Get an admin audit-log row with related events

GET

/portal/v1/accounts/{accountSlug}/audit-log/admin/{id}

Returns a single admin-surface audit row by id plus two related-event sidecars: related_by_correlation (rows sharing this row's correlation_id, chronological, capped at 50) and related_by_actor (the same actor's last 10 events within a 1-hour window, newest-first). All reads honor customer_visible = TRUE and the admin surface discriminator. Returns 404 — indistinguishably — when the row is missing, belongs to another Account, is off this surface, or is internal-only. Writes one audit.row.viewed audit row.

Authentication

Bearer TokenAuthorization

JWT access token. Never send alongside X-API-Key: a request carrying both is refused.

Requires capability audit.viewSecurity

View the account-wide audit log. Granted through an administrator role in the Admin Workspace; a valid token without it is refused with 403.

Path Parameters

idstring Required

Responses

application/json

dataAuditLogDetailResponseDto*

application/json

errorApiErrorBodyDto*

application/json

errorApiErrorBodyDto*

application/json

errorApiErrorBodyDto*

Errors

When the request can't be completed, the response body includes a stable error code you can branch on.

403account.capability_requiredForbidden

When it happens

The signed-in user's administrator roles do not grant the capability this endpoint requires.

Remediation

Ask an account administrator to grant a role carrying the capability named in the Authentication section, then retry.

Returned object

AuditLogDetailResponseDtoView all properties on this resource

Request

curl -X GET "https://auth.canopy-io.com/portal/v1/accounts/{accountSlug}/audit-log/admin/value" \
  -H "Authorization: Bearer $CANOPY_TOKEN"

Response

{
  "data": {
    "id": "string",
    "account_id": "string",
    "application_id": "string",
    "environment_id": "string",
    "actor_id": "string",
    "actor_type": "string",
    "action": "string",
    "resource_type": "string",
    "resource_id": "string",
    "metadata": {},
    "created_at": "2026-04-20T12:00:00.000Z",
    "actor_label": "string",
    "resource_label": "string",
    "correlation_id": "00000000-0000-0000-0000-000000000000",
    "outcome": "success",
    "category": "auth",
    "severity": "info",
    "customer_visible": false,
    "identity_visible": false,
    "related_by_correlation": [
      {
        "id": "string",
        "account_id": "string",
        "application_id": "string",
        "environment_id": "string",
        "actor_id": "string",
        "actor_type": "string",
        "action": "string",
        "resource_type": "string",
        "resource_id": "string",
        "metadata": {},
        "created_at": "2026-04-20T12:00:00.000Z",
        "actor_label": "string",
        "resource_label": "string",
        "correlation_id": "00000000-0000-0000-0000-000000000000",
        "outcome": "success",
        "category": "auth",
        "severity": "info",
        "customer_visible": false,
        "identity_visible": false
      }
    ],
    "related_by_actor": [
      {
        "id": "string",
        "account_id": "string",
        "application_id": "string",
        "environment_id": "string",
        "actor_id": "string",
        "actor_type": "string",
        "action": "string",
        "resource_type": "string",
        "resource_id": "string",
        "metadata": {},
        "created_at": "2026-04-20T12:00:00.000Z",
        "actor_label": "string",
        "resource_label": "string",
        "correlation_id": "00000000-0000-0000-0000-000000000000",
        "outcome": "success",
        "category": "auth",
        "severity": "info",
        "customer_visible": false,
        "identity_visible": false
      }
    ]
  }
}

GETLive-tail admin audit-log events (SSE)
GETQuery admin audit-log events
GETList recent audit-log export jobs
POSTCreate an admin audit-log export job (CSV / NDJSON)
GETGet an audit-log export job
DELETEDelete an audit-log export job

Was this page helpful?

Tell us how we can improve this guide.