PingOne Platform APIs

Read Audit Activities

   

POST {{apiPath}}/environments/{{envID}}/activities

You can use a POST request to get filtered audit activity events for a selected environment while removing sensitive or personal filtering information from the request URL. The following sample shows the POST {{apiPath}}/environments/{{envID}}/activities request, which specifies a SCIM filtering expression in the request body.

Request Model
Property Type Required? Description

filter

String

Required

Sets filtering criteria for events. Refer to available filters below.

limit

Integer

Optional

The number of results to return. Default value is 100.

offset

String

Optional

Returns next or current set of results.

Filtering data

The GET {{apiPath}}/environments/{{envID}}/activities and POST {{apiPath}}/environments/{{envID}}/activities requests accept SCIM filtering expressions to fine-tune the response data. For large collections, additional filtering expressions can be added to the request URL to focus on particular event types.

The minimum filter must include a date range for either the recorded event time or the created event time.

Filter Description

recordedAt lt "yyyy-MM-dd’T’HH:mm:ss.SSSZ"

Audit events recorded before the specified time.

recordedAt gt "yyyy-MM-dd’T’HH:mm:ss.SSSZ"

Audit events recorded after the specified time.

createdAt lt "yyyy-MM-dd’T’HH:mm:ss.SSSZ"

Audit events created before the specified time.

createdAt gt "yyyy-MM-dd’T’HH:mm:ss.SSSZ"

Audit events created after the specified time.

For example, this SCIM filter returns audit events from the start date of "2018-01-01" and an end date of "2018-03-31":

https://api.pingone.com/v1/environments/{{envID}}/activities?filter=recordedAt gt "2018-01-01T00:00:00Z" AND recordedAt lt "2018-03-31T23:59:00Z"

The filter can also include any one of the following:

  • Population ID

  • Actor ID and optional population ID.

  • Action Type and optional population ID

  • Resource ID

  • Resource Type and optional population ID

Filter Description

resources.population.id eq ":id"

Audit events associated with the specified population.

actors.id eq ":id"

Audit events performed by the specified user ID or client ID. Optionally, you can include the associated population.

action.type

Audit events recorded for the specified type of action (such as, authentication, password reset). Optionally, you can include the associated population.

resources.id eq ":id"

Audit events recorded for the specified resource.

resources.type

Audit events recorded for the specified type of resource. This can be any one of the following: ALL, USER, ENVIRONMENT, ORGANIZATION. Optionally, you can include the associated population.

tags

Audit events for the adminIdentityEvent tag. Currently, the adminIdentityEvent tag is the only one supported.

These SCIM operators can be applied to the following attributes:

  • eq (equals)

    Supported attributes: correlationid, actors.user.id, actors.user.name, actors.client.id, action.type, resources.id, resources.type, resources.population.id, org.id, environment.id

  • gt (greater than)

    Supported attributes: recordedAt, createdAt

  • lt (less than)

    Supported attributes: recordedAt, createdAt

  • ge (greater than or equal to)

    Supported attributes: recordedAt, createdAt

  • le (less than or equal to)

    Supported attributes: recordedAt, createdAt

  • and (logical AND)

    Logical AND for building compound expressions in which both expressions are true.

  • or (logical OR)

    Logical OR for building compound expressions if either expression is true.

These SCIM operators are not supported: ne (not equal), co (contains), ew (ends with), in (includes), pr (present, is a non-empty or non-null value), sw (starts with), not (logical NOT).

For more information about SCIM syntax and operators, refer to Conventions.

