Get user and enterprise events

get
https://api.box.com/2.0
/events

Returns up to a year of past events for a given user or for the entire enterprise.

By default this returns events for the authenticated user. To retrieve events for the entire enterprise, set the stream_type to admin_logs. The user making the API call will need to have admin privileges, and the application will need to have the permission to access the event feed to get the enterprise event feed.

Request

application/json

Query Parameters

string / date-timein queryoptional
2012-12-12T10:53:43-08:00

The lower bound date and time to return events for.

string / date-timein queryoptional
2013-12-12T10:53:43-08:00

The upper bound date and time to return events for.

string arrayin queryoptional
ADD_LOGIN_ACTIVITY_DEVICE

A comma-separated list of events to filter by.

Value is any of "ACCESS_GRANTED", "ACCESS_REVOKED", "ADD_DEVICE_ASSOCIATION", "ADD_LOGIN_ACTIVITY_DEVICE", "ADMIN_LOGIN", "APPLICATION_CREATED", "APPLICATION_PUBLIC_KEY_ADDED", "APPLICATION_PUBLIC_KEY_DELETED", "CHANGE_ADMIN_ROLE", "CHANGE_FOLDER_PERMISSION", "COLLABORATION_ACCEPT", "COLLABORATION_EXPIRATION", "COLLABORATION_INVITE", "COLLABORATION_REMOVE", "COLLABORATION_ROLE_CHANGE", "COLLAB_ADD_COLLABORATOR", "COLLAB_INVITE_COLLABORATOR", "COLLAB_REMOVE_COLLABORATOR", "COLLAB_ROLE_CHANGE", "COMMENT_CREATE", "COMMENT_DELETE", "CONTENT_WORKFLOW_ABNORMAL_DOWNLOAD_ACTIVITY", "CONTENT_WORKFLOW_AUTOMATION_ADD", "CONTENT_WORKFLOW_AUTOMATION_DELETE", "CONTENT_WORKFLOW_POLICY_ADD", "CONTENT_WORKFLOW_SHARING_POLICY_VIOLATION", "CONTENT_WORKFLOW_UPLOAD_POLICY_VIOLATION", "COPY", "DATA_RETENTION_CREATE_RETENTION", "DATA_RETENTION_REMOVE_RETENTION", "DELETE", "DELETE_USER", "DEVICE_TRUST_CHECK_FAILED", "DOWNLOAD", "EDIT", "EDIT_USER", "EMAIL_ALIAS_CONFIRM", "EMAIL_ALIAS_REMOVE", "ENABLE_TWO_FACTOR_AUTH", "FAILED_LOGIN", "FILE_MARKED_MALICIOUS", "FILE_WATERMARKED_DOWNLOAD", "GROUP_ADD_ITEM", "GROUP_ADD_USER", "GROUP_CREATION", "GROUP_DELETION", "GROUP_EDITED", "GROUP_REMOVE_ITEM", "GROUP_REMOVE_USER", "ITEM_COPY", "ITEM_CREATE", "ITEM_DOWNLOAD", "ITEM_MAKE_CURRENT_VERSION", "ITEM_MODIFY", "ITEM_MOVE", "ITEM_OPEN", "ITEM_PREVIEW", "ITEM_RENAME", "ITEM_SHARED", "ITEM_SHARED_CREATE", "ITEM_SHARED_UNSHARE", "ITEM_SHARED_UPDATE", "ITEM_SYNC", "ITEM_TRASH", "ITEM_UNDELETE_VIA_TRASH", "ITEM_UNSYNC", "ITEM_UPLOAD", "LEGAL_HOLD_ASSIGNMENT_CREATE", "LEGAL_HOLD_ASSIGNMENT_DELETE", "LEGAL_HOLD_POLICY_CREATE", "LEGAL_HOLD_POLICY_DELETE", "LEGAL_HOLD_POLICY_UPDATE", "LOCK", "LOCK_CREATE", "LOCK_DESTROY", "LOGIN", "MASTER_INVITE_ACCEPT", "MASTER_INVITE_REJECT", "METADATA_INSTANCE_CREATE", "METADATA_INSTANCE_DELETE", "METADATA_INSTANCE_UPDATE", "METADATA_TEMPLATE_CREATE", "METADATA_TEMPLATE_DELETE", "METADATA_TEMPLATE_UPDATE", "MOVE", "NEW_USER", "PREVIEW", "REMOVE_DEVICE_ASSOCIATION", "REMOVE_LOGIN_ACTIVITY_DEVICE", "RENAME", "RETENTION_POLICY_ASSIGNMENT_ADD", "SHARE", "SHARE_EXPIRATION", "SHIELD_ALERT", "STORAGE_EXPIRATION", "TAG_ITEM_CREATE", "TASK_ASSIGNMENT_CREATE", "TASK_ASSIGNMENT_DELETE", "TASK_ASSIGNMENT_UPDATE", "TASK_CREATE", "TASK_UPDATE", "TERMS_OF_SERVICE_ACCEPT", "TERMS_OF_SERVICE_REJECT", "UNDELETE", "UNLOCK", "UNSHARE", "UPDATE_COLLABORATION_EXPIRATION", "UPDATE_SHARE_EXPIRATION", "UPLOAD", "USER_AUTHENTICATE_OAUTH2_ACCESS_TOKEN_CREATE", "WATERMARK_LABEL_CREATE", "WATERMARK_LABEL_DELETE"

integer / int64in queryoptional
501000-500

Limits the number of events returned

stringin queryoptional
1348790499819

The location in the event stream to start receiving events from.

  • now will return an empty list events and the latest stream position for initialization.
  • 0 or null will return all events.
stringin queryoptional
all"all"

Defines the type of events that are returned

  • all returns everything for a user and is the default
  • changes returns events that may cause file tree changes such as file updates or collaborations.
  • sync is similar to changes but only applies to synced folders
  • admin_logs returns all events for an entire enterprise and requires the user making the API call to have admin permissions.

Value is one of "all", "changes", "sync", "admin_logs"

Response

application/jsonEvents

Returns a list of event objects.

Events objects are returned in pages, with each page (chunk) including a list of event objects. The response includes a chunk_size parameter indicating how many events were returned in this chunk, as well as the next stream_position that can be queried.

You can now try out some of our APIs live, right here in the documentation.
Log In

Request Example

cURL
curl -X GET https://api.box.com/2.0/events \
     -H "Authorization: Bearer <ACCESS_TOKEN>"
Python
stream_position = 0
events = client.events().get_events(stream_position=stream_position)
stream_position = events['next_stream_position']
for event in events['entries']:
    print('Got {0} event that occurred at {1}'.format(event.event_type, event.created_at))
Node
client.events.get({stream_position: '1408838928446360'}, callback);

Response Example

{
  "chunk_size": 2,
  "next_stream_position": 1152922976252290800,
  "entries": [
    {
      "type": "event",
      "event_id": "f82c3ba03e41f7e8a7608363cc6c0390183c3f83",
      "created_by": {
        "id": 11446498,
        "type": "user",
        "name": "Aaron Levie",
        "login": "ceo@example.com"
      },
      "event_type": "FILE_MARKED_MALICIOUS",
      "session_id": "70090280850c8d2a1933c1",
      "source": {
        "id": 11446498,
        "type": "user",
        "name": "Aaron Levie",
        "login": "ceo@example.com"
      },
      "additional_details": ""
    }
  ]
}