---
title: "Get an exec-audit session detail (internal)"
method: GET
path: "/internal/exec-audit/sessions/{session_id}"
tags: ["Exec-Audit"]
---

# Get an exec-audit session detail (internal)

`GET /internal/exec-audit/sessions/{session_id}`

## Path parameters

- `session_id` string, required

## Headers

- `X-Internal-Secret` string, required

## Response `200`

OK

- AuditSessionDetail
  - `first_calls` AuditCallSummary[], required
    - `exe_id` string, required
    - `id` string, required
    - `request_sha256` string
    - `request_size` integer
    - `rpc_id` string
    - `rpc_kind` string
    - `rpc_method` string
    - `session_id` string
    - `source` string, required — envmcp|rest|relay
    - `started_at` string, required — RFC3339
    - `user_id` string
    - `workspace_id` string, required
  - `session` AuditSessionSummary, required
    - `bytes_to_backend` integer
    - `bytes_to_client` integer
    - `client_ip` string
    - `close_reason` string
    - `closed_at` string — RFC3339
    - `exe_id` string, required
    - `frames_to_backend` integer
    - `frames_to_client` integer
    - `id` string, required
    - `opened_at` string, required — RFC3339
    - `stream_id` string, required
    - `turn_id` string
    - `user_id` string
    - `workspace_id` string, required

## Other responses

- `401` — Unauthorized
- `404` — Not Found
- `500` — Internal Server Error

## Changes

- **2026-05-24** `719bc8d6808a` — 6 warning
  - removed the optional property `first_calls/items/completed_at` from the response with the `200` status
  - removed the optional property `first_calls/items/duration_ms` from the response with the `200` status
  - removed the optional property `first_calls/items/error_summary` from the response with the `200` status
  - removed the optional property `first_calls/items/is_error` from the response with the `200` status
  - …2 more
- **2026-05-23** `04ebb6ce7b06` — 1 info
  - endpoint added
- **2026-05-22** `1ba39f384b63` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/agentserver/apis/agentserver-api/changes/internal/exec-audit/sessions/:session_id/get.md)

---

[API](https://skmtc.dev/agentserver/apis/agentserver-api.md) · [All operations](https://skmtc.dev/agentserver/apis/agentserver-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/agentserver/agentserver-api/revisions/e8c329825b4e/schema)