Events API
This page provides a reference of the available operations in the Events API. Events are recorded for security-relevant activities on endpoints and in the portal, for example when a user is added to the local administrators group, a file is blocked, or a PIN code is issued.
All operations must be prefixed with the correct datacenter URL for your tenant. All requests must be authenticated via an API key.
The following operations are available:
For a list of all event types, see Event codes.
Get events
Returns an array of events, in ascending order of their ID.
To retrieve new events incrementally, store the highest ID you have retrieved. In the next call, pass this ID plus one as startid.
Request
GET {datacenter}/events
Headers
| Name | Description | Type |
|---|---|---|
|
apikey |
The API key for connecting to your tenant. |
String |
Query Parameters
All parameters can alternatively be passed as headers. All parameters are optional. If a parameter is passed both as a URL parameter and as a header, the URL parameter takes precedence.
| Name | Description | Type |
|---|---|---|
|
|
The ID of the first Default: The first available ID. |
Integer |
|
|
The maximum number of Default: 50 Maximum: 10000. If you need to fetch more than 10000 If the value is not a number, an empty array is returned. Warning: Do not consistently set this parameter to high numbers. If you do, you will quickly exceed your quota, and your account will be blocked for the rest of the day.
|
Integer |
|
|
Retrieve the latest Maximum: 10000 Default: All |
Integer |
|
|
Only return events with the specified event code. See Event codes. Unknown codes and values that are not a number return an empty array. Default: Events with all codes are returned. |
Integer |
|
|
The number of days for which Days are counted as calendar days, not as 24-hour periods. For example, If the value is not a number, it is treated as 0. Negative values return an empty array. Default: 30 |
Integer |
|
|
Only return events created after the specified date. The specified date itself is not included: The date filters are applied to Default: All |
Date |
|
|
Only return The date filters are applied to Default: All |
Date |
Response
200 - OK - Success response
The operation returns an array of JSON objects. Each object corresponds to one event.
Object Properties
| Name | Description | Type |
|---|---|---|
|
|
The unique ID of the event. IDs are assigned in ascending order, so they can be used with |
Integer |
|
|
The type of the event. See Event codes. |
Integer |
|
|
The severity of the event. Possible values are:
|
Integer |
|
|
The description of the event type, as listed in Event codes. |
String |
|
|
The time of the event, in local time. Events reported by the endpoint use the local time of the computer. Events triggered from the portal, such as an issued PIN code, can use a different time zone. To compare or sort events, use |
String, dateTime |
|
|
The time of the event, in UTC. If unavailable, local time is used instead. |
String, dateTime |
|
|
The name of the computer on which the event occurred. |
String |
|
|
The account name of the user who caused the event. For events triggered from the portal, this is the account that the action applies to, for example the issued Break Glass account, or the user whose administrator rights are revoked. Can be null, for example for install events. |
String |
|
|
The full name of the user who caused the event. For events triggered from the portal, this is the name of the portal user who triggered the action. |
String |
|
|
A secondary account that is affected by the event, for example the account that was added to the local administrators group, or the local user that was created, deleted or whose password was changed. |
String |
|
|
A link to the related auditlog entry, if any. |
String |
|
|
Indicates whether or not the change was rolled back, for example if a user was added to the local administrators group and then removed again automatically. |
Boolean |
|
|
Additional information that depends on the event type, for example:
|
String |
|
|
Information about the file that was executed or blocked, for events that involve a file (for example, codes 92-94 and 124). For all other events, the properties of this object are null. |
Object |
|
|
The name of the file. |
String |
|
|
The path to the file. |
String |
|
|
The name of the application (the description property of the file). |
String |
|
|
The vendor of the application. |
String |
|
|
The version of the application. |
String |
|
|
The SHA-256 checksum of the file. |
String |
Examples
Retrieve the first three events
Request: GET https://dc1api.adminbyrequest.com/events?take=3
Response:
[
{
"id": 74668731,
"eventCode": 40,
"eventLevel": 0,