Headers

Authorization      Bearer {{accessToken}}

Content-Type      application/json

Body

raw ( application/json )

{
    "filter": "recordedat gt \"2019-01-01T22:54:12.988Z\" AND recordedat lt \"2019-01-31T22:54:12.988Z\" AND actors.user.name eq \"Bill\""
}

Example Request

  • cURL

  • C#

  • Go

  • HTTP

  • Java

  • jQuery

  • NodeJS

  • Python

  • PHP

  • Ruby

  • Swift

curl --location --globoff '{{apiPath}}/environments/{{envID}}/activities' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer {{accessToken}}' \
--data '{
    "filter": "recordedat gt \"2019-01-01T22:54:12.988Z\" AND recordedat lt \"2019-01-31T22:54:12.988Z\" AND actors.user.name eq \"Bill\""
}'
var options = new RestClientOptions("{{apiPath}}/environments/{{envID}}/activities")
{
  MaxTimeout = -1,
};
var client = new RestClient(options);
var request = new RestRequest("", Method.Post);
request.AddHeader("Content-Type", "application/json");
request.AddHeader("Authorization", "Bearer {{accessToken}}");
var body = @"{" + "\n" +
@"    ""filter"": ""recordedat gt \""2019-01-01T22:54:12.988Z\"" AND recordedat lt \""2019-01-31T22:54:12.988Z\"" AND actors.user.name eq \""Bill\""""" + "\n" +
@"}";
request.AddStringBody(body, DataFormat.Json);
RestResponse response = await client.ExecuteAsync(request);
Console.WriteLine(response.Content);
package main

import (
  "fmt"
  "strings"
  "net/http"
  "io"
)

func main() {

  url := "{{apiPath}}/environments/{{envID}}/activities"
  method := "POST"

  payload := strings.NewReader(`{
    "filter": "recordedat gt \"2019-01-01T22:54:12.988Z\" AND recordedat lt \"2019-01-31T22:54:12.988Z\" AND actors.user.name eq \"Bill\""
}`)

  client := &http.Client {
  }
  req, err := http.NewRequest(method, url, payload)

  if err != nil {
    fmt.Println(err)
    return
  }
  req.Header.Add("Content-Type", "application/json")
  req.Header.Add("Authorization", "Bearer {{accessToken}}")

  res, err := client.Do(req)
  if err != nil {
    fmt.Println(err)
    return
  }
  defer res.Body.Close()

  body, err := io.ReadAll(res.Body)
  if err != nil {
    fmt.Println(err)
    return
  }
  fmt.Println(string(body))
}
POST /environments/{{envID}}/activities HTTP/1.1
Host: {{apiPath}}
Content-Type: application/json
Authorization: Bearer {{accessToken}}

{
    "filter": "recordedat gt \"2019-01-01T22:54:12.988Z\" AND recordedat lt \"2019-01-31T22:54:12.988Z\" AND actors.user.name eq \"Bill\""
}
OkHttpClient client = new OkHttpClient().newBuilder()
  .build();
MediaType mediaType = MediaType.parse("application/json");
RequestBody body = RequestBody.create(mediaType, "{\n    \"filter\": \"recordedat gt \\\"2019-01-01T22:54:12.988Z\\\" AND recordedat lt \\\"2019-01-31T22:54:12.988Z\\\" AND actors.user.name eq \\\"Bill\\\"\"\n}");
Request request = new Request.Builder()
  .url("{{apiPath}}/environments/{{envID}}/activities")
  .method("POST", body)
  .addHeader("Content-Type", "application/json")
  .addHeader("Authorization", "Bearer {{accessToken}}")
  .build();
Response response = client.newCall(request).execute();
var settings = {
  "url": "{{apiPath}}/environments/{{envID}}/activities",
  "method": "POST",
  "timeout": 0,
  "headers": {
    "Content-Type": "application/json",
    "Authorization": "Bearer {{accessToken}}"
  },
  "data": JSON.stringify({
    "filter": "recordedat gt \"2019-01-01T22:54:12.988Z\" AND recordedat lt \"2019-01-31T22:54:12.988Z\" AND actors.user.name eq \"Bill\""
  }),
};

