---
title: "Get entity context"
method: GET
path: "/api/v2/security_monitoring/entity_context"
tags: ["Security Monitoring"]
---

# Get entity context

`GET /api/v2/security_monitoring/entity_context`

## Request

- Base URL: `https://api.datadoghq.com`
- URL: `https://api.datadoghq.com/api/v2/security_monitoring/entity_context`
- Auth: one of:
  - API key in header `DD-API-KEY` and API key in header `DD-APPLICATION-KEY`
  - OAuth 2
    - Authorization code: `/oauth2/v1/authorize`
    - Token URL: `/oauth2/v1/token` scopes: `siem_entities_read`

Search the Cloud SIEM entity context store for entities that match a query, and return the historical
revisions of each entity in the requested time range. The endpoint can either return revisions across an
interval (`from` / `to`) or the snapshot of each entity at a single point in time (`as_of`); the two modes
are mutually exclusive.

## Query parameters

- `query` string
- `from` string
- `to` string
- `as_of` string
- `limit` integer
- `page_token` string

## Response `200`

OK

- EntityContextResponse: Response from the entity context endpoint, containing the matching entities and pagination metadata.
  - `data` EntityContextEntity[], required: The list of entities matching the query.
    - `attributes` EntityContextEntityAttributes, required: The attributes of an entity context entry, grouping all the historical revisions of the entity.
      - `revisions` EntityContextRevision[], required: The historical revisions of the entity, ordered chronologically.
        - `attributes` EntityContextRevisionAttributes, required: The set of attributes recorded for the entity at this revision. The keys depend on the kind of entity.
        - `first_seen_at` string, date-time, required: The first time the entity was observed at this revision.
        - `last_seen_at` string, date-time, required: The last time the entity was observed at this revision.
    - `id` string, required: The unique identifier of the entity.
    - `type` string, required: The type of the entity. Reflects the underlying entity kind from the entity context store (for example, `siem_entity_identity` for identities). Defaults to `entity` when the kind is unknown.
  - `meta` EntityContextResponseMeta, required: Metadata returned alongside the entity context response.
    - `page` EntityContextPage, required: Pagination metadata for the entity context response.
      - `next_token` string, required: An opaque token to pass as `page_token` in a subsequent request to retrieve the next page of results. Empty when there are no more results.
    - `total_count` integer, required: The total number of entities matching the query, irrespective of pagination.

## Other responses

- `400`: Bad Request
- `403`: Not Authorized
- `429`: Too many requests

---

[API](https://skmtc.dev/datadog/apis/datadog-api-v2-collection.md) - [All operations](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/llms.txt) - [OpenAPI document](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/revisions/da68bf029e4c?raw)