---
title: "Get audit log entry"
method: GET
path: "/api/audit-logs/{id}"
tags: ["Audit Logs"]
---

# Get audit log entry

`GET /api/audit-logs/{id}`

## Request

- Base URL: `https://app.cotool.ai`
- URL: `https://app.cotool.ai/api/audit-logs/{id}`
- Auth: HTTP bearer

Retrieve a single audit-log record by its unique identifier.

## Path parameters

- `id` string, required: Unique identifier of the audit log entry to retrieve

## Response `200`

Successful response

- object: Single audit log entry response
  - `id` string, required: Unique identifier for this audit log entry
  - `timestamp` string, required: When the audited event occurred
  - `organizationId` string, uuid, required: Organization where the event took place
  - `event` string, required: Type of event that was audited (e.g., user.login, agent.runStarted)
  - `actor` string, required: Who or what performed the action (user, agent, chat)
  - `userId` string, uuid, nullable, required: ID of the user involved in the event (null if not applicable)
  - `ipAddress` string, nullable, required: IP address where the event originated (null if not applicable)
  - `chatId` string, uuid, nullable, required: ID of the chat involved in the event (null if not applicable)
  - `agentId` string, uuid, nullable, required: ID of the agent involved in the event (null if not applicable)
  - `runId` string, uuid, nullable, required: ID of the agent run involved in the event (null if not applicable)
  - `triggerId` string, uuid, nullable, required: ID of the trigger involved in the event (null if not applicable)
  - `data` object, nullable, required: Additional event-specific data (null if no extra data)
  - `via` object, nullable: The app the user acted through, such as an app connected to the Cotool MCP server (null for actions taken directly in Cotool or with an API key)
    - `appName` string, required
    - `connectionId` string, required
    - `clientId` string, required
    - `type` 'mcp', required
    - `publisher` string, nullable, required
  - `createdAt` string, required: When this audit log entry was created in the database
  - `user` object: Hydrated user information (included when available)
    - `email` string, required: Email address of the user associated with this audit log
  - `agent` object: Hydrated agent information (included when available)
    - `name` string, required: Display name of the agent associated with this audit log
  - `trigger` object: Hydrated trigger information (included when available)
    - `name` string, required: Display name of the trigger associated with this audit log
    - `type` string, required: Type of trigger (e.g., jira, slack, linear, cron)

## Other responses

- `400`: Bad request — input validation failed or the request was malformed
- `401`: Unauthorized — missing or invalid API key / session
- `403`: Forbidden — the authenticated user lacks the required permissions
- `500`: Internal server error

---

[API](https://skmtc.dev/cotool/apis/cotool-api.md) - [All operations](https://skmtc.dev/cotool/apis/cotool-api/llms.txt) - [OpenAPI document](https://skmtc.dev/cotool/apis/cotool-api/revisions/f5abe0add203?raw)