# Show an audit entry

`GET /audits/{audit_uuid}`

- Base: `GET https://portal.watcheye.com.au/api/v1/audits/{audit_uuid}`

Returns a single audit entry by its UUID, including the full `properties` object for the
action.

The shape of the `properties` object varies by action. Treat it as an action-specific
bag of contextual data rather than a fixed schema; new keys may be added over time as
new features are added.

## Parameters

| Name | In | Type | Description |
|------|----|------|-------------|
| `audit_uuid` | path | string (uuid) | **Required.** The audit entry UUID |

## Responses

### 200 Audit entry response

Content type: `application/json`

| Field | Type | Description |
|-------|------|-------------|
| `data` | object | Same as Audit, plus the `properties` object. Returned by the show endpoint only; the list endpoint omits properties because they can be many kilobytes for some actions. |
| `data.uuid` | string (uuid) | The audit entry's UUID Example: `5e1c0a8e-2b9f-4f0e-8d1a-1e2b3c4d5e6f` |
| `data.action` | string | Machine-readable action key (see Audit.action) Example: `updated_watcheye_entity` |
| `data.action_label` | string | Human-readable label for the action Example: `Entity updated` |
| `data.action_type` | string or null | Optional sub-type qualifying the action |
| `data.description` | string | Human-readable description recorded at the time the audit was created |
| `data.client_ip_address` | string or null | Originating IP address (`null` for actions performed by the system) |
| `data.agent` | object | Who performed the action - see Audit.agent |
| `data.agent.type` | string | Enum: `user`, `api_key`, `system` |
| `data.agent.uuid` | string (uuid) or null |  |
| `data.agent.name` | string or null |  |
| `data.subject` | object or null | The resource the action was performed on - see Audit.subject |
| `data.subject.type` | string |  |
| `data.subject.uuid` | string (uuid) or null |  |
| `data.properties` | object (dynamic) or null | Action-specific properties recorded at the time of the action. The exact keys vary by action - for example `created_watcheye_entity` includes the entity's attributes at creation time; `login_failed` includes the attempted username; `created_user` includes the new user's username and roles. Treat this as an action-specific bag of contextual data rather than a fixed schema; new keys may be added over time as new features are added. `null` when no properties are available for the action. |
| `data.created_at` | string (date-time) | ISO 8601 timestamp at which the audited action occurred Example: `2025-01-01T00:00:00Z` |
| `api_reference` | string (uuid) |  |

**Sample response**

```json
{
    "data": {
        "uuid": "5e1c0a8e-2b9f-4f0e-8d1a-1e2b3c4d5e6f",
        "action": "updated_watcheye_entity",
        "action_label": "Entity updated",
        "action_type": "string",
        "description": "string",
        "client_ip_address": "string",
        "agent": {
            "type": "user",
            "uuid": "00000000-0000-0000-0000-000000000000",
            "name": "string"
        },
        "subject": {
            "type": "string",
            "uuid": "00000000-0000-0000-0000-000000000000"
        },
        "properties": {
            "attributes": {
                "entity_name": "Jane A Doe",
                "entity_type": "individual",
                "risk_level": "low"
            }
        },
        "created_at": "2025-01-01T00:00:00Z"
    },
    "api_reference": "00000000-0000-0000-0000-000000000000"
}
```

Standard error responses: 400, 401, 403, 404, 429, 5XX (see [Common error responses](/docs/reference/general/common-error-responses.md))