---
title: "Get audit log by ID"
method: GET
path: "/api/audit-logs/{id}"
tags: ["Audit Logs"]
---

# Get audit log by ID

`GET /api/audit-logs/{id}`

Retrieves a single audit log event by its unique ID.

## Path parameters

- `id` string, required

## Response `200`

Successful response

- AuditLogResponse — Response wrapper for a single audit log entry.
  - `audit_log` AuditEvent, required — A CADF-compliant audit event.
    - `id` string, required — Unique identifier for this event (UUID).
    - `typeURI` string, required — Event type URI (e.g., "http://schemas.bifrost.io/audit/api/v1").
    - `eventType` 'activity' | 'monitor' | 'control', required — Classifies the audit event.
    - `eventTime` string, date-time, required — When the event occurred (RFC 3339).
    - `action` 'create' | 'read' | 'update' | 'delete' | 'authenticate' | 'authorize' | 'access' | 'enable' | 'disable' | 'start' | 'stop' | 'backup' | 'restore' | 'export' | 'import', required — The CADF action performed.
    - `outcome` 'success' | 'failure' | 'pending', required — The CADF outcome of the action.
    - `initiator` AuditResource, required — A CADF resource (initiator, target, or observer).
      - `id` string, required — Unique identifier of the resource.
      - `typeURI` string, required — Resource type URI (e.g., "bifrost/user", "bifrost/api_key").
      - `name` string — Human-readable name of the resource.
      - `host` string — Hostname or IP address associated with the resource.
    - `target` AuditResource, required — A CADF resource (initiator, target, or observer).
      - `id` string, required — Unique identifier of the resource.
      - `typeURI` string, required — Resource type URI (e.g., "bifrost/user", "bifrost/api_key").
      - `name` string — Human-readable name of the resource.
      - `host` string — Hostname or IP address associated with the resource.
    - `observer` AuditResource, required — A CADF resource (initiator, target, or observer).
      - `id` string, required — Unique identifier of the resource.
      - `typeURI` string, required — Resource type URI (e.g., "bifrost/user", "bifrost/api_key").
      - `name` string — Human-readable name of the resource.
      - `host` string — Hostname or IP address associated with the resource.
    - `reason` AuditReason — The CADF reason for an outcome (especially for failures).
      - `reasonCode` string — Machine-readable code (e.g., "401", "FORBIDDEN").
      - `reasonType` string — Category of reason (e.g., "HTTP", "policy").
      - `message` string — Human-readable description.
    - `attachments` AuditAttachment[]
      - `name` string, required — Identifies the attachment.
      - `contentType` string, required — MIME type of the content.
      - `content` string, required — Attachment data (typically a JSON string).
    - `tags` string[] — Searchable labels for categorization.
    - `requestMethod` string — HTTP method (GET, POST, etc.).
    - `requestPath` string — HTTP request path.
    - `requestIP` string — Client IP address.
    - `userAgent` string — HTTP User-Agent header.
    - `duration` integer — Request duration in milliseconds.
    - `signature` string, required — HMAC-SHA256 signature for tamper detection.
    - `createdAt` string, date-time, required — When the record was created in the database.

## Other responses

- `400` — Bad request
- `404` — Resource not found
- `500` — Internal server error

---

[API](https://skmtc.net/getbifrost/apis/bifrost-api.md) · [All operations](https://skmtc.net/getbifrost/apis/bifrost-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/getbifrost/bifrost-api/versions/f8cab88f64ea/schema)