Skip to main content
GET
Get

Authorizations

Authorization
string
header
required

OAuth 2.0 client-credentials flow. Request an access token from the token endpoint and send it as Authorization: Bearer <token>.

Path Parameters

id
string
required

Global id of the activity.

Response

The activity.

An Oleria Activity represents the action's taken by an [Oleria Account](#/components/schemas/Oleria Account) and notifications from a system or application as typically retrieved and processed from IDP, SaaS application, directory service, or other audit logs

activatedPermissionsAvailable
boolean
required

If this is true, then the activatedPermissionSets are correct even if len(activatedPermissionSets) is zero. Otherwise, the activated permissions should be treated as unknown

activityType
enum<string>
required

An Oleria schematization of activity types to enable type specific system processing. The following table details the type-specific data associated with these schematized activities as well as the affected object. Note: for enterprise applications and directories, xxxApplication == IntegratedApplication; for identity providers a) xxxApplication == AssignedApplication for SSO login activity, b) xxxApplication == IntegratedApplication for any other activities including local login and logout

Available options:
AccessTo.Deleted,
Account.AccountRoleChanged,
Account.Disabled,
Account.Enabled,
Account.Impersonated,
Authentication.Methods.Added,
Authentication.Methods.Authorized,
Authentication.Methods.Removed,
Authentication.Methods.ResetAllowed,
Authentication.Methods.ResetDisallowed,
Authentication.Methods.Revoked,
Authentication.Methods.Updated,
Authentication.Policy.General.Added,
Authentication.Policy.General.Removed,
Authentication.Policy.General.Updated,
Authentication.Policy.Method.NotRequired,
Authentication.Policy.Method.Required,
Authentication.Policy.MFA.Adaptive,
Authentication.Policy.MFA.NotRequired,
Authentication.Policy.MFA.Required,
Authentication.Policy.Password.Added,
Authentication.Policy.Password.Removed,
Authentication.Policy.Password.Updated,
Authentication.Policy.SSO.NotRequired,
Authentication.Policy.SSO.Required,
Authentication.Policy.SSO.Updated,
Authentication.Secret.Added,
Authentication.Secret.Removed,
Authentication.Secret.Rotated,
Authentication.Secret.Updated,
Authorization.Access.Authorized,
Authorization.Access.Denied,
Authorization.Access.Granted,
Authorization.Access.Requested,
Authorization.Access.Revoked,
Authorization.Access.Updated,
Authorization.Requirements.Created,
Authorization.Requirements.Deleted,
Authorization.Requirements.Updated,
Authorization.UnmanagedApplication.Granted,
Authorization.UnmanagedApplication.Revoked,
Container.Content.Activity,
Content.Download.Failed,
Content.Download.Success,
Content.Upload.Failed,
Content.Upload.Success,
Endpoint.Access.AccountToService.Failed,
Endpoint.Access.AccountToService.Success,
Endpoint.Access.AccountToUnmanagedApplication.Failed,
Endpoint.Access.AccountToUnmanagedApplication.Success,
Endpoint.Access.ServiceToService.Failed,
Endpoint.Access.ServiceToService.Success,
Label.Added,
Label.Created,
Label.Destroyed,
Label.Updated,
Label.Removed,
License.Added,
License.Assigned,
License.Removed,
License.Unassigned,
License.Updated,
Login.Failed,
Login.Remote.Failed,
Login.Remote.Success,
Login.Success,
Logout,
Logout.Remote,
Object.Created,
Object.Deleted,
Object.Updated,
Ownership.Added,
Ownership.Removed,
Ownership.Transferred,
Password.ChangedByUser,
Password.ChangedForUser,
Password.ResetByUser,
Password.ResetForUser,
Relationship.Created,
Relationship.Deleted,
Relationship.Updated,
Secret.Added,
Secret.Deleted,
Secret.Revocation.Failed,
Secret.Revocation.Success,
Secret.Updated,
Secret.Verification.Failed,
Secret.Verification.Success,
Security.Notification,
Settings.Updated,
Suspicious.Login.Failed,
Suspicious.Login.Success,
Token.Revocation.Failed,
Token.Revocation.Requested,
Token.Revocation.Success,
App.Custom
Example:

"Login.Success"

actorAccountId
string
required

An identifier (unique to integrated application) for an Account object represented in the Oleria system. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. It is important for this identifier to be based on an underlying persistent and reusable application or identity provider id so connections to the object are robust to metadata changes and other relevant operations

