--- title: "POST provider Directory Insights events count (converged audit)" method: POST path: "/api/v2/providers/{provider_id}/directoryinsights/events/count" tags: ["Providers", "Directory Insights"] --- # POST provider Directory Insights events count (converged audit) `POST /api/v2/providers/{provider_id}/directoryinsights/events/count` ## Request - Base URL: `https://console.jumpcloud.com` - URL: `https://console.jumpcloud.com/api/v2/providers/{provider_id}/directoryinsights/events/count` - Auth: API key in header `x-api-key` - TypeScript: (a function with typed inputs; its response is checked against the schema) Provider-scoped Directory Insights events count for converged (hybrid) audit logs. Proxies to insights-internal ``POST /v1/providers/events/count``. The ``provider_id`` in the path must match the authenticated provider (see ``providerTenancy``). ``x-org-id`` is optional. When ``SP-9645-EP-DI-EVENTS`` is disabled, organization scope is derived only from legacy ``x-org-id`` when present; otherwise the request remains provider-pillar scoped. When the flag is enabled, valid body org filters take precedence. Optional body field ``exclude_provider_activity`` (boolean): when true, excludes provider-pillar events only; it does not exclude primary-organization events included in resolved organization IDs. When ``SP-9645-EP-DI-EVENTS`` is enabled, this requires an organization scope. Optional body fields for multi-org filtering (Provider DI body org filter contract): - ``organization_scope`` (string: ``all`` | ``explicit``): when SP-9645-EP-DI-EVENTS is enabled, ``all`` expands to all accessible live organizations under the provider, including the primary organization when accessible. OU tombstones may be included only with primary-organization access; MSP tombstones are excluded. When the flag is disabled, SI does not interpret valid body filter fields in the Provider DI handler: legacy ``x-org-id`` behavior and provider-pillar behavior when ``x-org-id`` is absent are preserved. Valid body fields may still be forwarded downstream as part of the legacy passthrough body. Schema-level validation may still reject malformed shapes before the handler runs, such as unsupported scope enum values or non-array ``organization_ids``. - ``organization_ids`` (array of strings): explicit org filter when ``organization_scope`` is ``explicit`` (or omitted with this field present). When the flag is enabled, an empty array queries provider-pillar logs only, provided ``exclude_provider_activity`` is not true. Do not use ``"-"`` here (use ``organization_scope: "all"`` instead). When SP-9645-EP-DI-EVENTS is enabled and the request reaches the Provider DI handler, the following invalid combinations return ``400`` with message ``invalid organization context``: - ``organization_scope: "all"`` together with ``organization_ids`` present - ``organization_scope: "explicit"`` without ``organization_ids`` - ``"-"`` inside ``organization_ids`` - an empty ``organization_ids`` array with ``exclude_provider_activity: true`` - no organization scope with ``exclude_provider_activity: true`` - a malformed ObjectId in ``organization_ids`` When enabled, valid filters are resolved by SI and forwarded as ``x-validated-org-id``. Unauthorized or wrong-provider IDs are pruned; if none remain, SI returns an empty organization-scoped result without calling insights-internal. When enabled, ``organization_ids: []`` is the provider-pillar sentinel when ``exclude_provider_activity`` is false or omitted. #### Sample Request ``` curl -X POST 'https://console.jumpcloud.com/api/v2/providers/{provider_id}/directoryinsights/events/count' \ -H 'accept: application/json' \ -H 'content-type: application/json' \ -H 'x-api-key: {API_KEY}' \ -H 'x-org-id: {OPTIONAL_COMMA_SEPARATED_ORG_IDS}' \ -d '{"service": ["radius"], "start_time": "2019-01-12T20:00:00Z" }' ``` ## Headers - `x-org-id` string ## Request body - object - `exclude_provider_activity` boolean: When SP-9645-EP-DI-EVENTS is enabled, this excludes provider-pillar events only and requires an organization scope. It does not exclude primary-organization events when the primary organization ID is included in the resolved organization IDs. When the flag is disabled, the field is forwarded using legacy behavior. - `organization_scope` 'all' | 'explicit': Org filter mode. When SP-9645-EP-DI-EVENTS is enabled, all expands to all accessible live organizations under the provider, including the primary organization when accessible; OU deleted tombstones may also be included for users with access to the provider primary organization. MSP deleted tombstones are not included. explicit uses organization_ids. all cannot be combined with organization_ids, and explicit requires organization_ids. When the flag is disabled, these fields are ignored and legacy x-org-id behavior is preserved. - `organization_ids` string[]: Explicit org filter when organization_scope is explicit (or omitted with this field present). When the flag is enabled, an empty array queries provider-pillar logs only, except that an empty array with exclude_provider_activity true is invalid; malformed IDs and "-" are invalid handler-level filters. Schema validation may reject malformed request shapes, such as non-array values, before the flag-gated handler runs. When the flag is disabled, this field is ignored and legacy behavior is preserved. ## Response `200` directory insights provider-scoped events count query - object ## Other responses - `400`: Bad Request - `401`: Unauthenticated - `403`: Unauthorized - `404`: Not Found - `409`: Conflict - `500`: Internal Server Error --- [API](https://skmtc.dev/jumpcloud/apis/jumpcloud-console-api.md) - [All operations](https://skmtc.dev/jumpcloud/apis/jumpcloud-console-api/llms.txt) - [OpenAPI document](https://skmtc.dev/jumpcloud/apis/jumpcloud-console-api/revisions/f396d9271b46?raw)