--- title: "Query events (filter body). A POST, but a read: a read-only API key may call it" method: POST path: "/api/get_all_events_with_count/" tags: ["Events"] --- # Query events (filter body). A POST, but a read: a read-only API key may call it `POST /api/get_all_events_with_count/` ## Request - Base URL: `https://eyalsec.com` - URL: `https://eyalsec.com/api/get_all_events_with_count/` - Auth: one of: - API key in header `X-API-Key` - API key in cookie `__Host-es2session` Returns one page (up to 100 rows) of the caller's coalesced events, newest first (or most severe first with sort=severity), with an opaque next_cursor for pagination. Filters arrive as an optional JSON body (an empty POST = first page, no filters). Cookie callers must send a valid CSRF token (X-CSRFToken); API-key callers are exempt. Each event is a positional array of 17 elements: [created_at, where, str_repr, count, machine_name, severity, agent_kind, id, source_label, context, suppressed, sanitize_reason, impact, labels, has_comment, extension, taint_source]. taint_source is an es-python event's taint source by the name a rule's source takes (socket, file, env, ...); it is empty for every other product and when no source was recorded. The array is appended to, never reordered, so index by position and ignore trailing elements you do not know. impact is the event's vulnerability classes as [{label, sev}]: label is a short class name ("xss", "sqli", "command injection") and sev is that CLASS's own severity, which is not the event's severity in element 5 - an rce-class sink stays critical on an event graded low because its source is trusted. A row can carry more than one (a sink class plus a source class), worst first, at most three. labels is your own triage labels on the event as [{id, name, color}]; has_comment is true when you have written a note on it; extension names the browser extension an es-chromium event is attributed to (its name and version, or its id when no name is known) and is empty for every other event. The heavy per-event fields (trace, source, origin, repr_created, detail) and your note's text are NOT in this array; fetch them for one event with GET /api/event/{id}. A SHORT PAGE IS NOT THE LAST PAGE: every request examines a bounded slice of your history so no single call runs for seconds, so a selective filter can return fewer than 100 events, or zero, and still hand back a next_cursor. Follow the cursor until it comes back empty, even after an empty page; the scanned and exhausted fields report how far the current request got, and oldest_examined is the timestamp of the oldest row it looked at. When an enabled Hide rule matches every event (an empty pattern or .*), the response returns at once with no events, exhausted true, and hidden_by {id, label} naming that rule. This applies to every filter, including whitelist_repr, blacklist_repr, machine and sources. This is a **read**: a read-only API key may call it. ## Request body - EventQuery: The events filter. Every field is optional, and each matches a control on the events page. - `cursor` string: Opaque pagination cursor from a prior next_cursor. - `sort` string: List order: newest (the default) or severity (critical first, then high, medium, low and info, newest first within each; events with no recognised severity last). Both orders list the same events. A cursor only continues the order that produced it: a cursor from the other order is a 400, so start again without one when changing order. Any other value is a 400. - `whitelist_repr` string, regex: Show only events whose sink label (the where field) matches this regex, case-insensitively. Despite the name, it is not matched against the repr. An invalid regex is a 400. - `blacklist_repr` string, regex: Hide events whose sink label (the where field) matches this regex, case-insensitively. Despite the name, it is not matched against the repr. An invalid regex is a 400. - `from` string: Lower time bound (RFC3339 or YYYY-MM-DD). - `to` string: Upper time bound (RFC3339 or YYYY-MM-DD, inclusive of the whole day). - `machine` string: Restrict to one machine by display name (exact match). - `severity` string[]: Severity levels to include: critical, high, medium, low, info. Unknown values are ignored. - `sources` string[]: Taint-source categories to include, matched against the event's origin: socket, file, stdin, env, argv, manual, fuzzer, foreign. Unknown values are ignored. - `tags` string[]: Restrict to events carrying any of these impact class labels (e.g. sqli, xss). An unknown label is a 400. - `labels` integer[]: Restrict to events carrying any of these triage label ids (your own, from GET /api/event_labels/). - `xss_only` boolean: es-chromium only: keep just the events whose sink can end in script execution. Must be sent with view=browser; with any other view it is a 400. - `scope` object: The events page's scope bar, as {mode, value, include_empty}: mode is is, ends (suffix) or regex, matched against the event's scope key (see scope on GET /api/event_view_counts/). A scope with no mode or no value is ignored; an unknown mode or an invalid regex is a 400. - `advanced` object: The condition builder, as {match, conditions}: match is all (default) or any, and each condition is {field, op, value, negate}. The fields available depend on the view; an unknown field or an invalid value is a 400. - `view` string: Agent kind to include: python, browser, go, c, cpp, rust, node, solidity, java, bash, ruby or php. Omitted or empty = every view your account holds, which is what the pre-views clients this field exists for still get. Naming a view your account does not hold is a 403; if no products are enabled at all, even the omitted form is a 403. Any unrecognised value is a 400, never a silent empty page. - `bucket` string: Sanitizer visibility bucket: live (the default, unsuppressed rows only), suppressed, or all. This was briefly named view during development; view now always means the agent kind above. ## Response `200` OK. - EventPage - `events` EventRow[] - unknown[]: One event, as a positional array. New values are only ever added at the end, so read by position and ignore extra values you do not know. - unknown - `next_cursor` string: Send as cursor to get the next page. Empty when you have everything. - `scanned` integer: How many stored rows this request examined. - `exhausted` boolean: true when the scan reached the end of the range. - `oldest_examined` string: The time of the oldest row this request looked at. - `event_limit` integer: Your event quota; -1 means none. - `event_limit_monthly` boolean: Whether the quota resets each calendar month. - `hidden_by` object: Present when an enabled Hide rule matches every event: that rule's id and label. ## Other responses - `401`: The API key is missing, wrong, revoked or expired. - `429`: A rate limit was hit, or the account is locked after wrong passwords. Retry-After gives the seconds to wait. - `default`: An error. Check the status first; the body carries a short message, as JSON ({"error": "..."}) on most endpoints and as plain text on some. 400: malformed JSON, an invalid regex, an unreadable cursor or date, or an unknown value. 401: the API key is missing, wrong, revoked or expired. 403: a failed CSRF check, a read-only key trying to write, a product or feature not enabled on your account, a wrong password, or a write on an account limited to reading. 404: not found, including things that belong to another account. 409: conflict with the current state. 422: a field is missing or invalid. 429: a rate limit was hit, or the account is locked after wrong passwords. 500: something failed on our side. --- [API](https://skmtc.dev/eyalsec/apis/eyalsec-api.md) · [All operations](https://skmtc.dev/eyalsec/apis/eyalsec-api/llms.txt) · [OpenAPI document](https://skmtc.dev/eyalsec/apis/eyalsec-api/revisions/dc7520689cf1?raw)