Get security event
/v1/security/events/{id}
Signed-in sessionLaunch key product.securityOperation security_event_get
People see the devices that run their agents, their security posture and the events those devices report.
Headers
- X-Specify-Account-IdstringRequired
- The account the request acts in.
- X-Specify-Service-Tenancy-IdstringRequired
- The service tenancy the request acts in.
Path parameters
- idstringRequired
Query parameters
- expectedAuthorizationVersionstring
Returns
- idstringRequired
- ownerobjectRequired
- deviceIdnull | stringRequired
- deviceClient"claude_code" | "codex" | "cursor" | "mcp_proxy" | nullRequired
- eventType"decision" | "outcome"Required
- decisionEventIdnull | stringRequired
- occurredAtnumberRequired
- receivedAtnumberRequired
- decision"allow" | "deny" | "observe" | nullRequired
- outcome"cancelled" | "failed" | "not_executed" | "succeeded" | "unknown" | nullRequired
- toolNamestringRequired
- operationobjectRequired
- captureMode"full_content" | "matched_evidence" | "redacted_metadata"Required
- coverageState"degraded" | "enforced" | "invalid_policy" | "missing_policy" | "observed"Required
- policyBundleIdnull | stringRequired
- contentAvailablebooleanRequired
Errors
400, 401, 403, 404, 409, 429 and 503 return {"error": {"code", "message", "correlationId"}}.