---
title: "Get a single entity context"
method: GET
path: "/api/v2/security_monitoring/entity_context/{id}"
tags: ["Security Monitoring"]
---

# Get a single entity context

`GET /api/v2/security_monitoring/entity_context/{id}`

Get a single entity from the Cloud SIEM entity context store by its identifier, returning the historical
revisions of the entity in the requested time range. The endpoint can either return revisions across an
interval (`from` / `to`) or the snapshot of the entity at a single point in time (`as_of`); the two modes
are mutually exclusive.

## Path parameters

- `id` string, required

## Query parameters

- `from` string
- `to` string
- `as_of` string

## Response `200`

OK

- SingleEntityContextResponse — Response from the single entity context endpoint, containing the matching entity.
  - `data` EntityContextEntity, required — A single entity returned by the entity context endpoint.
    - `attributes` EntityContextEntityAttributes, required — The attributes of an entity context entry, grouping all the historical revisions of the entity.
      - `revisions` EntityContextRevision[], required — The historical revisions of the entity, ordered chronologically.
        - `attributes` EntityContextRevisionAttributes, required — The set of attributes recorded for the entity at this revision. The keys depend on the kind of entity.
        - `first_seen_at` string, date-time, required — The first time the entity was observed at this revision.
        - `last_seen_at` string, date-time, required — The last time the entity was observed at this revision.
    - `id` string, required — The unique identifier of the entity.
    - `type` string, required — The type of the entity. Reflects the underlying entity kind from the entity context store (for example, `siem_entity_identity` for identities). Defaults to `entity` when the kind is unknown.

## Other responses

- `400` — Bad Request
- `403` — Not Authorized
- `404` — Not Found
- `429` — Too many requests

---

[API](https://skmtc.dev/datadog/apis/api-v2.md) · [All operations](https://skmtc.dev/datadog/apis/api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/datadog/api-v2/revisions/da68bf029e4c/schema)