Updated on 2025-07-14 GMT+08:00

Querying User Events

Function

Queries user events. You can query data of a maximum of 30 days at a time, and data of the past 30 days.

Debugging

You can debug this API through automatic authentication in API Explorer or use the SDK sample code generated by API Explorer.

URI

GET /v2/{project_id}/user-events

Table 1 Path Parameters

Parameter

Mandatory

Type

Description

project_id

Yes

String

Project ID.

Table 2 Query Parameters

Parameter

Mandatory

Type

Description

start_time

Yes

String

Start time of the query. The value is in UTC format, for example, 1970-01-01T00:00:00Z.

end_time

Yes

String

End time of the query. The value is in UTC format, for example, 1970-01-01T00:00:00Z.

username

No

String

Username (exact search).

event_type

No

String

Event type. Use commas (,) to separate multiple event types.

resource_id

No

String

ID of the resource to be operated.

resource_name

No

String

Name of the resource to be operated.

offset

No

Integer

Where the pagination query starts. The value starts from 0.

limit

No

Integer

Number of returned user events for pagination query. The value ranges from 0 to 1,000. If this parameter is not specified, the default value 100 is used.

Request Parameters

Table 3 Request header parameters

Parameter

Mandatory

Type

Description

X-Auth-Token

No

String

User token.

It can be obtained by calling the IAM API used to obtain a user token. The value of X-Subject-Token in the response header is the user token.

Response Parameters

Status code: 200

Table 4 Response body parameters

Parameter

Type

Description

count

Integer

Total number of events.

items

Array of UserEventRsp objects

User events.

Table 5 UserEventRsp

Parameter

Type

Description

project_id

String

Project ID.

username

String

Username.

workspace_id

String

Enterprise ID.

event_trace_id

String

ID of the association between events.

event_type

String

Event type.

event_time

String

Event time. The value is in UTC format, for example, 1970-01-01T00:00:00Z.

resource_type

String

Operation object type.

resource_id

String

Operation object ID.

resource_name

String

Operation object name.

client_type

String

Client type.

client_ip

String

Client IP address.

client_mac

String

Client MAC address.

client_version

String

Client version.

source_ip

String

Source IP address of the operation user.

is_success

Boolean

Whether the request is successful.

error_code

String

Error code.

error_msg

String

Error message.

action_type

String

Trigger type. The value can be USER (triggered by a user) or SYSTEM (triggered by the system).

Status code: 400

Table 6 Response body parameters

Parameter

Type

Description

error_code

String

Error code.

error_msg

String

Error message.

Status code: 401

Table 7 Response body parameters

Parameter

Type

Description

error_code

String

Error code.

error_msg

String

Error message.

Status code: 500

Table 8 Response body parameters

Parameter

Type

Description

error_code

String

Error code.

error_msg

String

Error message.

Example Requests

None

Example Responses

Status code: 200

Succeeded.

{
  "count" : 0,
  "items" : [ {
    "project_id" : "xxx",
    "username" : "xxx",
    "workspace_id" : "xxx",
    "event_trace_id" : "407481bd-65b4-4de4-a553-67d858cbe29b",
    "event_type" : "loginByPassword",
    "event_time" : "1970-01-01T00:00:00Z",
    "resource_type" : "USER",
    "resource_id" : "407481bd-65b4-4de4-a553-67d858cbe29b",
    "resource_name" : "DESKTOP-01",
    "client_type" : "WINDOWS",
    "client_ip" : "127.0.0.1",
    "client_mac" : "xx.xx.xx.xx",
    "source_ip" : "127.0.0.1",
    "is_success" : true,
    "error_code" : "WKS.00000000",
    "error_msg" : "OK"
  } ]
}

Status Codes

Status Code

Description

200

Succeeded.

400

Invalid request from the client.

401

Authentication failed.

500

Internal error

Error Codes

See Error Codes.