---
title: "Query event counts by bucketed by a time interval"
method: POST
path: "/events/interval"
tags: ["EventIntervalQuery"]
---

# Query event counts by bucketed by a time interval

`POST /events/interval`

## Request

- Base URL: `https://api.jumpcloud.com/insights/directory/v1`
- URL: `https://api.jumpcloud.com/insights/directory/v1/events/interval`
- Auth: API key in header `x-api-key` and API key in header `x-org-id`
- TypeScript: <https://skmtc.dev/jumpcloud/apis/directory-insights-api/docs/events/interval/post.ts> (a function with typed inputs; its response is checked against the schema)

Query the API for a list of counts by time interval
#### Sample Request
```
curl -X POST 'https://api.jumpcloud.com/insights/directory/v1/events/interval' -H 'Content-Type: application/json' -H 'x-api-key: REPLACE_KEY_VALUE' --data '{"service": ["all"], "start_time": "2021-07-14T23:00:00Z", "end_time": "2021-07-28T14:00:00Z", "timezone": "-0500", "interval_unit": "h", "interval_value": "2"}'
```

## Request body

- EventIntervalQuery: EventServiceTimeQuery is the base struct for most event queries it includes the minimum-required fields of service and start/end times
  - `end_time` string, date-time: optional query end time, UTC in RFC3339 format
  - `service` string[], required: service name to query.
  - `start_time` string, date-time, required: query start time, UTC in RFC3339 format
  - `exact_match` string: optional string for specifying exact match query, do not use with full text query
  - `exclude_provider_activity` boolean: When true, exclude provider-level events and return only child organization activity.
  - `interval_unit` 's' | 'm' | 'h' | 'd' | 'w', required
  - `interval_value` string: Interval Value. This specifies how many units you want to bucket the event counts by
  - `q` string: optional string for specifying a full text query
  - `search_term` SearchTerm: SearchTerm is the filter portion of the query it contains only one of 'and', 'or', or 'not' conjunction maps
    - `and` TermConjunction: TermConjunction represents a conjunction (and/or) NOTE: the validator limits what the operator can be, not the object for future-proof-ness and a list of sub-values
    - `not` TermConjunction: TermConjunction represents a conjunction (and/or) NOTE: the validator limits what the operator can be, not the object for future-proof-ness and a list of sub-values
    - `or` TermConjunction: TermConjunction represents a conjunction (and/or) NOTE: the validator limits what the operator can be, not the object for future-proof-ness and a list of sub-values
  - `timezone` string: TimeZone. Specify the timezone in which the user is in optional

## Response `200`

List of bucketed event counts

- object
  - `buckets` object[]
    - `doc_count` integer
    - `key` integer
    - `key_as_string` string

## Other responses

- `400`: Invalid/unknown query JSON body
- `401`: Unauthorized (Invalid API Key)
- `402`: Directory Insights is not enabled for your organization
- `500`: Technical difficulties processing your request

---

[API](https://skmtc.dev/jumpcloud/apis/directory-insights-api.md) - [All operations](https://skmtc.dev/jumpcloud/apis/directory-insights-api/llms.txt) - [OpenAPI document](https://skmtc.dev/jumpcloud/apis/directory-insights-api/revisions/17eea0b00afb?raw)