---
title: "Get Detection History"
method: GET
path: "/connect/detection/{id}/history"
tags: ["Detections"]
---

# Get Detection History

`GET /connect/detection/{id}/history`

Retrieves a specific detection's audit history given an internal detection ID.

## Path parameters

- `id` string, required

## Response `200`

The array of history audit objects. Note that these objects will also contain either the Detection fields or a DetectionComment fields.

- ModelAuditable[]
  - `createTime` string — The date and time that this object was created. This is a read-only field.
  - `id` string — The ID assigned to this object by the server. This is a read-only field.
  - `kind` string — The kind of object. This is a read-only field.
  - `operation` string — The operation that was applied to the object. This is a read-only field.
  - `updateTime` string — The date and time that this object was last modified. This is a read-only field.
  - `userId` string — The user ID (or API client ID) that initiated this event. This is a read-only field.

## Other responses

- `401` — Request was not properly authenticated
- `403` — Insufficient permissions for this request
- `404` — Detection not found
- `500` — Internal SOC error; review SOC logs

---

[API](https://skmtc.net/security-onion-solutions/apis/security-onion-connect-api.md) · [All operations](https://skmtc.net/security-onion-solutions/apis/security-onion-connect-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/security-onion-solutions/security-onion-connect-api/revisions/0576ce393f8d/schema)