GET

Get Event

Use this API to return a single event by its id.

For details about each element in the response, see Event Resource.

Resource URL

https://<subdomain>.onelogin.com/api/2/events/:id

Header Parameters

Authorization

required

string

Set to bearer <access_token>.

Set <access_token> to the access token you generated using the Generate Token API.

The access token must have been generated using an API credential pair created using the scope required to call this API. This API can be called using any one of the following scopes: Read Users, Manage users, Read All, or Manage All.

Resource Parameter

id

required

integer

Set to the id of the event that you want to return. If you don't know the event's id, use List Events to search for it.

This is the event's own id, not its event_type_id.

Sample Responses

  • 200 OK
  • 401 Unauthorized
  • 404 Not Found

The response is the event object itself, not wrapped in an array.

Important: The user_name and actor_user_name elements displayed in the response refer to the first and last name of the relevant user, not to their username in OneLogin. If their first and last name user attributes are empty, your results will instead return the user’s email address.

{
    "id": 123456789,
    "created_at": "2026-02-18T02:34:15.626Z",
    "account_id": 55555,
    "user_id": 654321,
    "event_type_id": 8,
    "notes": "Initiated by OneLogin via SAML",
    "ipaddr": "11.111.11.111",
    "actor_user_id": 987654,
    "assuming_acting_user_id": null,
    "role_id": null,
    "app_id": 11111,
    "group_id": null,
    "otp_device_id": null,
    "policy_id": null,
    "actor_system": "",
    "custom_message": null,
    "role_name": null,
    "app_name": "AppWonder",
    "group_name": null,
    "actor_user_name": "Santiago Cuong",
    "user_name": "Santiago Cuong",
    "policy_name": null,
    "otp_device_name": null,
    "directory_sync_run_id": null,
    "directory_id": null,
    "resolution": null,
    "client_id": null,
    "resource_type_id": null,
    "error_description": null,
    "proxy_ip": null,
    "risk_score": 48,
    "risk_reasons": "Infrequent access from 73.68.253.46 (13%)\nLow trust for session (15%)....",
    "risk_cookie_id": "1cc3xx9-6a0d-4643-8111-b5xx",
    "browser_fingerprint": "71fxxxxxxxxxxxbc184748e5a6b"
}

Typically, this error means that your access token value is invalid, has expired, or was generated with a credential whose scope does not include reading events.

{
    "name": "UnauthorizedError",
    "message": "Authentication required",
    "statusCode": 401
}

Returned when no event with that id exists in your account, including when id is not a number.

{
    "name": "NotFoundError",
    "message": "The requested resource was not found",
    "statusCode": 404
}

Sample cURL Request

Replace sample values indicated by < > with your actual values.

curl 'https://<subdomain>.onelogin.com/api/2/events/<id>' \
-X GET \
-H "Authorization: bearer <access_token>"