"eventText": "Admin By Request Workstation installed",
"eventTime": "2026-10-02T02:12:25.307",
"eventTimeUTC": "2026-10-02T09:12:25",
"computerName": "WIN0815",
"userAccount": null,
"userName": null,
"alertAccount": null,
"auditLogURL": null,
"rollback": false,
"additionalData": "9.0",
"application": {
"file": null,
"path": null,
"name": null,
"vendor": null,
"version": null,
"sha256": null
}
},
{
"id": 74668740,
"eventCode": 5,
"eventLevel": 0,
"eventText": "Audited administrator logged on",
"eventTime": "2026-10-02T02:12:32.18",
"eventTimeUTC": "2026-10-02T09:12:32",
"computerName": "WIN0815",
"userAccount": "ADMINISTRATOR",
"userName": "Administrator",
"alertAccount": null,
"auditLogURL": null,
"rollback": false,
"additionalData": null,
"application": {
"file": null,
"path": null,
"name": null,
"vendor": null,
"version": null,
"sha256": null
}
},
{
"id": 74669133,
"eventCode": 120,
"eventLevel": 0,
"eventText": "Device owner set",
"eventTime": "2026-10-02T02:17:00.433",
"eventTimeUTC": "2026-10-02T09:17:00.433",
"computerName": "WIN0815",
"userAccount": "jdoe",
"userName": "John Doe",
"alertAccount": null,
"auditLogURL": null,
"rollback": false,
"additionalData": null,
"application": {
"file": null,
"path": null,
"name": null,
"vendor": null,
"version": null,
"sha256": null
}
}
]Request: GET https://dc1api.adminbyrequest.com/events?code=92&last=1
Response:
[
{
"id": 74954445,
"eventCode": 92,
"eventLevel": 0,
"eventText": "Execution of file blocked by policy",
"eventTime": "2026-10-05T04:07:29.703",
"eventTimeUTC": "2026-10-05T11:07:29",
"computerName": "WIN0815",
"userAccount": "jdoe",
"userName": "John Doe",
"alertAccount": null,
"auditLogURL": null,
"rollback": false,
"additionalData": null,
"application": {
"file": "7z2603-x64.exe",
"path": "C:\\Users\\jdoe\\Downloads",
"name": "7-Zip Installer",
"vendor": "",
"version": "7z2603-x64.exe",
"sha256": "F17518028CC19AB0406FE310D7199472C85D7F8EF5BC7D7E29449393FAD65D55"
}
}
]Get event
Returns the event with the specified ID.
Request
GET {datacenter}/events/{id}
Headers
| Name | Description | Type |
|---|---|---|
|
apikey |
The API key for connecting to your tenant. |
String |
Path Parameters
| Name | Description | Type |
|---|---|---|
|
|
The ID of the |
Integer |
Response
200 - OK - Success response
The operation returns the event with the specified ID as a JSON object.
Object Properties
| Name | Description | Type |
|---|---|---|
|
|
The unique ID of the event. IDs are assigned in ascending order, so they can be used with |
Integer |
|
|
The type of the event. See Event codes. |
Integer |
|
|
The severity of the event. Possible values are:
|
Integer |
|
|
The description of the event type, as listed in Event codes. |
String |
|
|
The time of the event, in local time. Events reported by the endpoint use the local time of the computer. Events triggered from the portal, such as an issued PIN code, can use a different time zone. To compare or sort events, use |
String, dateTime |
|
|
The time of the event, in UTC. If unavailable, local time is used instead. |
String, dateTime |
|
|
The name of the computer on which the event occurred. |
String |
|
|
The account name of the user who caused the event. For events triggered from the portal, this is the account that the action applies to, for example the issued Break Glass account, or the user whose administrator rights are revoked. Can be null, for example for install events. |
String |
|
|
The full name of the user who caused the event. For events triggered from the portal, this is the name of the portal user who triggered the action. |
String |
|
|
A secondary account that is affected by the event, for example the account that was added to the local administrators group, or the local user that was created, deleted or whose password was changed. |
String |
|
|
A link to the related auditlog entry, if any. |
String |
|
|
Indicates whether or not the change was rolled back, for example if a user was added to the local administrators group and then removed again automatically. |
Boolean |
|
|
Additional information that depends on the event type, for example:
|
String |
|
|
Information about the file that was executed or blocked, for events that involve a file (for example, codes 92-94 and 124). For all other events, the properties of this object are null. |
Object |
|
|
The name of the file. |
String |
|
|
The path to the file. |
String |
|
|
The name of the application (the description property of the file). |
String |
|
|
The vendor of the application. |
String |
|
|
The version of the application. |
String |
|
|
The SHA-256 checksum of the file. |
String |
500 - Internal Server Error - Unknown ID
There is no event with the specified ID, or the event does not match the query parameters. The response contains the message "Unknown id".
