Get audit log by ID
Use this endpoint to retrieve the details of a specific audit log entry by its identifier.
Authorizations
Bearer token authentication (format: "Bearer {token}")
Headers
A unique identifier for tracing the request across services.
Path Parameters
Audit Log ID
Response
Indicates that the request was successful and the response contains the expected data.
Action that was performed on the entity (e.g. CREATE, UPDATE, DELETE)
"CREATE"
JSON diff of the changes made to the entity; when the diff exceeded the outbox payload cap this carries a truncation marker envelope instead of the full diff (see truncated and originalSize)
10000Creation timestamp in RFC 3339 format (UTC)
"2025-01-15T10:30:00Z"
Identifier (UUID) of the entity that was modified
"550e8400-e29b-41d4-a716-446655440002"
Type of entity that was modified (e.g. reconciliation_context, match_rule)
"reconciliation_context"
Version of the canonicalization scheme used to compute recordHash
1
Unique identifier (UUID) for the audit log entry
"550e8400-e29b-41d4-a716-446655440000"
Byte size of the original diff before truncation; zero when truncated is false or the marker was malformed
0
Lowercase-hex SHA-256 hash of the previous record; the genesis record links to 32 zero bytes
"0000000000000000000000000000000000000000000000000000000000000000"
Lowercase-hex SHA-256 hash of this record: SHA-256(prevHash || canonical content); empty for pre-hash-chain records
"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"
Tenant ID (UUID) that owns this audit log entry
"550e8400-e29b-41d4-a716-446655440001"
1-based monotonic position of this entry within its tenant's audit hash chain
42
True when the original audit diff exceeded the outbox payload cap and was replaced with a truncation marker; consumers should treat changes as a metadata envelope, not the full diff, in this case
false
Identifier of the actor who performed the action; absent for system-originated changes
"user@example.com"

