> ## Documentation Index
> Fetch the complete documentation index at: https://docs.auditrails.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Single Audit Event — AuditRails API Reference

> Fetch complete details of a single audit log event by its ULID log_id, including all hash chain fields for independent tamper verification.

The Get Single Event endpoint retrieves every field stored for one specific audit log entry, identified by its `log_id`. This is useful when you need to inspect full event detail — including hash chain fields — after spotting an entry of interest in a list query or a dashboard. The response includes the same fields available in the list endpoint, plus additional enrichment fields such as `actor_type`, `resource_type`, `category`, `severity`, and `session_id`.

## Endpoint

```
GET https://api.auditrails.io/v1/events/{log_id}
```

## Path Parameters

<ParamField path="log_id" type="string" required>
  The ULID identifier of the event to retrieve, for example `01HX7YGBFZ3QK8N9VMJT5RPCE4`. ULIDs are case-insensitive and 26 characters long. Passing a malformed value returns a `404`.
</ParamField>

## Response Fields

<ResponseField name="log_id" type="string" required>
  Unique ULID identifier for this event.
</ResponseField>

<ResponseField name="tenant_id" type="string" required>
  The organization that owns this event.
</ResponseField>

<ResponseField name="project_id" type="string" required>
  The project within the organization this event belongs to.
</ResponseField>

<ResponseField name="schema_version" type="integer" required>
  Version of the event schema used at ingestion time.
</ResponseField>

<ResponseField name="action" type="string" required>
  The logged action name, for example `user.login`.
</ResponseField>

<ResponseField name="actor_id" type="string" required>
  Identifier of the actor who triggered the action.
</ResponseField>

<ResponseField name="actor_type" type="string">
  Semantic type of the actor, for example `user`, `service`, or `system`. Present when supplied at ingestion.
</ResponseField>

<ResponseField name="resource" type="string" required>
  The resource that was acted upon, for example `session/sess_abc`.
</ResponseField>

<ResponseField name="resource_type" type="string">
  Semantic type of the resource, for example `session` or `document`. Present when supplied at ingestion.
</ResponseField>

<ResponseField name="category" type="string">
  High-level grouping for the action, for example `auth` or `data_access`. Derived from the action catalog.
</ResponseField>

<ResponseField name="severity" type="string">
  Severity level of the event, for example `info`, `warning`, or `critical`. Present when supplied at ingestion or when set by the action catalog.
</ResponseField>

<ResponseField name="session_id" type="string">
  Session identifier linked to this event. Present when supplied at ingestion.
</ResponseField>

<ResponseField name="ts_client" type="string">
  Client-supplied timestamp in ISO 8601 format. Distinct from `timestamp`, which is set server-side at ingestion. Present when supplied at ingestion.
</ResponseField>

<ResponseField name="metadata" type="object">
  Arbitrary key-value payload attached at ingestion. Contents vary by action type; required and optional fields for each action are defined in the [action catalog](/api-reference/actions).
</ResponseField>

<ResponseField name="timestamp" type="string" required>
  ISO 8601 timestamp (UTC) recorded server-side at ingestion, for example `2025-01-15T10:30:00.123Z`.
</ResponseField>

<ResponseField name="ip_address" type="string">
  IP address associated with the event, if provided at ingestion.
</ResponseField>

<ResponseField name="country" type="string">
  Two-letter ISO country code resolved from `ip_address`, for example `US`.
</ResponseField>

<ResponseField name="city" type="string">
  City name resolved from `ip_address`, for example `San Francisco`.
</ResponseField>

<ResponseField name="chain_seq" type="integer" required>
  Sequential position of this event in the project's tamper-evident hash chain.
</ResponseField>

<ResponseField name="prev_hash" type="string" required>
  SHA-256 hash of the immediately preceding event in the chain. Used to verify chain continuity.
</ResponseField>

<ResponseField name="hash" type="string" required>
  SHA-256 hash of this event's canonical payload. To verify, recompute `SHA-256(prev_hash + canonical_payload + timestamp)` and compare to this value.
</ResponseField>

<Note>
  Events are scoped to the project associated with your API key. If you request a `log_id` that exists in a different project, you will receive a `404 read/not_found` response — not a `403`. This is intentional: returning a `403` would confirm that the event exists, leaking information across project boundaries.
</Note>

<Note>
  The response body does not include a `request_id` field. Use the `X-Request-Id` response header when filing a support request or correlating server-side traces.
</Note>

## Example Request

```bash theme={null}
curl https://api.auditrails.io/v1/events/01HX7YGBFZ3QK8N9VMJT5RPCE4 \
  -H "Authorization: Bearer at_live_xxx"
```

## Example Response

```json theme={null}
{
  "log_id": "01HX7YGBFZ3QK8N9VMJT5RPCE4",
  "tenant_id": "org_abc123",
  "project_id": "proj_def456",
  "schema_version": 1,
  "action": "user.login",
  "actor_id": "user_123",
  "actor_type": "user",
  "resource": "session/sess_abc",
  "resource_type": "session",
  "category": "auth",
  "severity": "info",
  "session_id": "ses_xyz789",
  "ts_client": "2025-01-15T10:29:59.800Z",
  "metadata": {
    "method": "password"
  },
  "timestamp": "2025-01-15T10:30:00.123Z",
  "ip_address": "203.0.113.1",
  "country": "US",
  "city": "San Francisco",
  "chain_seq": 4271,
  "prev_hash": "a1b2c3d4e5f6789012345678abcdef0123456789abcdef0123456789abcdef01",
  "hash": "f9e8d7c6b5a4321098765432fedcba9876543210fedcba9876543210fedcba98"
}
```

## Error Responses

| Status | Code                 | Description                                                                                                              |
| ------ | -------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| `401`  | `auth/key_not_found` | The API key provided in the `Authorization` header is missing or invalid.                                                |
| `404`  | `read/not_found`     | No event with the given `log_id` exists within your project. Also returned when the event exists in a different project. |