> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qobra.co/llms.txt
> Use this file to discover all available pages before exploring further.

# get_audit_log

Full detail of one audit-trail entry, including its change payload.

A list\_audit\_logs row plus `changes` — the action's field-level before/after
diff as a clean list — and its `description`. Reach for it after list\_audit\_logs
surfaces an entry whose change detail you need to explain. For the affected
resource's own current state, use that resource's tool.

## Parameters

<Accordion title="Body" defaultOpen>
  <ParamField body="audit_log_id" type="string" required>
    Id of the audit-trail entry to inspect — the id returned by list\_audit\_logs.
  </ParamField>
</Accordion>

## Response

<Accordion title="Body" defaultOpen>
  <ResponseField name="id" type="string" />

  <ResponseField name="timestamp" type="string">
    When the action happened (UTC, ISO-8601).
  </ResponseField>

  <ResponseField name="event_name" type="string">
    Coded name of the audited event, e.g. 'UserUpdated' or
    'CompensationRuleUpdated' — the precise action taken.
  </ResponseField>

  <ResponseField name="resource_id" type="string">
    Id of the affected resource; null when not applicable.
  </ResponseField>

  <ResponseField name="resource_name" type="string">
    Human-readable name of the affected resource, if known.
  </ResponseField>

  <ResponseField name="actor" type="object">
    <Expandable title="object properties">
      <ResponseField name="id" type="string">
        ObjectId of the actor; feed it to get\_user for detail.
      </ResponseField>

      <ResponseField name="email" type="string">
        Actor's email as recorded at action time — the identifier to recognize
        the user by. Null for a system/script action.
      </ResponseField>

      <ResponseField name="name" type="string" />

      <ResponseField name="role" type="string">
        Actor's role name as recorded at action time.
      </ResponseField>
    </Expandable>
  </ResponseField>

  <ResponseField name="description" type="string" />

  <ResponseField name="changes" type="object[]">
    The action's field-level changes as a clean before/after list. Empty when
    the action carries no field diff (e.g. a create/delete, or a payload-less
    event).

    <Expandable title="object properties">
      <ResponseField name="field" type="string">
        Name of the field that changed.
      </ResponseField>

      <ResponseField name="old_value" type="any">
        Value before the change; null when unset or on a create.
      </ResponseField>

      <ResponseField name="new_value" type="any">
        Value after the change; null when unset or on a delete.
      </ResponseField>
    </Expandable>
  </ResponseField>
</Accordion>