---
title: "Download Event Feed for Device"
method: GET
path: "/enterprise/{enterprise_id}/device/{device_id}/download/eventfeed/"
tags: ["esper_cloud_api_AndroidDevice"]
---

# Download Event Feed for Device

`GET /enterprise/{enterprise_id}/device/{device_id}/download/eventfeed/`

Download the event feed for an Android device. Retrieves a paginated, chronologically ordered list of EventFeed records for the specified Android device, each containing an event id, message_id, device_status_id, created_on timestamp, and a message describing what occurred — including commands issued, who issued them, and from which state they were issued. Results default to 250 records per page.

This endpoint is for Android devices only. For group-level event history, use GET /enterprise/{enterprise_id}/group/{group_id}/download/eventfeed/ instead.

About the Event Feed

The event feed is a chronological record of activity on a device, capturing commands, state transitions, and other significant events. It is the primary source for auditing device history, investigating incidents, and understanding the sequence of operations performed on a device. Each event links back to a device_status_id, which can be used to retrieve the full telemetry snapshot associated with that event.
Available query parameters:

limit — number of results per page (default: 250)
offset — pagination offset (default: 0)

**Common Use Cases** 

Auditing the full history of commands issued to a specific Android device, investigating device incidents by reviewing the sequence of events leading up to a failure or unexpected state change, downloading a complete event log for offline analysis or compliance reporting, and correlating device events with command requests to verify that operations were executed as expected.

**Best Practices** 

For large event histories, use limit and offset to paginate through results rather than fetching everything in a single call. If you only need the most recent device status snapshot rather than a full event history, use GET /enterprise/{enterprise_id}/device/{device_id}/status/?latest_event=1 instead — it is significantly lighter. For the Esper Console timeline view of device events, use GET /v1/enterprise/{enterprise_id}/device/{device_id}/report/eventfeed/ instead, which returns the same data with a smaller default page size suited to UI rendering.

**Workflow**

1. Call GET /enterprise/{enterprise_id}/device/{device_id}/ to confirm the device details and retrieve the device_id.
2. Call this endpoint to retrieve the full chronological event feed for the device.
3. Use message and created_on to identify the events relevant to your investigation or audit.
4. Use device_status_id from a specific event to retrieve the associated telemetry snapshot via GET /enterprise/{enterprise_id}/device/{device_id}/status/ if deeper context is needed.

## Path parameters

- `enterprise_id` string, required
- `device_id` string, required

## Query parameters

- `limit` integer
- `offset` integer

## Response `200`

successful operation

- object
  - `count` integer, required
  - `next` string, url, nullable
  - `previous` string, url, nullable
  - `results` EsperCloudApiEventFeed[], required
    - `id` integer — Integer representing the event ID
    - `message_id` string, UUID — UUID string representing message ID
    - `device_status_id` string, UUID — UUID string representing device status ID
    - `created_on` string, date-time
    - `message` string — Message describing the command, who issued it, and from which state it was issued.
    - `device` string, url — URL to device instance
    - `enterprise` string, url — URL to enterprise instance

## Other responses

- `401` — Authorization information is missing or invalid.
- `500` — Internal server error

---

[API](https://skmtc.dev/esper/apis/esper-api-reference.md) · [All operations](https://skmtc.dev/esper/apis/esper-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/esper/esper-api-reference/revisions/6b55f43485ae/schema)