Returns one authorized immutable audit event and its safe recorded snapshot.

GET

/api/workspace/file-protection/signal-audit/{id}

using System.Net.Http.Headers;
var client = new HttpClient();
var request = new HttpRequestMessage
{
    Method = HttpMethod.Get,
    RequestUri = new Uri("https://example.com/api/workspace/file-protection/signal-audit/example"),
    Headers =
    {
        { "Authorization", "Bearer <token>" },
    },
};
using (var response = await client.SendAsync(request))
{
    response.EnsureSuccessStatusCode();
    var body = await response.Content.ReadAsStringAsync();
    Console.WriteLine(body);
}

const url = 'https://example.com/api/workspace/file-protection/signal-audit/example';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url https://example.com/api/workspace/file-protection/signal-audit/example \
  --header 'Authorization: Bearer <token>'

Authorizations

WorkspaceBearer

Parameters

Path Parameters

required

string

Query Parameters

access_token

string

Optional access token for clients that cannot set Authorization headers. Prefer Authorization: Bearer <token> when possible.

Responses

200

application/json

object

Data

One immutable episode transition.

object

string

nullable

Event

string

nullable

OccurredAtUtc

string format: date-time

Severity

integer format: int32

Allowed values: 1 2

ActorUserId

string

nullable

Reason

string

nullable

Comment

string

nullable

SourceId

string

nullable

AgentId

string

nullable

SignalId

string

nullable

PolicyKind

integer format: int32

Allowed values: 0 1 2 3 4 5

FileId

string

nullable

FileName

string

nullable

DiagnosticSnapshot

Only recorded, safe diagnostic facts; null means the historical event did not record that value.

object

PolicyKind

integer format: int32

Allowed values: 0 1 2 3 4 5

State

integer format: int32

Allowed values: 0 1 2

FileId

string

nullable

FileName

string

nullable

DiagnosticCode

string

nullable

SafeErrorCode

string

nullable

ResolutionCode

string

nullable

RunId

string

nullable

OccurrenceId

string

nullable

RecoveryPointId

string

nullable

RaisedAtUtc

string format: date-time

nullable

UpdatedAtUtc

string format: date-time

nullable

ResolvedAtUtc

string format: date-time

nullable

ReferenceAtUtc

string format: date-time

nullable

LastObservedAtUtc

string format: date-time

nullable

CountedMinutes

number format: double

nullable

ThresholdMinutes

integer format: int32

nullable

TimeZoneId

string

nullable

Calendar

Array<object>

nullable

One weekly local interval; day is ISO Monday=1 through Sunday=7. End less than start crosses midnight.

object

DayOfWeek

integer format: int32

StartMinute

integer format: int32

EndMinute

integer format: int32

Policies

Array<object>

nullable

Object-owned rule. Null thresholds disable the corresponding escalation level.

object

Kind

integer format: int32

Allowed values: 0 1 2 3 4 5

Enabled

boolean

EventSeverity

integer format: int32

Allowed values: 1 2

WarningAfterMinutes

integer format: int32

nullable

ErrorAfterMinutes

integer format: int32

nullable

Calendar

Array<object>

nullable

One weekly local interval; day is ISO Monday=1 through Sunday=7. End less than start crosses midnight.

object

DayOfWeek

integer format: int32

StartMinute

integer format: int32

EndMinute

integer format: int32

Recipients

Array<object>

nullable

Recipient selections for one type and level, with current workspace eligible audience count.

object

PolicyKind

integer format: int32

Allowed values: 0 1 2 3 4 5

Severity

integer format: int32

Allowed values: 1 2

Recipients

Array<object>

nullable

An explicit role or responsibility-group recipient selection.

object

Kind

integer format: int32

Allowed values: 0 1

string

nullable

DisplayName

string

nullable

EligibleRecipientCount

integer format: int32

TimeZoneId

string

nullable

ActorDisplayName

string

nullable

ObjectDisplayName

string

nullable

Errors

Array<object>

nullable

object

Code

required

string

nullable

Message

required

string

nullable

Target

string

nullable

Field

string

nullable

Metadata

object

key

additional properties

string

nullable

Type

integer format: int32

Allowed values: 0 1 2

Severity

integer format: int32

Allowed values: 0 1 2

Warnings

Array<object>

nullable

object

Code

required

string

nullable

Message

required

string

nullable

Target

string

nullable

Field

string

nullable

Metadata

object

key

additional properties

string

nullable

Type

integer format: int32

Allowed values: 0 1 2

Severity

integer format: int32

Allowed values: 0 1 2

Success

boolean

Example

{
  "Data": {
    "Severity": 1,
    "PolicyKind": 0,
    "DiagnosticSnapshot": {
      "PolicyKind": 0,
      "State": 0
    },
    "Policies": [
      {
        "Kind": 0,
        "EventSeverity": 1
      }
    ],
    "Recipients": [
      {
        "PolicyKind": 0,
        "Severity": 1,
        "Recipients": [
          {
            "Kind": 0
          }
        ]
      }
    ]
  },
  "Errors": [
    {
      "Type": 0,
      "Severity": 0
    }
  ],
  "Warnings": [
    {
      "Type": 0,
      "Severity": 0
    }
  ]
}