Get Events

description retrieves a list of all system log events from okta identity management for monitoring or analysis endpoint url /api/v1/logs method get inputs parameters (object) since (string) filters the lower time bound of the log events published property for bounded queries or persistence time for polling queries until (string) filters the upper time bound of the log events published property for bounded queries or persistence time for polling queries after (string) retrieves the next page of results okta returns a link in the http header (rel=next) that includes the after query parameter filter (string) filter expression that filters the results all operators except are supported q (string) filters log events results by one or more case insensitive keywords url encoded string max length is 40 characters per keyword, with a maximum of 10 keyword filters per query (before encoding limit (number) sets the number of results that are returned in the response integer between 0 and 1000 sortorder (string) the order of the returned events that are sorted by the published property output example \[ { "status code" 200, "response headers" { "content length" "140", "content type" "application/json", "date" "wed, 8 jan 2025 20 37 23 gmt" }, "reason" "ok", "json" { "actor" { "id" "00uttidj01jql21am1d6", "type" "user", "alternateid" "john doe\@example com", "displayname" "john doe", "detailentry" null }, "client" { "useragent" { "rawuseragent" "mozilla/5 0 (macintosh; intel mac os x 10 15 7) applewebkit/537 36 (khtml, like gecko) chrome/127 0 0 0 safari/537 36", "os" "mac os x", "browser" "chrome" }, "zone" null, "device" "computer", "id" null, "ipaddress" "10 0 0 1", "geographicalcontext" { "city" "new york", "state" "new york", "country" "united states", "postalcode" 10013, "geolocation" { "lat" 40 3157, "lon" 74 01 } } }, "device" { "id" "guofdhyjex1feogbn1d9", "name" "mac15,6", "os platform" "osx", "os version" "14 6 0", "managed" false, "registered" true, "device integrator" null, "disk encryption type" "all internal volumes", "screen lock type" "biometric", "jailbreak" null, "secure hardware present" true }, "authenticationcontext" { "authenticationprovider" null, "credentialprovider" null, "credentialtype" null, "issuer" null, "interface" null, "authenticationstep" 0, "rootsessionid" "idxbager62csveuktxvgrtona", "externalsessionid" "idxbager62csveuktxvgrtona" }, "displaymessage" "user login to okta", "eventtype" "user session start", "outcome" { "result" "success", "reason" null }, "published" "2024 08 13t15 58 20 353z", "securitycontext" { "asnumber" 394089, "asorg" "asn 0000", "isp" "google", "domain" null, "isproxy" false }, "severity" "info", "debugcontext" { "debugdata" { "requestid" "ab609228fe84ce59cdcbfa690bcce016", "requesturi" "/idp/idx/authenticators/poll", "url" "/idp/idx/authenticators/poll" } }, "legacyeventtype" "core user auth login success", "transaction" { "type" "web", "id" "ab609228fe84ce59cdcbfa690bgce016", "detail" null }, "uuid" "dc9fd3c0 598c 11ef 8478 2b7584bf8d5a", "version" 0, "request" { "ipchain" \[ { "ip" "10 0 0 1", "geographicalcontext" { "city" "new york", "state" "new york", "country" "united states", "postalcode" 10013, "geolocation" { "lat" 40 3157, "lon" 74 01 } }, "version" "v4", "source" null } ] }, "target" \[ { "id" "pfdfdhyjf0hmbkp2e1d7", "type" "authenticatorenrollment", "alternateid" "unknown", "displayname" "okta verify", "detailentry" null }, { "id" "0oatxlef9sqvvqinq5d6", "type" "appinstance", "alternateid" "okta admin console", "displayname" "okta admin console", "detailentry" null } ] } } ] output parameters status code (number) reason (string) json (object) actor (object) id (string) type (string) alternateid (string) displayname (string) detailentry (object) client (object) useragent (object) rawuseragent (string) os (string) browser (string) zone (object) device (string) id (object) ipaddress (string) geographicalcontext (object) city (string) state (string) country (string) postalcode (number) geolocation (object) lat (number) lon (number) device (object) id (string) name (string) os platform (string) os version (string) managed (boolean) registered (boolean) device integrator (object) disk encryption type (string) screen lock type (string) jailbreak (object) secure hardware present (boolean) authenticationcontext (object) authenticationprovider (object) credentialprovider (object) credentialtype (object) issuer (object) interface (object) authenticationstep (number) rootsessionid (string) externalsessionid (string) displaymessage (string) eventtype (string) outcome (object) result (string) reason (object) published (string) securitycontext (object) asnumber (number) asorg (string) isp (string) domain (object) isproxy (boolean) severity (string) debugcontext (object) debugdata (object) requestid (string) requesturi (string) url (string) legacyeventtype (string) transaction (object) type (string) id (string) detail (object) uuid (string) version (number) request (object) ipchain (array) ip (string) geographicalcontext (object) city (string) state (string) country (string) postalcode (number) geolocation (object) lat (number) lon (number) version (string) source (object) target (array) id (string) type (string) alternateid (string) displayname (string) detailentry (object) response headers header type content length string content type string date string