---
title: "Get an audit entry"
method: GET
path: "/v1/projects/{project_id}/audit-log/{entry_id}"
tags: ["Audit Log"]
---

# Get an audit entry

`GET /v1/projects/{project_id}/audit-log/{entry_id}`

## Request

- Base URL: `https://api.naturali.ai`
- URL: `https://api.naturali.ai/v1/projects/{project_id}/audit-log/{entry_id}`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://api.naturali.ai/authorize`, token URL `https://api.naturali.ai/token`, scopes: `mcp:access`)

Returns a single audit-log entry, including its `detail` payload

## Path parameters

- `entry_id` string, required

## Response `200`

Audit entry details

- AuditEntry
  - `id` string
  - `project_id` string, nullable: Project the action targeted; null for global actions
  - `principal_type` 'user' | 'api_key' | 'agent' | 'automation' | 'approval' | 'system': What kind of principal acted. `user` and `api_key` are authenticated callers, and the id is the user's (`user_…`) or the key's own (`key_…`), so a record names which key acted rather than its owner. `agent` is an agent writing under its own identity (`agent_…`). `automation` is the task engine acting on a dispatch outcome and `approval` an approval resolution; neither carries an id. `system` is the platform itself, with an id naming the mechanism (`retention_sweep`, `zero_retention`).
  - `principal_id` string, nullable: Public id of the principal (`user_…` or `key_…`); null for platform-originated entries
  - `on_behalf_of` OnBehalfOf, nullable: The tool call the write was made on behalf of, for a write a `naturali` tool made; null for any other write. Attribution only: the `created_by_principal_*` pair and the permissions checked are the project credential's.
    - `tool_id` string, nullable
    - `agent_id` string, nullable: The agent whose turn called the tool
    - `generation_id` string, nullable: The generation that called the tool
    - `session_id` string, nullable
    - `actor_id` string, nullable
  - `action` string: The permission-action string that authorized the request
  - `resource_srn` string, nullable: SRN the action targeted (type-level `srn:{project}:{type}:*` on creates)
  - `resource_public_id` string, nullable: Target resource public id (from the SRN, or the response body on creates)
  - `status` integer: HTTP status of the response
  - `request_id` string, nullable: Per-request correlation id (also returned in the X-Request-Id header)
  - `ip` string, nullable
  - `user_agent` string, nullable
  - `detail` object, nullable: Kind-specific payload. Multi-check routes record the remaining checks under `additional_checks`. Platform-originated entries set a `detail.kind` discriminator, e.g. `quota_monitor_breach` or `guardrail_evaluation`.
  - `created_at` string, date-time

## Other responses

- `401`: Unauthorized
- `403`: Forbidden
- `404`: Audit entry not found

---

[API](https://skmtc.dev/naturali/apis/naturali-ai-api.md) · [All operations](https://skmtc.dev/naturali/apis/naturali-ai-api/llms.txt) · [OpenAPI document](https://skmtc.dev/naturali/apis/naturali-ai-api/revisions/e4905b78f422?raw)