List security events

POST

/events

Query and filter security events. Events represent security-related activities
such as data sharing, phishing interactions, OAuth app consents, device threats, etc.

Queryable fields: employee_email, happened, risk_score, source, allowlisted, high_prevalence, id, parent_id, event_type.

Filtering by time range: Use the happened field with comparison operators to filter
events by when they occurred. For example: happened >= '2024-01-01'

Filtering by event type: Filter by event type using =, !=, or IN. For example:
event_type = 'shadow_it' or event_type IN ('shadow_it', 'mfa'). Only exact enum
string values are supported; LIKE patterns are not supported for this field.

Relations:

employee (Person): The person associated with the event

Request

Authorization

Bearer Token

Provide your bearer token in the

Authorization

header when making requests to protected resources.

Example:

Authorization: Bearer ********************

Body Params application/jsonRequired

Examples

Responses

🟢200OK

application/json

Successful operation

Body

🟠400Bad Request

🟠401Unauthorized

🟠403Forbidden

Request Example

Shell

JavaScript

Java

Swift

curl --location --request POST '/events' \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data-raw '{
    "distinct_count": "string",
    "include_total_count": true,
    "limit": 10,
    "offset": 0,
    "query": "name='\''WINPC-4291'\'' AND status IN ('\''active'\'', '\''pending'\'')",
    "sort": "name desc, id"
}'

Response Example

200 - Example 1

{
    "distinct_values": [
        {
            "count": 0,
            "value": null
        }
    ],
    "pagination": {
        "count": 0,
        "total_count": 1000
    },
    "items": [
        {
            "allowlisted": true,
            "asset_name": "ChatGPT",
            "description": "User accessed unauthorized application chatgpt.com",
            "employee_email": "joe.smith@example.com",
            "employee_name": "Joe Smith",
            "event_type": "shadow_it",
            "happened": "2024-01-15T10:30:00Z",
            "high_prevalence": true,
            "id": "8CA67511-744C-4D74-B26E-7281CF88712F",
            "parent_id": "string",
            "risk_score": 9.2,
            "source": "unspecified"
        }
    ]
}

Modified at 2026-03-31 19:28:57

List users associated with a given detection

Query all Shadow IT instances