> ## Documentation Index > Fetch the complete documentation index at: https://docs.didit.me/llms.txt > Use this file to discover all available pages before exploring further. # Get Monitoring Event > Retrieve one monitoring event with its payload, device context, IP enrichment, cached subject signals, tags and rule evidence. Get Monitoring Event API Prompt Copy prompt to clipboard 
  \`Retrieve one monitoring event from Didit with its full envelope, enrichment and rule evidence.

  Endpoint:
  GET [https://verification.didit.me/v3/events/\{event\_uuid}/](https://verification.didit.me/v3/events/\{event_uuid}/)

  Authentication:
  Use the x-api-key header with my Didit API key. A scoped key needs transactions: read.

  Goal:

  * Show the event detail in my back office or an investigation tool: what was sent, what Didit derived, and why a rule matched.

  Behavior:

  * event\_uuid is the Didit id returned by the create, batch, list and timeline calls (not my own event\_id).
  * Returns every summary field of the list call plus payload, custom\_values, device\_context, field\_sources, the promoted domain fields (hand\_id, dispute\_id, chargeback\_id, withdrawal\_address\_hash, changed\_field, ...), expires\_at, rules\_evaluated\_count, rule\_runs, ip\_enrichment, subject\_profile and tags.
  * field\_sources maps each field path to customer (sent by my backend), sdk (sent by the device lane) or server (derived by Didit, such as received\_at and IP enrichment).
  * While correlation\_pending is true an asynchronous rule still has to run; read the event again later for the final status, score and rule\_runs.
  * ip\_enrichment and subject\_profile are null when nothing is known.

  Example call:
  curl -X GET "[https://verification.didit.me/v3/events/11111111-2222-3333-4444-555555555555/](https://verification.didit.me/v3/events/11111111-2222-3333-4444-555555555555/)" \
  -H "x-api-key: YOUR\_API\_KEY"

  What to read from the response:

  * status, score, rules\_matched\_count.
  * rule\_runs\[] - one per matching rule: rule\_uuid, rule\_title, library\_key, mode (ACTIVE or TEST), severity, matched (always true), score\_delta, action\_summary, is\_async, matched\_payload (the conditions and aggregations that matched, with expected and observed values) and created\_at.
  * ip\_enrichment - ip\_country\_code, ip\_city, asn\_number, asn\_organization, is\_vpn\_or\_tor, is\_data\_center, proxy\_type, last\_enriched\_at.
  * field\_sources - trust signal for each value before acting on a match.
  * tags - names of the tags rules attached.

  Failure modes:

  * 401 - the API key has expired.
  * 403 - missing or invalid API key, or a scoped key without transactions: read.
  * 404 - no event with this event\_uuid in the application (never stored, deleted, or another application's).

  Side effects: none. This is a pure read.

