---
title: "Get audit log entry detail"
method: GET
path: "/admin/audit/detail"
tags: ["admin"]
---

# Get audit log entry detail

`GET /admin/audit/detail`

Returns one audit log entry enriched with usage summary when available.

## Query parameters

- `log_id` string, required

## Response `200`

OK

- AdminAuditLogEntryResponse
  - `alias_used` boolean
  - `auth_key_id` string
  - `auth_method` string
  - `cache_type` string
  - `client_ip` string
  - `data` AuditlogLogData
    - `api_key_hash` string
    - `attempts` AuditlogAttemptSnapshot[] — Attempts captures provider calls made for this logical request. SQL stores split this into audit_log_attempts; Mongo stores it embedded.
      - `duration_ns` integer
      - `error_code` string
      - `error_message` string
      - `error_type` string
      - `kind` string
      - `model` string
      - `provider_name` string
      - `provider_type` string
      - `response_body` unknown
      - `response_headers` object
      - `seq` integer
      - `started_at` string
      - `status_code` integer
      - `success` boolean
    - `error_code` string
    - `error_message` string — Error details (message can be long, so kept in JSON)
    - `failover` AuditlogFailoverSnapshot
      - `target_model` string
    - `labels` string[] — Labels are request labels extracted from configured tagging headers.
    - `max_tokens` integer
    - `request_body` unknown
    - `request_body_too_big_to_handle` boolean — Body capture status flags (set when body exceeds 1MB limit)
    - `request_headers` object — Optional headers (when LOGGING_LOG_HEADERS=true) Sensitive headers are auto-redacted
    - `request_revisions` AuditlogRequestRevisionSnapshot[] — RequestRevisions captures the ingress request-rewrite chain: one entry per registered rewriter that changed the body, in application order. RequestBody always remains the original client request; the last revision is what was forwarded downstream.
      - `body` unknown
      - `bytes_after` integer
      - `bytes_before` integer
      - `detail` unknown
      - `rewriter` string
      - `seq` integer
      - `tokens_saved` integer — TokensSaved is the rewriter-reported estimate of prompt tokens this revision saved (e.g. token compression); zero when the rewriter does not report savings.
    - `response_body` unknown
    - `response_body_too_big_to_handle` boolean
    - `response_headers` object
    - `temperature` number — Request parameters
    - `user_agent` string — Identity
    - `workflow_features` AuditlogWorkflowFeaturesSnapshot
      - `audit` boolean
      - `budget` boolean
      - `cache` boolean
      - `failover` boolean
      - `guardrails` boolean
      - `usage` boolean
  - `duration_ns` integer — DurationNs is the request duration in nanoseconds
  - `error_type` string
  - `id` string — ID is a unique identifier for this log entry (UUID)
  - `method` string
  - `path` string
  - `provider` string — canonical provider type used for routing and filters
  - `provider_name` string
  - `request_id` string — Extracted fields for efficient filtering (indexed in relational DBs)
  - `requested_model` string — Core fields (indexed for queries)
  - `resolved_model` string
  - `status_code` integer
  - `stream` boolean
  - `timestamp` string — Timestamp is when the request started
  - `usage` UsageRequestUsageSummary
    - `cache_write_input_tokens` integer
    - `cached_input_ratio` number
    - `cached_input_tokens` integer
    - `entries` integer
    - `estimated_cached_characters` integer
    - `input_tokens` integer
    - `output_tokens` integer
    - `rewrite_cost_saved` number
    - `rewrite_tokens_saved` integer
    - `total_tokens` integer
    - `uncached_input_tokens` integer
  - `user_path` string
  - `workflow_version_id` string

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `404` — Not Found
- `500` — Internal Server Error

## Changes

- **2026-07-08** `c658d104b32e` — 3 info
  - added the optional property `data/allOf[#/components/schemas/auditlog.LogData]/request_revisions/items/tokens_saved` to the response with the `200` status
  - added the optional property `usage/rewrite_cost_saved` to the response with the `200` status
  - added the optional property `usage/rewrite_tokens_saved` to the response with the `200` status
- **2026-07-05** `998978d487e9` — 1 info
  - added the optional property `data/allOf[#/components/schemas/auditlog.LogData]/request_revisions` to the response with the `200` status
- **2026-07-04** `b559d13a3057` — 1 info
  - added the optional property `data/allOf[#/components/schemas/auditlog.LogData]/labels` to the response with the `200` status
- **2026-07-01** `145e48ccfd43` — 1 warning, 2 info
  - removed the optional property `data/allOf[#/components/schemas/auditlog.LogData]/workflow_features/allOf[#/components/schemas/auditlog.WorkflowFeaturesSnapshot]/fallback` from the response with the `200` status
  - added the optional property `data/allOf[#/components/schemas/auditlog.LogData]/attempts` to the response with the `200` status
  - added the optional property `data/allOf[#/components/schemas/auditlog.LogData]/workflow_features/allOf[#/components/schemas/auditlog.WorkflowFeaturesSnapshot]/failover` to the response with the `200` status
- **2026-05-22** `4473702da82e` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/enterpilot/apis/gomodel-api/changes/admin/audit/detail/get.md)

---

[API](https://skmtc.dev/enterpilot/apis/gomodel-api.md) · [All operations](https://skmtc.dev/enterpilot/apis/gomodel-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/enterpilot/gomodel-api/revisions/a807d76b5ae5/schema)