---
title: "Retrieve Audit Log Entry"
method: GET
path: "/v2/audit-logs/{id}"
tags: ["Audit Logs V2"]
---

# Retrieve Audit Log Entry

`GET /v2/audit-logs/{id}`

Retrieves a single audit log entry by id within the specified organization. Requires audit_logs:read scope.

## Response `200`

AuditLogEntryWithActor

- AuditLogEntryWithActor
  - `id` string, required — Unique audit log entry id (UUID)
  - `object` 'audit_log_entry', required — Object type, always `audit_log_entry`
  - `timestamp` string, required — ISO 8601 timestamp of when the request was served
  - `request_id` string, required — Request identifier (x-request-id header, or auto-generated UUID)
  - `route_family` 'public_v2' | 'internal_v2', required — Which route family served the request
  - `method` string, required — HTTP method
  - `request_url` string, required — Full request URL with query string
  - `path` string, required — URL path with query string
  - `endpoint_id` string, nullable, required — Resolved OpenAPI endpoint name (e.g. listPaywalls)
  - `auth_method` 'api_key' | 'cookie' | 'oauth' | 'agent_token' | 'service_token', nullable, required — Authentication method used
  - `attempted_auth_method` 'api_key' | 'cookie' | 'oauth' | 'agent_token' | 'service_token', nullable, required — Authentication method used
  - `user_id` number, nullable, required — User id if authenticated via cookie/oauth
  - `token_id` integer, nullable, required — an integer
  - `token_name` string, nullable, required — Credential label at time of request
  - `service_principal_id` integer, nullable, required — an integer
  - `organization_id` integer, nullable, required — an integer
  - `authorized` boolean, required — Whether the request cleared authn + authz checks
  - `status_code` number, required — HTTP response status code
  - `failure_stage` 'authn' | 'authz', nullable, required — Stage at which the request was rejected, if any
  - `failure_code` string, nullable, required — Machine-readable failure code (e.g. MissingApiKey, insufficient_scope)
  - `mutation` boolean, required — Whether the endpoint mutates state (POST/PUT/PATCH/DELETE except read endpoints)
  - `resource_type` string, nullable, required — Resource type touched by the mutation (e.g. `paywall`, `product`), if known
  - `resource_id` string, nullable, required — Stringified id of the resource touched by the mutation, if known
  - `changes` AuditChange[], nullable, required — Structured before/after diff for mutations. Null for reads, no-op patches, and entries from before this field was introduced.
    - `op` 'add' | 'remove' | 'replace' | 'truncated', required — Diff operation type. `truncated` is a sentinel emitted when the serialized diff exceeded the storage cap; subsequent changes were dropped.
    - `path` string, required — Dot-joined path to the changed field (e.g. `metadata.foo`, `products.0.identifier`)
    - `before` unknown
    - `after` unknown
  - `ip_address` string, nullable, required — Client IP address the request originated from
  - `country` string, nullable, required — ISO-3166 country code resolved from the client IP
  - `city` string, nullable, required — City resolved from the client IP, if available
  - `region` string, nullable, required — Region/state resolved from the client IP, if available
  - `timezone` string, nullable, required — IANA timezone resolved from the client IP, if available
  - `user_agent` string, nullable, required — Raw User-Agent header of the request
  - `session_id` string, nullable, required — Identifier of the login session (OAuth `sid`/`jti` claim). Groups every entry from one session. Null for api_key and cookie auth.
  - `actor` AuditActorUser, required
    - `id` number, required
    - `name` string, nullable, required — Display name, if set
    - `email` string, required — User email address
    - `image` string, nullable, required — Avatar image URL, if set

## Other responses

- `400` — The request did not match the expected schema
- `401` — No API key was provided in the request
- `403` — The API key does not have permission to perform this action
- `404` — The requested resource was not found
- `429` — Too many requests have been made in a short period
- `500` — An unexpected error occurred on the server

---

[API](https://skmtc.dev/superwall/apis/superwall-api-v2.md) · [All operations](https://skmtc.dev/superwall/apis/superwall-api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/superwall/superwall-api-v2/revisions/44900ad77d2c/schema)