Get Audit Log

curl --request GET \
  --url https://api.dfns.io/auth/action/logs/{id} \
  --header 'Authorization: Bearer <token>'

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.dfns.io/auth/action/logs/{id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.dfns.io/auth/action/logs/{id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.dfns.io/auth/action/logs/{id}"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.dfns.io/auth/action/logs/{id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "id": "uj-4vs1l-5012b-95825381215t26u8",
  "action": "eyJwYXlsb2FkIjoie1wibmFtZVwi3215853bGlhXCJ9IiwibWV0aG9kIjoiUFVUIiwicGF0aCI6Ii93YWxsZX32584LTNsNmFwLXI0Y2J0LThqMDltaGh0YnU1MjQyYzgiLCJzZXJ2ZXIiOiJhcGkuZGZucy5pbyIsInN56534nkiOiJVcGRhdGUgd2FsbGV0IHdhLTNsNmFwLXI0Y2J0LThqMDlt84388jQyYzguIiwibm9uY2UiOiIifQ==",
  "actionToken": "eyJ0eXAiOiJKV1QiLC453JFZERTQSJ9.eyJqdGkiOiJ1ai00dnMxbC01MDEyYi05NTg5Y3M0NXIy548nU4IiwiaXNzIjoiYXV0aC5kZm5zLmlvIiwiYXVk3543586XRoOnVzZXI6YWN0aW9uIiwic3ViIjoidXMtNG92aDQtNmEwaDgtODFvYWgwZmozdThsNmRqdC354348HBzOi8vY3VzdG9tL2FwcF9tZXRhZGF0YSI6eyJvcmdJZCI6Im9yLTFtZG9rLTV1dmgwLTllNzluOTlqNWE5azV1MWoiLCJmaXJzdEZhY3RvckNyZWRlbnRpYWxVdWlkIjoiY3ItN2JmcWstODl1YWctOG5scXZxdmd0NmR2ZDFtayIsInNlY29uZEZhY3RvckNyZWRlbnRpYWxVdWlkIjoiIiwiaGFzaCI6ImM5YTc5YjcxZjI0ZTRkMzJjNGJmN2M1NzlkYmQ3Y2RmZDRlNDUwOWFkMGM1ZmM5ZDVlNjEyYWFkODllMmQzOTYiLCJub25jZSI6Im5vLTVoMG44LWg5b211LTkxZHJqc2RjZnRxMzJmbmMifSwiaWF0IjoxNzYwMDE2MTg1LCJleHAiOjE3NjAwMTcwODV9.zva5vMQHkkbxGgk8IG2jHtbWOoftDA1ga_5INqLks2aCO9V29U3lWE9eE3Mu3M6z5SPHprF31BpIMW0jOzWbDA",
  "datePerformed": "2025-10-09T13:23:05.134Z",
  "dateSigned": "2025-10-09T13:23:04.000Z",
  "dateResolved": "2025-10-09T13:23:05.600Z",
  "responseStatus": "200",
  "responseError": null,
  "userId": "us-4ovh4-6a0h8-81oa5584u8l6djt",
  "username": "my-user@my-company.com",
  "firstFactorCredential": {
    "id": "cr-7bfqk-89uag-8nlq12437958dvd1mk",
    "kind": "Fido2",
    "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE2315138132rYlwMzKbl458cZk\nyiHqVsN6QJRE/tqvqsdfq35eT8KEwjSGsh/Lv4LiWMFlnz/kIzjo6TCJpA==\n-----END PUBLIC KEY-----\n",
    "assertion": {
      "authenticatorData": "k3SiDdanJToQdO2q1f3se58ELbhdGfzoZ3GRSPmOO9AdAAAAAA",
      "clientData": "eyJ0eXBlIjoid2ViYXV0aG4uZ2V0qfses135ebmdlIjoiWlhsS2NGcERTVFpKYlU1dlRGUmFibGt5ZERKTVYwVXlZbnBXZGt4VWFIVmphbXd3V1ZkU2JrNHpXbk5QVjNOM1RVUlJhVXhEU25WaU1qVnFXbE5KTmtsdE5YWk1WRlUwWTBkVmVVeFVVblZaVkVGM1RGUm5lVTlIUlRKUFZFWXhZMjFPZEdFeVdYcE9WekJwVEVOS2QxbFliSE5pTWtaclUwZEdlbUZEU1RaSmJWSm9Xa2RhYkU5VVdUSmFSMVUxVFZSTk0xcEVUVFJQVjFFd1RrUlJlVTlFWXpGUFJFcHFUVlJKTVU1NlJYaE9hbWN6VFVkSk0xcEVTWGRaVjBsM1RsUlpNRmx0Vm14YWFtTXhUbGRLYWxwWFNYcE9Na2xwVEVOS2QxbFlVbTlKYW05cFRETmthR0pIZUd4a1NFMTJaREpGZEUweWR6SlpXRUYwWTJwU2FsbHVVWFJQUjI5M1QxY3hiMkZJVW1sa1ZGVjVUa1JLYWs5RFNYTkpiazR4WWxjeGFHTnVhMmxQYVVwV1kwZFNhR1JIVldka01rWnpZa2RXTUVsSVpHaE1WRTV6VG0xR2QweFlTVEJaTWtvd1RGUm9jVTFFYkhSaFIyZ3dXVzVWTVUxcVVYbFplbWQxU1c0dyIsIm9yaWdpbiI6Imh0dHBzOi8vYXBwLmRmbnMuaW8iLCJjcm9zc09yaWdpbiI6ZmFsc2V9",
      "signature": "MEYCIQDq2iXdlHcsqf13se5BlK1VJFiMQuV1x-HTj1efWvu5dKGgIhAJOudYr43QPWNQnxu1Y1U7PJ3pxjQNhx7kBb821HZJNk"
    }
  }
}

