Get admin audit log entry

GET

/api/admin/admin-audit-log/{id}

Code sample: Shell / cURL

curl --request GET \
  --url https://auth.example.com/api/admin/admin-audit-log/example \
  --header 'Authorization: Bearer <token>'

Returns one admin audit log entry with actor information and, when permitted, before/after sensitive detail metadata loaded from the detail artifact. Retained whole-row archives are included in supported log queries. A bounded query that cannot read its required rows returns log_query_incomplete instead of partial statistics or an empty success.

Authorizations

• adminBearer
• adminSessionCookie

Parameters

Path Parameters

id

required

string

Query Parameters

event_at

integer

<= 9007199254740991

Optional event time in Unix milliseconds to narrow the lookup. Without this hint the current Iceberg snapshot is also searched. Additional detail permissions still apply.

Responses

200

Successful JSON response.

Media type application/json

object

id

string

tenant_id

string

admin_user_id

string

admin_email

string

admin_user_name

string | null

actor_type

string

actor_id

string

actor_display_name

string

action

string

resource_type

string

resource_id

string

result

string

Allowed values: success failure

severity

string

Allowed values: debug info warn error critical

metadata

object

key

additional properties

before

object

key

additional properties

after

object

key

additional properties

created_at

integer

admin_user

One of:

object

object

id

required

string

email

required

string

name

string | null

key

additional properties

null

null

Example

{
  "id": "audit_123",
  "tenant_id": "tenant_123",
  "admin_user_id": "admin_123",
  "admin_email": "admin@example.com",
  "action": "admin_policy.create",
  "resource_type": "admin_policy",
  "resource_id": "policy_123",
  "result": "success",
  "severity": "info",
  "metadata": {},
  "created_at": 1770000000000,
  "admin_user": {
    "id": "admin_123",
    "email": "admin@example.com",
    "name": "Admin User"
  },
  "actor_type": "admin_user",
  "actor_id": "admin_123",
  "actor_display_name": "Admin User"
}

Headers

X-Authrim-Log-Consistency

string

Allowed values: snapshot eventual local_hot_only

Snapshot for the remote scheduled view; eventual when Pipeline visibility can lag ingestion; local_hot_only for local scheduled staging without a remote Catalog.

X-Authrim-Log-Pending-Deliveries

integer

Tenant deliveries not yet confirmed visible. Omitted for self-service subjects. Zero does not guarantee immediate Pipeline visibility.

X-Authrim-Log-Complete

boolean

True only for a complete bounded snapshot query. Pipeline responses remain false; incomplete reads return 503.

400

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

401

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

403

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

404

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

500

Error response.

Media type application/json

object

error

string

message

string

error_description

string

key

additional properties

Example ^generated

{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

503

The retained log query is incomplete. No partial entries or statistics are returned as a successful result. Narrow the period or retry.

Media type application/json

object

error

required

string

Allowed value: log_query_incomplete

error_description

required

string

complete

required

boolean

key

additional properties

Example

{
  "error": "log_query_incomplete",
  "complete": false
}