Retrieve an audit log entry
Returns one audit entry of the workspace with everything stored for it: the redacted request body
in changes, and the integrity and redaction fields that GET /api/audit/verify-chain checks.
changes usually has the shape { "body": {...}, "statusCode"?: 403, "_resource_ref"?: "..." }.
body is the request body with secrets and contact PII replaced by [REDACTED]. statusCode is
present on failed attempts. _resource_ref holds a non-UUID resource id. Large bodies are stored
compressed. When changes_compressed is true, changes is a base64 string of the gzip of that
JSON: base64-decode it, gunzip it, then parse the JSON.
Idempotency. A read with no side effects. Safe to retry.
Access
- Required scope:
full. Human users need the owner role; admins are refused. - Rate limit: Audit — 20 requests/min per workspace, shared with the other audit routes, plus the general API limit (120–600/min by plan). See Rate limits.
- Plan: Available on every plan.
Authentication
Workspace API key: jl_ followed by 64 lowercase hex characters, created by the workspace owner in the
dashboard (Settings → API Keys) and sent as Authorization: Bearer jl_.... The plaintext is shown once,
at creation; Jelliu stores only a SHA-256 hash. A workspace can hold up to 25 active keys.
Operations restricted to admins or owners reject keys without the full scope with 403, and say so in
their description. No key, whatever its scope, can mint or revoke API keys or rotate a webhook secret —
that requires a signed-in owner session. A revoked key stops authenticating within about 10 seconds.
See Authentication.
Path parameters
UUID of the audit entry, as returned in id by GET /api/audit. An entry of another workspace answers 404.