Retrieve an Audit Event

Use this endpoint to retrieve a single audit event by its unique identifier. Designed for SOX/GLBA compliance.

GET /v1/audit-events/{id}

Retrieve an Audit Event

cURL

curl --request GET \
  --url https://tracer.lerian.io/v1/audit-events/{id} \
  --header 'Content-Type: <content-type>' \
  --header 'X-API-Key: <api-key>'

200

{
  "eventId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "resourceId": "<string>",
  "actor": {
    "id": "<string>",
    "name": "<string>",
    "role": "<string>",
    "ipAddress": "<string>"
  },
  "context": {},
  "metadata": {},
  "hash": "<string>",
  "previousHash": "<string>",
  "createdAt": "2023-11-07T05:31:56Z"
}

Authorizations

ApiKeyAuthBearerAuth

X-API-Key · string · header · required

API Key authentication. Used by single-tenant deployments (MULTI_TENANT_ENABLED=false). Sent on every /v1/* request.

Headers

Content-Type · string · required

The type of media of the resource. Must be application/json.

X-API-Key · string · required

The API Key for authentication. This header is required for all endpoints except health checks.

X-Request-Id · string<uuid>

A unique identifier used to trace and track each request.

Path Parameters

id · string<uuid> · required

The unique identifier of the audit event that you want to retrieve or verify.

Response

200

application/json

Indicates that the request was successful and the response contains the expected data.

Audit trail event for SOX/GLBA compliance.

eventId · string<uuid>

Unique identifier for the audit event.

eventType · enum<string>

Type of event that occurred.

Available options: TRANSACTION_VALIDATED, RULE_CREATED, RULE_UPDATED, RULE_ACTIVATED, RULE_DEACTIVATED, RULE_DRAFTED, RULE_DELETED, LIMIT_CREATED, LIMIT_UPDATED, LIMIT_ACTIVATED, LIMIT_DEACTIVATED, LIMIT_DRAFTED, LIMIT_DELETED

resourceType · enum<string>

Type of resource affected by the event.

Available options: transaction, rule, limit

resourceId · string

ID of the affected resource.

action · enum<string>

Action performed on the resource.

Available options: VALIDATE, CREATE, UPDATE, DELETE, ACTIVATE, DEACTIVATE, DRAFT

result · enum<string>

Result of the action. ALLOW/DENY/REVIEW for validations; SUCCESS/FAILED for CRUD operations.

Available options: SUCCESS, FAILED, ALLOW, DENY, REVIEW

actor · object

Actor who performed the action.

Show child attributes

context · object

Event context. For validations includes request and response. For CRUD includes before and after states.

metadata · object

Additional info (ticketId, correlationId, etc.).

hash · string

SHA-256 hash of event content for tamper detection.

previousHash · string

Hash of previous event in chain (forms immutable chain).

createdAt · string<date-time>

When the event occurred.