---
title: "Get the interaction session containing an audit log entry"
method: GET
path: "/admin/audit/conversation"
tags: ["admin"]
---

# Get the interaction session containing an audit log entry

`GET /admin/audit/conversation`

Thread entries carry the request/response bodies the
transcript is built from; attempts, request revisions, and
response headers are omitted; redacted request headers are
retained so the dashboard can continue the same session.

## Query parameters

- `log_id` string, required
- `limit` integer

## Response `200`

OK

- AuditlogConversationResult
  - `anchor_id` string
  - `entries` AuditlogLogEntry[]
    - `alias_used` boolean
    - `auth_key_id` string
    - `auth_method` string
    - `cache_type` string
    - `client_ip` string
    - `data` AuditlogLogData
      - `api_key_hash` string
      - `attempts` AuditlogAttemptSnapshot[] — Attempts captures provider calls made for this logical request. SQL stores split this into audit_log_attempts; Mongo stores it embedded.
        - `duration_ns` integer
        - `error_code` string
        - `error_message` string
        - `error_type` string
        - `kind` string
        - `model` string
        - `provider_name` string
        - `provider_type` string
        - `response_body` unknown
        - `response_headers` object
        - `seq` integer
        - `started_at` string
        - `status_code` integer
        - `success` boolean
      - `error_code` string
      - `error_message` string — Error details (message can be long, so kept in JSON)
      - `failover` AuditlogFailoverSnapshot
        - `target_model` string
      - `labels` string[] — Labels are request labels extracted from configured tagging headers.
      - `max_tokens` integer
      - `request_body` unknown
      - `request_body_too_big_to_handle` boolean — Body capture status flags (set when body exceeds 1MB limit)
      - `request_headers` object — Optional headers (when LOGGING_LOG_HEADERS=true) Sensitive headers are auto-redacted
      - `request_revisions` AuditlogRequestRevisionSnapshot[] — RequestRevisions captures the ingress request-rewrite chain: one entry per registered rewriter that ran, in application order. Rewriters that changed the body carry the rewritten body; those that left it alone are recorded with NoChange so the audit trail still shows the step ran. RequestBody always remains the original client request; the last changed revision is what was forwarded downstream — when every rewriter was a no-op there is no such revision and the original body is what went upstream.
        - `body` unknown
        - `bytes_after` integer
        - `bytes_before` integer
        - `detail` unknown
        - `no_change` boolean — NoChange marks a rewriter that ran and left the body untouched. Such revisions record the step for operators — BytesAfter equals BytesBefore, Body is empty and TokensSaved is zero, though Detail may explain why nothing changed — but are not part of the chain that produced the forwarded request. Absent on entries written before no-change steps were tracked, which is why the flag is positive: an old revision always changed the body.
        - `rewriter` string
        - `seq` integer
        - `tokens_saved` integer — TokensSaved is the rewriter-reported estimate of prompt tokens this revision saved (e.g. token compression); zero when the rewriter does not report savings.
      - `response_body` unknown
      - `response_body_too_big_to_handle` boolean
      - `response_headers` object
      - `temperature` number — Request parameters
      - `user_agent` string — Identity
      - `workflow_features` AuditlogWorkflowFeaturesSnapshot
        - `audit` boolean
        - `budget` boolean
        - `cache` boolean
        - `failover` boolean
        - `guardrails` boolean
        - `usage` boolean
    - `duration_ns` integer — DurationNs is the request duration in nanoseconds
    - `error_type` string
    - `id` string — ID is a unique identifier for this log entry (UUID)
    - `method` string
    - `path` string
    - `provider` string — canonical provider type used for routing and filters
    - `provider_name` string
    - `request_id` string — Extracted fields for efficient filtering (indexed in relational DBs)
    - `requested_model` string — Core fields (indexed for queries)
    - `resolved_model` string
    - `session_id` string
    - `status_code` integer
    - `stream` boolean
    - `timestamp` string — Timestamp is when the request started
    - `user_path` string
    - `workflow_version_id` string
  - `truncated` boolean — Truncated reports that the thread walk stopped early because the caller's deadline expired; the entries collected up to that point are returned rather than failing the whole request.

## Other responses

- `400` — Bad Request
- `401` — Unauthorized

## Changes

- **2026-07-28** `19ae6eb873aa` — 1 info
  - added the optional property `entries/items/session_id` to the response with the `200` status
- **2026-07-27** `28e27884d2d6` — 1 info
  - added the optional property `truncated` to the response with the `200` status
- **2026-07-26** `229246ed8c52` — 1 info
  - added the optional property `entries/items/data/allOf[#/components/schemas/auditlog.LogData]/request_revisions/items/no_change` to the response with the `200` status
- **2026-07-08** `c658d104b32e` — 1 info
  - added the optional property `entries/items/data/allOf[#/components/schemas/auditlog.LogData]/request_revisions/items/tokens_saved` to the response with the `200` status
- **2026-07-05** `998978d487e9` — 1 info
  - added the optional property `entries/items/data/allOf[#/components/schemas/auditlog.LogData]/request_revisions` to the response with the `200` status

[Full history](https://skmtc.dev/enterpilot/apis/gomodel-api/changes/admin/audit/conversation/get.md)

---

[API](https://skmtc.dev/enterpilot/apis/gomodel-api.md) · [All operations](https://skmtc.dev/enterpilot/apis/gomodel-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/enterpilot/gomodel-api/revisions/42127fe766e9/schema)