Skip to content
Authrim

Get an access trace entry.

GET
/api/admin/access-trace/{id}
Code sample: Shell / cURL 
curl --request GET \
  --url https://auth.example.com/api/admin/access-trace/example \
  --header 'Authorization: Bearer <token>'

Returns one permission-check audit entry by id for the current tenant. Retained whole-row archives are included in supported log queries. A bounded query that cannot read its required rows returns log_query_incomplete instead of partial statistics or an empty success.

Authorizations

Section titled “Authorizations ”

Parameters

Section titled “ Parameters ”

Path Parameters

Section titled “Path Parameters ”
id
required
string

Access trace entry id.

Query Parameters

Section titled “Query Parameters ”
event_at
integer
<= 9007199254740991

Optional event time in Unix milliseconds to narrow the lookup. Without this hint the current Iceberg snapshot is also searched. Additional detail permissions still apply.

Responses

Section titled “ Responses ”

200

Section titled “200 ”

Access trace entry response.

Media type application/json
object
entry
required
object
id
required
string
subject_id
required
string
permission
required
string
permission_parsed
required
nullable
allowed
required
boolean
resolved_via
required
Array<string>
final_decision
required
string
reason
required
string | null
api_key_id
required
string | null
client_id
required
string | null
checked_at
required
integer format: int64
key
additional properties
key
additional properties
Example generated
{
  "entry": {
    "id": "example",
    "subject_id": "example",
    "permission": "example",
    "permission_parsed": "example",
    "allowed": true,
    "resolved_via": [
      "example"
    ],
    "final_decision": "example",
    "reason": "example",
    "api_key_id": "example",
    "client_id": "example",
    "checked_at": 1
  }
}

Headers

Section titled “Headers ”
X-Authrim-Log-Consistency
string
Allowed values: snapshot eventual local_hot_only

Snapshot for the remote scheduled view; eventual when Pipeline visibility can lag ingestion; local_hot_only for local scheduled staging without a remote Catalog.

X-Authrim-Log-Pending-Deliveries
integer

Tenant deliveries not yet confirmed visible. Omitted for self-service subjects. Zero does not guarantee immediate Pipeline visibility.

X-Authrim-Log-Complete
boolean

True only for a complete bounded snapshot query. Pipeline responses remain false; incomplete reads return 503.

400

Section titled “400 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

401

Section titled “401 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

403

Section titled “403 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

404

Section titled “404 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

503

Section titled “503 ”

The retained log query is incomplete. No partial entries or statistics are returned as a successful result. Narrow the period or retry.

Media type application/json
object
error
required
string
Allowed value: log_query_incomplete
error_description
required
string
complete
required
boolean
key
additional properties
Example 
{
  "error": "log_query_incomplete",
  "complete": false
}