> ## Documentation Index
> Fetch the complete documentation index at: https://docs.microsandbox.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Get an audit event



## OpenAPI

````yaml /api-reference/openapi.json get /v1/events/{event_id}
openapi: 3.1.0
info:
  title: microsandbox cloud API
  description: >-
    REST API for microsandbox cloud: sandbox and volume lifecycle, organization
    context, quotas, usage, and audit events, authenticated with an organization
    API key.
  version: 0.1.0
servers:
  - url: https://api.microsandbox.dev
security:
  - api_key: []
paths:
  /v1/events/{event_id}:
    get:
      tags:
        - Audit events
      summary: Get an audit event
      operationId: get_event
      parameters:
        - name: event_id
          in: path
          description: Event ID
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: Event details
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EventResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              example:
                error:
                  code: invalid_api_key
                  message: unauthorized
                  details: null
        '404':
          description: Event not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              example:
                error:
                  code: sandbox_not_found
                  message: resource not found
                  details: null
      security:
        - api_key: []
components:
  schemas:
    EventResponse:
      type: object
      description: A single audit/lifecycle event returned by the API.
      required:
        - id
        - org_id
        - category
        - event_type
        - actor
        - payload
        - timestamp
      properties:
        actor:
          $ref: '#/components/schemas/EventActor'
        category:
          type: string
        event_type:
          type: string
        id:
          type: string
          format: uuid
        org_id:
          type: string
          format: uuid
        payload: {}
        timestamp:
          type: string
          format: date-time
    ErrorResponse:
      type: object
      description: Error envelope returned by every non-2xx response.
      required:
        - error
      properties:
        error:
          type: object
          required:
            - code
            - message
          properties:
            code:
              type: string
              description: Stable machine-readable error code, e.g. `invalid_api_key`.
            message:
              type: string
              description: Human-readable description of the error.
            details:
              type:
                - object
                - 'null'
              description: Optional structured context for the error.
    EventActor:
      oneOf:
        - type: object
          required:
            - user_id
            - label
            - redacted_email
            - kind
          properties:
            kind:
              type: string
              enum:
                - user
            label:
              type: string
            redacted_email:
              type: string
            user_id:
              type: string
              format: uuid
        - type: object
          required:
            - api_key_id
            - name
            - kind
          properties:
            api_key_id:
              type: string
              format: uuid
            kind:
              type: string
              enum:
                - api_key
            name:
              type: string
        - type: object
          required:
            - code
            - label
            - kind
          properties:
            code:
              type: string
            kind:
              type: string
              enum:
                - system
            label:
              type: string
        - type: object
          description: >-
            The authorized SSH key that authenticated a front-door session. The

            principal SSH actually proves at connect is the *key*, not a person
            -

            the scope-only model (D8) doesn't bind a key to a user (a global key
            may

            be shared), so the session is attributed to the key (label +
            fingerprint),

            while whoever registered it rides the event payload as `added_by`.
          required:
            - key_id
            - fingerprint
            - kind
          properties:
            fingerprint:
              type: string
              description: '`SHA256:…` fingerprint.'
            key_id:
              type: string
              format: uuid
            kind:
              type: string
              enum:
                - ssh_key
            label:
              type:
                - string
                - 'null'
              description: Human label set at registration (e.g. `alice-laptop`), if any.
      description: |-
        Maximum total length, in characters, of the truncated `command` field in
        Immutable actor snapshot stored alongside an event.
  securitySchemes:
    api_key:
      type: http
      scheme: bearer
      description: Organization API key (msb_…) - org-scoped programmatic access.

````