External DocumentationTo learn more, visit the Admin By Request documentation.
Parameters
| Parameter | Description |
|---|---|
| Code | Filter by the event’s event code. For the complete list of event codes, refer to Admin By Requests’ documentation. |
| Days | The number of days of event history to include. |
| End Date | The end of the timeframe to retrieve events up to. |
| Last | The number of entries to retrieve from the end of the list. The maximum value is 10000. |
| Limit | The maximum number of resources to return. The maximum value is 10000. |
| Start Date | The start of the timeframe to retrieve events from. |
| Start ID | The resource ID as a pagination token that indicates the next results page. |
| Time Filter | Select how to filter the event by time. |
Example Output
[
{
"id": 49287606,
"eventCode": 40,
"eventLevel": 0,
"eventText": "Admin By Request Workstation installed",
"eventTime": "2022-01-23T15:49:20.597",
"eventTimeUTC": "2022-01-23T15:49:20.597",
"computerName": "FTWIN11",
"userAccount": null,
"userName": null,
"alertAccount": null,
"auditLogURL": null,
"rollback": false,
"additionalData": "7.3.0",
"application": {
"file": null,
"path": null,
"name": null,
"vendor": null,
"version": null,
"sha256": null
}
},
{
"id": 53820480,
"eventCode": 92,
"eventLevel": 0,
"eventText": "Execution of file blocked by policy",
"eventTime": "2022-01-27T12:16:38.817",
"eventTimeUTC": "2022-01-27T12:16:38.817",
"computerName": "FTWIN11",
"userAccount": "TEST",
"userName": "FastTrack Support",
"alertAccount": null,
"auditLogURL": null,
"rollback": false,
"additionalData": null,
"application": {
"file": "msedge.exe",
"path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application",
"name": "Microsoft Edge",
"vendor": "Microsoft Corporation",
"version": "msedge.exe",
"sha256": "3BC499B8B30FE66A91FABC2FF5AE6E6A9452C116AEDCAC7DBC5AEEEAEED2EB9C"
}
},
{
"id": 53821158,
"eventCode": 5,
"eventLevel": 0,
"eventText": "Audited administrator logged on",
"eventTime": "2022-01-27T12:30:13.357",
"eventTimeUTC": "2022-01-27T12:30:13.357",
"computerName": "FTWIN11",
"userAccount": "ADMINISTRATOR",
"userName": "Administrator",
"alertAccount": null,
"auditLogURL": null,
"rollback": false,
"additionalData": null,
"application": {
"file": null,
"path": null,
"name": null,
"vendor": null,
"version": null,
"sha256": null
}
}
]
Workflow Library Example
List Events with Admin by Request and Send Results Via Email