Example
Get event 74956656
Request: GET https://dc1api.adminbyrequest.com/events/74956656
Response:
{
"id": 74956656,
"eventCode": 124,
"eventLevel": 0,
"eventText": "Execution of file blocked by lack of ownership",
"eventTime": "2026-10-05T04:26:30.643",
"eventTimeUTC": "2026-10-05T11:26:30",
"computerName": "WIN0815",
"userAccount": "asmith",
"userName": "Anna Smith",
"alertAccount": null,
"auditLogURL": null,
"rollback": false,
"additionalData": null,
"application": {
"file": "brave.exe",
"path": "C:\\Program Files\\BraveSoftware\\Brave-Browser\\Application",
"name": "Brave Browser",
"vendor": "Brave Software",
"version": "brave.exe",
"sha256": "3A9C04E1B7D52F86C0E4A19B7D3F25E8806C1BF4D9A27E53C6B8F01D4E92A7C5"
}
}Get computer events
Returns the events for the specified computer.
Request
GET {datacenter}/computers/{computer}/events
Headers
| Name | Description | Type |
|---|---|---|
|
apikey |
The API key for connecting to your tenant. |
String |
Query Parameters
All parameters can alternatively be passed as headers. All parameters are optional. If a parameter is passed both as a URL parameter and as a header, the URL parameter takes precedence.
| Name | Description | Type |
|---|---|---|
|
|
The ID of the first Default: The first available ID. |
Integer |
|
|
The maximum number of Default: 50 Maximum: 10000. If you need to fetch more than 10000 If the value is not a number, an empty array is returned. Warning: Do not consistently set this parameter to high numbers. If you do, you will quickly exceed your quota, and your account will be blocked for the rest of the day.
|
Integer |
|
|
Retrieve the latest Maximum: 10000 Default: All |
Integer |
|
|
Only return events with the specified event code. See Event codes. Unknown codes and values that are not a number return an empty array. Default: Events with all codes are returned. |
Integer |
|
|
The number of days for which Days are counted as calendar days, not as 24-hour periods. For example, If the value is not a number, it is treated as 0. Negative values return an empty array. Default: 30 |
Integer |
|
|
Only return events created after the specified date. The specified date itself is not included: The date filters are applied to Default: All |
Date |
|
|
Only return The date filters are applied to Default: All |
Date |
Path Parameters
| Name | Description | Type |
|---|---|---|
|
|
The name of the computer for which to retrieve events. Not case-sensitive. If there is no computer with this name, an empty array is returned. |
String |
Response
200 - OK - Success response
The operation returns an array of JSON objects. Each object corresponds to one event.
Object Properties
| Name | Description | Type |
|---|---|---|
|
|
The unique ID of the event. IDs are assigned in ascending order, so they can be used with |
Integer |
|
|
The type of the event. See Event codes. |
Integer |
|
|
The severity of the event. Possible values are:
|
Integer |
|
|
The description of the event type, as listed in Event codes. |
String |
|
|
The time of the event, in local time. Events reported by the endpoint use the local time of the computer. Events triggered from the portal, such as an issued PIN code, can use a different time zone. To compare or sort events, use |
String, dateTime |
|
|
The time of the event, in UTC. If unavailable, local time is used instead. |
String, dateTime |
|
|
The name of the computer on which the event occurred. |
String |
|
|
The account name of the user who caused the event. For events triggered from the portal, this is the account that the action applies to, for example the issued Break Glass account, or the user whose administrator rights are revoked. Can be null, for example for install events. |
String |
|
|
The full name of the user who caused the event. For events triggered from the portal, this is the name of the portal user who triggered the action. |
String |
|
|
A secondary account that is affected by the event, for example the account that was added to the local administrators group, or the local user that was created, deleted or whose password was changed. |
String |
|
|
A link to the related auditlog entry, if any. |
String |
|
|
Indicates whether or not the change was rolled back, for example if a user was added to the local administrators group and then removed again automatically. |
Boolean |
|
|
Additional information that depends on the event type, for example:
|
String |
|
|
Information about the file that was executed or blocked, for events that involve a file (for example, codes 92-94 and 124). For all other events, the properties of this object are null. |
Object |
|
|
The name of the file. |
String |
|
|
The path to the file. |
String |
|
|
The name of the application (the description property of the file). |
String |
|
|
The vendor of the application. |
String |
|
|
The version of the application. |
String |
|
|
The SHA-256 checksum of the file. |
String |
Example
Get the last two administrator logons on computer "WIN0815"
Request: GET https://dc1api.adminbyrequest.com/computers/WIN0815/events?code=5&last=2
Response:
[
{
"id": 77522568,
"eventCode": 5,
"eventLevel": 0,
"eventText": "Audited administrator logged on",
"eventTime": "2026-10-29T08:23:44.633",
"eventTimeUTC": "2026-10-29T07:23:44",
"computerName": "WIN0815",
"userAccount": "ADMINISTRATOR",
"userName": "Administrator",
"alertAccount": null,
"auditLogURL": null,
"rollback": false,
"additionalData": null,
"application": {
"file": null,
"path": null,
"name": null,
"vendor": null,
"version": null,
"sha256": null
}
},
{
"id": 77183628,
"eventCode": 5,
"eventLevel": 0,
"eventText": "Audited administrator logged on",
"eventTime": "2026-10-26T10:14:20.213",
"eventTimeUTC": "2026-10-26T09:14:20",
"computerName": "WIN0815",
"userAccount": "ADMINISTRATOR",
"userName": "Administrator",
"alertAccount": null,
"auditLogURL": null,
"rollback": false,
"additionalData": null,
"application": {
"file": null,
"path": null,
"name": null,
"vendor": null,
"version": null,
"sha256": null
}
}
]Get user events
Returns the events for the specified user.
