`get_impersonation_audit_by_sessionid`

Read-only

Calls GET /api/impersonation/audit/{sessionId} as the signed-in person · REST reference

Audit trail recorded against one session id

Requires execute:CreateImpersonationSessionCommand. Returns the :AuditLog entries whose sessionId property equals the path value, capped at 200 entries with no paging. The rows CreateImpersonationSessionCommand and TerminateImpersonationSessionCommand write record the session id as resourceId and carry no sessionId, so the id POST /api/impersonation returns matches neither of them here. There is NO existence check on the session. An unknown, expired or invented sessionId returns 200 with an empty auditTrail, exactly like a session that recorded nothing. This endpoint never answers 404. It is a projection of GET /api/audit-logs?sessionId=..., reshaped and with fields dropped - resource, resourceId, severity, status, ipAddress and userAgent are not carried here.

Arguments

Argument	Type		Description
`sessionId`path	string	required	The session id to filter audit entries by. Never validated or resolved - an unknown value is answered with an empty trail, not a 404.

Example call

A client sends this over the MCP session; Claude and other agents build it for you. The values are placeholders — the shape is real.

json

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "get_impersonation_audit_by_sessionid",
    "arguments": {
      "sessionId": "string"
    }
  }
}

Result

On success (HTTP 200) the tool returns one text item holding the API's JSON, pretty-printed.

Up to 200 audit entries carrying this sessionId. An empty array means either "nothing was recorded" or "no such session" - the two are indistinguishable.

json

{
  "auditTrail": [
    {
      "action": "string",
      "actor": {},
      "details": {},
      "timestamp": "2026-01-15T12:00:00Z"
    }
  ],
  "success": true
}

Fields

Field	Type	Description
`auditTrail`	array of object
`auditTrail[].action`	string
`auditTrail[].actor`	object	`{ id }` alone when the actor's name is not on the row, otherwise `{ id, name, email }`.
`auditTrail[].actor.email`	string (email)
`auditTrail[].actor.id`	string
`auditTrail[].actor.name`	string
`auditTrail[].details`	object	Empty object when the entry carried none.
`auditTrail[].timestamp`	string (date-time)	ISO-8601 - AuditService converts the DAL's epoch milliseconds. Empty string when the row carries no usable epoch.
`success`	true

When it fails

A failed call returns isError: true with the API's message as text.

403: Authenticated, but the caller holds none of the required permissions.

What the model is shown

This is the tool exactly as the server lists it in tools/list. The description starts with the REST call it makes.

json

{
  "name": "get_impersonation_audit_by_sessionid",
  "description": "GET /api/impersonation/audit/{sessionId} — Requires execute:CreateImpersonationSessionCommand. Returns the :AuditLog entries whose `sessionId` property equals the path value, capped at 200 entries with no paging. The rows CreateImpersonationSessionCommand and TerminateImpersonationSessionCommand write record the session id as `resourceId` and carry no `sessionId`, so the id POST /api/impersonation returns matches neither of them here. There is NO existence check on the session. An unknown, expired or invented sessionId returns 200 with an empty `auditTrail`, exactly like a session that recorded nothing. This endpoint never answers 404. It is a projection of GET /api/audit-logs?sessionId=..., reshaped and with fields dropped - resource, resourceId, severity, status, ipAddress and userAgent are not carried here.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "sessionId": {
        "type": "string",
        "description": "The session id to filter audit entries by. Never validated or resolved - an unknown value is answered with an empty trail, not a 404."
      }
    },
    "required": [
      "sessionId"
    ]
  },
  "annotations": {
    "readOnlyHint": true,
    "openWorldHint": false
  }
}