Audit log

Get an audit event

A single audit event. An unknown identifier returns a 404.

Required scope audit_log:read

get/audit-log/{id}

Authorizations

Authorizationstringrequired

Authorization header carrying a workspace API key, as “Bearer kbn_live_…”. The X-Api-Key header is accepted equivalently.

Path parameters

idstring<uuid>required

Identifier of the event.

Response200 · application/json

The audit event.

idstring<uuid>required

Identifier of the event.

timestampstring<date-time>required

When the event happened.

intentstring

Intent behind the action.

actionstringrequired

Action that was performed.

categorystring

Category the action falls under.

actorobjectrequired

Who performed the action. Public API calls appear with the API key as a `service` actor.

resourceTypestring

Kind of resource the action targeted.

resourceIdstring<uuid>

Identifier of that resource.

resourceNamestring | null

Name of that resource at the time.

correlationIdstring | null

Identifier tying related events together.

messagestring | null

Human-readable summary of the event.