/v2/activity-log

https://us-east1-org01.analytics.controld.com

GET

/v2/activity-log

Returns up to 33 days of historical query data, descending by default.

Organizations should consider using SIEM Streaming as an alternative to the activity log
if data durability is a concern.

Request

Authorization

API Key

Add parameter in header

Authorization

Example:

Authorization: ********************

Query Params

Responses

🟢200

application/json

Note page indexing starts at 0.

Bodyapplication/json

🟠400BadRequest

🟠401Unauthorized

🔴500InternalServerError

Request Example

Shell

JavaScript

Java

Swift

curl --location --globoff 'https://us-east1-org01.analytics.controld.com/v2/activity-log?startTime={{%24date.now%7CaddHours(-1)}}&endTime=undefined&endpointId[]=undefined&clientId[]=undefined&action[]=undefined&trigger[]=undefined&triggerValue[]=undefined&spoofTarget[]=undefined&question[]=undefined&profileId[]=undefined&searchQuestion=undefined&searchQuestionMode=undefined&protocol[]=undefined&statusCode[]=undefined&rrType[]=undefined&srcCountry[]=undefined&dstCountry[]=undefined&dstAsn[]=undefined&srcAsn[]=undefined&dstIsp[]=undefined&srcIsp[]=undefined&page=undefined&pageSize=undefined&sortOrder=undefined' \
--header 'Authorization: <api-key>'

Response Example

200 - Example 1

{
    "success": true,
    "body": {
        "meta": {
            "page": 3,
            "pageSize": 100
        },
        "queries": [
            {
                "timestamp": "2025-02-07T13:20:47.214Z",
                "organizationId": "abc123",
                "userId": "abc123",
                "endpointId": "def",
                "endpointName": "hjk",
                "clientId": "ghi",
                "profileId": "jkl",
                "question": "movies.netflix.com",
                "domainCategory": "Business",
                "rrType": "CNAME",
                "sourceIp": "10.10.10.11",
                "statusCode": 0,
                "protocol": "doh",
                "answers": [
                    {
                        "ips": [
                            "12.34.56.78"
                        ],
                        "geoip": {
                            "countryCode": "CA",
                            "city": "Toronto",
                            "isp": "AT&T Internet",
                            "asn": 7018
                        }
                    }
                ],
                "action": 3,
                "trigger": "default",
                "triggerValue": "netflix",
                "spoofTarget": "YYZ",
                "sourceGeoip": {
                    "countryCode": "CA",
                    "city": "Toronto",
                    "isp": "AT&T Internet",
                    "asn": 7018
                }
            }
        ]
    }
}

Modified at 2026-03-31 19:19:32

/v2/auth/token

/v2/activity-log