Don't get Personal Apps with Events API

wafon (wafon) asked a question.

Edited by varun.kavoori1.5210444522562532E12 September 5, 2018 at 1:19 AM

Hello, I'm using the Events API to get sign on events from the last 2 hours. However the system I am using has been timing out as the response takes too long, is there a way I can search for Events that don't include "Personal App: User performed single sign on to app"?

I am new to the Okta API so any help is appreciated.

gabriel.sroka1.4374539321839353E12 (Okta, Inc.)
Edited by varun.kavoori1.5210444522562532E12 September 5, 2018 at 1:29 AM
Hi Jamie
Can you provide a few more details on how you're making the call, arguments, etc.? Please don't include your SSWS token...

For example, what date range and limit are you using? The limit should be set to about 1000, and if you have more than 1000 events, you should use pagination:
http://developer.okta.com/docs/api/getting_started/design_principles.html#pagination(http://developer.okta.com/docs/api/getting_started/design_principles.html#pagination)

Here is some information on filters:
http://developer.okta.com/docs/api/resources/events.html#filters(http://developer.okta.com/docs/api/resources/events.html#filters)
Expand Post
wafon (wafon)
Edited by varun.kavoori1.5210444522562532E12 September 5, 2018 at 1:29 AM
Hi,

This is the call I'm making and it's working fine:
{{url}}/api/v1/events?limit=1000&filter=action.objectType eq "app.auth.sso" and published gt "2017-02-02T14:00:00.000Z"

However it is picking up all apps when I only want ones that have been set up in Okta. For example when someone signs into an app the action.message is "User performed single sign on to app. SSO is of type: SECURE_WEB_AUTH". But when someone logs into a 'Personal App' e.g. one they have added themselves. the action.message is "Personal App: User performed single sign on to app".

Obviously I can filter this out after the results are returned but can I filter this out in the API call?
I've tried adding action.message sw "User" but this didn't seem to work. Is this simply a feature that doesn't exist or am I doing something wrong?
Expand Post
gabriel.sroka1.4374539321839353E12 (Okta, Inc.)
Edited by varun.kavoori1.5210444522562532E12 September 5, 2018 at 1:29 AM
Hi Jame
Your call looks good. Currently, the _only_ filters/fields/operators allowed are the 6 shown here:
http://developer.okta.com/docs/api/resources/events.html#filters(http://developer.okta.com/docs/api/resources/events.html#filters)

So, "action.message" won't work, and neither will "sw".

There is a beta for the System Log that will support enhanced filters and queries and more detail, see:
http://developer.okta.com/docs/api/resources/system_log.html(http://developer.okta.com/docs/api/resources/system_log.html)
Expand Post

Your Privacy

Your Privacy

Strictly Necessary Cookies

Strictly Necessary Cookies

Functional Cookies

Functional Cookies

Performance Cookies

Performance Cookies

Share or Sell of Personal Data

Share or Sell of Personal Data

Advertising Cookies

Your Privacy

Your Privacy

Strictly Necessary Cookies

Strictly Necessary Cookies

Functional Cookies

Functional Cookies

Performance Cookies

Performance Cookies

Share or Sell of Personal Data

Share or Sell of Personal Data

Advertising Cookies