Get Audit Log

Gets detailed information for a particular audit log. Specifically, the API returns the action performed, as well as the firstFactorCredential in which you will find the signature information required to validate it.

Dfns maintains a script which can be used for audit log signature validation: WebAuthn Signature Verifier

Because the response includes the full signed action (request body and path), details are only returned for actions on routes that Dfns has marked as safe to expose (the same set forwarded to SIEM exports). Requesting details for any other event returns 403 Forbidden.

GET

auth

action

logs

{id}

Get Audit Log

curl --request GET \
  --url https://api.dfns.io/auth/action/logs/{id} \
  --header 'Authorization: Bearer <token>'

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.dfns.io/auth/action/logs/{id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.dfns.io/auth/action/logs/{id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.dfns.io/auth/action/logs/{id}"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.dfns.io/auth/action/logs/{id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "id": "uj-4vs1l-5012b-95825381215t26u8",
  "action": "eyJwYXlsb2FkIjoie1wibmFtZVwi3215853bGlhXCJ9IiwibWV0aG9kIjoiUFVUIiwicGF0aCI6Ii93YWxsZX32584LTNsNmFwLXI0Y2J0LThqMDltaGh0YnU1MjQyYzgiLCJzZXJ2ZXIiOiJhcGkuZGZucy5pbyIsInN56534nkiOiJVcGRhdGUgd2FsbGV0IHdhLTNsNmFwLXI0Y2J0LThqMDlt84388jQyYzguIiwibm9uY2UiOiIifQ==",
  "actionToken": "eyJ0eXAiOiJKV1QiLC453JFZERTQSJ9.eyJqdGkiOiJ1ai00dnMxbC01MDEyYi05NTg5Y3M0NXIy548nU4IiwiaXNzIjoiYXV0aC5kZm5zLmlvIiwiYXVk3543586XRoOnVzZXI6YWN0aW9uIiwic3ViIjoidXMtNG92aDQtNmEwaDgtODFvYWgwZmozdThsNmRqdC354348HBzOi8vY3VzdG9tL2FwcF9tZXRhZGF0YSI6eyJvcmdJZCI6Im9yLTFtZG9rLTV1dmgwLTllNzluOTlqNWE5azV1MWoiLCJmaXJzdEZhY3RvckNyZWRlbnRpYWxVdWlkIjoiY3ItN2JmcWstODl1YWctOG5scXZxdmd0NmR2ZDFtayIsInNlY29uZEZhY3RvckNyZWRlbnRpYWxVdWlkIjoiIiwiaGFzaCI6ImM5YTc5YjcxZjI0ZTRkMzJjNGJmN2M1NzlkYmQ3Y2RmZDRlNDUwOWFkMGM1ZmM5ZDVlNjEyYWFkODllMmQzOTYiLCJub25jZSI6Im5vLTVoMG44LWg5b211LTkxZHJqc2RjZnRxMzJmbmMifSwiaWF0IjoxNzYwMDE2MTg1LCJleHAiOjE3NjAwMTcwODV9.zva5vMQHkkbxGgk8IG2jHtbWOoftDA1ga_5INqLks2aCO9V29U3lWE9eE3Mu3M6z5SPHprF31BpIMW0jOzWbDA",
  "datePerformed": "2025-10-09T13:23:05.134Z",
  "dateSigned": "2025-10-09T13:23:04.000Z",
  "dateResolved": "2025-10-09T13:23:05.600Z",
  "responseStatus": "200",
  "responseError": null,
  "userId": "us-4ovh4-6a0h8-81oa5584u8l6djt",
  "username": "my-user@my-company.com",
  "firstFactorCredential": {
    "id": "cr-7bfqk-89uag-8nlq12437958dvd1mk",
    "kind": "Fido2",
    "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE2315138132rYlwMzKbl458cZk\nyiHqVsN6QJRE/tqvqsdfq35eT8KEwjSGsh/Lv4LiWMFlnz/kIzjo6TCJpA==\n-----END PUBLIC KEY-----\n",
    "assertion": {
      "authenticatorData": "k3SiDdanJToQdO2q1f3se58ELbhdGfzoZ3GRSPmOO9AdAAAAAA",
      "clientData": "eyJ0eXBlIjoid2ViYXV0aG4uZ2V0qfses135ebmdlIjoiWlhsS2NGcERTVFpKYlU1dlRGUmFibGt5ZERKTVYwVXlZbnBXZGt4VWFIVmphbXd3V1ZkU2JrNHpXbk5QVjNOM1RVUlJhVXhEU25WaU1qVnFXbE5KTmtsdE5YWk1WRlUwWTBkVmVVeFVVblZaVkVGM1RGUm5lVTlIUlRKUFZFWXhZMjFPZEdFeVdYcE9WekJwVEVOS2QxbFliSE5pTWtaclUwZEdlbUZEU1RaSmJWSm9Xa2RhYkU5VVdUSmFSMVUxVFZSTk0xcEVUVFJQVjFFd1RrUlJlVTlFWXpGUFJFcHFUVlJKTVU1NlJYaE9hbWN6VFVkSk0xcEVTWGRaVjBsM1RsUlpNRmx0Vm14YWFtTXhUbGRLYWxwWFNYcE9Na2xwVEVOS2QxbFlVbTlKYW05cFRETmthR0pIZUd4a1NFMTJaREpGZEUweWR6SlpXRUYwWTJwU2FsbHVVWFJQUjI5M1QxY3hiMkZJVW1sa1ZGVjVUa1JLYWs5RFNYTkpiazR4WWxjeGFHTnVhMmxQYVVwV1kwZFNhR1JIVldka01rWnpZa2RXTUVsSVpHaE1WRTV6VG0xR2QweFlTVEJaTWtvd1RGUm9jVTFFYkhSaFIyZ3dXVzVWTVUxcVVYbFplbWQxU1c0dyIsIm9yaWdpbiI6Imh0dHBzOi8vYXBwLmRmbnMuaW8iLCJjcm9zc09yaWdpbiI6ZmFsc2V9",
      "signature": "MEYCIQDq2iXdlHcsqf13se5BlK1VJFiMQuV1x-HTj1efWvu5dKGgIhAJOudYr43QPWNQnxu1Y1U7PJ3pxjQNhx7kBb821HZJNk"
    }
  }
}