$.ajax(settings).done(function (response) {
  console.log(response);
});
var request = require('request');
var options = {
  'method': 'POST',
  'url': '{{apiPath}}/environments/{{envID}}/activities',
  'headers': {
    'Content-Type': 'application/json',
    'Authorization': 'Bearer {{accessToken}}'
  },
  body: JSON.stringify({
    "filter": "recordedat gt \"2019-01-01T22:54:12.988Z\" AND recordedat lt \"2019-01-31T22:54:12.988Z\" AND actors.user.name eq \"Bill\""
  })

};
request(options, function (error, response) {
  if (error) throw new Error(error);
  console.log(response.body);
});
import requests
import json

url = "{{apiPath}}/environments/{{envID}}/activities"

payload = json.dumps({
  "filter": "recordedat gt \"2019-01-01T22:54:12.988Z\" AND recordedat lt \"2019-01-31T22:54:12.988Z\" AND actors.user.name eq \"Bill\""
})
headers = {
  'Content-Type': 'application/json',
  'Authorization': 'Bearer {{accessToken}}'
}

response = requests.request("POST", url, headers=headers, data=payload)

print(response.text)
<?php
require_once 'HTTP/Request2.php';
$request = new HTTP_Request2();
$request->setUrl('{{apiPath}}/environments/{{envID}}/activities');
$request->setMethod(HTTP_Request2::METHOD_POST);
$request->setConfig(array(
  'follow_redirects' => TRUE
));
$request->setHeader(array(
  'Content-Type' => 'application/json',
  'Authorization' => 'Bearer {{accessToken}}'
));
$request->setBody('{\n    "filter": "recordedat gt \\"2019-01-01T22:54:12.988Z\\" AND recordedat lt \\"2019-01-31T22:54:12.988Z\\" AND actors.user.name eq \\"Bill\\""\n}');
try {
  $response = $request->send();
  if ($response->getStatus() == 200) {
    echo $response->getBody();
  }
  else {
    echo 'Unexpected HTTP status: ' . $response->getStatus() . ' ' .
    $response->getReasonPhrase();
  }
}
catch(HTTP_Request2_Exception $e) {
  echo 'Error: ' . $e->getMessage();
}
require "uri"
require "json"
require "net/http"

url = URI("{{apiPath}}/environments/{{envID}}/activities")

http = Net::HTTP.new(url.host, url.port);
request = Net::HTTP::Post.new(url)
request["Content-Type"] = "application/json"
request["Authorization"] = "Bearer {{accessToken}}"
request.body = JSON.dump({
  "filter": "recordedat gt \"2019-01-01T22:54:12.988Z\" AND recordedat lt \"2019-01-31T22:54:12.988Z\" AND actors.user.name eq \"Bill\""
})

response = http.request(request)
puts response.read_body
let parameters = "{\n    \"filter\": \"recordedat gt \\\"2019-01-01T22:54:12.988Z\\\" AND recordedat lt \\\"2019-01-31T22:54:12.988Z\\\" AND actors.user.name eq \\\"Bill\\\"\"\n}"
let postData = parameters.data(using: .utf8)

var request = URLRequest(url: URL(string: "{{apiPath}}/environments/{{envID}}/activities")!,timeoutInterval: Double.infinity)
request.addValue("application/json", forHTTPHeaderField: "Content-Type")
request.addValue("Bearer {{accessToken}}", forHTTPHeaderField: "Authorization")

request.httpMethod = "POST"
request.httpBody = postData

let task = URLSession.shared.dataTask(with: request) { data, response, error in
  guard let data = data else {
    print(String(describing: error))
    return
  }
  print(String(data: data, encoding: .utf8)!)
}

task.resume()

