Don't get Personal Apps with Events API Skip to main content
https://support.okta.com/help/answers?id=9062a000000bmmtqai&refurl=http%3a%2f%2fsupport.okta.com%2fhelp%2fanswers
How satisfied are you with the Okta Help Center?
Thank you for your feedback!
How satisfied are you with the Okta Help Center?
1
2
3
4
5
Very Dissatisfied
Very satisfied
Enter content less than 200 characters.
Ask Search:
Jamie MacDonaldJamie MacDonald 

Don't get Personal Apps with Events API

Hello, I'm using the Events API to get sign on events from the last 2 hours. However the system I am using has been timing out as the response takes too long, is there a way I can search for Events that don't include "Personal App: User performed single sign on to app"?

I am new to the Okta API so any help is appreciated. 
Gabriel SrokaGabriel Sroka (Okta, Inc.)
Hi Jamie
Can you provide a few more details on how you're making the call, arguments, etc.? Please don't include your SSWS token...

For example, what date range and limit are you using? The limit should be set to about 1000, and if you have more than 1000 events, you should use pagination:
http://developer.okta.com/docs/api/getting_started/design_principles.html#pagination

Here is some information on filters:
http://developer.okta.com/docs/api/resources/events.html#filters
 
Jamie MacDonaldJamie MacDonald
Hi,

This is the call I'm making and it's working fine:
{{url}}/api/v1/events?limit=1000&filter=action.objectType eq "app.auth.sso" and published gt "2017-02-02T14:00:00.000Z"

However it is picking up all apps when I only want ones that have been set up in Okta. For example when someone signs into an app the action.message is "User performed single sign on to app. SSO is of type: SECURE_WEB_AUTH". But when someone logs into a 'Personal App' e.g. one they have added themselves. the action.message is "Personal App: User performed single sign on to app". 

Obviously I can filter this out after the results are returned but can I filter this out in the API call?
I've tried adding action.message sw "User" but this didn't seem to work. Is this simply a feature that doesn't exist or am I doing something wrong?
Gabriel SrokaGabriel Sroka (Okta, Inc.)
Hi Jame
Your call looks good. Currently, the _only_ filters/fields/operators allowed are the 6 shown here:
http://developer.okta.com/docs/api/resources/events.html#filters

So, "action.message" won't work, and neither will "sw".

There is a beta for the System Log that will support enhanced filters and queries and more detail, see:
http://developer.okta.com/docs/api/resources/system_log.html