---
title: "Heavy fields of one event (trace, origin, detail, your note; source admin-only)"
method: GET
path: "/api/event/{id}"
tags: ["Events"]
---

# Heavy fields of one event (trace, origin, detail, your note; source admin-only)

`GET /api/event/{id}`

## Request

- Base URL: `https://eyalsec.com`
- URL: `https://eyalsec.com/api/event/{id}`
- Auth: one of:
  - API key in header `X-API-Key`
  - API key in cookie `__Host-es2session`

Returns the large per-event fields that /api/get_all_events_with_count/ deliberately omits: trace, source, origin, repr_created, detail, source_code and sink_code, plus comment (the text of your note on the event, empty when there is none), extension ({id, name, version, label} of the browser extension an es-chromium event is attributed to, all empty otherwise) and runs (the programs that produced the event, newest first, at most 50: {run_uid, cmdline, env, count, first_seen, last_seen}, with values that look like secrets masked; env is empty unless the machine sends it, and the list is empty for an event reported without run context), and requests (the web requests an es-python event happened in, newest first, at most 50: {ip, peer, method, path, host, count, first_seen, last_seen}; ip is the client address web protection attributed the request to, peer the connection address when it differs, and query values whose names look like secrets are masked; empty outside a web request). source_code and sink_code are listings of the program's own source around the line that created the tainted value and the line that consumed it, each beginning with a "<path>:<line>" header line; both are empty unless that machine is set to send them. The id is element 7 of an events-list row. source is the forensic taint chain and is blank for non-admin accounts. Ownership is a predicate in the lookup, not a check after it, so an event belonging to another account 404s exactly like a missing one, and so does an event of a product your account no longer holds. rule_source is the value a rule's source field takes to match this event's taint source: a built-in source name, a number for one of your own sources, or any when the source is unknown.

This is a **read**: a read-only API key may call it.

## Path parameters

- `id` integer, required

## Response `200`

OK.

- object

## Other responses

- `401`: The API key is missing, wrong, revoked or expired.
- `429`: A rate limit was hit, or the account is locked after wrong passwords. Retry-After gives the seconds to wait.
- `default`: An error. Check the status first; the body carries a short message, as JSON ({"error": "..."}) on most endpoints and as plain text on some. 400: malformed JSON, an invalid regex, an unreadable cursor or date, or an unknown value. 401: the API key is missing, wrong, revoked or expired. 403: a failed CSRF check, a read-only key trying to write, a product or feature not enabled on your account, a wrong password, or a write on an account limited to reading. 404: not found, including things that belong to another account. 409: conflict with the current state. 422: a field is missing or invalid. 429: a rate limit was hit, or the account is locked after wrong passwords. 500: something failed on our side.

---

[API](https://skmtc.dev/eyalsec/apis/eyalsec-api.md) · [All operations](https://skmtc.dev/eyalsec/apis/eyalsec-api/llms.txt) · [OpenAPI document](https://skmtc.dev/eyalsec/apis/eyalsec-api/revisions/dc7520689cf1?raw)