Skip to main content
GET
List Events

Query Parameters

limit
integer
default:50
Required range: 1 <= x <= 500
offset
integer
default:0
Required range: 0 <= x <= 1000000
verdict
string | null
Pattern: ^(allow|flag|redact|block)$
direction
string | null
Pattern: ^(input|output|tool_call)$
app
string[]

App UUID(s) to filter by

device
string[]

Device UUID(s) to filter by

user
string | null

Filter to events from devices belonging to this user, matches the bound directory email, or the OS account / hostname for devices that haven't completed SSO binding (the same labels the DLP Users tab shows).

Maximum string length: 255
provider
string | null
Maximum string length: 64
source_app
string | null
Maximum string length: 128
q
string | null

Case-insensitive substring match across event id, direction, verdict, injection label, source app, provider, model, blocked reason, and PII categories. Applied before pagination, so total reflects the filtered count.

Maximum string length: 200
device_only
boolean
default:false

Only events from enrolled DLP desktop agents (device_id set)

include_facets
boolean
default:false

Include distinct source_app / provider values for the current scope (workspace + device_only) so clients can build filter dropdowns without paging through events.

Response

Successful Response