---
title: "Query event distinct field values"
method: POST
path: "/events/distinct"
tags: ["EventDistinctQuery"]
---

# Query event distinct field values

`POST /events/distinct`

## Request

- Base URL: `https://api.jumpcloud.com/insights/directory/v1`
- URL: `https://api.jumpcloud.com/insights/directory/v1/events/distinct`
- Auth: API key in header `x-api-key` and API key in header `x-org-id`
- TypeScript: <https://skmtc.dev/jumpcloud/apis/directory-insights-api/docs/events/distinct/post.ts> (a function with typed inputs; its response is checked against the schema)

Query the API for a list of distinct values for a field
#### Sample Request
```
curl -X POST 'https://api.jumpcloud.com/insights/directory/v1/events/distinct' -H 'Content-Type: application/json' -H 'x-api-key: REPLACE_KEY_VALUE' --data '{"service": ["all"], "start_time": "2021-07-14T23:00:00Z", "end_time": "2021-07-28T14:00:00Z", "sort": "DESC", "field": "event_type"}'
```

## Request body

- EventDistinctQuery: EventServiceTimeQuery is the base struct for most event queries it includes the minimum-required fields of service and start/end times
  - `end_time` string, date-time: optional query end time, UTC in RFC3339 format
  - `service` string[], required: service name to query.
  - `start_time` string, date-time, required: query start time, UTC in RFC3339 format
  - `exclude_provider_activity` boolean: When true, exclude provider-level events and return only child organization activity.
  - `field` string, required: field is what they wish to query on
  - `search_term` SearchTerm: SearchTerm is the filter portion of the query it contains only one of 'and', 'or', or 'not' conjunction maps
    - `and` TermConjunction: TermConjunction represents a conjunction (and/or) NOTE: the validator limits what the operator can be, not the object for future-proof-ness and a list of sub-values
    - `not` TermConjunction: TermConjunction represents a conjunction (and/or) NOTE: the validator limits what the operator can be, not the object for future-proof-ness and a list of sub-values
    - `or` TermConjunction: TermConjunction represents a conjunction (and/or) NOTE: the validator limits what the operator can be, not the object for future-proof-ness and a list of sub-values

## Response `200`

List of distinct field values

- object
  - `buckets` object[]
    - `doc_count` integer
    - `key` string
  - `doc_count_error_upper_bound` integer
  - `sum_other_doc_count` integer

## Other responses

- `400`: Invalid/unknown query JSON body
- `401`: Unauthorized (Invalid API Key)
- `402`: Directory Insights is not enabled for your organization
- `500`: Technical difficulties processing your request

---

[API](https://skmtc.dev/jumpcloud/apis/directory-insights-api.md) - [All operations](https://skmtc.dev/jumpcloud/apis/directory-insights-api/llms.txt) - [OpenAPI document](https://skmtc.dev/jumpcloud/apis/directory-insights-api/revisions/17eea0b00afb?raw)