---
title: "List audit records for a given alert"
method: GET
path: "/alerts/{id}/audit"
tags: ["Alert Audit"]
---

# List audit records for a given alert

`GET /alerts/{id}/audit`

## Request

- Base URL: `https://www.virustotal.com/api/v3/dtm`
- URL: `https://www.virustotal.com/api/v3/dtm/alerts/{id}/audit`
- Auth: none required

## Path parameters

- `id` string, required

## Query parameters

- `sort` 'alert_id' | 'history_created_at' | 'operation'
- `order` 'asc' | 'desc'
- `size` integer
- `since` string, date-time
- `until` string, date-time
- `page` string
- `operation` 'read' | 'update' | 'rollback' | 'delete' | 'update_analysis' | 'delete_analysis' | 'create_attachment' | 'delete_attachment' | 'add_tags' | 'remove_tags' | 'download'

## Headers

- `x-apikey` string, required

## Response `200`

OK

- AlertAuditRecords: List of alert audit records.
  - `history` AlertAuditRecord[]: The list of alert audit records.
    - `alert_id` string: The ID of the alert that was operated on.
    - `history_created_at` string, date-time: The time the operation was performed.
    - `id` string: The ID of the audit record.
    - `monitor_id` string: The ID of the monitor that created the alert.
    - `operation` 'read' | 'update' | 'rollback' | 'delete' | 'update_analysis' | 'delete_analysis' | 'create_attachment' | 'delete_attachment' | 'add_tags' | 'remove_tags' | 'download': The operation performed on the alert.
    - `previous_status` string: The status of the alert prior to the operation.
    - `to_status` string: The status of the alert after the operation.
    - `user_email` string: The username that performed the operation.
    - `user_id` string: The ID of the user that performed the operation.

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `500`: Internal Server Error

---

[API](https://skmtc.dev/virustotal/apis/dtm-digital-threat-monitoring.md) - [All operations](https://skmtc.dev/virustotal/apis/dtm-digital-threat-monitoring/llms.txt) - [OpenAPI document](https://skmtc.dev/virustotal/apis/dtm-digital-threat-monitoring/revisions/ba27db660651?raw)