Get
Returns an activity by its global id. Requires the https://devx.{environment}.oleria.io/read scope.
Authorizations
OAuth 2.0 client-credentials flow. Request an access token from the token endpoint and send it as Authorization: Bearer <token>.
Path Parameters
Global id of the activity.
Response
The activity.
An Oleria Activity represents the action's taken by an [Oleria Account](#/components/schemas/Oleria Account) and notifications from a system or application as typically retrieved and processed from IDP, SaaS application, directory service, or other audit logs
If this is true, then the activatedPermissionSets are correct even if len(activatedPermissionSets) is zero. Otherwise, the activated permissions should be treated as unknown
An Oleria schematization of activity types to enable type specific system processing. The following table details the type-specific data associated with these schematized activities as well as the affected object. Note: for enterprise applications and directories, xxxApplication == IntegratedApplication; for identity providers a) xxxApplication == AssignedApplication for SSO login activity, b) xxxApplication == IntegratedApplication for any other activities including local login and logout
AccessTo.Deleted, Account.AccountRoleChanged, Account.Disabled, Account.Enabled, Account.Impersonated, Authentication.Methods.Added, Authentication.Methods.Authorized, Authentication.Methods.Removed, Authentication.Methods.ResetAllowed, Authentication.Methods.ResetDisallowed, Authentication.Methods.Revoked, Authentication.Methods.Updated, Authentication.Policy.General.Added, Authentication.Policy.General.Removed, Authentication.Policy.General.Updated, Authentication.Policy.Method.NotRequired, Authentication.Policy.Method.Required, Authentication.Policy.MFA.Adaptive, Authentication.Policy.MFA.NotRequired, Authentication.Policy.MFA.Required, Authentication.Policy.Password.Added, Authentication.Policy.Password.Removed, Authentication.Policy.Password.Updated, Authentication.Policy.SSO.NotRequired, Authentication.Policy.SSO.Required, Authentication.Policy.SSO.Updated, Authentication.Secret.Added, Authentication.Secret.Removed, Authentication.Secret.Rotated, Authentication.Secret.Updated, Authorization.Access.Authorized, Authorization.Access.Denied, Authorization.Access.Granted, Authorization.Access.Requested, Authorization.Access.Revoked, Authorization.Access.Updated, Authorization.Requirements.Created, Authorization.Requirements.Deleted, Authorization.Requirements.Updated, Authorization.UnmanagedApplication.Granted, Authorization.UnmanagedApplication.Revoked, Container.Content.Activity, Content.Download.Failed, Content.Download.Success, Content.Upload.Failed, Content.Upload.Success, Endpoint.Access.AccountToService.Failed, Endpoint.Access.AccountToService.Success, Endpoint.Access.AccountToUnmanagedApplication.Failed, Endpoint.Access.AccountToUnmanagedApplication.Success, Endpoint.Access.ServiceToService.Failed, Endpoint.Access.ServiceToService.Success, Label.Added, Label.Created, Label.Destroyed, Label.Updated, Label.Removed, License.Added, License.Assigned, License.Removed, License.Unassigned, License.Updated, Login.Failed, Login.Remote.Failed, Login.Remote.Success, Login.Success, Logout, Logout.Remote, Object.Created, Object.Deleted, Object.Updated, Ownership.Added, Ownership.Removed, Ownership.Transferred, Password.ChangedByUser, Password.ChangedForUser, Password.ResetByUser, Password.ResetForUser, Relationship.Created, Relationship.Deleted, Relationship.Updated, Secret.Added, Secret.Deleted, Secret.Revocation.Failed, Secret.Revocation.Success, Secret.Updated, Secret.Verification.Failed, Secret.Verification.Success, Security.Notification, Settings.Updated, Suspicious.Login.Failed, Suspicious.Login.Success, Token.Revocation.Failed, Token.Revocation.Requested, Token.Revocation.Success, App.Custom "Login.Success"
An identifier (unique to integrated application) for an Account object represented in the Oleria system. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. It is important for this identifier to be based on an underlying persistent and reusable application or identity provider id so connections to the object are robust to metadata changes and other relevant operations
"user:U_kgDOB7P6Rg (GitHub based on node identifier), 838439349399 (Google Workspace based on user id), user:wiz-inc-4db1c46901 (GitHub based on app slug)"
An identifier (unique to the integrated or assigned application) of any object or entity represented in the Oleria system as well as any relationship or connection among entities when they are represented in Oleria. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. The full list of Oleria objects or entities is defined by the object-type enumeration, and the full list of relationships or connections is defined by the relationship-type enumeration
1The enumerated list of all Oleria objects used to describe and manage any customer application's identity security. The definition of each object describes its usage
Account, AccountRole, Activity, AssignedApplication, Authenticator, AuthenticatorEnrollment, Department, DirectoryProvider, Employee, IntegratedApplication, None, ObjectDirectory, PermissionSet, Person, ResourceClass, ResourceInstance, RiskDefinition, RiskViolation, Role, UserGroup "Account"
The application-specific activity type that is sometimes schematized to an Oleria activity type as defined by ActivityType. If there is a schematized corresponding activity type, then applicationActivityType gives additional application-specific information about the activity e.g. Login.Success == org.sso_response for GitHub in the SSO login scenario. If there is not a relevant schematized type then activityType is ApplicationSpecific and the applicationActivityType is used to communicate the full information about the type of activity e.g. workflows.completed_workflow_run (GitHub), drive.access (Google Workspace)
"org.sso_response (GitHub), workflows.completed_workflow_run (GitHub), drive.access (Google Workspace)"
For any activity type indicating failure e.g. login.failed, a reason code can be emitted with the activity
404
