> ## Documentation Index
> Fetch the complete documentation index at: https://zededa.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Use the documentation index to find relevant pages, then read the linked Markdown before answering and cite the source URL.
> Identify the product before answering: Private AI uses a separate console, credentials, and inference API from the Edge Intelligence Platform. Do not apply instructions from one product to the other.
> Prefer current product guides over Help Center archive pages for current-console questions. Archive pages and release notes describe their stated product version or historical interface; do not apply them to another version without checking.
> Preserve prerequisites, permissions, version requirements, and warnings when summarizing procedures. Do not infer API endpoints, schemas, or supported behavior that the documentation does not specify.

# User Events API

> Query user lifecycle events — sign-ins, account changes, role assignments, and 2FA actions — using the Edge Infrastructure Services Events API.

## Introduction

User events are recorded whenever a user account is created, modified, authenticated, or deleted, and whenever a user performs a configuration action in Edge Infrastructure Services. You can query these events programmatically using the Events API to build audit logs, compliance reports, or automated monitoring workflows.

### Prerequisites

* A valid API token. See [How to Use the ZEDEDA API](https://zededa.mintlify.site/api-reference/how-to-use-zededa-api.md).
* Your user account has the SysAdmin or SysManager role, or read permissions on the event resource.

## API Endpoint

**List events:**

```text theme={"dark"}
GET /api/v1/events
```

To scope events to a specific user, include the `objtype` and `objname` query parameters:

```text theme={"dark"}
GET /api/v1/events?objtype=user&objname=user@example.com&startTime.seconds=1730279711&endTime.seconds=1730322911&next.pageSize=20&next.pageNum=1
```

## Query Parameters

| Parameter | Description |
| - | - |
| `startTime.seconds` | Start of the time range as a Unix timestamp (seconds). |
| `endTime.seconds` | End of the time range as a Unix timestamp (seconds). |
| `objtype` | Filter by object type. Use `user` to scope to user events. |
| `objname` | Filter by the object's name or identifier, for example a username or email address. |
| `severity` | Filter by severity: `INFO`, `WARNING`, `ERROR`, or `CRITICAL`. |
| `source` | Filter by event source. Use `EVENT_SOURCE_USER` for user-initiated events or `EVENT_SOURCE_SYSTEM` for system-generated events. |
| `next.pageSize` | Number of results per page (default `100`). |
| `next.pageNum` | Page number to retrieve (default `1`). |

## Response Structure

A successful response returns an event list object:

```text theme={"dark"}
{
  "list": [ ... ],
  "next": {
    "pageNum": 1,
    "pageSize": 20,
    "totalPages": 5,
    "pageToken": "..."
  },
  "summary": {
    "total": 97
  }
}
```

Each event in `list` contains:

| Field | Description |
| - | - |
| `description` | Human-readable description of the event, for example `"User user@example.com is Updated"`. |
| `severity` | Event severity: `Info`, `Notice`, `Warning`, or `Critical`. |
| `source` | Event source: `EVENT_SOURCE_USER` (user action) or `EVENT_SOURCE_SYSTEM` (automated platform change). |
| `resource` | The resource type affected, for example `"User"`. |
| `timestamp` | ISO 8601 timestamp of when the event occurred. |
| `user` | The username or email address of the user who triggered the event. |
| `project` | The project context, if applicable. |
| `tags` | Key-value metadata tags associated with the event. |
| `jsonData` | Additional structured data, if available, serialized as a JSON string. |

## Event Types and Descriptions

The following table shows the event descriptions generated for common user lifecycle actions:

| Action | Example description |
| - | - |
| Account created | User account created via the console or API. |
| Account updated | `"User user@example.com is Updated"` |
| Account deleted | `"User user@example.com is Deleted"` |
| Sign-in | `"User 'user@example.com' Logged in after successful password verification"` |
| Password reset (success) | `"SysAdmin@example.com reset user user@example.com password"` |
| Password reset (failure) | `"Password reset failed: new password cannot be one of the recently used passwords"` |
| 2FA enabled | `"Tenant User 'user@example.com' Totp Registration succeeded"` |
| 2FA disabled | `"User user@example.com is Updated"` |
| Role assignment | `"User user@example.com is Updated"` |

## Pagination

The response includes a `next` object with pagination state. To retrieve the next page, increment `next.pageNum` in your request. The `next.totalPages` field indicates how many pages are available. The `next.pageToken` value can be passed as the `token` query parameter as an alternative to page-number-based pagination.

## User Account API

To retrieve the full user object for a specific user (for example, to inspect state, roles, or authentication type), call the IAM service directly:

```text theme={"dark"}
GET /api/v1/users/id/{userId}
```

The response includes fields such as `username`, `state`, `type`, `roleId`, `totpEnabled`, `allowedEnterprises`, and revision metadata.

**`state` values:** `USER_STATE_CREATED`, `USER_STATE_ACTIVE`, `USER_STATE_INACTIVE`, `USER_STATE_SIGNEDUP`, `USER_STATE_SUSPENDED`

**`type` values:** `AUTH_TYPE_LOCAL`, `AUTH_TYPE_OAUTH`, `AUTH_TYPE_SAML`

## Next Steps

* [How to Use the ZEDEDA API](https://zededa.mintlify.site/api-reference/how-to-use-zededa-api.md): Generate a token and authenticate API requests.
* [API Reference](https://zededa.mintlify.site/api-reference/overview.md): Full endpoint documentation.
* [Manage Users](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/manage-users.md): Manage user accounts through the console.
* [Monitoring, Logs, Events, and Jobs](https://zededa.mintlify.site/new-ui/infrastructure-services/monitoring-logs-events-reports-jobs.md): View events in the Edge Infrastructure Services console.