`get_audit_logs_by_id`

Read-only

Calls GET /api/audit-logs/{id} as the signed-in person · REST reference

Fetch a single audit entry

Platform staff only (platformRead), as the listing. The single-record read does NOT expand the actor - the DAL's getAuditLog omits the user relationship - so userName and userEmail are always null here even when the same row carries them in the listing above. timestamp, details and metadata are served exactly as in the listing.

Arguments

Argument	Type		Description
`id`path	string	required	Audit log id.

Example call

A client sends this over the MCP session; Claude and other agents build it for you. The values are placeholders — the shape is real.

json

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "get_audit_logs_by_id",
    "arguments": {
      "id": "string"
    }
  }
}

Result

On success (HTTP 200) the tool returns one text item holding the API's JSON, pretty-printed.

The audit entry, with userName and userEmail always null.

json

{
  "action": "string",
  "id": "string",
  "resource": "string",
  "status": "string",
  "timestamp": "2026-01-15T12:00:00Z",
  "userId": "string",
  "details": {},
  "ipAddress": "string",
  "metadata": {},
  "resourceId": "string",
  "sessionId": "string",
  "severity": "string",
  "userAgent": "string",
  "userEmail": "string"
}

Fields

Field	Type	Description
`action`	string
`details`	object \| null
`id`	string
`ipAddress`	string \| null
`metadata`	object \| null	What the writer recorded under metadata, decoded like details. The delivery trail (receipt and email deliveries, claim auto-approval decisions) records each entry here and leaves details empty. Null when the row stores none.
`resource`	string
`resourceId`	string \| null
`sessionId`	string \| null
`severity`	string \| null	Lower-cased riskLevel, or null.
`status`	string
`timestamp`	string (date-time)	ISO-8601. Empty string when the row carries no usable epoch.
`userAgent`	string \| null
`userEmail`	string \| null
`userId`	string
`userName`	string \| null	Null when the actor was deleted.

When it fails

A failed call returns isError: true with the API's message as text.

403: Authenticated, but the caller holds none of the required permissions.
404: No such resource — or none this caller may see.

What the model is shown

This is the tool exactly as the server lists it in tools/list. The description starts with the REST call it makes.

json

{
  "name": "get_audit_logs_by_id",
  "description": "GET /api/audit-logs/{id} — Platform staff only (`platformRead`), as the listing. The single-record read does NOT expand the actor - the DAL's getAuditLog omits the user relationship - so `userName` and `userEmail` are always null here even when the same row carries them in the listing above. `timestamp`, `details` and `metadata` are served exactly as in the listing.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "id": {
        "type": "string",
        "description": "Audit log id."
      }
    },
    "required": [
      "id"
    ]
  },
  "annotations": {
    "readOnlyHint": true,
    "openWorldHint": false
  }
}