---
title: "Retrieve event from audit log"
method: GET
path: "/v0/audit-log/events/{id}"
tags: ["Events in the audit log"]
---

# Retrieve event from audit log

`GET /v0/audit-log/events/{id}`

## Path parameters

- `id` string, uuid, required — Event ID

## Response `200`

OK

- HandlersGetAuditLogEventResponse
  - `additional_data` integer[] — Additional event data
  - `created_at` string, date-time, required — Event creation time
  - `created_by` HandlerTypesUser — User that created the event. Nil if system originated
    - `access_restricted` boolean — For inactive users only. Indicates the user cannot actually access due to permissions in parent org
    - `active` boolean — Whether or not the user is active/enabled (generally managed through SCIM)
    - `created_at` string, date-time, required — User creation time
    - `deleted_at` string, date-time, nullable — User deletion time
    - `email_address` string, email, required — Email address
    - `first_name` string, string, required — First name
    - `google_oauth_user_id` string — The user's Google user ID, if it exists'
    - `id` string, uuid, required — User ID
    - `is_enrolled` boolean — Whether the user has begun using the system (e.g. accepted an invitation or logged in at least once)
    - `last_name` string, string, required — Last name
    - `microsoft_oauth_user_id` string — The user's Microsoft user ID, if it exists'
    - `phone_number` string, nullable — Phone number
    - `role` string — Role assumed by the user
    - `service_account` string, nullable — The service account type (e.g., 'ade') if this is a service account
    - `updated_at` string, date-time, required — User last updated time
  - `data` HandlerTypesEventData, required — Event data
    - `message` TypesEventMessage — API request data, if originated from an API request
      - `id` string, uuid, required — Message ID
    - `message_group` TypesEventMessageGroup — Message group data, if originated from an API request taking an action on a message group
      - `id` string, uuid, required — Message Group ID
    - `request` TypesAPIRequest — API request data, if originated from an API request
      - `api_key_name` string, nullable — Name of API key if an API key was used
      - `authentication_method` string, nullable — Description of how request was authenticated
      - `body` string — Request body
      - `id` string, uuid, required — API request ID
      - `ip` string, nullable — IP address of requester, if available
      - `method` string, required — HTTP method
      - `path` string, required — URL path
      - `query` object — Query parameters
      - `user_agent` string — User agent of requester, if available
  - `id` string, uuid, required — Event ID
  - `type` string, required — Event type

---

[API](https://skmtc.net/sublime/apis/sublime-platform-api.md) · [All operations](https://skmtc.net/sublime/apis/sublime-platform-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/sublime/sublime-platform-api/revisions/d5df82850357/schema)