Skip to main content
GET
Retrieve a token access log

Authorizations

x-api-key
string
header
required

API Key authentication. Format: 'x-api-key: api_key'

Path Parameters

id
string<uuid>
required

A UUID string identifying this token access log.

Response

200 - application/json

One access-log line plus the request and response content recorded with it.

content has no fixed shape and may gain or lose fields over time — read it as a document, not as a fixed set of columns. It can also be absent: content_status says whether it was available for this line.

id
string<uuid>
required
read-only
created_at
string<date-time>
required
read-only
token_kind
enum<string>
required
  • api-token - API token
  • mcp-token - MCP token
Available options:
api-token,
mcp-token
token_id
string<uuid> | null
required
read-only

The APIToken's or the MCPToken's id — token_kind says which. Not a foreign key because it points at two different tables. Null when authentication failed, and there is no token to name.

token_description
string
required
read-only
token_owner
integer | null
required
read-only
token_owner_email
string
required
read-only
action
string
required
read-only

Client-facing action slug from the audit registry (source.create, data.sql_query, ...), derived from the resolved route — never from the raw URL. unknown is a valid value: a route nobody has mapped yet is still recorded.

transport
enum<string>
required
  • http - HTTP
  • websocket - WebSocket
  • mcp_tool - MCP tool call
Available options:
http,
websocket,
mcp_tool
method
string
required
read-only
path
string
required
read-only
status_code
integer | null
required
read-only
response_content_length
integer | null
required
read-only

How much data left with this response — the size question an access audit exists to answer.

duration_ms
integer | null
required
read-only
remote_address
string
required
read-only
client_tool
string
required
read-only

MCP tool name, when the caller declares one. Informational only — it comes from the client, so it authorises nothing.

tool_call_id
string<uuid> | null
required
read-only

The MCP tool call this line belongs to: on an HTTP or WebSocket line, the call that made the request; on a tool call line, the outer call (run_tool) that dispatched it. Null otherwise. Not indexed: it is only read inside the time window of one call, which the workspace/created_at index already bounds.

content
string
required
read-only
content_status
string
required
read-only
tool_requests
object[]
required
read-only

For an MCP tool call line, the requests the call made to the API (and the inner calls a run_tool dispatched), oldest first. Empty for any other line.