Get an audit event
Get one audit event with its full payload.
Get one audit event with its full payload.
ApiKeyAuthAuthorizationBearer <token>Bearer token authentication. Send an API key (a saai_api_-prefixed token) as Authorization: Bearer <token>.
Required permission
view_auditevent_id*stringA UUIDv7, the id of a row in a time-partitioned table, which rejects any other version.
^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-7[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$uuidscope?stringown returns only the caller's own records, even when they may see the whole organization. all, the default, returns everything the caller may see. It never widens what the caller may see.
"all""own"The request has succeeded.
application/json- response
A single entry in the audit trail: one action taken through the gateway, who took it, what it acted on, when, and the reasoning behind the decision.
id*uuiduuidorg_id*uuiduuidaction*AuditEventActionThe action that was recorded: what happened, from a tool call to a configuration change.
"mcp.created""mcp.updated""mcp.deleted""mcp.synced""agent.created""agent.updated""agent.deleted""agent.revoked""agent.connected""policy.created""policy.updated""policy.deleted""dlp.rule.created""dlp.rule.updated""dlp.rule.deleted""rate_limit.rule.created""rate_limit.rule.updated""rate_limit.rule.deleted""gateway.tool.executed""gateway.tool.error""gateway.tool.searched""gateway.llm.request""connection.created""connection.removed""connection.revoked""connection.expired""mcp_request.created""mcp_request.withdrawn""mcp_request.dismissed""approval.requested""approval.approved""approval.denied""approval.expired""tag.created""tag.updated""tag.deleted""mcp.tag.assigned""tool.tag.assigned""agent.tag.assigned""ingest.key.created""ingest.key.revoked""api_key.created""api_key.rotated""api_key.revoked""role.created""role.updated""role.deleted""user_roles.changed""anomaly_finding.created""anomaly_finding.escalated""anomaly_finding.resolved""anomaly_finding.status_changed""nhi_finding.status_changed""webhook.created""webhook.updated""webhook.deleted""webhook.disabled""seat_price.created""seat_price.ended""seat_price.deleted""seat_assignment.created""seat_assignment.ended""seat_assignment.deleted""gateway_settings.updated""user.deleted""group.deleted"actor_type*AuditEventActorTypeWho or what performed the action.
"user""agent""api_key""system"actor_id?uuiduuidactor_display_name?stringHuman-readable name of the actor, for display in an audit feed.
resource_type*AuditEventResourceTypeThe kind of entity the action was performed on.
"mcp""agent""policy""dlp_rule""rate_limit_rule""connection""mcp_request""approval_request""tag""ingest_key""api_key""role""user""anomaly_finding""nhi_finding""webhook""seat_price""seat_assignment""gateway_settings"resource_id?uuiduuidresource_display_name?stringHuman-readable name of the entity acted on, frozen at the time of the event so the feed stays readable after later renames.
resources*The entities involved in an audit event, so an investigator can see at a glance which resource, agent, user, connection, or policy it concerned. Each carries a display name frozen at event time so the feed stays readable after later renames. Only the fields relevant to the event are present.
context?Where the action came from: the device, location, and network details of the actor, useful for spotting activity from unexpected places.
changes?array<>The specific fields that changed, for configuration edits.
payload*|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||Event-specific details, including the reasoning behind a policy decision. Its shape depends on action.
created_at*stringWhen the action occurred.
date-timecurl -X GET 'https://your-org.aisecurity.services.us.connect.secureauth.com/api/v1/audit-events/497f6eca-6276-4993-bfeb-53cbbbba6f08'{ "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "org_id": "a40f5d1f-d889-42e9-94ea-b9b33585fc6b", "action": "mcp.created", "actor_type": "user", "actor_id": "04f37679-bfbf-4906-b749-01756515cecf", "actor_display_name": "string", "resource_type": "mcp", "resource_id": "4d5215ed-38bb-48ed-879a-fdb9ca58522f", "resource_display_name": "string", "resources": { "mcp_id": "92dad337-069f-4a18-a93d-2e7f16082ffb", "mcp_display_name": "string", "agent_instance_id": "e6b55a46-e2a1-4495-b96e-367af02e9908", "agent_instance_display_name": "string", "agent_slug": "string", "autonomous": true, "user_id": "a169451c-8525-4352-b8ca-070dd449a1a5", "user_display_name": "string", "connection_id": "d3547de1-d1f2-4344-b4c2-17169b7526f9", "policy_id": "ee9b03e0-6495-427a-85a5-34444d24ae04", "policy_display_name": "string", "dlp_rule_id": "e090a7ce-e55c-4dad-9728-ac5d9a88f84d", "dlp_rule_display_name": "string", "rate_limit_rule_id": "bf0cd7b5-1b50-4cec-8854-fe1ecbf87d0d", "rate_limit_rule_display_name": "string", "tag_id": "39c8a0b3-fbe8-4801-95bf-e8a0792edf1d", "tag_display_name": "string", "tool_key": "string" }, "context": { "device": "string", "os": "string", "browser": "string", "ip": "string", "city": "string", "country": "string", "user_agent": "string", "trace_id": "string" }, "changes": [ { "type": "create", "path": "string", "from": null, "to": null } ], "payload": { "display_name": "string", "slug": "string", "origin": "catalog" }, "created_at": "2019-08-24T14:15:22Z"}