List user events | emnify Documentation

Returns the list of events, filtered, sorted and paged according to query parameters.

Only an administrator or observer may be allowed to see events of other users, provided they belong to an organisation he/she has access to.

Any user can retrieve their own events at /api/v1/user/my/event.

This API endpoint deviates from the specified conventions and may not return the same HTTP Codes as the higher layer call (/api/v1/user/{user_id|my}).

In case the requested {user_id} does not exist or is not accessible for the user, HTTP 200 will be returned with empty [] as long as the provided {user_id} is a number and all parameters are valid.

Please take that into consideration when building automation on top of the error behavior of this endpoint.

Returns the list of events, filtered, sorted and paged according to query parameters. Only an administrator or observer may be allowed to see events of other users, provided they belong to an organisation he/she has access to. Any user can retrieve their own events at `/api/v1/user/my/event`. <Error> This API endpoint deviates from the specified conventions and may not return the same HTTP Codes as the higher layer call (`/api/v1/user/{user_id|my}`). In case the requested `{user_id}` does not exist or is not accessible for the user, **HTTP 200** will be returned with empty **[]** as long as the provided `{user_id}` is a number and all parameters are valid. Please take that into consideration when building automation on top of the error behavior of this endpoint. </Error>

Authentication

AuthorizationBearer

An auth_token should be provided to authenticate a session.

To obtain an auth_token, see the /api/v1/authenticate POST request.

Path parameters

user_iddoubleRequired

User ID

Query parameters

pageintegerOptional

Current page number

per_pageintegerOptional

Defines the number of items per page

sortstringOptional

Sort properties according to a comma separated list of accepted fields. Valid fields are:

id - (event id)
timestamp - (event timestamp)
source - (event source)
severity - (event severity)
alert - (alert status)
organisation - (organisation name)
user - (user id)
endpoint - (endpoint name)
tags - (endpoint tags)
ip_address - (endpoint ip_address)
iccid - (sim iccid)
imsi - (sim imsi)
type - (event type)

Sort properties according to a comma separated list of accepted fields. Valid fields are: * `id` - (**event id**) * `timestamp` - (**event timestamp**) * `source` - (**event source**) * `severity` - (**event severity**) * `alert` - (**alert status**) * `organisation` - (**organisation name**) * `user` - (**user id**) * `endpoint` - (**endpoint name**) * `tags` - (**endpoint tags**) * `ip_address` - (**endpoint ip_address**) * `iccid` - (**sim iccid**) * `imsi` - (**sim imsi**) * `type` - (**event type**)

qstringOptional

format: "(from|until|type|source|severity|alert|description|organisation|user|endpoint|tags|ip_address|imei|iccid|imsi|timestamp):.+"

Filter parameter in <filter>:<value> format. Multiple filters must be a comma-separated list of the following fields:

from (date, format YYYY-MM-DDTHH:mm:ssZ, only valid with until)
until (date, format YYYY-MM-DDTHH:mm:ssZ, only valid with from)
type (event_type, numerical)
source (event_type, numerical, e.g. 0 = Network), 1 = Policy Control, 2 = API)
severity (event_severity, numerical, e.g. 0 = Info, 1 = Warn), 2 = Critical)
alert (boolean, e.g. true, false)
description (event description, string)
organisation (organisation name, string)
user (user name, string)
endpoint (endpoint name, string)
tags (endpoint tags, string)
ip_address (endpoint IP address, valid IPv4/IPv6 address)
imei (endpoint imei, numerical string)
iccid (sim iccid, numerical string)
imsi (sim imsi, numerical string)
timestamp (date, format YYYY-MM-DDTHH:mm:ssZ, for querying events of 1 day, deprecated in future)

