BObox
Events

List user and enterprise events

Changed on

Returns up to a year of past events for a given user or for the entire enterprise.

By default this returns events for the authenticated user. To retrieve events for the entire enterprise, set the stream_type to admin_logs_streaming for live monitoring of new events, or admin_logs for querying across historical events. The user making the API call will need to have admin privileges, and the application will need to have the scope manage enterprise properties checked.

get/events

Request

  • Base URL
    https://api.box.com/2.0
  • URL
    https://api.box.com/2.0/events
  • Auth
    OAuth 2
    Authorization code: https://account.box.com/api/oauth2/authorize
    Token URL: https://api.box.com/oauth2/token

Query parameters

stream_type'all' | 'changes' | 'sync' | 'admin_logs' | 'admin_logs_streaming'

Defines the type of events that are returned

  • all returns everything for a user and is the default
  • changes returns events that may cause file tree changes such as file updates or collaborations.
  • sync is similar to changes but only applies to synced folders
  • admin_logs returns all events for an entire enterprise and requires the user making the API call to have admin permissions. This stream type is for programmatically pulling from a 1 year history of events across all users within the enterprise and within a created_after and created_before time frame. The complete history of events will be returned in chronological order based on the event time, but latency will be much higher than admin_logs_streaming.
  • admin_logs_streaming returns all events for an entire enterprise and requires the user making the API call to have admin permissions. This stream type is for polling for recent events across all users within the enterprise. Latency will be much lower than admin_logs, but events will not be returned in chronological order and may contain duplicates.
stream_positionstring

The location in the event stream to start receiving events from.

  • now will return an empty list events and the latest stream position for initialization.
  • 0 or null will return all events.
limitinteger

Limits the number of events returned.

Note: Sometimes, the events less than the limit requested can be returned even when there may be more events remaining. This is primarily done in the case where a number of events have already been retrieved and these retrieved events are returned rather than delaying for an unknown amount of time to see if there are any more results.

event_typestring[]

A comma-separated list of events to filter by. This can only be used when requesting the events with a stream_type of admin_logs or adming_logs_streaming. For any other stream_type this value will be ignored.

created_afterstring date-time

The lower bound date and time to return events for. This can only be used when requesting the events with a stream_type of admin_logs. For any other stream_type this value will be ignored.

created_beforestring date-time

The upper bound date and time to return events for. This can only be used when requesting the events with a stream_type of admin_logs. For any other stream_type this value will be ignored.

Response

Returns a list of event objects.

Events objects are returned in pages, with each page (chunk) including a list of event objects. The response includes a chunk_size parameter indicating how many events were returned in this chunk, as well as the next stream_position that can be queried.

chunk_sizeinteger

The number of events returned in this response.

Example response

{
  "chunk_size": 2,
  "entries": [
    {
      "type": "event",
      "created_at": "2022-12-12T10:53:43-08:00",
      "recorded_at": "2022-12-12T10:54:43-08:00",
      "event_id": "f82c3ba03e41f7e8a7608363cc6c0390183c3f83",
      "created_by": {
        "id": "11446498",
        "type": "user",
        "name": "Aaron Levie",
        "login": "ceo@example.com"
      },
      "event_type": "FILE_MARKED_MALICIOUS",
      "session_id": "70090280850c8d2a1933c1",
      "source": {
        "id": "11446498",
        "type": "user",
        "name": "Aaron Levie",
        "login": "ceo@example.com",
        "created_at": "2012-12-12T10:53:43-08:00",
        "modified_at": "2012-12-12T10:53:43-08:00",
        "language": "en",
        "timezone": "Africa/Bujumbura",
        "space_amount": 11345156112,
        "space_used": 1237009912,
        "max_upload_size": 2147483648,
        "status": "active",
        "job_title": "CEO",
        "phone": "6509241374",
        "address": "900 Jefferson Ave, Redwood City, CA 94063",
        "avatar_url": "https://www.box.com/api/avatar/large/181216415",
        "notification_email": {
          "email": "notifications@example.com",
          "is_confirmed": true
        }
      },
      "additional_details": {
        "key": "value"
      }
    }
  ]
}

Changes

  • c4d5303fa5c3Revision changes
    • breaking

      the response property ////// became nullable for the status

    • warning

      added the new SHARED_LINK_ONE_TIME_PASSCODE_ACCESS enum value to the /// response property for the response status

    • warning

      added the new SHARED_LINK_ONE_TIME_PASSCODE_CHALLENGE enum value to the /// response property for the response status

    • warning

      added the new SHIELD_EXTERNAL_COLLAB_ACCESS_JUSTIFIED enum value to the /// response property for the response status

    • warning

      added the new SHIELD_PREVIEW_BLOCKED enum value to the /// response property for the response status

    • warning

      added the new unprocessable_entity enum value to the response property for the response status

    • info

      added the enum value SHARED_LINK_ONE_TIME_PASSCODE_ACCESS to the property items/ of the query request parameter event_type

    • info

      added the enum value SHARED_LINK_ONE_TIME_PASSCODE_CHALLENGE to the property items/ of the query request parameter event_type

    • info

      added the enum value SHIELD_DOWNLOAD_BLOCKED to the property items/ of the query request parameter event_type

    • info

      added the enum value SHIELD_EXTERNAL_COLLAB_ACCESS_JUSTIFIED to the property items/ of the query request parameter event_type

    • info

      added the enum value SHIELD_EXTERNAL_COLLAB_INVITE_JUSTIFIED to the property items/ of the query request parameter event_type

    • info

      added the enum value SHIELD_PREVIEW_BLOCKED to the property items/ of the query request parameter event_type

    • info

      added subschema #1 subschema #2 subschema #3 to the /////// response property allOf list for the response status

    • info

      added subschema #2 to the ////// response property allOf list for the response status

    • info

      removed subschema #1 subschema #2 subschema #3 from the /////// response property allOf list for the response status

    • info

      removed subschema #2 subschema #3 from the ////// response property allOf list for the response status

    • info

      added the required property //////// to the response with the status

    • info

      added the required property //////// to the response with the status