Querying User Events

Function

Queries user events. You can query data of a maximum of 30 days at a time, and data of the past 30 days.

Debugging

You can debug this API through automatic authentication in API Explorer or use the SDK sample code generated by API Explorer.

Authorization Information

Each account has all the permissions required to call all APIs, but IAM users must be assigned the required permissions.

If you are using role/policy-based authorization, see Permissions Policies and Supported Actions for details on the required permissions.

If you are using identity policy-based authorization, the following identity policy-based permissions are required.

Action	Access Level	Resource Type (*: required)	Condition Key	Alias	Dependencies
workspace:userEvents:list	List	-	-	-	-

URI

GET /v2/{project_id}/user-events

**Table 1** Path Parameters
Parameter	Mandatory	Type	Description
project_id	Yes	String	Project ID.

**Table 2** Query Parameters
Parameter	Mandatory	Type	Description
start_time	Yes	String	Start time of the query. The value is in UTC format, for example, 1970-01-01T00:00:00Z.
end_time	Yes	String	End time of the query. The value is in UTC format, for example, 1970-01-01T00:00:00Z.
username	No	String	Username (exact search).
event_type	No	String	Event type. Use commas (,) to separate multiple event types.
resource_id	No	String	ID of the resource to be operated.
resource_name	No	String	Name of the resource to be operated.
offset	No	Integer	Where the pagination query starts. The value starts from 0.
limit	No	Integer	Number of returned user events for pagination query. The value ranges from 0 to 1,000. If this parameter is not specified, the default value 100 is used.

Request Parameters

None

Response Parameters

Status code: 200

**Table 3** Response body parameters
Parameter	Type	Description
count	Integer	Total number of events.
items	Array of UserEventRsp objects	User events.

**Table 4** UserEventRsp
Parameter	Type	Description
project_id	String	Project ID.
username	String	Username.
workspace_id	String	Enterprise ID.
event_trace_id	String	ID of the association between events.
event_type	String	Event type.
event_time	String	Event time. The value is in UTC format, for example, 1970-01-01T00:00:00Z.
resource_type	String	Operation object type.
resource_id	String	Operation object ID.
resource_name	String	Operation object name.
client_type	String	Client type.
client_ip	String	Client IP address.
client_mac	String	Client MAC address.
client_version	String	Client version.
source_ip	String	Source IP address of the operation user.
is_success	Boolean	Whether the request is successful.
error_code	String	Error code.
error_msg	String	Error message.
action_type	String	Trigger type. The value can be USER (triggered by a user) or SYSTEM (triggered by the system).

Status code: 400

**Table 5** Response body parameters
Parameter	Type	Description
error_code	String	Error code.
error_msg	String	Error message.

Status code: 401

**Table 6** Response body parameters
Parameter	Type	Description
error_code	String	Error code.
error_msg	String	Error message.

Status code: 500

**Table 7** Response body parameters
Parameter	Type	Description
error_code	String	Error code.
error_msg	String	Error message.

Example Requests

None

Example Responses

Status code: 200

Succeeded.

{
  "count" : 0,
  "items" : [ {
    "project_id" : "xxx",
    "username" : "xxx",
    "workspace_id" : "xxx",
    "event_trace_id" : "407481bd-65b4-4de4-a553-67d858cbe29b",
    "event_type" : "loginByPassword",
    "event_time" : "1970-01-01T00:00:00Z",
    "resource_type" : "USER",
    "resource_id" : "407481bd-65b4-4de4-a553-67d858cbe29b",
    "resource_name" : "DESKTOP-01",
    "client_type" : "WINDOWS",
    "client_ip" : "127.0.0.1",
    "client_mac" : "xx.xx.xx.xx",
    "source_ip" : "127.0.0.1",
    "is_success" : true,
    "error_code" : "WKS.00000000",
    "error_msg" : "OK"
  } ]
}