1. Company
Anzenna Public API
  • How To Use the Anzenna Public API
  • AI Governance
    • Query all Shadow AI instances
      POST
    • Get a Shadow AI instance by id
      GET
    • Query all AI interactions
      POST
    • Get an AI interaction by id
      GET
    • List MCP servers
      POST
    • Get an MCP server
      GET
    • Query MCP server installations
      POST
  • Investigation
    • Query all investigations
      POST
    • Start an investigation
      POST
    • Get an investigation by id
      GET
    • Dismiss an investigation
      POST
    • Get detection investigation prompts
      GET
    • Get global investigation prompts
      GET
    • Get user investigation prompts
      GET
    • Query all risk registers
      POST
    • Query all risk register catalog entries
      POST
  • Identity
    • List accounts
      POST
    • Get an account by id
      GET
    • List login events
      POST
    • Get a login event by ID
      GET
    • Query all mfa statuses
      POST
    • Get an MFA status by id
      GET
    • Query all OAuth applications
      POST
    • Get an OAuth application by id
      GET
    • Query all OAuth application instances
      POST
    • Query all password reuse instances
      POST
  • Advanced
    • Execute an advanced query
    • List security events
    • Receive a webhook event
    • Query raw events
  • Detection
    • Query all allowlists
    • Create a new allowlist
    • Delete an allowlist
    • Update an allowlist
    • Get an anomaly by ID
    • Get key finding detections
    • Get detection details
    • List users associated with a given detection
    • Execute a remediation
  • Browser
    • Query all browser applications
    • Get a browser application by id
    • List browser application instances
    • List browser history entries
    • Query all remote machines
    • Get a remote machine by id
    • Query all web host resources
    • Get a web host resource by id
  • Data & IP
    • Query database exfiltration events
    • List file delete events
    • List file movement activities
    • Get file movement activity by id
    • List files used with data exfiltration.
    • Get a specific data exfiltration file
    • List git events
    • Get a specific git event by id
    • List git repositories
    • Get a specific git repository
    • List file sharing instances
    • Query database share grants
    • Query database share user additions
    • List documents
    • Get document by id
    • List DLP policies
    • Get a DLP policy by id
    • List DLP policy detectors
    • Query all DLP alerts
    • Get a DLP alert by id
  • Device
    • List devices
    • Get a device
    • List device applications
    • Get a device application
    • Query device application instances.
    • List device infections
    • Get a device infection
    • List device policies
    • Get a device policy
    • List USB device connection events
    • Get a USB connection event
    • List IDE applications
    • Get an IDE application
    • Query IDE application instances.
  • Email
    • Query all outbound email events
    • Get an outbound email event by id
    • Query all phishing interactions
  • Company
    • List groups
      POST
    • Query all people
      POST
    • Get departure analysis for a person
      GET
    • Get a person by id
      GET
    • Add a category to multiple people
      POST
    • Remove a category from multiple people
      POST
    • Get company risk trends
      POST
    • Get number of high risk organizations
      POST
  • SaaS
    • Query all Shadow IT instances
  • Outreach
    • List training campaigns
    • Create a training campaign
  • API Key
    • Get API key information
  1. Company

Get departure analysis for a person

GET
/people/{id}/departure-analysis
Returns a summary of security-relevant activity observed in the 30 days
before a person's departure. Includes file uploads, downloads, external
sharing, app installs, and account deactivation details.

Request

Authorization
Path Params

Responses

🟢200OK
application/json
Successful operation
Bodyapplication/json

🟠400Bad Request
🟠401Unauthorized
🟠403Forbidden
Request Request Example
Shell
JavaScript
Java
Swift
curl --location '/people//departure-analysis'
Response Response Example
{
    "accounts": [
        {
            "aliases": [
                "john@example.com"
            ],
            "avatar": {
                "content_type": "image/jpeg",
                "url": "https://example.com/avatars/user.jpg"
            },
            "company": "Acme Inc",
            "cost_center": "CC-001",
            "department": "Engineering",
            "division": "Product Division",
            "email": "joe.smith@example.com",
            "external_id": "00u1e8VTUYyPDmZLkXXX",
            "first_name": "John",
            "id": "8CA67511-744C-4D74-B26E-7281CF88712F",
            "job_title": "Software Engineer",
            "last_name": "Doe",
            "level": 3,
            "location": {
                "city": "San Francisco",
                "country": "USA",
                "state": "CA"
            },
            "login": "john.doe",
            "manager": "manager@example.com",
            "name": "Joe Smith",
            "password_changed": "2021-01-15T00:00:00Z",
            "phones": [
                "+1-555-123-4567"
            ],
            "source": "unspecified",
            "state": "unspecified"
        }
    ],
    "app_installs": 3,
    "browser_app_installs": 1,
    "departure_time": "2024-01-15T10:30:00Z",
    "employee_email": "user@example.com",
    "external_sharing": {
        "count": 7,
        "unique_recipients": 3
    },
    "file_deletes": {
        "count": 12,
        "forward_link": {
            "href": "/data-exfiltration/file-deletes",
            "payload": {
                "distinct_count": "string",
                "distinct_on": "host_name",
                "include_total_count": true,
                "limit": 10,
                "offset": 0,
                "query": "name='WINPC-4291' AND status IN ('active', 'pending')",
                "sort": "name desc, id"
            }
        }
    },
    "file_downloads": {
        "count": 42,
        "unique_sources": 5
    },
    "file_uploads": {
        "count": 42,
        "unique_sources": 5
    },
    "last_login": "2024-01-14T09:00:00Z",
    "person_id": "8CA67511-744C-4D74-B26E-7281CF88712F"
}
Modified at 2026-10-20 18:32:30
Previous
Query all people
Next
Get a person by id
Built with