> ## Documentation Index
> Fetch the complete documentation index at: https://docs.igrisecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Get request and response bodies

> Returns the decrypted LLM request and response bodies of an event. Bodies are captured only when the connection (or the matching rule) logs full content, and only until the retention window passes. Otherwise the response is `{ "captured": false }`.

**Required permission:** `audit:read`




## OpenAPI

````yaml /api-reference/openapi.yaml get /api/v1/audit-events/{id}/body
openapi: 3.1.0
info:
  title: Igris Management API
  version: '1'
  description: >-
    REST API for managing Igris connections, policies, sessions, audit events
    and alerts.
servers:
  - url: https://api.igrisecurity.com
security:
  - bearerAuth: []
tags:
  - name: Connections
  - name: Policies
  - name: Sessions
  - name: Audit Events
  - name: Incidents
  - name: Webhooks
  - name: API Keys
  - name: Members
  - name: LLM Providers
  - name: LLM Cost
  - name: Observe
paths:
  /api/v1/audit-events/{id}/body:
    get:
      tags:
        - Audit Events
      summary: Get request and response bodies
      description: >
        Returns the decrypted LLM request and response bodies of an event.
        Bodies are captured only when the connection (or the matching rule) logs
        full content, and only until the retention window passes. Otherwise the
        response is `{ "captured": false }`.


        **Required permission:** `audit:read`
      operationId: getAuditEventBody
      parameters:
        - $ref: '#/components/parameters/Id'
      responses:
        '200':
          description: The bodies, or `captured false`.
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    oneOf:
                      - type: object
                        title: Not captured
                        properties:
                          captured:
                            type: boolean
                            const: false
                      - type: object
                        title: Captured
                        properties:
                          captured:
                            type: boolean
                            const: true
                          request:
                            description: The request body as sent to the provider.
                          response:
                            description: The provider's response body.
                          expiresAt:
                            type: string
                            format: date-time
              example:
                data:
                  captured: true
                  request:
                    model: gpt-4o
                    messages:
                      - role: user
                        content: Hello
                  response:
                    choices:
                      - message:
                          role: assistant
                          content: Hi there
                  expiresAt: '2026-01-31T00:00:00Z'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
components:
  parameters:
    Id:
      name: id
      in: path
      required: true
      schema:
        type: string
        format: uuid
  responses:
    Unauthorized:
      description: No valid session or API key, or the key's creator is no longer a member.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error: Unauthorized
    Forbidden:
      description: The caller lacks the required permission.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ForbiddenError'
    NotFound:
      description: Not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error: Not found
  schemas:
    Error:
      type: object
      required:
        - error
      properties:
        error:
          type: string
    ForbiddenError:
      type: object
      properties:
        error:
          type: string
          example: Forbidden
        required:
          type: string
          description: The permission the caller lacks.
          example: policies:write
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: ig_...
      description: >-
        An Igris API key. It acts with the current role and permission overrides
        of the member who created it.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.