Search actions

Request

Returns a paginated list of actions within the requested time window. The response is scoped to the tenant identified by the access token — there is no tenantId parameter on this endpoint, and cross-tenant reads are not possible.

Security

risk_access_token

Query

start_timeinteger, >= 0required

Start of the time window, Unix epoch time in milliseconds.

Example:start_time=1779600000000

end_timeinteger, >= 0required

End of the time window, Unix epoch time in milliseconds.

Example:end_time=1779686400000

skipinteger, [ 0 .. 10000 ]

Pagination offset. Maximum 10000.

Default:0

takeinteger, [ 1 .. 400 ]

Page size. Maximum 400.

Default:100

sort_fieldstring

Field to sort by. Defaults to issued_at.

Default:"issued_at"

Enum:"id""issued_at""risk_score""threats""was_consumed_by_api""recommendation.type""recommendation.result""recommendation.challenge_type""context.action_id""context.action_type"

orderstring

Sort direction. Defaults to DESC.

Default:"DESC"

Enum:"ASC""DESC"

filtersobject

URL-encoded JSON describing the filter expression. One of: a single { field, operator, value } condition, an { and: [conditions...] } group, or an { or: [conditions...] } group. One level deep.

fieldsArray of strings

URL-encoded JSON array of field names to include in each item. When omitted, only id, issued_at, context.action_id, and context.action_performed_at are populated with real data; all other fields contain empty or zero default values. Specify the fields required by your integration to populate them with meaningful data.

hash_filter_valuesboolean

When true, plaintext filter values for attributes the tenant stores hashed are hashed server-side before matching. Leave false when passing already-hashed values.

Default:false

curl -i -X GET \
  'https://api.sbx.transmitsecurity.io/risk/v1/search/actions?start_time=1779600000000&end_time=1779686400000&skip=0&take=100&sort_field=id&order=ASC&filters=and%3D%5Bobject%20Object%5D%26or%3D%5Bobject%20Object%5D%26field%3Did%26operator%3Deq%26value%3Dstring&fields=id&hash_filter_values=false' \
  -H 'Authorization: Bearer <YOUR_JWT_HERE>'

Responses

Paginated list of actions for the requested window.

Bodyapplication/json

itemsArray of objectsrequired

Page of actions matching the query.

countintegerrequired

Number of items in this page.

Example:100

skippedintegerrequired

Echo of the requested skip offset.

Example:0

Response

{
  "items": [
    { … }
  ],
  "count": 1,
  "skipped": 0
}