---
title: "Get recently updated entity context"
method: GET
path: "/api/v2/security_monitoring/entity_context/recently_updated"
tags: ["Security Monitoring"]
---

# Get recently updated entity context

`GET /api/v2/security_monitoring/entity_context/recently_updated`

## Request

- Base URL: `https://api.datadoghq.com`
- URL: `https://api.datadoghq.com/api/v2/security_monitoring/entity_context/recently_updated`
- Auth: one of:
  - API key in header `DD-API-KEY` and API key in header `DD-APPLICATION-KEY`
  - OAuth 2
    - Authorization code: `/oauth2/v1/authorize`
    - Token URL: `/oauth2/v1/token` scopes: `siem_entities_read`
- TypeScript: <https://skmtc.dev/datadog/apis/datadog-api-v2-collection/docs/api/v2/security_monitoring/entity_context/recently_updated/get.ts> (a function with typed inputs; its response is checked against the schema)

Get the entities with the most recent updates in the Cloud SIEM entity context store. Entities are ranked
by the time of their most recent revision in the requested time range, and the top `limit` entities are
returned in that order. This endpoint is not paginated.

## Query parameters

- `query` string
- `entity_type` 'siem_entity_identity': The type of entity to retrieve. Only `siem_entity_identity` is currently supported.
- `from` string
- `to` string
- `limit` integer
- `revisions` 'latest' | 'all': Which revisions to return for each entity: `latest` returns only the latest revision of each entity as of `to`, and `all` returns every revision in the requested time range.

## Response `200`

OK

- RecentlyUpdatedEntitiesResponse: Response from the recently updated entities endpoint, containing the entities with the most recent updates in the requested time range, ordered from most to least recently updated.
  - `data` EntityContextEntity[], required: The list of entities with the most recent updates, ordered from most to least recently updated.
    - `attributes` EntityContextEntityAttributes, required: The attributes of an entity context entry, grouping all the historical revisions of the entity.
      - `revisions` EntityContextRevision[], required: The historical revisions of the entity, ordered chronologically.
        - `attributes` EntityContextRevisionAttributes, required: The set of attributes recorded for the entity at this revision. The keys depend on the kind of entity.
        - `first_seen_at` string, date-time, required: The first time the entity was observed at this revision.
        - `last_seen_at` string, date-time, required: The last time the entity was observed at this revision.
    - `id` string, required: The unique identifier of the entity.
    - `type` string, required: The type of the entity. Reflects the underlying entity kind from the entity context store (for example, `siem_entity_identity` for identities). Defaults to `entity` when the kind is unknown.

## Other responses

- `400`: Bad Request
- `403`: Not Authorized
- `429`: Too many requests

---

[API](https://skmtc.dev/datadog/apis/datadog-api-v2-collection.md) - [All operations](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/llms.txt) - [OpenAPI document](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/revisions/3f70db624329?raw)