List Events

Use this API to search and page through the events in your OneLogin account. Events are returned newest first.

The list can be filtered by event type, user, app, role, group, directory, time window, IP address, risk score, and free text. See the Query Parameters section for the full set of filters.

This call returns up to 100 events per page (50 by default).

Fast pagination at any depth

This endpoint uses cursor-based (keyset) pagination. Each page is read directly from the position of the previous page’s next_cursor, so the thousandth page costs the same as the first. The v1 endpoint (/api/1/events) has to read and discard every earlier event on each page, which makes deep pagination progressively slower and can time out on large accounts. If you page through events in bulk, use this endpoint.

For details about each element in the response, see Event Resource.

Resource URL

https://<subdomain>.onelogin.com/api/2/events

Header Parameters

Query Parameters

All parameters are optional. Combine any number of filters with &; an event must match every filter you supply.

Pagination

Filters

Examples

The following examples illustrate how to use the query parameters to return subsets of events:

• Return events whose event_type_id value equals 5 (user logged into OneLogin):

  https://<subdomain>.onelogin.com/api/2/events?event_type_id=5

• Return events whose event_type_id value is either 5 or 6:

  https://<subdomain>.onelogin.com/api/2/events?event_type_id=5,6

• Return unresolved exception events:

  https://<subdomain>.onelogin.com/api/2/events?resolution=0

• Return the 100 most recent events for one user:

  https://<subdomain>.onelogin.com/api/2/events?user_id=12345678&limit=100

• Return events created within a window of time using the since and until parameters:

  https://<subdomain>.onelogin.com/api/2/events?since=2026-09-01T00:00:00Z&until=2026-09-02T00:00:00Z

• Return everything that happened from a given IP address:

  https://<subdomain>.onelogin.com/api/2/events?ip=203.0.113.10

• Return high-risk login events:

  https://<subdomain>.onelogin.com/api/2/events?event_type_id=5&risk_score_min=70

• Return events mentioning a word or a name:

  https://<subdomain>.onelogin.com/api/2/events?search=provisioning

• Return the next page of a previous query. Repeat the original filters and add the next_cursor value from the previous response:

  https://<subdomain>.onelogin.com/api/2/events?event_type_id=5&after_cursor=OTk5OTk5OTk5fDE0MTg5NTQ1NTk

Paging through results

Each response includes a pagination object:

To walk the full result set, keep requesting with after_cursor set to the previous next_cursor until has_more is false. There is no before_cursor; to start over, drop after_cursor. Because results are ordered newest first, events created while you are paging appear before your starting point and are not included in the walk. To pick up only what is new on the next run, record the created_at of the first event you saw and pass it as since. Because since is inclusive, that boundary event (and any others with the same timestamp) is returned again, so de-duplicate by id.

Sample Responses

{
    "data": [
        {
            "id": 999999999,
            "created_at": "2026-09-15T03:38:19.899Z",
            "account_id": 55555,
            "user_id": 77777777,
            "event_type_id": 5,
            "notes": "Authentication method: password.",
            "ipaddr": "22.222.22.222",
            "actor_user_id": 77777777,
            "assuming_acting_user_id": null,
            "role_id": null,
            "app_id": null,
            "group_id": null,
            "otp_device_id": null,
            "policy_id": null,
            "actor_system": "",
            "custom_message": null,
            "role_name": null,
            "app_name": null,
            "group_name": null,
            "actor_user_name": "Jimena Xie",
            "user_name": "Jimena Xie",
            "policy_name": null,
            "otp_device_name": null,
            "directory_sync_run_id": null,
            "directory_id": null,
            "resolution": null,
            "client_id": null,
            "resource_type_id": null,
            "error_description": null,
            "proxy_ip": null,
            "risk_score": 48,
            "risk_reasons": "Infrequent access from 73.68.253.46 (13%)\nLow trust for session (15%)....",
            "risk_cookie_id": "1cc3xx9-6a0d-4643-8111-b5xx",
            "browser_fingerprint": "71fxxxxxxxxxxxbc184748e5a6b"
        },
      ...
        {
            "id": 888888888,
            "created_at": "2026-09-15T02:02:39.276Z",
            "account_id": 55555,
            "user_id": 88888888,
            "event_type_id": 13,
            "notes": null,
            "ipaddr": "11.111.11.111",
            "actor_user_id": 7777777,
            "assuming_acting_user_id": null,
            "role_id": null,
            "app_id": null,
            "group_id": null,
            "otp_device_id": null,
            "policy_id": null,
            "actor_system": "",
            "custom_message": null,
            "role_name": null,
            "app_name": null,
            "group_name": null,
            "actor_user_name": "Xavier Wong",
            "user_name": "Xavier Wong",
            "policy_name": null,
            "otp_device_name": null,
            "directory_sync_run_id": null,
            "directory_id": null,
            "resolution": null,
            "client_id": null,
            "resource_type_id": null,
            "error_description": null,
            "proxy_ip": null,
            "risk_score": null,
            "risk_reasons": null,
            "risk_cookie_id": null,
            "browser_fingerprint": null
        }
    ],
    "pagination": {
        "next_cursor": "ODg4ODg4ODg4fDE0MTg5NjAyOTk",
        "has_more": true,
        "size": 50,
        "limit": 50
    }
}

{
    "name": "BadRequestError",
    "message": "Invalid user_id format: abc",
    "statusCode": 400
}

{
    "name": "UnauthorizedError",
    "message": "Authentication required",
    "statusCode": 401
}

Sample Code

cURL

Replace sample values indicated by < > with your actual values.

List Events

curl 'https://<subdomain>.onelogin.com/api/2/events' \
-X GET \
-H "Authorization: bearer <access_token>"

List Events Created within a Date/Time Range

curl 'https://<subdomain>.onelogin.com/api/2/events?since=<since>&until=<until>' \
-X GET \
-H "Authorization: bearer <access_token>"

List Events by Event Type ID

curl 'https://<subdomain>.onelogin.com/api/2/events?event_type_id=<event_type_id>' \
-X GET \
-H "Authorization: bearer <access_token>"

Fetch the Next Page

curl 'https://<subdomain>.onelogin.com/api/2/events?event_type_id=<event_type_id>&after_cursor=<next_cursor>' \
-X GET \
-H "Authorization: bearer <access_token>"

Walk Every Event for a User

cursor=""
while :; do
  page=$(curl -s "https://<subdomain>.onelogin.com/api/2/events?user_id=<user_id>&limit=100${cursor:+&after_cursor=$cursor}" \
    -H "Authorization: bearer <access_token>")
  echo "$page" | jq -c '.data[]'
  [ "$(echo "$page" | jq -r '.pagination.has_more')" = "true" ] || break
  cursor=$(echo "$page" | jq -r '.pagination.next_cursor')
done