Authentication

✅ Organization User (CustomerEmployee)
❌ Delegated User (EndUser)
✅ Service Account

Required Permissions

Auth:Logs:Read: Always required.

Authorizations

Authorization

string

header

required

Bearer Token: Used to authenticate API requests. More details how to generate the token: Authentication flows

Path Parameters

required

Log id you need information about.

Required string length: 1 - 64

Pattern: ^uj-[a-z0-9]{5}-[a-z0-9]{5}-[a-z0-9]{14,16}$

Example:

"uj-22lhj-mp2ir-88at3r4cufpis60i"

Response

200 - application/json

Success

required

Log id.

Required string length: 1 - 64

Pattern: ^uj-[a-z0-9]{5}-[a-z0-9]{5}-[a-z0-9]{14,16}$

Example:

"uj-22lhj-mp2ir-88at3r4cufpis60i"

action

string

required

Action performed.

actionToken

string

required

User Action Signature used as token for permorming this action.

userId

string | null

required

User who performed the action.

Required string length: 1 - 64

Pattern: ^us-[a-z0-9]{5}-[a-z0-9]{5}-[a-z0-9]{14,16}$

Example:

"us-6b58p-r53sr-rlrd3l5cj3uc4ome"

username

string | null

required

Username who performed the action.

datePerformed

string<date-time> | null

required

ISO 8601 date (must be UTC). When this action was performed (consumed by its handler).

Example:

"2023-04-14T20:41:28.715Z"

dateSigned

string<date-time> | null

required

ISO 8601 date (must be UTC). Date when the user action token was signed.

Example:

"2023-04-14T20:41:28.715Z"

dateResolved

string<date-time> | null

required

ISO 8601 date (must be UTC). When this action reached its final outcome (handler finished and the HTTP status was recorded). Null for legacy rows recorded before outcome tracking.

Example:

"2023-04-14T20:41:28.715Z"

responseStatus

string | null

required

Final HTTP status code returned for this action (e.g. "200", "403"). Null for legacy rows recorded before outcome tracking.

responseError

string | null

required

Failure reason for the action, when it failed. Null on success or when no failure reason was recorded.

firstFactorCredential

object

required

Cryptographic Signature details. Use these parameters if you want to validate the signature.

Show child attributes

API Authorization

Identity & Access Management

Wallets & Transactions

Management

Webhooks

Get Audit Log

Authentication

Required Permissions

Authorizations

Path Parameters

Response

​Authentication

​Required Permissions

Authorizations

Path Parameters

Response

Authentication

Required Permissions