userAccount and userName fields of the event. For events triggered from the portal, userName is the portal user who triggered the action. The result can therefore contain events that this user triggered for other accounts, for example issued Break Glass accounts.Request
GET {datacenter}/users/{user}/events
Headers
| Name | Description | Type |
|---|---|---|
|
apikey |
The API key for connecting to your tenant. |
String |
Query Parameters
All parameters can alternatively be passed as headers. All parameters are optional. If a parameter is passed both as a URL parameter and as a header, the URL parameter takes precedence.
| Name | Description | Type |
|---|---|---|
|
|
The ID of the first Default: The first available ID. |
Integer |
|
|
The maximum number of Default: 50 Maximum: 10000. If you need to fetch more than 10000 If the value is not a number, an empty array is returned. Warning: Do not consistently set this parameter to high numbers. If you do, you will quickly exceed your quota, and your account will be blocked for the rest of the day.
|
Integer |
|
|
Retrieve the latest Maximum: 10000 Default: All |
Integer |
|
|
Only return events with the specified event code. See Event codes. Unknown codes and values that are not a number return an empty array. Default: Events with all codes are returned. |
Integer |
|
|
The number of days for which Days are counted as calendar days, not as 24-hour periods. For example, If the value is not a number, it is treated as 0. Negative values return an empty array. Default: 30 |
Integer |
|
|
Only return events created after the specified date. The specified date itself is not included: The date filters are applied to Default: All |
Date |
|
|
Only return The date filters are applied to Default: All |
Date |
Path Parameters
| Name | Description | Type |
|---|---|---|
|
|
The account name or full name of the user for which to retrieve events. Not case-sensitive. If no events match, an empty array is returned. |
String |
Response
200 - OK - Success response
The operation returns an array of JSON objects. Each object corresponds to one event.
Object Properties
| Name | Description | Type |
|---|---|---|
|
|
The unique ID of the event. IDs are assigned in ascending order, so they can be used with |
Integer |
|
|
The type of the event. See Event codes. |
Integer |
|
|
The severity of the event. Possible values are:
|
Integer |
|
|
The description of the event type, as listed in Event codes. |
String |
|
|
The time of the event, in local time. Events reported by the endpoint use the local time of the computer. Events triggered from the portal, such as an issued PIN code, can use a different time zone. To compare or sort events, use |
String, dateTime |
|
|
The time of the event, in UTC. If unavailable, local time is used instead. |
String, dateTime |
|
|
The name of the computer on which the event occurred. |
String |
|
|
The account name of the user who caused the event. For events triggered from the portal, this is the account that the action applies to, for example the issued Break Glass account, or the user whose administrator rights are revoked. Can be null, for example for install events. |
String |
|
|
The full name of the user who caused the event. For events triggered from the portal, this is the name of the portal user who triggered the action. |
String |
|
|
A secondary account that is affected by the event, for example the account that was added to the local administrators group, or the local user that was created, deleted or whose password was changed. |
String |
|
|
A link to the related auditlog entry, if any. |
String |
|
|
Indicates whether or not the change was rolled back, for example if a user was added to the local administrators group and then removed again automatically. |
Boolean |
|
|
Additional information that depends on the event type, for example:
|
String |
|
|
Information about the file that was executed or blocked, for events that involve a file (for example, codes 92-94 and 124). For all other events, the properties of this object are null. |
Object |
|
|
The name of the file. |
String |
|
|
The path to the file. |
String |
|
|
The name of the application (the description property of the file). |
String |
|
|
The vendor of the application. |
String |
|
|
The version of the application. |
String |
|
|
The SHA-256 checksum of the file. |
String |
Example
Get Admin Session attempts by user "jdoe" during a remote kill blackout (event code 222)
Request: GET https://dc1api.adminbyrequest.com/users/jdoe/events?code=222
Response:
[
{
"id": 75056436,
"eventCode": 222,
"eventLevel": 2,
"eventText": "Admin Session attempted in blackout period",
"eventTime": "2026-10-06T02:07:42.517",
"eventTimeUTC": "2026-10-06T09:07:42",
"computerName": "WIN0815",
"userAccount": "jdoe",
"userName": "John Doe",
"alertAccount": null,
"auditLogURL": null,
"rollback": false,
"additionalData": null,
"application": {
"file": null,
"path": null,
"name": null,
"vendor": null,
"version": null,
"sha256": null
}
}
]Event codes
The following table lists the event codes. Use the code in the eventCode field to identify the type of an event, or pass it as the code query parameter to filter events.
