> ## Documentation Index
> Fetch the complete documentation index at: https://docs.microsandbox.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Get an audit event



## OpenAPI

````yaml /api-reference/openapi.personal.json get /v1/orgs/{slug}/events/{event_id}
openapi: 3.1.0
info:
  title: Personal token API
  description: User-scoped API for account and organization management.
  version: 0.1.0
servers:
  - url: https://api.microsandbox.dev
security:
  - bearer: []
paths:
  /v1/orgs/{slug}/events/{event_id}:
    get:
      tags:
        - Audit events
      summary: Get an audit event
      operationId: get_event
      parameters:
        - name: slug
          in: path
          description: Organization slug
          required: true
          schema:
            type: string
        - name: event_id
          in: path
          description: Event ID
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: Event details
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EventResponse'
        '401':
          description: Unauthorized
        '403':
          description: Insufficient permissions
        '404':
          description: Event not found
      security:
        - bearer: []
components:
  schemas:
    EventResponse:
      type: object
      description: A single audit/lifecycle event returned by the API.
      required:
        - id
        - org_id
        - category
        - event_type
        - actor
        - payload
        - timestamp
      properties:
        actor:
          $ref: '#/components/schemas/EventActor'
        category:
          type: string
        event_type:
          type: string
        id:
          type: string
          format: uuid
        org_id:
          type: string
          format: uuid
        payload: {}
        timestamp:
          type: string
          format: date-time
    EventActor:
      oneOf:
        - type: object
          required:
            - user_id
            - label
            - redacted_email
            - kind
          properties:
            kind:
              type: string
              enum:
                - user
            label:
              type: string
            redacted_email:
              type: string
            user_id:
              type: string
              format: uuid
        - type: object
          required:
            - api_key_id
            - name
            - kind
          properties:
            api_key_id:
              type: string
              format: uuid
            kind:
              type: string
              enum:
                - api_key
            name:
              type: string
        - type: object
          required:
            - code
            - label
            - kind
          properties:
            code:
              type: string
            kind:
              type: string
              enum:
                - system
            label:
              type: string
        - type: object
          description: >-
            The authorized SSH key that authenticated a front-door session. The

            principal SSH actually proves at connect is the *key*, not a person
            -

            the scope-only model (D8) doesn't bind a key to a user (a global key
            may

            be shared), so the session is attributed to the key (label +
            fingerprint),

            while whoever registered it rides the event payload as `added_by`.
          required:
            - key_id
            - fingerprint
            - kind
          properties:
            fingerprint:
              type: string
              description: '`SHA256:…` fingerprint.'
            key_id:
              type: string
              format: uuid
            kind:
              type: string
              enum:
                - ssh_key
            label:
              type:
                - string
                - 'null'
              description: Human label set at registration (e.g. `alice-laptop`), if any.
      description: |-
        Maximum total length, in characters, of the truncated `command` field in
        Immutable actor snapshot stored alongside an event.
  securitySchemes:
    bearer:
      type: http
      scheme: bearer
      description: >-
        Personal access token (msb_pat_…) or session JWT - the credential an
        agent acts with on a user's behalf.

````