---
title: "List all SIEM events"
method: GET
path: "/api/v2/siem/events"
tags: ["SIEM"]
---

# List all SIEM events

`GET /api/v2/siem/events`

## Request

- Base URL: `https://app.360learning.com`
- URL: `https://app.360learning.com/api/v2/siem/events`
- Auth: OAuth 2
  - Client credentials
  - Token URL: `/api/v2/oauth2/token`

> 🔑
>
> Required OAuth scope: `siem:read`.

> 📖
>
> This endpoint is paginated with a page size of 1,000 events. For more information, see the [Pagination guide](doc:pagination).

Lists all security audit events in your platform.

## Headers

- `360-api-version` 'v2.0', required

## Response `200`

Returns one page of 1000 events.

- SiemEventDTO[]
  - `eventId` string, required: The unique ID of the event.

## Other responses

- `400`: The SIEM feature is not enabled.
- `401`: The given access token is either missing, invalid, has expired, or has been revoked.
- `403`: The given access token does not have the required OAuth scope to execute the request.
- `429`: The client has sent too many requests in a short amount of time.

## Changes

- **2026-11-03** `d827a4a84180`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/360learning/apis/core-api/changes/api/v2/siem/events/get.md)

---

[API](https://skmtc.dev/360learning/apis/core-api.md) - [All operations](https://skmtc.dev/360learning/apis/core-api/llms.txt) - [OpenAPI document](https://skmtc.dev/360learning/apis/core-api/revisions/d827a4a84180?raw)