Audit

Get Audit Entry

Changed on

Get a single audit entry by ID.

get/audit/{audit_id}

Request

  • Base URL: / (relative, and the document was published on a file host, not at the API’s origin)
  • URL: /audit/{audit_id}
  • Auth: one of:
    • HTTP bearer
    • OAuth 2 (authorization code, authorization URL /authorize, token URL /oauth/token)

Path parameters

audit_idstring required

ID of the audit entry.

Example:aud_6968b3984275d71e90f7f09f

Response

Successful Response

actionstring required

The audited action, e.g. create, update or revoke.

actor_idstring nullable

ID of the actor that performed the action; null if unknown.

actor_session_idstring nullable

Session the actor acted under; null if not recorded.

actor_typestring required

Kind of actor that performed the action, e.g. user or agent.

afterobject nullable

Snapshot of the target after the action; null if none.

beforeobject nullable

Snapshot of the target before the action; null if none.

diffobject nullable

Changes between before and after, keyed added, removed and modified (each modified key maps to old/new); null when nothing changed.

idstring required

Unique ID of the audit entry.

ip_addressstring nullable

Client IP address of the triggering request, if recorded.

job_idstring nullable

ID of the job the action ran under, if any.

occurred_atstring date-time required

When the audited action happened (RFC 3339).

originstring nullable

Surface the action was initiated from, e.g. dashboard, cli, api, agent, mcp or system; null if not recorded.

reasonstring nullable

Reason recorded for the action; null if none was given.

request_idstring nullable

ID of the request that triggered the action, if recorded.

target_idstring required

ID of the entity the action was performed on.

target_parent_idstring nullable

ID of the target's parent entity; null when not applicable.

target_typestring required

Type of the entity the action was performed on.

trace_idstring nullable

Trace ID of the triggering request, if recorded.

user_agentstring nullable

User-Agent of the triggering request, if recorded.

Example response

{
  "action": "update",
  "actor_id": "usr_6968b3987ee4c3ec0b4ee3b9",
  "actor_session_id": "5f0c2a9e-3b7d-4c1a-9e8f-2d6b4a1c7e30",
  "actor_type": "user",
  "after": {
    "active": true,
    "name": "Stripe production key"
  },
  "before": {
    "active": true,
    "name": "Stripe test key"
  },
  "diff": {
    "added": {},
    "modified": {
      "name": {
        "new": "Stripe production key",
        "old": "Stripe test key"
      }
    },
    "removed": {}
  },
  "id": "aud_6968b3984275d71e90f7f09f",
  "ip_address": "203.0.113.42",
  "job_id": "job_6968b3985e8c9902207afaeb",
  "occurred_at": "2026-01-15T09:30:00Z",
  "origin": "dashboard",
  "reason": "Rotated to the production key",
  "request_id": "req_6968b3984d1c238d",
  "target_id": "cred_6968b39855d91a3561684b32",
  "target_parent_id": "agnt_6968b3984d1c238dbe7e2e29",
  "target_type": "credential",
  "trace_id": "4bf92f3577b34da6a3ce929d0e0e4736",
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15"
}

Changes