Skip to main content
Return a list of events with optional filtering.
External DocumentationTo learn more, visit the Admin By Request documentation.

​
Parameters

ParameterDescription
CodeFilter by the event’s event code.

For the complete list of event codes, refer to Admin By Requests’ documentation.
DaysThe number of days of event history to include.
End DateThe end of the timeframe to retrieve events up to.
LastThe number of entries to retrieve from the end of the list. The maximum value is 10000.
LimitThe maximum number of resources to return. The maximum value is 10000.
Start DateThe start of the timeframe to retrieve events from.
Start IDThe resource ID as a pagination token that indicates the next results page.
Time FilterSelect how to filter the event by time.

​
Example Output

[
	{
		"id": 49287606,
		"eventCode": 40,
		"eventLevel": 0,
		"eventText": "Admin By Request Workstation installed",
		"eventTime": "2022-01-23T15:49:20.597",
		"eventTimeUTC": "2022-01-23T15:49:20.597",
		"computerName": "FTWIN11",
		"userAccount": null,
		"userName": null,
		"alertAccount": null,
		"auditLogURL": null,
		"rollback": false,
		"additionalData": "7.3.0",
		"application": {
			"file": null,
			"path": null,
			"name": null,
			"vendor": null,
			"version": null,
			"sha256": null
		}
	},
	{
		"id": 53820480,
		"eventCode": 92,
		"eventLevel": 0,
		"eventText": "Execution of file blocked by policy",
		"eventTime": "2022-01-27T12:16:38.817",
		"eventTimeUTC": "2022-01-27T12:16:38.817",
		"computerName": "FTWIN11",
		"userAccount": "TEST",
		"userName": "FastTrack Support",
		"alertAccount": null,
		"auditLogURL": null,
		"rollback": false,
		"additionalData": null,
		"application": {
			"file": "msedge.exe",
			"path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application",
			"name": "Microsoft Edge",
			"vendor": "Microsoft Corporation",
			"version": "msedge.exe",
			"sha256": "3BC499B8B30FE66A91FABC2FF5AE6E6A9452C116AEDCAC7DBC5AEEEAEED2EB9C"
		}
	},
	{
		"id": 53821158,
		"eventCode": 5,
		"eventLevel": 0,
		"eventText": "Audited administrator logged on",
		"eventTime": "2022-01-27T12:30:13.357",
		"eventTimeUTC": "2022-01-27T12:30:13.357",
		"computerName": "FTWIN11",
		"userAccount": "ADMINISTRATOR",
		"userName": "Administrator",
		"alertAccount": null,
		"auditLogURL": null,
		"rollback": false,
		"additionalData": null,
		"application": {
			"file": null,
			"path": null,
			"name": null,
			"vendor": null,
			"version": null,
			"sha256": null
		}
	}
]

​
Workflow Library Example

List Events with Admin by Request and Send Results Via Email
Workflow LibraryPreview this Workflow on desktop
⌘I