# Get a log

`GET /v1/logs/{log_id}` · permission `logs:read`

Returns one log record including `details`.

## Request

| Parameter | In | Required | Description |
|---|---|---|---|
| `log_id` | path | yes | Log record id, prefixed `evt_`. |

## Response

`200 OK` with the record. Empty fields are `null`.

`ip`, `ip_asn`, `user_agent` and `user_agent_family` are present only when the key has the `audit-events:read_ip` permission, and `identifier_hint` only when it has `users:read_pii`. Without the permission the field is left out entirely (no masked value). `ip_country` is always returned.

```json
{
  "id": "evt_01j9xk3m7q8r2s4t6v8w0y2z4a",
  "occurred_at": "2026-10-01T08:15:42.120Z",
  "type": "authentication.password.failed",
  "outcome": "failure",
  "reason_code": "invalid_credentials",
  "user_id": "usr_0a1b2c3d4e5f6g7h8j9k0m1n2p",
  "org_id": null,
  "application_id": "app_01j9xk3m7q8r2s4t6v8w0y2z4b",
  "connection_id": "conn_01j9xk3m7q8r2s4t6v8w0y2z4c",
  "directory_id": null,
  "session_id": null,
  "identifier_hint": "a***@e***.com",
  "ip": "203.0.113.7",
  "ip_country": "DE",
  "ip_asn": 64500,
  "user_agent": "Mozilla/5.0 (X11; Linux x86_64)",
  "user_agent_family": "Firefox",
  "risk": null,
  "auth_context": null,
  "act_chain": null,
  "details": {"attempt": 3},
  "request_id": "0192a6c1-7d3e-7a10-9b2c-3d4e5f607182",
  "correlation_id": null,
  "trace_id": "4bf92f3577b34da6a3ce929d0e0e4736"
}
```

## Errors

Every error is an `application/problem+json` body with a stable `code`.

| HTTP | `code` | When |
|---|---|---|
| 401 | `unauthenticated` | The API key is missing, invalid or revoked. |
| 403 | `insufficient_permissions` | The key lacks the `logs:read` permission. |
| 404 | `not_found` | The record does not exist, belongs to another environment or is outside the retention window. |
| 429 | `rate_limited` | The rate limit was exceeded; honor `Retry-After`. |
| 503 | `service_unavailable` | A dependency is temporarily unavailable; retry later. |

## Example

```bash
curl https://api.eu.keenauth.com/v1/logs/log_01j9xk3m7q8r2s4t6v8w0y2z4a \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"
```

## Personal data

This endpoint carries personal data: environment logs. [Personal data in the KeenAuth APIs](/docs/policies/personal-data) describes what is stored, how long it is kept and how it is deleted. Do not send special categories of personal data (health, biometric data, religion, political opinions, sexual orientation) in any field.