| Code | Description |
|---|---|
|
1 |
User added to local admins group |
|
2 |
User downgraded from administrator to user |
|
3 |
Group removed from local administrators group |
|
5 |
Audited administrator logged on |
|
6 |
Unaudited administrator logged on |
|
8 |
Support assist initiated |
|
10 |
Password changed for local user |
|
11 |
Local user disabled |
|
12 |
Local user enabled |
|
13 |
Local user created |
|
14 |
Local user deleted |
|
20 |
Policy registry key changed |
|
21 |
Policy registry key added |
|
30 |
Uninstall attempted |
|
31 |
Uninstalled by PIN code |
|
32 |
PIN code uninstall attempted unsuccessfully |
|
40 |
Admin By Request Workstation installed |
|
41 |
Admin By Request Workstation uninstalled |
|
42 |
Admin By Request Server installed |
|
43 |
Admin By Request Server uninstalled |
|
50 |
Diagnostics submitted |
|
60 |
User restored to local administrators group |
|
61 |
Group restored to local administrators group |
|
70 |
Break Glass Account created |
|
71 |
Break Glass Account removed |
|
72 |
Break Glass Account logged on |
|
73 |
Clock tampering using Break Glass account |
|
80 |
Azure Device Administrator restored |
|
81 |
Azure Company Administrator restored |
|
90 |
Admin Session denied by policy |
|
91 |
Clock tampering during Admin Session |
|
92 |
Execution of file blocked by policy |
|
93 |
Execution of file blocked due to detected malware |
|
94 |
Execution of file blocked due to suspected malware |
|
95 |
Admin Session PIN code used |
|
97 |
Application block PIN code used |
|
98 |
Elevated application block PIN code used |
|
100 |
Application block PIN 2 issued |
|
101 |
Uninstall PIN issued |
|
102 |
Break Glass Account issued |
|
103 |
Admin Session PIN 2 issued |
|
110 |
Local administrator account revoke issued |
|
111 |
Local administrator group revoke issued |
|
112 |
Local administrator account revoke cancelled |
|
113 |
Local administrator group revoke cancelled |
|
114 |
Local administrator account restore issued |
|
115 |
Local administrator group restore issued |
|
116 |
Local administrator account restore cancelled |
|
117 |
Local administrator group restore cancelled |
|
120 |
Device owner set |
|
121 |
Device ownership released |
|
122 |
Device owner set by administrator |
|
123 |
Admin Session denied by lack of ownership |
|
124 |
Execution of file blocked by lack of ownership |
|
130 |
Admin Session denied by lack of Intune compliance |
|
131 |
Execution of file blocked by lack of Intune compliance |
|
140 |
Remote desktop account revoke issued |
|
141 |
Remote desktop group revoke issued |
|
142 |
Remote desktop account revoke cancelled |
|
143 |
Remote desktop group revoke cancelled |
|
144 |
Remote desktop account restore issued |
|
145 |
Remote desktop group restore issued |
|
146 |
Remote desktop account restore cancelled |
|
147 |
Remote desktop group restore cancelled |
|
150 |
User removed from remote desktop users |
|
151 |
Group removed from remote desktop users |
|
152 |
User restored to remote desktop users |
|
153 |
Group restored to remote desktop users |
|
160 |
Local administrator account addition issued |
|
161 |
Local administrator group addition issued |
|
162 |
Local administrator account addition cancelled |
|
163 |
Local administrator group addition cancelled |
|
170 |
Remote desktop account addition issued |
|
171 |
Remote desktop group addition issued |
|
172 |
Remote desktop account addition cancelled |
|
173 |
Remote desktop group addition cancelled |
|
180 |
Rotating admin account created |
|
181 |
Rotating admin account removed |
|
182 |
Rotating admin account logged on |
|
220 |
Remote kill issued |
|
222 |
Admin Session attempted in blackout period |
|
223 |
Remote kill executed |