---
title: "Get Security Event"
method: POST
path: "/security-events/{id}/get-item"
tags: ["Security Event"]
---

# Get Security Event

`POST /security-events/{id}/get-item`

## Request

- Base URL: `https://oneuptime.com/api`
- URL: `https://oneuptime.com/api/security-events/{id}/get-item`
- Auth: API key in header `APIKey`
- TypeScript: <https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/docs/security-events/:id/get-item/post.ts> (a function with typed inputs; its response is checked against the schema)

Endpoint to retrieve a single Security Event by ID

## Path parameters

- `id` string, uuid, required

## Request body

- object
  - `select` SecurityEventItemV1SelectSchema: Select schema for SecurityEventItemV1. Set fields to true to include them in the response.
    - `projectId` boolean
    - `primaryEntityId` boolean
    - `primaryEntityType` boolean
    - `time` boolean
    - `eventUid` boolean
    - `categoryUid` boolean
    - `categoryName` boolean
    - `classUid` boolean
    - `className` boolean
    - `activityName` boolean
    - `severityId` boolean
    - `severityName` boolean
    - `statusName` boolean
    - `message` boolean
    - `vendorName` boolean
    - `productName` boolean
    - `ruleId` boolean
    - `ruleName` boolean
    - `mitreTactics` boolean
    - `mitreTechniques` boolean
    - `principalUser` boolean
    - `principalHost` boolean
    - `principalIp` boolean
    - `principalProcess` boolean
    - `processName` boolean
    - `processPath` boolean
    - `processCommandLine` boolean
    - `parentProcessName` boolean
    - `parentProcessPath` boolean
    - `parentProcessCommandLine` boolean
    - `targetUser` boolean
    - `targetHost` boolean
    - `targetIp` boolean
    - `targetPort` boolean
    - `targetResource` boolean
    - `observables` boolean
    - `traceId` boolean
    - `spanId` boolean
    - `sessionId` boolean
    - `requestOutcome` boolean
    - `attributes` boolean
    - `attributeKeys` boolean
    - `_id` boolean
    - `createdAt` boolean

## Response `200`

Successful response

- object
  - `data` SecurityEventItemV1
    - `projectId` string, required: Project ID
    - `primaryEntityId` string, required: Source ID
    - `primaryEntityType` string: Source Type
    - `time` string: Time
    - `eventUid` string: Event UID
    - `categoryUid` number: Category UID
    - `categoryName` string: Category
    - `classUid` number: Class UID
    - `className` string: Event Class
    - `activityName` string: Activity
    - `severityId` number: Severity ID
    - `severityName` string: Severity
    - `statusName` string: Status
    - `message` string: Message
    - `vendorName` string: Vendor
    - `productName` string: Product
    - `ruleId` string: Rule ID
    - `ruleName` string: Rule Name
    - `mitreTactics` string[]: MITRE Tactics
    - `mitreTechniques` string[]: MITRE Techniques
    - `principalUser` string: Principal User
    - `principalHost` string: Principal Host
    - `principalIp` string: Principal IP
    - `principalProcess` string: Principal Process
    - `processName` string: Process
    - `processPath` string: Process Path
    - `processCommandLine` string: Command Line
    - `parentProcessName` string: Parent Process
    - `parentProcessPath` string: Parent Process Path
    - `parentProcessCommandLine` string: Parent Command Line
    - `targetUser` string: Target User
    - `targetHost` string: Target Host
    - `targetIp` string: Target IP
    - `targetPort` number: Target Port
    - `targetResource` string: Target Resource
    - `observables` string[]: Observables
    - `traceId` string: Trace ID
    - `spanId` string: Span ID
    - `sessionId` string: Session ID
    - `requestOutcome` string: Request Outcome
    - `attributes` string: Attributes
    - `attributeKeys` string[]: Attribute Keys

## Other responses

- `400`: Bad request. This response indicates that the request was malformed or contained invalid data.
- `401`: Unauthorized. This response indicates that the request requires user authentication.
- `402`: Payment Required. This response indicates that the request requires payment or a valid subscription.
- `403`: Forbidden. This response indicates that the server understood the request, but refuses to authorize it.
- `404`: Not found. The record does not exist, belongs to another project, or is one you may not read - the same answer for each.
- `405`: Project not found. This response indicates that the requested project does not exist or is not accessible.
- `408`: Request Timeout. This response indicates that the server timed out waiting for the request.
- `415`: Unable to reach server. This response indicates that the server is currently unreachable or down.
- `422`: Not authorized. This response indicates that the user does not have permission to access the requested resource.
- `500`: Internal Server Error. This response indicates that the server encountered an unexpected condition that prevented it from fulfilling the request.

---

[API](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification.md) - [All operations](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/llms.txt) - [OpenAPI document](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/revisions/ba3307d00304?raw)