was created.

Responses

200

Successful response for Get Audit Event