Get Logs
The Okta System Log API provides read access to your organization’s system log. This API provides more functionality than the Events API.
External Documentation
To learn more, visit the Okta documentation.
Basic Parameters
Parameter | Description |
---|---|
Query | Filters the log events results by one or more exact keywords. |
Return All Pages | Automatically fetch all resources, page by page. |
Since | Filters the lower time bound of the log events published property for bounded queries or persistence time for polling queries. |
Until | Filters the upper time bound of the log events published property for bounded queries or persistence time for polling queries. |
Advanced Parameters
Parameter | Description |
---|---|
Filter | Filter Expression that filters the results, for more information visit https://developer.okta.com/docs/reference/api/system-log/#expression-filter |
Limit | Sets the number of results that are returned in the response. |
Sort Order | The order of the returned events. |
Example Output
[
{
"version": "0",
"severity": "INFO",
"client": {
"zone": "OFF_NETWORK",
"device": "Unknown",
"userAgent": {
"os": "Unknown",
"browser": "UNKNOWN",
"rawUserAgent": "UNKNOWN-DOWNLOAD"
},
"ipAddress": "12.97.85.90"
},
"actor": {
"id": "00u1qw1mqitPHM8AJ0g7",
"type": "User",
"alternateId": "admin@example.com",
"displayName": "John Doe"
},
"outcome": {
"result": "SUCCESS"
},
"uuid": "f790999f-fe87-467a-9880-6982a583986c",
"published": "2017-09-31T22:23:07.777Z",
"eventType": "user.session.start",
"displayMessage": "User login to Okta",
"transaction": {
"type": "WEB",
"id": "V04Oy4ubUOc5UuG6s9DyNQAABtc"
},
"debugContext": {
"debugData": {
"requestUri": "/login/do-login"
}
},
"legacyEventType": "core.user_auth.login_success",
"authenticationContext": {
"authenticationStep": 0,
"externalSessionId": "1013FfF-DKQSvCI4RVXChzX-w"
}
}
]
Workflow Library Example
Get Alerts for Login Attempts of Disabled Users in Okta