Get Enterprise Events

To get a enterprise's events, make a call to the GET /events API with the stream_type set to admin_logs or admin_logs_streaming.

Stream Types

Live Monitoring

To monitor recent events that have been generated within Box across the enterprise, set the stream_type to admin_logs_streaming. This is also known as the Enterprise Event Stream API.

The emphasis for this feed is on low latency rather than chronological accuracy, which means that Box may return events more than once and out of chronological order. Events are returned via the API in near real time after they are processed by Box. A small delay/buffer ensures that new events are not written after your cursor position. Only two weeks of events are available via this stream_type.

Historical Querying

To query historical events across the enterprise up to one year old, set the stream_type to admin_logs. This is also known as the Enterprise Event History API.

The emphasis for this feed is on completeness over latency, which means that Box will deliver admin events in chronological order and without duplicates, but with higher latency than the user or admin_logs_streaming feed. Consuming events in near real time may lead to missed events as events can arrive later than your filtering window.

Anonymous Users

In some cases, the event feed might list a user with an ID of 2. This is Box's internal identifier for anonymous users.

An anonymous user is a user that is not logged in. This can happen any time a user interacts with content and they aren't asked to log in first. An example would be when a user downloads a file through an open shared link.

Limitations

The enterprise event feed does not support long polling.

Box does not store events indefinitely. Two weeks of enterprise events are available when stream_type is set to admin_logs_streaming. One year of enterprise events are available when stream_type is set to admin_logs. Seven years of enterprise events are available via the Box Admin Console’s exported reports.

The emphasis of the admin_logs_streaming feed is to return the complete results quickly, which means that Box may return events more than once and out of order. Duplicate events can be identified by their event IDs.

Filter by Event Type

The enterprise event feed supports filtering by event type.

A full list of event types can be found below.

Event Types

The following events can be triggered for an enterprise. This list is not exhaustive, so it is possible events appear that are not listed.