  For the full integration shape, see /integration/integration-prompt.\`
Paste into See [Evidence](/transaction-monitoring/event-rules.md#evidence) for how rule runs record each matched value and its source, and [IP enrichment](/transaction-monitoring/ip-enrichment.md) for the enriched address fields. ## OpenAPI ````yaml GET /v3/events/{event_uuid}/ openapi: 3.0.0 info: version: 3.0.0 title: Didit Verification API description: Identity verification API. Authenticate with x-api-key header. servers: - url: https://verification.didit.me security: [] tags: [] paths: /v3/events/{event_uuid}/: get: tags: - Monitoring Events summary: Get monitoring event description: >- Retrieve one monitoring event with everything the list returns plus the payload, custom values, device context, field provenance (`field_sources`), the promoted domain fields, `expires_at`, every matching rule run with its evidence, the IP enrichment and the tags rules attached. While `correlation_pending` is `true` an asynchronous rule still has to run; read the event again a few minutes later for the final `status`, `score` and `rule_runs`. Reads work whether or not event ingestion is switched on. A scoped API key needs `transactions: read`. See [Evidence](https://docs.didit.me/transaction-monitoring/event-rules#evidence) and [IP enrichment](https://docs.didit.me/transaction-monitoring/ip-enrichment). operationId: get_monitoring_event parameters: - name: event_uuid in: path required: true description: >- Didit identifier of the event (`event_uuid` from the create, batch, list or timeline response), not your own `event_id`. schema: type: string format: uuid example: 11111111-2222-3333-4444-555555555555 responses: '200': description: The event with its evidence. content: application/json: schema: $ref: '#/components/schemas/MonitoringEventDetail' examples: Login from a VPN, in review: value: event_uuid: 33333333-4444-5555-6666-777777777777 event_id: login-2026-10-17-000001 event_category: auth action_type: login occurred_at: '2026-10-17T09:15:02.481000Z' received_at: '2026-10-17T09:15:02.903114Z' status: IN_REVIEW score: 40 subject_vendor_data: user-42 subject_entity_type: individual subject_uuid: 66666666-7777-8888-9999-000000000000 counterparty_vendor_data: null session_id: web-session-abc device_fingerprint: fp-a8c1 ip_address: 203.0.113.42 ip_country: ES amount: null currency: null game_id: null round_id: null bonus_id: null affiliate_code: null payment_reference_id: null retention_class: risk_relevant rules_matched_count: 1 correlation_pending: false is_droppable: true payload: method: password custom_values: vip_tier: gold vpn_or_proxy_detected: true device_context: fingerprint: fp-a8c1 network_context: ip_address: 203.0.113.42 ip_country: Spain ip_country_code: ES ip_city: Madrid asn_number: 64500 asn_organization: Example Networks is_vpn_or_tor: true is_data_center: false field_sources: subject.vendor_data: customer event_category: customer action_type: customer occurred_at: customer received_at: server payload.method: customer session.session_id: customer session.sequence: customer device_context.fingerprint: customer device_context.network_context.ip_address: customer device_context.network_context.ip_country: server device_context.network_context.ip_country_code: server device_context.network_context.ip_city: server device_context.network_context.asn_number: server device_context.network_context.asn_organization: server device_context.network_context.is_vpn_or_tor: server device_context.network_context.is_data_center: server session_sequence: 142 table_id: null hand_id: null match_id: null market_id: null side: null role: null net_result_amount: null payment_fingerprint: null instrument_reference_hash: null withdrawal_address_hash: null dispute_id: null chargeback_id: null changed_field: null identity_match_ref: null schema_version: 1 expires_at: '2027-01-15T09:15:02.481000Z' rules_evaluated_count: 6 rule_runs: - rule_uuid: aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee rule_title: Login from VPN or Tor library_key: null matched: true mode: ACTIVE is_async: false severity: MEDIUM score_delta: 40 action_summary: score +40; add_tag:VPN_LOGIN matched_payload: - field: event.ip.is_vpn_or_tor operator: eq expected_value: true current_value: true matched: true group_index: null group_logic: AND field_source: server created_at: '2026-10-17T09:15:02.951207Z' ip_enrichment: ip_country_code: ES ip_city: Madrid asn_number: 64500 asn_organization: Example Networks is_vpn_or_tor: true is_data_center: false proxy_type: null last_enriched_at: '2026-10-17T09:15:02.910442Z' subject_profile: null tags: - VPN_LOGIN '401': description: >- The scoped API key has expired. Only an expired key gets `401`; a missing or invalid key gets `403`. content: application/json: examples: Expired key: value: detail: This API key has expired. '403': description: >- Missing or invalid `x-api-key` (this endpoint answers `403`, never `401`, for a missing or invalid key), a scoped key without `transactions: read`, a key limited to some workflows or to approved sessions (such a key never reaches transaction monitoring data), or a request from outside the key's IP allowlist. content: application/json: examples: Missing or invalid API key: value: detail: You do not have permission to perform this action. Scoped key without access: value: detail: This API key has no read access to transactions. Key limited to workflows or approved sessions: value: detail: >- This API key only reaches sessions inside its workflow or status limits, so it can't use this endpoint. IP not allowed: value: detail: This API key can't be used from this IP address. '404': description: >- No event with this `event_uuid` exists in the application: it was never stored, it was deleted, or