See api-docs Menu
  1. Home >
  2. API >
  3. 1 >
  4. Events >
  5. Get Events

Get Events

The call returns up to 50 events per page.

For details about using the pagination element to easily “page” through events, see Query Parameters.

For details about each element in the Event resource and a list of event type IDs, see Event Resource and Types.

Resource URL

https://<subdomain>/api/1/events

Header Parameter

Authorization

required

string

Set to bearer:<access_token>.

Set <access_token> to the access token you generated using the Generate Token API.

The access token must have been generated using an API credential pair created using the scope required to call this API. This API can be called using any one of the following scopes: Read Users, Manage users, Read All, or Manage All.

Query Parameters

For more information about how to search for events using these query parameters, see Search.

  • client_id

  • created_at

  • directory_id

  • event_type_id

  • id

  • resolution

  • since

  • until

  • user_id

The following examples illustrate how to use various query parameters to return subsets of events:

  • Return events whose event_type_id value equals 13

    https://<subdomain>.onelogin.com/api/1/events?event_type_id=13

  • Return events whose event_type_id value is either 8 or 13

    https://<subdomain>.onelogin.com/api/1/events?event_type_id=8,13

  • Return a limited number of events:

    https://<subdomain>.onelogin.com/api/1/events?limit=10

  • Return events sorted by id. Use + to sort in ascending order or - to sort in descending order:

    https://<subdomain>.onelogin.com/api/1/events?sort=+id

  • Return events displaying only selected fields per event:

    https://<subdomain>.onelogin.com/api/1/events?fields=created_at,event_type_id,user_id

  • Combine use of multiple query parameters using an &:

    https://<subdomain>.onelogin.com/api/1/events?event_type_id=13&sort=+id&fields= created_at,event_type_id,user_id

  • Return events created within a window of time bound by specific created_at values using the since and until parameters:

    https://<subdomain>.onelogin.com/api/1/events?since=2018-11-01T19:44:55.000Z&until=2018-11-02T19:44:55.000Z

    This will return events created after 2018-11-01T19:44:55.000Z, but before 2018-11-02T19:44:55.000Z. Precision for these filters is to the second but the millisecond value should be included in the query.

For more details, see Using Query Parameters.

Sample Response

  • 200 OK
  • 400 Bad Request
  • 401 Unauthorized

Important: The user_name and actor_user_name elements displayed in the response refer to the first and last name of the relevant user, not to their username in OneLogin. If their first and last name user attributes are empty, your results will instead return the user’s email address.

{
    "status": {
        "error": false,
        "code": 200,
        "type": "success",
        "message": "Success"
    },
    "pagination": {
        "before_cursor": null,
        "after_cursor": "xWNjb3VudF9pZDo6OjUzNDEzLS0jI2lkOjo6OTA0MjU3NTQ2",
        "previous_link": null,
        "next_link": "https://subdomain.onelogin.com/api/1/events?
        after_cursor=xWNjb3VudF9pZDo6OjUzNDEzLS0jI2lkOjo6OTA0MjU3NTQ2"
    },
    "data": [
        {
            "id": 999999999,
            "created_at": "2014-12-19T02:02:39.276Z",
            "account_id": 55555,
            "user_id": 88888888,
            "event_type_id": 13,
            "notes": null,
            "ipaddr": "11.111.11.111",
            "actor_user_id": 7777777,
            "assuming_acting_user_id": null,
            "role_id": null,
            "app_id": null,
            "group_id": null,
            "otp_device_id": null,
            "policy_id": null,
            "actor_system": "",
            "custom_message": null,
            "role_name": null,
            "app_name": null,
            "group_name": null,
            "actor_user_name": "Xavier Wong",
            "user_name": "Xavier Wong",
            "policy_name": null,
            "otp_device_name": null,
            "operation_name": null,
            "directory_sync_run_id": null,
            "directory_id": null,
            "resolution": null,
            "client_id": null,
            "resource_type_id": null,
            "error_description": null,
            "proxy_ip": null,
            "risk_score": null,
            "risk_reasons": null,
            "risk_cookie_id": null,
            "browser_fingerprint": null
        },
      ...
        {
            "id": 888888888,
            "created_at": "2014-12-19T03:38:19.899Z",
            "account_id": 55555,
            "user_id": 77777777,
            "event_type_id": 5,
            "notes": "Authentication method: password.",
            "ipaddr": "22.222.22.222",
            "actor_user_id": 11111111,
            "assuming_acting_user_id": null,
            "role_id": null,
            "app_id": null,
            "group_id": null,
            "otp_device_id": null,
            "policy_id": null,
            "actor_system": "",
            "custom_message": null,
            "role_name": null,
            "app_name": null,
            "group_name": null,
            "actor_user_name": "Jimena Xie",
            "user_name": "Jimena Xie",
            "policy_name": null,
            "otp_device_name": null,
            "operation_name": null,
            "directory_sync_run_id": null,
            "directory_id": null,
            "resolution": null,
            "client_id": null,
            "resource_type_id": null,
            "error_description": null,
            "proxy_ip": null,
            "risk_score": 48,
            "risk_reasons": "Infrequent access from 73.68.253.46 (13%)\nLow trust for session (15%)....",
            "risk_cookie_id": "1cc3xx9-6a0d-4643-8111-b5xx",
            "browser_fingerprint": "71fxxxxxxxxxxxbc184748e5a6b"
        }
    ]
}

Typically, this error means that your Authorization header value is missing or incorrectly formatted. The Authorization header value should use this format: bearer:<access_token>.

{
    "status": {
        "error": true,
        "code": 400,
        "type": "bad request",
        "message": "Authorization Information is incorrect"
    }
}

Typically, this error means that your access token value is invalid.

{
    "status": {
        "error": true,
        "code": 401,
        "type": "Unauthorized",
        "message": "Authentication Failure"
    }
}

Postman Collection

Run In Postman

    Clicking Run in Postman button navigates to the page where you can fork the collection to your workspace. Forking the collection into your workspace will enable you to contribute to the source collection using pull requests. You can also view the collection in a public workspace if you like and even import a copy of the collection using the links present on the screen.

Sample Code

cURL

Replace sample values indicated by < > with your actual values.

Get Events

curl 'https://<subdomain>/api/1/events' \
-X GET \
-H "Authorization: bearer:<access_token>"

Get Events Created within Date/Time Range

curl 'https://<subdomain>/api/1/events?since=<since>&until=<until>' \
-X GET \
-H "Authorization: bearer:<access_token>"

Get Events by Event Type ID

curl 'https://<subdomain>/api/1/events?event_type_id=<event_type_id>' \
-X GET \
-H "Authorization: bearer:<access_token>"

Python

See Get Events.

Have a Question?

Found a problem or a bug? Submit a support ticket.

Looking for walkthroughs or how-to guides on OneLogin's user and admin features? Check out the documentation in our Knowledge Base.

Have a product idea or request? Share it with us in our Ideas Portal.