---
title: "Query Events"
method: POST
path: "/events"
tags: ["EventQuery"]
---

# Query Events

`POST /events`

## Request

- Base URL: `https://api.jumpcloud.com/insights/directory/v1`
- URL: `https://api.jumpcloud.com/insights/directory/v1/events`
- Auth: API key in header `x-api-key` and API key in header `x-org-id`
- TypeScript: <https://skmtc.dev/jumpcloud/apis/directory-insights-api/docs/events/post.ts> (a function with typed inputs; its response is checked against the schema)

Query the API for Directory Insights events
#### Sample Request
```
curl -X POST 'https://api.jumpcloud.com/insights/directory/v1/events' -H 'Content-Type: application/json' -H 'x-api-key: REPLACE_KEY_VALUE' --data '{"service": ["all"], "start_time": "2021-07-14T23:00:00Z", "end_time": "2021-07-28T14:00:00Z", "sort": "DESC", "fields": ["timestamp", "event_type", "initiated_by", "success", "client_ip", "provider", "organization"]}'
```

## Request body

- EventQuery: EventServiceTimeQuery is the base struct for most event queries it includes the minimum-required fields of service and start/end times
  - `end_time` string, date-time: optional query end time, UTC in RFC3339 format
  - `service` string[], required: service name to query.
  - `start_time` string, date-time, required: query start time, UTC in RFC3339 format
  - `exact_match` string: optional string for specifying exact match query, do not use with full text query
  - `exclude_provider_activity` boolean: When true, exclude provider-level events and return only child organization activity.
  - `fields` string[]: optional list of fields to return from query
  - `limit` integer: Max number of rows to return
  - `q` string: optional string for specifying a full text query
  - `search_after` object[]: Specific query to search after, see x-* response headers for next values
  - `search_term` SearchTerm: SearchTerm is the filter portion of the query it contains only one of 'and', 'or', or 'not' conjunction maps
    - `and` TermConjunction: TermConjunction represents a conjunction (and/or) NOTE: the validator limits what the operator can be, not the object for future-proof-ness and a list of sub-values
    - `not` TermConjunction: TermConjunction represents a conjunction (and/or) NOTE: the validator limits what the operator can be, not the object for future-proof-ness and a list of sub-values
    - `or` TermConjunction: TermConjunction represents a conjunction (and/or) NOTE: the validator limits what the operator can be, not the object for future-proof-ness and a list of sub-values
  - `skip` integer: optional offset into the result set to start with when returning
  - `sort` string: ASC or DESC order for timestamp

## Response `200`

Array of Directory Insights events JSON objects

- object[]

## Other responses

- `400`: Invalid/unknown query JSON body
- `401`: Unauthorized (Invalid API Key)
- `402`: Directory Insights is not enabled for your organization
- `500`: Technical difficulties processing your request

## Changes

- **2026-11-06** `17eea0b00afb`: 1 breaking, 5 info
  - added required request body
  - added the media type `application/json` for the response with the status `200`
  - added the media type `application/json` for the response with the status `400`
  - added the media type `application/json` for the response with the status `401`
  - …2 more

[Operation history](https://skmtc.dev/jumpcloud/apis/directory-insights-api/changes/events/post.md)

---

[API](https://skmtc.dev/jumpcloud/apis/directory-insights-api.md) - [All operations](https://skmtc.dev/jumpcloud/apis/directory-insights-api/llms.txt) - [OpenAPI document](https://skmtc.dev/jumpcloud/apis/directory-insights-api/revisions/17eea0b00afb?raw)