it belongs to another application. A path segment that is not a UUID does not match the route and also returns `404`. content: application/json: examples: Not found: value: detail: No MonitoringEvent matches the given query. '429': description: >- Rate limit exceeded: `GET` requests share a budget of 600 requests per minute per API key. Wait `Retry-After` seconds, then retry. headers: Retry-After: description: Seconds to wait before retrying. schema: type: integer minimum: 1 example: 30 content: application/json: examples: Throttled: value: detail: >- GET request rate limit exceeded. You can make up to 600 requests per minute. security: - ApiKeyAuth: [] x-codeSamples: - lang: curl label: curl source: >- curl -X GET 'https://verification.didit.me/v3/events/11111111-2222-3333-4444-555555555555/' \ -H 'x-api-key: YOUR_API_KEY' - lang: python label: Python source: |- import os import requests event_uuid = '11111111-2222-3333-4444-555555555555' resp = requests.get( f'https://verification.didit.me/v3/events/{event_uuid}/', headers={'x-api-key': os.environ['DIDIT_API_KEY']}, timeout=10, ) resp.raise_for_status() event = resp.json() print(event['status'], event['score']) for run in event['rule_runs']: print(run['rule_title'], run['score_delta'], run['action_summary']) - lang: javascript label: JavaScript source: >- const eventUuid = '11111111-2222-3333-4444-555555555555'; const resp = await fetch(`https://verification.didit.me/v3/events/${eventUuid}/`, { headers: { 'x-api-key': process.env.DIDIT_API_KEY }, }); if (!resp.ok) throw new Error(`Request failed: ${resp.status}`); const event = await resp.json(); console.log(event.status, event.score, event.rule_runs.length, 'rule runs'); components: schemas: MonitoringEventDetail: description: >- One monitoring event with its full envelope, enrichment and rule evidence. Every field of `MonitoringEvent` plus the fields below. allOf: - $ref: '#/components/schemas/MonitoringEvent' - type: object required: - payload - custom_values - device_context - field_sources - session_sequence - table_id - hand_id - match_id - market_id - side - role - net_result_amount - payment_fingerprint - instrument_reference_hash - withdrawal_address_hash - dispute_id - chargeback_id - changed_field - identity_match_ref - schema_version - expires_at - rules_evaluated_count - rule_runs - ip_enrichment - subject_profile - tags properties: payload: type: object additionalProperties: true description: The category fields you sent in `payload`. custom_values: type: object additionalProperties: true description: >- The scalar `custom_values` you sent. Didit adds `vpn_or_proxy_detected: true` or `is_data_center: true` when IP enrichment flags the address and you did not set them. device_context: type: object additionalProperties: true description: >- The device context as stored: your `device_context` (including `fingerprint`, `persistent_device_id` and `bot_score` when sent) with `network_context` completed by IP enrichment (`ip_country`, `ip_country_code`, `ip_city`, `asn_number`, `asn_organization`, `is_vpn_or_tor`, `is_data_center`, `proxy_type`, `connection_type`) for keys you left empty. field_sources: type: object additionalProperties: type: string enum: - customer - sdk - server description: >- Field path to provenance: `customer` (sent by your backend), `sdk` (sent through the device lane) or `server` (derived by Didit, such as `received_at` and enriched network fields). Check it before acting on a match. session_sequence: type: integer format: int64 nullable: true description: '`session.sequence` sent with the event.' table_id: type: string nullable: true description: Promoted from `payload.table_id`. maxLength: 128 hand_id: type: string nullable: true description: Promoted from `payload.hand_id`. maxLength: 128 match_id: type: string nullable: true description: Promoted from `payload.match_id`. maxLength: 128 market_id: type: string nullable: true description: Promoted from `payload.market_id`. maxLength: 128 side: type: string nullable: true description: Promoted from `payload.side`. maxLength: 64 role: type: string nullable: true description: Promoted from `payload.role`. maxLength: 64 net_result_amount: type: string nullable: true description: >- Promoted from `payload.net_result_amount`, as a decimal string with 18 decimal places. example: '-120.000000000000000000' payment_fingerprint: type: string nullable: true description: Promoted from `payload.payment_fingerprint`. maxLength: 255 instrument_reference_hash: type: string nullable: true description: Promoted from `payload.instrument_reference_hash`. maxLength: 255 withdrawal_address_hash: type: string nullable: true description: >- Promoted from `payload.withdrawal_address_hash` (or `payload.destination_reference_hash`). maxLength: 255 dispute_id: type: string nullable: true description: Promoted from `payload.dispute_id`. maxLength: 255 chargeback_id: type: string nullable: true description: Promoted from `payload.chargeback_id`. maxLength: 255 changed_field: type: string nullable: true description: Promoted from `payload.changed_field` (security change events). maxLength: 128 identity_match_ref: type: string nullable: true description: >- Promoted from `payload.identity_match_ref` (responsible-gambling registry matches). maxLength: 255 schema_version: type: integer description: Version of the event envelope schema. Currently `1`. example: 1 expires_at: type: string format: date-time nullable: true description: >- When the event expires under its retention class and is deleted: `occurred_at` plus the class period (14, 30 or 90 days by default, adjustable per application). Null for `monetary_or_compliance` events, which follow transaction retention. rules_evaluated_count: type: integer minimum: 0 description: Number of event