---
title: "GET /api/activity/reports/security/"
method: GET
path: "/api/activity/reports/security/"
tags: ["activity"]
---

# GET /api/activity/reports/security/

`GET /api/activity/reports/security/`

Return security events (recorded by the Record Security Event brick and the policy-driven clipboard/URL-block/file-upload/protected-field enforcers) over the reporting window, newest first, for a member (``user``) or across one or more groups (``groups``), else the whole organization. Optional ``category`` / ``severity`` / ``action`` / ``destination`` query params filter the list; the response also includes per-category, per-severity, per-action, and top-destination (file-upload report) counts over the full window. Restricted to organization admins/managers and gated by the activity-tracking flag.

## Query parameters

- `organization` string, uuid, required
- `user` string, uuid
- `groups` string[]
- `start` string, date-time
- `end` string, date-time
- `limit` integer
- `category` string
- `severity` 'low' | 'medium' | 'high' | 'critical'
- `action` string
- `destination` string
- `precision` string

## Response `200`

---

[API](https://skmtc.dev/pixiebrix/apis/pixiebrix-api.md) · [All operations](https://skmtc.dev/pixiebrix/apis/pixiebrix-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/pixiebrix/pixiebrix-api/revisions/941ab9eb01d6/schema)