An identifier (unique to the integrated or assigned application) of any object or entity represented in the Oleria system as well as any relationship or connection among entities when they are represented in Oleria. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. The full list of Oleria objects or entities is defined by the object-type enumeration, and the full list of relationships or connections is defined by the relationship-type enumeration
1The ObjectMetadata structure defines metadata that applies to every object and relationship, and is usually managed by the system that receives the data
The timestamp of the activity
"2024-05-02T03:17:34.948Z"
object metadata supersets object metadata with platform enrichment provenance — the enrichment version and the time the record was generated
An array of permission specifications (one per resource class) associated with this activity
The description of the activity that was logged
"CI"
An array of additional metadata values associated with the activity including cached activity data about the affected object using a namespace string equal to the affectedObjectType
Federation information used when specifying an EntityIdentifier
An authentication method specific context that may be used by the platform to connect authentication activity and sessions across ApplicationInstances. For example, an enterprise application that has SSO to an identity provider could emit an event with an authentication method of SSO and an authentication context with the base64 encoded SHA256 hash of the authentication token. The corresponding IDP would emit an authentication activity with a method of Passkey and the same authentication token. This enables enrichment of application activities with the SSO authentication method. When the authentication context is empty (because the application could not provide the hash of the token), the Oleria platform will use other heuristics to try to connect the application activity with IDP authentication
"fBDpDdUUN1z0jMIUg1saZQmaA9Dx3B+0IPdcHG0fN4c="
Authentication methods associated with this activity and actor
Scope specification optionally specified in a PermissionSetSpecification
The ImpersonatorReferenceInformation describes the impersonating account for an activity that is based on the impersonation auth method
Federation information used when specifying an EntityIdentifier
Historical actorAuthenticationContext entries that can be associated with this Activity
The name of the browser used for a web-based activity if applicable and available
"Chrome"
The version of the browser used for a web-based activity if applicable and available
"126"
HTTP, IntegratedApplication Error description string
"The requested resource was not found"
"192.39.212.89"
Federation information used when specifying an EntityIdentifier
An identifier (unique to the integrated application) for a ObjectDirectory object represented in the Oleria system. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. It is important for this identifier to be based on an underlying persistent and reusable application or identity provider id so connections to the object are robust to metadata changes and other relevant operations
"repo:R_kgDOLL0doQ (GitHub based on repository node identifier), 1BUxdX4M-H7X8GKRgTjprJS8fjY_Ij1giE82lQlny2kc (Google Drive based on file id)"
Activity specific data for AccessTo.Deleted
- Option 1
- Option 2
- Option 3
- Option 4
- Option 5
- Option 6
- Option 7
The name of the operating system being used by the source of the activity if available
"OSX"
The version of the operating system being used by the source of the activity if available
"10.15.7"
The URI of the entity being used by the source of a web-based activity if applicable and available
"/lightning/r/Opportunity/006Dn000007rkDYIAY/view"
Federation information used when specifying an EntityIdentifier
An identifier (unique to integrated application) for an Account object represented in the Oleria system. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. It is important for this identifier to be based on an underlying persistent and reusable application or identity provider id so connections to the object are robust to metadata changes and other relevant operations
"user:U_kgDOB7P6Rg (GitHub based on node identifier), 838439349399 (Google Workspace based on user id), user:wiz-inc-4db1c46901 (GitHub based on app slug)"
The ImpersonatorReferenceInformation describes the impersonating account for an activity that is based on the impersonation auth method
Compact integer-bitmask encoding of the permissions this activity activated, derived by mapping the activated permission specifications (Activity.activatedPermissionSets - coarse create/read/update/delete/execute/share/privileged access plus any application-specific fine-grained specifiers) through the application's permission catalog. Enables efficient permission filtering without traversing the nested globalActivatedPermissionSets structure.
The following sub-types of account are supported:
- Application is used to represent accounts used to represent an "installed" application or custom created service principal for application or federated use. When the sub-type is Application, the source application should also emit ApprovedApplicationUsage for the account
- AnonymousUser is used to represent anonymous accounts typically in the context of sharing resources
- ExternalUser is used to represent accounts that are outside of the application-defined customer organizational unit, and is typically used in the context of sharing resources]
- StandardUser accounts are any user accounts not classified as AnonymousUser or ExternalUser and is typically the majority of accounts managed by an enterprise application
- System is used to represent system bots and pre-defined or configurable system service principals e.g. the merge queue bot in GitHub
- Unavailable should be indicated when the sub-type of the account cannot be definitively determined as AnonymousUser, ExternalUser, StandardUser, Application, or System based on the absence of endpoint functionality or lack of access
Application, AnonymousUser, ExternalUser, StandardUser, System, Unavailable "Standard"
- Machine accounts are used to represent system-defined accounts and service principals registered with the enterprise application that can take some sort of audited action
- Token accounts are used to represent tokens used to impersonate accounts with some restricted scope e.g. personal access tokens
- User accounts are used to represent human users of the application
Machine, Token, User "User"