rules evaluated for this event. rule_runs: type: array description: Every rule that matched the event, newest first. items: $ref: '#/components/schemas/MonitoringEventRuleRun' ip_enrichment: type: object nullable: true description: >- Enrichment of the event's IP address, or null when the address was not enriched. See [IP enrichment](https://docs.didit.me/transaction-monitoring/ip-enrichment). properties: ip_country_code: type: string nullable: true description: Country code of the address. ip_city: type: string nullable: true description: City of the address. asn_number: type: integer nullable: true description: Autonomous system number. asn_organization: type: string nullable: true description: Organization that operates the autonomous system. is_vpn_or_tor: type: boolean description: Whether the address is a known VPN or Tor exit. is_data_center: type: boolean description: >- Whether the address belongs to a hosting or data-centre network. proxy_type: type: string nullable: true description: >- Proxy classification of the address as an opaque string, or null. last_enriched_at: type: string format: date-time nullable: true description: When the address was last enriched. required: - ip_country_code - ip_city - asn_number - asn_organization - is_vpn_or_tor - is_data_center - proxy_type - last_enriched_at subject_profile: type: object nullable: true description: >- Cached email and phone risk signals of the subject, or null when no profile exists for the subject. properties: email_risk_score: type: integer nullable: true description: Email risk score. email_deliverability: type: string nullable: true description: Email deliverability verdict. email_is_disposable: type: boolean nullable: true description: Whether the email address is disposable. email_is_breached: type: boolean nullable: true description: Whether the email address appears in known data breaches. email_social_count: type: integer nullable: true description: Number of online accounts linked to the email address. email_social_providers: type: array items: type: string description: >- Names of the online services where an account linked to the email address was found. phone_risk_score: type: integer nullable: true description: Phone risk score. phone_line_type: type: string nullable: true description: Phone line type. phone_carrier: type: string nullable: true description: Phone carrier name. phone_social_count: type: integer nullable: true description: Number of online accounts linked to the phone number. phone_social_providers: type: array items: type: string description: >- Names of the online services where an account linked to the phone number was found. source_provider: type: string nullable: true description: Opaque identifier of the source of the profile. last_enriched_at: type: string format: date-time nullable: true description: When the profile was last refreshed. required: - email_risk_score - email_deliverability - email_is_disposable - email_is_breached - email_social_count - email_social_providers - phone_risk_score - phone_line_type - phone_carrier - phone_social_count - phone_social_providers - source_provider - last_enriched_at tags: type: array items: type: string description: >- Names of the tags attached to the event (rule `add_tags` actions). MonitoringEvent: type: object description: >- One stored monitoring event as returned by the list and subject-timeline endpoints. Restricted evidence (payload, device context, rule evidence) is only returned by `GET /v3/events/{event_uuid}/`. required: - event_uuid - event_id - event_category - action_type - occurred_at - received_at - status - score - subject_vendor_data - subject_entity_type - subject_uuid - counterparty_vendor_data - session_id - device_fingerprint - ip_address - ip_country - amount - currency - game_id - round_id - bonus_id - affiliate_code - payment_reference_id - retention_class - rules_matched_count - correlation_pending - is_droppable properties: event_uuid: type: string format: uuid description: >- Didit identifier of the event. Use it as `{event_uuid}` in the retrieve and delete calls. event_id: type: string maxLength: 128 description: Your own identifier, the idempotency key you sent. event_category: type: string enum: - auth - session - gameplay - bonus - affiliate - payment - dispute - security - responsible_gambling - custom description: Event category. action_type: type: string maxLength: 128 description: What happened within the category, as you sent it. occurred_at: type: string format: date-time description: When the event happened on your side. received_at: type: string format: date-time description: When Didit accepted the event. status: type: string enum: - ACCEPTED - APPROVED - IN_REVIEW - DECLINED description: >- `ACCEPTED`: stored, no matched rule changed its standing (the normal answer for most events, and always the answer in a sandbox application, where no rules run). `APPROVED`: a rule matched and the score stayed under your review threshold. `IN_REVIEW`: a rule pushed the score over the review threshold or set the status. `DECLINED`: a rule declined it or the score crossed your decline threshold. score: type: integer description: >- Accumulated rule score. Starts at 0; rule `add_score` actions move it (negative deltas are allowed). subject_vendor_data: type: string maxLength: 255 description: '`subject.vendor_data` of the event: your id for the user or company.' subject_entity_type: type: string description: >- `individual` or `company`: which kind of subject `subject_vendor_data` names. example: individual subject_uuid: type: string format: uuid nullable: true description: >- UUID of the user (individual) or company the event resolved to, or null when that record no longer exists. counterparty_vendor_data: type: string