Example:

"user:U_kgDOB7P6Rg (GitHub based on node identifier), 838439349399 (Google Workspace based on user id), user:wiz-inc-4db1c46901 (GitHub based on app slug)"

affectedObjectId
string
required

An identifier (unique to the integrated or assigned application) of any object or entity represented in the Oleria system as well as any relationship or connection among entities when they are represented in Oleria. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. The full list of Oleria objects or entities is defined by the object-type enumeration, and the full list of relationships or connections is defined by the relationship-type enumeration

Minimum string length: 1
affectedObjectType
enum<string>
required

The enumerated list of all Oleria objects used to describe and manage any customer application's identity security. The definition of each object describes its usage

Available options:
Account,
AccountRole,
Activity,
AssignedApplication,
Authenticator,
AuthenticatorEnrollment,
Department,
DirectoryProvider,
Employee,
IntegratedApplication,
None,
ObjectDirectory,
PermissionSet,
Person,
ResourceClass,
ResourceInstance,
RiskDefinition,
RiskViolation,
Role,
UserGroup
Example:

"Account"

applicationActivityType
string
required

The application-specific activity type that is sometimes schematized to an Oleria activity type as defined by ActivityType. If there is a schematized corresponding activity type, then applicationActivityType gives additional application-specific information about the activity e.g. Login.Success == org.sso_response for GitHub in the SSO login scenario. If there is not a relevant schematized type then activityType is ApplicationSpecific and the applicationActivityType is used to communicate the full information about the type of activity e.g. workflows.completed_workflow_run (GitHub), drive.access (Google Workspace)

Example:

"org.sso_response (GitHub), workflows.completed_workflow_run (GitHub), drive.access (Google Workspace)"

errorCode
integer
required

For any activity type indicating failure e.g. login.failed, a reason code can be emitted with the activity

Example:

404

id
string
required

An identifier (unique to the integrated or assigned application) of any object or entity represented in the Oleria system as well as any relationship or connection among entities when they are represented in Oleria. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. The full list of Oleria objects or entities is defined by the object-type enumeration, and the full list of relationships or connections is defined by the relationship-type enumeration

Minimum string length: 1
objectMetadata
object
required

The ObjectMetadata structure defines metadata that applies to every object and relationship, and is usually managed by the system that receives the data

timestamp
string<date-time>
required

The timestamp of the activity

Example:

"2024-05-02T03:17:34.948Z"

globalActorAccountId
string
required
globalAffectedObjectId
string
required
globalId
string
required
oleriaObjectMetadata
object
required

object metadata supersets object metadata with platform enrichment provenance — the enrichment version and the time the record was generated

activatedPermissionSets
object[]

An array of permission specifications (one per resource class) associated with this activity

activity
string

The description of the activity that was logged

Example:

"CI"

activityMetadata
object[]

An array of additional metadata values associated with the activity including cached activity data about the affected object using a namespace string equal to the affectedObjectType

actorAccountFederation
object

Federation information used when specifying an EntityIdentifier

actorAuthenticationContext
string

An authentication method specific context that may be used by the platform to connect authentication activity and sessions across ApplicationInstances. For example, an enterprise application that has SSO to an identity provider could emit an event with an authentication method of SSO and an authentication context with the base64 encoded SHA256 hash of the authentication token. The corresponding IDP would emit an authentication activity with a method of Passkey and the same authentication token. This enables enrichment of application activities with the SSO authentication method. When the authentication context is empty (because the application could not provide the hash of the token), the Oleria platform will use other heuristics to try to connect the application activity with IDP authentication

Example:

"fBDpDdUUN1z0jMIUg1saZQmaA9Dx3B+0IPdcHG0fN4c="

actorAuthenticationMethods
object[]

Authentication methods associated with this activity and actor

Example:
actorAuthenticationScopes
object

Scope specification optionally specified in a PermissionSetSpecification

actorImpersonatorReference
object

The ImpersonatorReferenceInformation describes the impersonating account for an activity that is based on the impersonation auth method

actorLocation
object
affectedObjectFederation
object

Federation information used when specifying an EntityIdentifier

authenticationContextHistory
string[]

Historical actorAuthenticationContext entries that can be associated with this Activity

browserName
string

The name of the browser used for a web-based activity if applicable and available

