> ## Documentation Index > Fetch the complete documentation index at: https://docs.basaltic.sh/llms.txt > Use this file to discover all available pages before exploring further. # Get audit log entry > Get a specific audit log entry by ID. Requires `audit:GetLog` permission. ## OpenAPI ````yaml /api-reference/specs/audit.yaml get /v1/audit-logs/{log_id} openapi: 3.0.3 info: title: Basaltic Audit API version: 1.0.0 description: | Read-only access to the account's audit trail. Every mutating call to a Basaltic API records who made it, what it touched and whether it succeeded — failed attempts included. One trail per account, across every region. contact: name: Basaltic Support email: ping@basaltic.sh license: name: Proprietary url: https://basaltic.sh/terms servers: - url: https://audit.basaltic.sh description: Global API endpoint security: - SignatureAuth: [] paths: /v1/audit-logs/{log_id}: get: tags: - Audit Logs summary: Get audit log entry description: | Get a specific audit log entry by ID. Requires `audit:GetLog` permission. operationId: getAuditLog parameters: - name: log_id in: path required: true description: Audit log entry ID schema: type: string format: uuid example: e5f6a7b8-c9d0-1234-5678-90abcdef1234 responses: '200': description: Audit log entry details content: application/json: schema: $ref: '#/components/schemas/AuditLogResponse' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' components: schemas: AuditLogResponse: type: object properties: audit_log: $ref: '#/components/schemas/AuditLog' AuditLog: type: object properties: id: type: string format: uuid readOnly: true example: e5f6a7b8-c9d0-1234-5678-90abcdef1234 timestamp: type: string format: date-time description: When the event occurred example: '2026-01-15T09:30:00Z' actor_id: type: string format: uuid nullable: true description: ID of the user or service account that performed the action example: 550e8400-e29b-41d4-a716-446655440000 actor_type: type: string enum: - user - service_account - system description: Type of actor example: user actor_name: type: string nullable: true description: Name of the actor at the time of the event example: John Doe actor_email: type: string nullable: true description: Email of the actor (for users only) example: john.doe@acme.com organization_id: type: string format: uuid nullable: true description: Organization context of the action example: 550e8400-e29b-41d4-a716-446655440000 action: type: string description: The action performed (e.g., "iam.policy.create", "instance.start") example: iam.policy.create status: type: string enum: - success - failure - denied description: Outcome of the action example: success resource_type: type: string nullable: true description: Type of resource affected example: instance resource_id: type: string nullable: true description: ID of the resource affected example: i-0a1b2c3d4e5f67890 resource_name: type: string nullable: true description: Name of the resource at the time of the event example: web-server-1 ip_address: type: string nullable: true description: IP address of the request origin example: 192.168.1.100 user_agent: type: string nullable: true description: User agent string from the request example: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 request_id: type: string nullable: true description: Request ID for correlation example: req-7c9e6679742540de details: type: object additionalProperties: true description: Additional action-specific details error_code: type: string nullable: true description: Error code for failed actions example: access_denied error_message: type: string nullable: true description: Error message for failed actions example: Principal is not authorized to perform this action Error: type: object required: - error properties: error: type: object required: - code - message - request_id properties: code: type: string description: Error code identifying the type of error example: INVALID_INPUT message: type: string description: Human-readable error message example: Invalid request parameters request_id: type: string format: uuid description: Request ID for debugging example: 550e8400-e29b-41d4-a716-446655440000 responses: Unauthorized: description: Authentication required or token invalid content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: UNAUTHORIZED message: Authentication required request_id: 550e8400-e29b-41d4-a716-446655440000 Forbidden: description: Insufficient permissions content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: ACCESS_DENIED message: You don't have permission to perform this action request_id: 550e8400-e29b-41d4-a716-446655440000 NotFound: description: Resource not found content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: NOT_FOUND message: Resource not found request_id: 550e8400-e29b-41d4-a716-446655440000 securitySchemes: SignatureAuth: type: apiKey in: header name: Authorization description: > Request signing with an access key issued to a service account. An HMAC-SHA256 over a canonical form of the request, close to AWS SigV4. The `basaltic` CLI signs for you. Send `Authorization`, `X-Date` (UTC, `YYYYMMDDTHHMMSSZ`) and `X-Nonce` (random per request); add `X-Content-Sha256` to bind a body, and `X-Amz-Security-Token` when using temporary credentials. ``` Authorization: BASALTIC-HMAC-SHA256 Credential=///basaltic/basaltic_request, SignedHeaders=host;x-date;x-nonce, Signature= ``` `` is the region code you are calling, or `global` for the global services. A signature is valid for 5 minutes from `X-Date`, and mutating requests are replay-guarded on the nonce. **Full signing procedure, including a working implementation:** https://docs.basaltic.sh/authentication ## Rate limits There is no global request budget. A limit applies only where an operation documents a `429`, and that operation says what it counts. Those responses carry `X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset` and, on a `429`, `Retry-After` — read them rather than hard-coding a number. Retrying before `Retry-After` is refused and extends the window. Everything else is bounded by quota, not by request rate. ````