---
title: "Where the account is in setting up es-python"
method: GET
path: "/api/onboarding_state/"
tags: ["Activity and account"]
---

# Where the account is in setting up es-python

`GET /api/onboarding_state/`

## Request

- Base URL: `https://eyalsec.com`
- URL: `https://eyalsec.com/api/onboarding_state/`
- Auth: one of:
  - API key in header `X-API-Key`
  - API key in cookie `__Host-es2session`

Returns the steps of the dashboard's setup checklist for es-python and the next one to do. has_plan is false until a plan is set up for the account. machines_total, machines_installed and machines_pending count es-python machines by status. sources_on is true when at least one es-python source of untrusted data is On for the account or for one of its es-python machines. ran is true once es-python has been started on a machine. events_total counts es-python events, leaving out self-test events, and stops counting at 100. selftest_seen is true when `eyalsec selftest` has reached the dashboard in the last 30 days. next_step is one of plan, add_machine, install, sources, run, first_event, done. empty_reason is one plain sentence saying why the es-python events list is empty, or empty when there is no setup reason. Cheap enough to poll every few seconds.

This is a **read**: a read-only API key may call it.

## Response `200`

OK.

- object

## Other responses

- `401`: The API key is missing, wrong, revoked or expired.
- `429`: A rate limit was hit, or the account is locked after wrong passwords. Retry-After gives the seconds to wait.
- `default`: An error. Check the status first; the body carries a short message, as JSON ({"error": "..."}) on most endpoints and as plain text on some. 400: malformed JSON, an invalid regex, an unreadable cursor or date, or an unknown value. 401: the API key is missing, wrong, revoked or expired. 403: a failed CSRF check, a read-only key trying to write, a product or feature not enabled on your account, a wrong password, or a write on an account limited to reading. 404: not found, including things that belong to another account. 409: conflict with the current state. 422: a field is missing or invalid. 429: a rate limit was hit, or the account is locked after wrong passwords. 500: something failed on our side.

---

[API](https://skmtc.dev/eyalsec/apis/eyalsec-api.md) · [All operations](https://skmtc.dev/eyalsec/apis/eyalsec-api/llms.txt) · [OpenAPI document](https://skmtc.dev/eyalsec/apis/eyalsec-api/revisions/dc7520689cf1?raw)