Filter parameter in `<filter>:<value>` format. Multiple filters must be a comma-separated list of the following fields: * `from` (**date**, format `YYYY-MM-DDTHH:mm:ssZ`, **only valid with until**) * `until` (**date**, format `YYYY-MM-DDTHH:mm:ssZ`, **only valid with from**) * `type` (**event_type**, numerical) * `source` (**event_type**, numerical, e.g. 0 = Network), 1 = Policy Control, 2 = API) * `severity` (**event_severity**, numerical, e.g. 0 = Info, 1 = Warn), 2 = Critical) * `alert` (boolean, e.g. true, false) * `description` (**event description**, string) * `organisation` (**organisation name**, string) * `user` (**user name**, string) * `endpoint` (**endpoint name**, string) * `tags` (**endpoint tags**, string) * `ip_address` (**endpoint IP address**, valid IPv4/IPv6 address) * `imei` (**endpoint imei**, numerical string) * `iccid` (**sim iccid**, numerical string) * `imsi` (**sim imsi**, numerical string) * `timestamp` (**date**, format `YYYY-MM-DDTHH:mm:ssZ`, for querying events of 1 day, deprecated in future)

Response

Successfully returned a list of User events

idinteger

alertboolean

descriptionstring

timestampstring

event_typeobject

event_sourceobject

event_severityobject

organisationobject

userobject

Errors

Filter parameter in <filter>:<value> format. Multiple filters must be a comma-separated list of the following fields:

from (date, format YYYY-MM-DDTHH:mm:ssZ, only valid with until)
until (date, format YYYY-MM-DDTHH:mm:ssZ, only valid with from)
type (event_type, numerical)
source (event_type, numerical, e.g. 0 = Network), 1 = Policy Control, 2 = API)
severity (event_severity, numerical, e.g. 0 = Info, 1 = Warn), 2 = Critical)
alert (boolean, e.g. true, false)
description (event description, string)
organisation (organisation name, string)
user (user name, string)
endpoint (endpoint name, string)
tags (endpoint tags, string)
ip_address (endpoint IP address, valid IPv4/IPv6 address)
imei (endpoint imei, numerical string)
iccid (sim iccid, numerical string)
imsi (sim imsi, numerical string)
timestamp (date, format YYYY-MM-DDTHH:mm:ssZ, for querying events of 1 day, deprecated in future)

1	curl -G https://cdn.emnify.net/api/v1/user/1.1/event \
2	-H "Authorization: Bearer <token>" \
3	-d sort= \
4	-d q=

1	[
2	{
3	"id": 11,
4	"alert": false,
5	"description": " Failed authentication request from 'ford.prefect@hitchhikerguide.net', Reason: invalid passwort from IP 1.2.3.4",
6	"timestamp": "2017-05-08T10:56:25.000Z",
7	"event_type": {
8	"id": 6,
9	"description": "User authentication failed"
10	},
11	"event_source": {
12	"id": 2,
13	"description": "API"
14	},
15	"event_severity": {
16	"id": 1,
17	"description": "Warn"
18	},
19	"organisation": {
20	"id": 123,
21	"name": "Seeley & Co."
22	},
23	"user": {
24	"id": 42,
25	"username": "ford.prefect@hitchhikerguide.net",
26	"name": "Ford Prefect"
27	}
28	},
29	{
30	"id": 12,
31	"alert": false,
32	"description": "MFA key with Id '1' of Type 'Time-Based One-Time Password' deleted for user 'eabbot@flatland.org'",
33	"timestamp": "2017-05-08T11:04:34.000Z",
34	"event_type": {
35	"id": 14,
36	"description": "Multi-factor Authentication"
37	},
38	"event_source": {
39	"id": 2,
40	"description": "API"
41	},
42	"event_severity": {
43	"id": 0,
44	"description": "Info"
45	},
46	"organisation": {
47	"id": 123,
48	"name": "Seeley & Co."
49	},
50	"user": {
51	"id": 123,
52	"username": "eabbot@flatland.org",
53	"name": "Edwin Abbott"
54	}
55	}
56	]