Example Response

200 OK

{
    "_links": {
        "self": {
            "href": "https://api.pingone.com/v1/environments/58f92121-b753-4e7e-8d82-23b5bf80efe5/activities?filter=recordedat%20gt%20%222018-08-20T00:00:00Z%22%20AND%20recordedat%20lt%20%222018-08-22T23:59:00Z"
        }
    },
    "_embedded": {
        "activities": [
            {
                "_links": {
                    "self": {
                        "href": "https://api.pingone.com/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6/activities/a4a0a8c0-2d47-4efe-a8a5-463684f79f1c"
                    }
                },
                "id": "a4a0a8c0-2d47-4efe-a8a5-463684f79f1c",
                "recordedAt": "2018-08-22T21:47:12.859Z",
                "correlationId": "B2C30206-9EE5-42DE-8B98-D8D3E4913F80",
                "actors": {
                    "client": {
                        "id": "common-services-test",
                        "name": "common-services-test",
                        "type": "CLIENT"
                    }
                },
                "action": {
                    "type": "APPLICATION.DELETED",
                    "description": "Application Deleted"
                },
                "resources": [
                    {
                        "type": "APPLICATION",
                        "id": "60420de9-9d38-44c5-a2a7-4839ded541f0",
                        "name": "UPDATED_1534974432",
                        "environment": {
                            "id": "abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6"
                        },
                        "href": "https://api.pingone.com/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6/applications/60420de9-9d38-44c5-a2a7-4839ded541f0"
                    }
                ],
                "result": {
                    "status": "SUCCESS",
                    "description": "Deleted Application UPDATED_1534974432 of type 'SERVICE' with disabled state"
                }
            },
            {
                "_links": {
                    "self": {
                        "href": "https://api.pingone.com/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6/activities/deee0af7-655f-48cf-ae2e-7571fdfe5ac6"
                    }
                },
                "id": "deee0af7-655f-48cf-ae2e-7571fdfe5ac6",
                "recordedAt": "2018-08-22T21:47:12.005Z",
                "correlationId": "68E80AD8-C9D4-4DB8-93A9-6FF4C88D1E2B",
                "actors": {
                    "client": {
                        "id": "common-services-test",
                        "name": "common-services-test",
                        "type": "CLIENT"
                    }
                },
                "action": {
                    "type": "APPLICATION.UPDATED",
                    "description": "Application Updated"
                },
                "resources": [
                    {
                        "type": "APPLICATION",
                        "id": "60420de9-9d38-44c5-a2a7-4839ded541f0",
                        "name": "UPDATED_1534974432",
                        "environment": {
                            "id": "abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6"
                        },
                        "href": "https://api.pingone.com/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6/applications/60420de9-9d38-44c5-a2a7-4839ded541f0"
                    }
                ],
                "result": {
                    "status": "SUCCESS",
                    "description": "Updated Application UPDATED_1534974432 of type 'SERVICE' with disabled state"
                }
            },
            {
                "_links": {
                    "self": {
                        "href": "https://api.pingone.com/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6/activities/ddc7214e-23a1-401d-be06-ea70a3479be8"
                    }
                },
                "id": "ddc7214e-23a1-401d-be06-ea70a3479be8",
                "recordedAt": "2018-08-22T21:47:11.404Z",
                "correlationId": "3678B778-2DE3-4AB4-BA25-38529D3CE1AF",
                "actors": {
                    "client": {
                        "id": "common-services-test",
                        "name": "common-services-test",
                        "type": "CLIENT"
                    }
                },
                "action": {
                    "type": "APPLICATION.CREATED",
                    "description": "Application Created"
                },
                "resources": [
                    {
                        "type": "APPLICATION",
                        "id": "60420de9-9d38-44c5-a2a7-4839ded541f0",
                        "name": "app_1534974431",
                        "environment": {
                            "id": "abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6"
                        },
                        "href": "https://api.pingone.com/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6/applications/60420de9-9d38-44c5-a2a7-4839ded541f0"
                    }
                ],
                "result": {
                    "status": "SUCCESS",
                    "description": "Created Application app_1534974431 of type 'SERVICE' with enabled state"
                }
            }
        ]
    }
}