---
title: "GET /v1/events/:event_id — get a single audit event (Admin+); lifecycle events 404."
method: GET
path: "/v1/events/{event_id}"
tags: ["audit-log"]
---

# GET /v1/events/:event_id — get a single audit event (Admin+); lifecycle events 404.

`GET /v1/events/{event_id}`

Retrieve one audit event by its identifier.

## Path parameters

- `event_id` string, uuid, required

## Response `200`

Event details

- EventResponse — A single audit/lifecycle event returned by the API.
  - `actor` union, required — Maximum total length, in characters, of the truncated `command` field in Immutable actor snapshot stored alongside an event.
    - object
      - `kind` 'user', required
      - `label` string, required
      - `redacted_email` string, required
      - `user_id` string, uuid, required
    - object
      - `api_key_id` string, uuid, required
      - `kind` 'api_key', required
      - `name` string, required
    - object
      - `code` string, required
      - `kind` 'system', required
      - `label` string, required
    - object — The authorized SSH key that authenticated a front-door session. The principal SSH actually proves at connect is the *key*, not a person — the scope-only model (D8) doesn't bind a key to a user (a global key may be shared), so the session is attributed to the key (label + fingerprint), while whoever registered it rides the event payload as `added_by`.
      - `fingerprint` string, required — `SHA256:…` fingerprint.
      - `key_id` string, uuid, required
      - `kind` 'ssh_key', required
      - `label` string, nullable — Human label set at registration (e.g. `alice-laptop`), if any.
  - `category` string, required
  - `event_type` string, required
  - `id` string, uuid, required
  - `org_id` string, uuid, required
  - `payload` unknown, required
  - `timestamp` string, date-time, required

## Other responses

- `401` — Unauthorized
- `404` — Event not found

---

[API](https://skmtc.dev/microsandbox/apis/microsandbox-api.md) · [All operations](https://skmtc.dev/microsandbox/apis/microsandbox-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/microsandbox/microsandbox-api/revisions/23f2a45cb09b/schema)