nullable: true description: >- The other player of a P2P event (promoted from `payload.counterparty_vendor_data`). maxLength: 255 session_id: type: string nullable: true description: '`session.session_id` sent with the event.' maxLength: 255 device_fingerprint: type: string nullable: true description: '`device_context.fingerprint` sent with the event.' maxLength: 255 ip_address: type: string nullable: true description: >- IP address of the event. On the server lane this is `device_context.network_context.ip_address` as you sent it; on the device lane it is the IP of the request. maxLength: 64 ip_country: type: string nullable: true description: >- Country code of `ip_address` from IP enrichment, or null when the address was not enriched (missing, private, or low-value telemetry whose address was not already known). example: ES amount: type: string nullable: true description: >- Amount as a decimal string with 18 decimal places, from `transaction_context.amount`, `payload.amount` or `payload.stake_amount`, in that order. example: '250.000000000000000000' currency: type: string nullable: true description: Currency from `transaction_context.currency` or `payload.currency`. maxLength: 10 game_id: type: string nullable: true description: Promoted from `payload.game_id`. maxLength: 128 round_id: type: string nullable: true description: Promoted from `payload.round_id`. maxLength: 128 bonus_id: type: string nullable: true description: Promoted from `payload.bonus_id`. maxLength: 128 affiliate_code: type: string nullable: true description: Promoted from `payload.affiliate_code`. maxLength: 128 payment_reference_id: type: string nullable: true description: >- Payment reference from `transaction_context.payment_reference_id` or `payload.payment_reference_id`. maxLength: 255 retention_class: type: string enum: - low_value - standard - risk_relevant - monetary_or_compliance description: >- Retention class. Payment and dispute events are `monetary_or_compliance`; security and responsible-gambling events are `risk_relevant`; `session.page_view`, `session.sdk_heartbeat`, `session.sdk_loaded`, `session.device_seen`, `session.bot_signal_observed`, `bonus.promotion_viewed` and `affiliate.referral_clicked` are `low_value`; everything else is `standard`. An event an active rule matched is promoted to `risk_relevant` (never demoted). rules_matched_count: type: integer minimum: 0 description: >- Number of rules that matched the event, including rules in `TEST` mode (which record evidence but apply no actions). correlation_pending: type: boolean description: >- `true` while an asynchronous rule (cross-subject correlation, or a sequence longer than 24 hours) still has to run for this event. It resolves within minutes and `status`, `score` and `rules_matched_count` update in place. is_droppable: type: boolean description: >- Whether an SDK under backpressure may drop events of this kind. `false` for every `security`, `payment`, `dispute` and `responsible_gambling` event and for `gameplay.bet_placed`, `gameplay.bet_settled` and `gameplay.p2p_settlement`. MonitoringEventRuleRun: type: object properties: rule_uuid: type: string format: uuid description: UUID of the transaction monitoring rule. rule_title: type: string description: Title of the rule. library_key: type: string nullable: true description: >- Library key when the rule was installed from the rules library, otherwise null. matched: type: boolean description: 'Always `true`: only matching runs are recorded.' mode: type: string enum: - ACTIVE - TEST description: >- Mode of the rule when it ran. A `TEST` run records evidence but applied no actions. is_async: type: boolean description: >- `true` when the run came from the asynchronous correlation pass rather than the ingest request. severity: type: string nullable: true enum: - UNKNOWN - LOW - MEDIUM - HIGH - CRITICAL - null description: >- Severity of the rule. Null for `TEST` runs and for rules without a severity. score_delta: type: integer description: How much this run changed the event's score (0 for `TEST` runs). action_summary: type: string nullable: true description: >- Short summary of the actions applied, for example `score +40; add_tag:VPN_LOGIN`. Null when nothing was applied. matched_payload: type: array description: >- The conditions and aggregations that matched. Condition entries carry `field`, `operator`, `expected_value`, `current_value`, `matched`, `group_index`, `group_logic` and `field_source` (`server`, `sdk` or `customer`); aggregation entries carry `metric`, `field`, `operator`, `expected_value`, `computed_value`, `window`, `filters`, `matched` and `sample_references`. items: type: object additionalProperties: true created_at: type: string format: date-time description: When the rule run was recorded. required: - rule_uuid - rule_title - library_key - matched - mode - is_async - severity - score_delta - action_summary - matched_payload - created_at securitySchemes: ApiKeyAuth: type: apiKey in: header name: x-api-key description: >- Your application's API key, from Developers -> API keys in the Business Console. The primary key has full access. A named key can be scoped: none, read or write per resource, limited to some workflows or to approved sessions, to a list of IP addresses, and to an expiry date. 401 means the key is missing, wrong, revoked or expired; 403 means the key has no access to this resource or action, or the request came from an address outside its IP list; 404 on a session route means the session is outside the key's workflows or statuses. A key without media access receives image, video and PDF URLs as null, and a key without sessions write receives session links and tokens as null. See https://docs.didit.me/console/api-keys. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.