Event

The description of an event that happened within Box

This object provides additional information about the event if available.

This can include how a user performed an event as well as additional information to correlate an event to external Keysafe logs. Not all events have an additional_details object. This object is only available in the Enterprise Events.

The user that performed the action represented by the event. Some events may be performed by users not logged into Box. In that case, not all attributes of the object are populated and the event is attributed to a unknown user (user_id = 2)

string
f82c3ba03e41f7e8a7608363cc6c0390183c3f83

The ID of the event object. You can use this to detect duplicate events

string
FILE_MARKED_MALICIOUS

The event type that triggered this event

Value is one of "ACCESS_GRANTED", "ACCESS_REVOKED", "ADD_DEVICE_ASSOCIATION", "ADD_LOGIN_ACTIVITY_DEVICE", "ADMIN_LOGIN", "APPLICATION_CREATED", "APPLICATION_PUBLIC_KEY_ADDED", "APPLICATION_PUBLIC_KEY_DELETED", "CHANGE_ADMIN_ROLE", "CHANGE_FOLDER_PERMISSION", "COLLABORATION_ACCEPT", "COLLABORATION_EXPIRATION", "COLLABORATION_INVITE", "COLLABORATION_REMOVE", "COLLABORATION_ROLE_CHANGE", "COLLAB_ADD_COLLABORATOR", "COLLAB_INVITE_COLLABORATOR", "COLLAB_REMOVE_COLLABORATOR", "COLLAB_ROLE_CHANGE", "COMMENT_CREATE", "COMMENT_DELETE", "CONTENT_WORKFLOW_ABNORMAL_DOWNLOAD_ACTIVITY", "CONTENT_WORKFLOW_AUTOMATION_ADD", "CONTENT_WORKFLOW_AUTOMATION_DELETE", "CONTENT_WORKFLOW_POLICY_ADD", "CONTENT_WORKFLOW_SHARING_POLICY_VIOLATION", "CONTENT_WORKFLOW_UPLOAD_POLICY_VIOLATION", "COPY", "DATA_RETENTION_CREATE_RETENTION", "DATA_RETENTION_REMOVE_RETENTION", "DELETE", "DELETE_USER", "DEVICE_TRUST_CHECK_FAILED", "DOWNLOAD", "EDIT", "EDIT_USER", "EMAIL_ALIAS_CONFIRM", "EMAIL_ALIAS_REMOVE", "ENABLE_TWO_FACTOR_AUTH", "FAILED_LOGIN", "FILE_MARKED_MALICIOUS", "FILE_WATERMARKED_DOWNLOAD", "GROUP_ADD_ITEM", "GROUP_ADD_USER", "GROUP_CREATION", "GROUP_DELETION", "GROUP_EDITED", "GROUP_REMOVE_ITEM", "GROUP_REMOVE_USER", "ITEM_COPY", "ITEM_CREATE", "ITEM_DOWNLOAD", "ITEM_MAKE_CURRENT_VERSION", "ITEM_MODIFY", "ITEM_MOVE", "ITEM_OPEN", "ITEM_PREVIEW", "ITEM_RENAME", "ITEM_SHARED", "ITEM_SHARED_CREATE", "ITEM_SHARED_UNSHARE", "ITEM_SHARED_UPDATE", "ITEM_SYNC", "ITEM_TRASH", "ITEM_UNDELETE_VIA_TRASH", "ITEM_UNSYNC", "ITEM_UPLOAD", "LEGAL_HOLD_ASSIGNMENT_CREATE", "LEGAL_HOLD_ASSIGNMENT_DELETE", "LEGAL_HOLD_POLICY_CREATE", "LEGAL_HOLD_POLICY_DELETE", "LEGAL_HOLD_POLICY_UPDATE", "LOCK", "LOCK_CREATE", "LOCK_DESTROY", "LOGIN", "MASTER_INVITE_ACCEPT", "MASTER_INVITE_REJECT", "METADATA_INSTANCE_CREATE", "METADATA_INSTANCE_DELETE", "METADATA_INSTANCE_UPDATE", "METADATA_TEMPLATE_CREATE", "METADATA_TEMPLATE_DELETE", "METADATA_TEMPLATE_UPDATE", "MOVE", "NEW_USER", "PREVIEW", "REMOVE_DEVICE_ASSOCIATION", "REMOVE_LOGIN_ACTIVITY_DEVICE", "RENAME", "RETENTION_POLICY_ASSIGNMENT_ADD", "SHARE", "SHARE_EXPIRATION", "SHIELD_ALERT", "STORAGE_EXPIRATION", "TAG_ITEM_CREATE", "TASK_ASSIGNMENT_CREATE", "TASK_ASSIGNMENT_DELETE", "TASK_ASSIGNMENT_UPDATE", "TASK_CREATE", "TASK_UPDATE", "TERMS_OF_SERVICE_ACCEPT", "TERMS_OF_SERVICE_REJECT", "UNDELETE", "UNLOCK", "UNSHARE", "UPDATE_COLLABORATION_EXPIRATION", "UPDATE_SHARE_EXPIRATION", "UPLOAD", "USER_AUTHENTICATE_OAUTH2_ACCESS_TOKEN_CREATE", "WATERMARK_LABEL_CREATE", "WATERMARK_LABEL_DELETE"

string
70090280850c8d2a1933c1

The session of the user that performed the action. Not all events will populate this attribute.

The item that triggered this event

string
event

event

Response Example

{
  "type": "event",
  "event_id": "f82c3ba03e41f7e8a7608363cc6c0390183c3f83",
  "created_by": {
    "id": 11446498,
    "type": "user",
    "name": "Aaron Levie",
    "login": "ceo@example.com"
  },
  "event_type": "FILE_MARKED_MALICIOUS",
  "session_id": "70090280850c8d2a1933c1",
  "source": {
    "id": 11446498,
    "type": "user",
    "name": "Aaron Levie",
    "login": "ceo@example.com"
  },
  "additional_details": ""
}