Example:

"Chrome"

browserVersion
string

The version of the browser used for a web-based activity if applicable and available

Example:

"126"

errorCodeType
enum<string>
Available options:
HTTP,
IntegratedApplication
errorDescription
string

Error description string

Example:

"The requested resource was not found"

ipAddress
string<ip>
Example:

"192.39.212.89"

objectDirectoryContainerFederation
object

Federation information used when specifying an EntityIdentifier

objectDirectoryContainerId
string

An identifier (unique to the integrated application) for a ObjectDirectory object represented in the Oleria system. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. It is important for this identifier to be based on an underlying persistent and reusable application or identity provider id so connections to the object are robust to metadata changes and other relevant operations

Example:

"repo:R_kgDOLL0doQ (GitHub based on repository node identifier), 1BUxdX4M-H7X8GKRgTjprJS8fjY_Ij1giE82lQlny2kc (Google Drive based on file id)"

oleriaActivityTypeSpecificData
object

Activity specific data for AccessTo.Deleted

osName
string

The name of the operating system being used by the source of the activity if available

Example:

"OSX"

osVersion
string

The version of the operating system being used by the source of the activity if available

Example:

"10.15.7"

pageUri
string<uri>

The URI of the entity being used by the source of a web-based activity if applicable and available

Example:

"/lightning/r/Opportunity/006Dn000007rkDYIAY/view"

requestorAccountFederation
object

Federation information used when specifying an EntityIdentifier

requestorAccountId
string

An identifier (unique to integrated application) for an Account object represented in the Oleria system. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. It is important for this identifier to be based on an underlying persistent and reusable application or identity provider id so connections to the object are robust to metadata changes and other relevant operations

Example:

"user:U_kgDOB7P6Rg (GitHub based on node identifier), 838439349399 (Google Workspace based on user id), user:wiz-inc-4db1c46901 (GitHub based on app slug)"

secondaryAffectedObjects
object[]
globalActivatedPermissionSets
object[]
globalActorImpersonatorReference
object

The ImpersonatorReferenceInformation describes the impersonating account for an activity that is based on the impersonation auth method

globalObjectDirectoryContainerId
string
globalRequestorAccountId
string
globalSecondaryAffectedObjects
string[]
enrichedActivatedPermissionFlags
integer<int64>[] | null

Compact integer-bitmask encoding of the permissions this activity activated, derived by mapping the activated permission specifications (Activity.activatedPermissionSets - coarse create/read/update/delete/execute/share/privileged access plus any application-specific fine-grained specifiers) through the application's permission catalog. Enables efficient permission filtering without traversing the nested globalActivatedPermissionSets structure.

enrichedUserAgent
string
analyticsActorAccountAlias
string
analyticsActorAccountName
string
analyticsActorAccountSubType
enum<string>

The following sub-types of account are supported:

  1. Application is used to represent accounts used to represent an "installed" application or custom created service principal for application or federated use. When the sub-type is Application, the source application should also emit ApprovedApplicationUsage for the account
  2. AnonymousUser is used to represent anonymous accounts typically in the context of sharing resources
  3. ExternalUser is used to represent accounts that are outside of the application-defined customer organizational unit, and is typically used in the context of sharing resources]
  4. StandardUser accounts are any user accounts not classified as AnonymousUser or ExternalUser and is typically the majority of accounts managed by an enterprise application
  5. System is used to represent system bots and pre-defined or configurable system service principals e.g. the merge queue bot in GitHub
  6. Unavailable should be indicated when the sub-type of the account cannot be definitively determined as AnonymousUser, ExternalUser, StandardUser, Application, or System based on the absence of endpoint functionality or lack of access
Available options:
Application,
AnonymousUser,
ExternalUser,
StandardUser,
System,
Unavailable
Example:

"Standard"

analyticsActorAccountType
enum<string>
  1. Machine accounts are used to represent system-defined accounts and service principals registered with the enterprise application that can take some sort of audited action
  2. Token accounts are used to represent tokens used to impersonate accounts with some restricted scope e.g. personal access tokens
  3. User accounts are used to represent human users of the application
Available options:
Machine,
Token,
User
Example:

"User"

analyticsActorEmployeeType
string
analyticsAffectedObjectName
string
analyticsSecondaryAffectedObjectNames
string[]