Event Resource

This page describes the Event resource returned by the API v2 Events endpoints and how v2 differs from API v1 Events.

There are three endpoints in the v2 Events API:

List Event Types – the catalogue of event types. Each entry's id is the value that appears as event_type_id on events and in the List Events filter.
List Events – search and page through the events in your account.
Get Event – return a single event by its id.

Both List Events and List Event Types return items that have an id attribute, but they are different things. An event’s id uniquely identifies one thing that happened at one point in time, and is the value to pass to Get Event. The event_type_id on an event (and the id returned by List Event Types) identifies a kind of event, such as a login or a user creation. You can browse the full list with the Event Type Lookup tool.

Event-related dates and times use the Coordinated Universal Time (UTC) ISO8601 format: YYYY-MM-DDThh:mm:ss.mscZ. For example: 2016-01-21T09:20:15.990Z.

Differences from API v1

Why use v2?
/api/2/events is served by a dedicated events service. It uses cursor-based (keyset) pagination, so every page costs the same regardless of how deep into the result set you are. The v1 endpoint has to read and discard every earlier event on each page, which makes deep pagination progressively slower and can time out on large accounts.

Area	API v1 (`/api/1/events`)	API v2 (`/api/2/events`)
Response envelope	Wrapped in a `status` object; the resource is always inside a `data` array.	No `status` object. List Events returns `{ "data": [...], "pagination": {...} }`; Get Event returns the event object itself; List Event Types returns a plain array.
Pagination	Offset-based under the hood. Each page re-reads everything before it, so deep pages are slow.	Cursor-based. Pass `next_cursor` from the previous response as `after_cursor`. Constant cost per page. There is no `before_cursor`; page forward only.
Ordering	Configurable with `sort`.	Always newest first (`created_at` descending). There is no `sort` parameter.
Field selection	`fields` parameter.	Not supported. Every event is returned in full.
Filters	`event_type_id`, `user_id`, `directory_id`, `client_id`, `resolution`, `since`, `until`, `id`, `created_at`.	Everything v1 supports except `id` and `created_at`, plus `app_id`, `role_id`, `group_id`, `resource_type_id`, `actor_system`, `ip`, `risk_score_min`, `risk_score_max`, and free-text `search`. See List Events.
Multiple event types	Comma-separated: `event_type_id=8,13`	Either form: `event_type_id=8,13` or `event_type_id[]=8&event_type_id[]=13`
Page size	Up to 50 per page.	Default 50, up to 100 per page (`limit`).
Required scope	`Read Users`, `Manage users`, `Read All`, or `Manage All`.	Same as v1.
Errors	`status` object with `error: true`.	Standard v2 error object: `{ "name": "...", "message": "...", "statusCode": ... }`. Invalid query parameters return `400` with the reason in `message`.

Event Resource

Important: The user_name and actor_user_name elements refer to the first and last name of the relevant user, not to their username in OneLogin. If their first and last name user attributes are empty, these elements return the user’s email address instead.

Element	Data Type	Description
id	Integer	Event's unique ID in OneLogin. Autogenerated by OneLogin. Pass this value to Get Event.
created_at	String	ISO8601 time and date at which the event was created. This value is autogenerated by OneLogin.
account_id	Integer	Account that triggered the event.
user_id	Integer	ID of the user that was acted upon to trigger the event.
user_name	String	First and last name of the user that was acted upon to trigger the event.
event_type_id	Integer	Type of event triggered. See List Event Types.
notes	String	More details about the event.
custom_message	String	More details about the event.
ipaddr	String	IP address of the machine used to trigger the event.
proxy_ip	String	IP address of the proxy the request came through, if applicable.
actor_user_id	Integer	ID of the user whose action triggered the event.
actor_user_name	String	First and last name of the user whose action triggered the event.
actor_system	String	Acting system that triggered the event when the actor is not a user.
assuming_acting_user_id	Integer	ID of the user who assumed the role of the acting user to trigger the event, if applicable.
app_id	Integer	ID of the app involved in the event, if applicable.
app_name	String	Name of the app involved in the event, if applicable.
role_id	Integer	ID of a role involved in the event.
role_name	String	Name of a role involved in the event.
group_id	Integer	ID of a group involved in the event.
group_name	String	Name of a group involved in the event.
policy_id	Integer	ID of the policy involved in the event.
policy_name	String	Name of the policy involved in the event.
otp_device_id	Integer	ID of a device involved in the event.
otp_device_name	String	Name of a device involved in the event.
directory_id	Integer	ID of the directory involved in the event, if applicable.
directory_sync_run_id	Integer	Directory sync run ID.
resolution	Integer	Resolution of an exception event: `0` unresolved, `1` ignored, `2` unlocked. `null` for events that are not exceptions.
client_id	String	Client ID used to generate the access token that made the API call that generated the event.
resource_type_id	Integer	ID of the resource (user, role, group, and so forth) associated with the event.
error_description	String	Provisioning error details, if applicable.
risk_score	Integer	Vigilance AI risk score (0–100) calculated for the event, if applicable.
risk_reasons	String	Human-readable reasons behind the risk score, if applicable.
risk_cookie_id	String	ID of the risk cookie associated with the event, if applicable.
browser_fingerprint	String	Fingerprint of the browser used to trigger the event, if applicable.