POST provider Directory Insights distinct event field values (converged audit)

Provider-scoped Directory Insights distinct field values for converged (hybrid) audit logs. Proxies to insights-internal POST /v1/providers/events/distinct.

The provider_id in the path must match the authenticated provider (see providerTenancy). x-org-id is optional. When SP-9645-EP-DI-EVENTS is disabled, organization scope is derived only from legacy x-org-id when present; otherwise the request remains provider-pillar scoped. When the flag is enabled, valid body org filters take precedence.

Optional body field exclude_provider_activity (boolean): when true, excludes provider-pillar events only; it does not exclude primary-organization events included in resolved organization IDs. When SP-9645-EP-DI-EVENTS is enabled, this requires an organization scope.

Optional body fields for multi-org filtering (Provider DI body org filter contract):

• organization_scope (string: all | explicit): when SP-9645-EP-DI-EVENTS is enabled, all expands to all accessible live organizations under the provider, including the primary organization when accessible. OU tombstones may be included only with primary-organization access; MSP tombstones are excluded. When the flag is disabled, SI does not interpret valid body filter fields in the Provider DI handler: legacy x-org-id behavior and provider-pillar behavior when x-org-id is absent are preserved. Valid body fields may still be forwarded downstream as part of the legacy passthrough body. Schema-level validation may still reject malformed shapes before the handler runs, such as unsupported scope enum values or non-array organization_ids.
• organization_ids (array of strings): explicit org filter when organization_scope is explicit (or omitted with this field present). When the flag is enabled, an empty array queries provider-pillar logs only, provided exclude_provider_activity is not true. Do not use "-" here (use organization_scope: "all" instead).

When SP-9645-EP-DI-EVENTS is enabled and the request reaches the Provider DI handler, the following invalid combinations return 400 with message invalid organization context:

• organization_scope: "all" together with organization_ids present
• organization_scope: "explicit" without organization_ids
• "-" inside organization_ids
• an empty organization_ids array with exclude_provider_activity: true
• no organization scope with exclude_provider_activity: true
• a malformed ObjectId in organization_ids

When enabled, valid filters are resolved by SI and forwarded as x-validated-org-id. Unauthorized or wrong-provider IDs are pruned; if none remain, SI returns an empty organization-scoped result without calling insights-internal. When enabled, organization_ids: [] is the provider-pillar sentinel when exclude_provider_activity is false or omitted.

Sample Request

curl -X POST 'https://console.jumpcloud.com/api/v2/providers/{provider_id}/directoryinsights/events/distinct' \
  -H 'accept: application/json' \
  -H 'content-type: application/json' \
  -H 'x-api-key: {API_KEY}' \
  -H 'x-org-id: {OPTIONAL_COMMA_SEPARATED_ORG_IDS}' \
  -d '{"service": ["radius"], "start_time": "2019-01-12T20:00:00Z", "field": "client_ip" }'