---
title: "List audit records for a given alert"
method: GET
path: "/alerts/{id}/audit"
tags: ["Alert Audit"]
---

# List audit records for a given alert

`GET /alerts/{id}/audit`

## Path parameters

- `id` string, required

## Query parameters

- `sort` 'alert_id' | 'history_created_at' | 'operation'
- `order` 'asc' | 'desc'
- `size` integer
- `since` string, date-time
- `until` string, date-time
- `page` string
- `operation` 'read' | 'update' | 'rollback' | 'delete' | 'update_analysis' | 'delete_analysis' | 'create_attachment' | 'delete_attachment' | 'add_tags' | 'remove_tags' | 'download'

## Headers

- `x-apikey` string, required

## Response `200`

OK

- AlertAuditRecords — List of alert audit records.
  - `history` AlertAuditRecord[] — The list of alert audit records.
    - `alert_id` string — The ID of the alert that was operated on.
    - `history_created_at` string, date-time — The time the operation was performed.
    - `id` string — The ID of the audit record.
    - `monitor_id` string — The ID of the monitor that created the alert.
    - `operation` 'read' | 'update' | 'rollback' | 'delete' | 'update_analysis' | 'delete_analysis' | 'create_attachment' | 'delete_attachment' | 'add_tags' | 'remove_tags' | 'download' — The operation performed on the alert.
    - `previous_status` string — The status of the alert prior to the operation.
    - `to_status` string — The status of the alert after the operation.
    - `user_email` string — The username that performed the operation.
    - `user_id` string — The ID of the user that performed the operation.

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `500` — Internal Server Error

---

[API](https://skmtc.net/virustotal/apis/threat-landscape.md) · [All operations](https://skmtc.net/virustotal/apis/threat-landscape/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/virustotal/threat-landscape/revisions/d61b85e6a6b3/schema)