Get Single Audit Event — AuditRails API Reference

The Get Single Event endpoint retrieves every field stored for one specific audit log entry, identified by its log_id. This is useful when you need to inspect full event detail — including hash chain fields — after spotting an entry of interest in a list query or a dashboard. The response includes the same fields available in the list endpoint, plus additional enrichment fields such as actor_type, resource_type, category, severity, and session_id.

Endpoint

GET https://api.auditrails.io/v1/events/{log_id}

Path Parameters

string

required

The ULID identifier of the event to retrieve, for example 01HX7YGBFZ3QK8N9VMJT5RPCE4. ULIDs are case-insensitive and 26 characters long. Passing a malformed value returns a 404.

Response Fields

string

required

Unique ULID identifier for this event.

string

required

The organization that owns this event.

string

required

The project within the organization this event belongs to.

integer

required

Version of the event schema used at ingestion time.

string

required

The logged action name, for example user.login.

string

required

Identifier of the actor who triggered the action.

string

Semantic type of the actor, for example user, service, or system. Present when supplied at ingestion.

string

required

The resource that was acted upon, for example session/sess_abc.

string

Semantic type of the resource, for example session or document. Present when supplied at ingestion.

string

High-level grouping for the action, for example auth or data_access. Derived from the action catalog.

string

Severity level of the event, for example info, warning, or critical. Present when supplied at ingestion or when set by the action catalog.

string

Session identifier linked to this event. Present when supplied at ingestion.

string

Client-supplied timestamp in ISO 8601 format. Distinct from timestamp, which is set server-side at ingestion. Present when supplied at ingestion.

object

Arbitrary key-value payload attached at ingestion. Contents vary by action type; required and optional fields for each action are defined in the action catalog.

string

required

ISO 8601 timestamp (UTC) recorded server-side at ingestion, for example 2025-01-15T10:30:00.123Z.

string

IP address associated with the event, if provided at ingestion.

string

Two-letter ISO country code resolved from ip_address, for example US.

string

City name resolved from ip_address, for example San Francisco.

integer

required

Sequential position of this event in the project’s tamper-evident hash chain.

string

required

SHA-256 hash of the immediately preceding event in the chain. Used to verify chain continuity.

string

required

SHA-256 hash of this event’s canonical payload. To verify, recompute SHA-256(prev_hash + canonical_payload + timestamp) and compare to this value.

Events are scoped to the project associated with your API key. If you request a log_id that exists in a different project, you will receive a 404 read/not_found response — not a 403. This is intentional: returning a 403 would confirm that the event exists, leaking information across project boundaries.

The response body does not include a request_id field. Use the X-Request-Id response header when filing a support request or correlating server-side traces.

Example Request

curl https://api.auditrails.io/v1/events/01HX7YGBFZ3QK8N9VMJT5RPCE4 \
  -H "Authorization: Bearer at_live_xxx"

Example Response

{
  "log_id": "01HX7YGBFZ3QK8N9VMJT5RPCE4",
  "tenant_id": "org_abc123",
  "project_id": "proj_def456",
  "schema_version": 1,
  "action": "user.login",
  "actor_id": "user_123",
  "actor_type": "user",
  "resource": "session/sess_abc",
  "resource_type": "session",
  "category": "auth",
  "severity": "info",
  "session_id": "ses_xyz789",
  "ts_client": "2025-01-15T10:29:59.800Z",
  "metadata": {
    "method": "password"
  },
  "timestamp": "2025-01-15T10:30:00.123Z",
  "ip_address": "203.0.113.1",
  "country": "US",
  "city": "San Francisco",
  "chain_seq": 4271,
  "prev_hash": "a1b2c3d4e5f6789012345678abcdef0123456789abcdef0123456789abcdef01",
  "hash": "f9e8d7c6b5a4321098765432fedcba9876543210fedcba9876543210fedcba98"
}

Error Responses

Status	Code	Description
`401`	`auth/key_not_found`	The API key provided in the `Authorization` header is missing or invalid.
`404`	`read/not_found`	No event with the given `log_id` exists within your project. Also returned when the event exists in a different project.

Overview

Ingestion

Read & Verify

Data Subject Requests

Get Single Audit Event — AuditRails API Reference

Endpoint

Path Parameters

Response Fields

Example Request

Example Response

Error Responses

​Endpoint

​Path Parameters

​Response Fields

​Example Request

​Example Response

​Error Responses

Endpoint

Path Parameters

Response Fields

Example Request

Example Response

Error Responses