# Collect events Retrieve a list of events, according to the requested type. Transmit can report events related to orchestration, authentication, and user management (cis), platform management (admin), identity verification (verify), and Fraud Prevention (risk). Endpoint: POST /activities/collect Security: oauth2 ## Security: - `oauth2` (unknown) oauth2 ## Query parameters: - `type` (string, required) The event type to retrieve - `stream_id` (string, required) Event stream ID to collect events from - `batch_size` (integer) The maximum number of events to return in each batch. ## Response 201: - `201` (unknown) OK ## Response 201 fields (application/json): - `activity` (string, required) The activity performed by the user Enum: "add_password", "assertion_end", "assertion_error", "assertion_escape", "assertion_start", "assign_user_to_organization", "authentication_failed", "authentication_resumed", "authentication_started", "authentication_succeeded", "client_access_token_request", "condition_evaluated", "consume_ticket", "create_client_authority", "create_iat", "create_scope", "create_sso_client_group", "create_ticket", "create_user", "create_user_failure", "custom_data", "custom_event", "custom_token_enrichment", "delegated_access_login", "delete_iat", "delete_scope", "delete_sso_client_group", "delete_user", "email", "external_connection_call", "failed_otp_attempt", "failed_webauthn_attempt", "failover_switch", "get_user", "get_users", "http_auth_pass", "ido_error", "journey_completed_successfully", "journey_completed_unsuccessfully", "journey_started", "ldap_bind_entry", "locked_authenticator", "Loop", "oidc_code_issued", "oidc_completed", "oidc_started", "oidc_token_exchange_request", "on_behalf_of_token_exchange", "passwordless_authentication", "passwordless_registration", "passwordless_transaction", "policy_decision", "refresh_token_exchange", "remove_user_from_org", "resend_user_invitation_link", "reset_password", "saml_completed", "saml_started", "send_user_passkey_registration", "session_logout", "session_pending", "set_variables", "silent_authentication", "sms", "sms_sent", "sso_group_authentication_started", "sso_group_authentication_succeeded", "step_completed", "step_started", "sub_journey_completed_successfully", "sub_journey_completed_unsuccessfully", "sub_journey_started", "suspend_user", "suspend_user_from_org_app", "transmit_identity_verification", "transmit_platform_custom_authentication", "typescript_function_node", "unsuspend_user", "unsuspend_user_from_org_app", "update_client_authority", "update_password", "update_scope", "update_sso_client_group", "update_ticket", "update_user", "update_user_failure", "update_user_org_roles", "user_authenticator_deleted", "user_authenticator_locked", "user_authenticator_unlocked", "user_consent_granted", "user_consent_requested", "user_consent_revoked", "user_create_managed_org", "user_create_organization", "user_delete_managed_org", "user_delete_mobile_native_biometrics", "user_delete_organization", "user_delete_pin_authenticator", "user_delete_webauthn_credential", "user_disable_managed_org", "user_disable_organization", "user_enable_managed_org", "user_enable_organization", "user_export_org_members_list_csv_download", "user_failed_login", "user_login", "user_logout", "user_password_reset", "user_register_mobile_native_biometrics", "user_register_pin_authenticator", "user_update_managed_org", "user_update_organization", "validate fail", "validate success", "validate_response", "webauthn_authentication", "webauthn_registration", "risk_fraud_ring", "risk_recommendation", "risk_report_action_result", "add_fraud_image_data", "add_multiple_session_detector_data", "allow_by_restriction_criterion", "app_settings_updated", "check_image_quality", "consent_approved", "delete_fraud_image_data", "delete_image_from_entity", "delete_multiple_session_detector_data", "deny_by_restriction_criterion", "download_session_data", "error", "expiration_session", "face_auth_error", "face_auth_face_registered", "face_auth_face_verified", "image_uploaded", "image_uploaded_info", "page_loaded", "read_fraud_image_data", "read_image_data", "redirect", "sdk_process_completed", "search_multiple_session_detector_data", "security_insight_added", "session_created", "session_deleted", "session_started", "user_action_performed", "verification_status_updated" - `tenant_id` (string) The unique ID of the tenant - `activity_id` (string) The unique ID of the activity - `app_id` (string) The unique ID of the application that generated the audit event - `user_id` (string) The unique ID of the user who performed the activity - `correlation_id` (string) A correlation ID that links related events - `ip` (string) The IP address of the user - `user_agent` (string) The user agent string of the user's device - `timestamp` (string) The date and time the event occurred (ISO 8601) - `original_app_id` (string) The hashed value of the app ID before enrichment - `original_user_id` (string) The hashed value of the user ID before enrichment - `additional_params` (object) Additional parameters for this event. - `additional_params.member_role_ids` (array) List of role IDs assigned to the member - `additional_params.member_role_names` (array) List of role names assigned to the member - `additional_params.target_organization_id` (string) Unique identifier of the target organization - `additional_params.target_organization_name` (string) Name of the target organization - `additional_params.target_organization_domains` (array) List of domains associated with the target organization - `additional_params.target_organization_alias_name` (string) Alias name of the target organization - `additional_params.target_app_id` (string) Unique identifier of the target application - `additional_params.actor_id` (string) Unique identifier of the actor who initiated the operation - `additional_params.original_actor_id` (string) Unique identifier of the original actor in delegated scenarios - `additional_params.child_organization_id` (string) Unique identifier of the child organization - `additional_params.child_organization_name` (string) Name of the child organization - `additional_params.child_organization_domains` (array) List of domains associated with the child organization - `additional_params.child_organization_alias_name` (string) Alias name of the child organization - `additional_params.parent_organization_id` (string) Unique identifier of the parent organization - `additional_params.parent_organization_name` (string) Name of the parent organization - `additional_params.parent_organization_domains` (array) List of domains associated with the parent organization - `additional_params.parent_organization_alias_name` (string) Alias name of the parent organization - `activity` (string, required) The activity performed by the actor Enum: "Add list items", "add_admin", "add_fraud_entity_data", "add_fraud_image_data", "add_image_to_entity", "add_multiple_session_detector_data", "admin_assign_role_groups", "admin_assign_roles", "admin_assign_user_to_organization", "admin_authenticator_deleted", "admin_authenticator_locked", "admin_authenticator_unlocked", "admin_authenticator_unlocked_by_type", "admin_client_secret_deleted", "admin_client_secret_generated", "admin_create_managed_org", "admin_create_organization", "admin_create_role", "admin_create_role_group", "admin_create_tenant", "admin_create_user", "admin_delete_managed_org", "admin_delete_organization", "admin_delete_role", "admin_delete_role_group", "admin_delete_user", "admin_delete_webauthn_credential", "admin_disable_managed_org", "admin_disable_organization", "admin_enable_managed_org", "admin_enable_organization", "admin_export_org_members_list_csv_download", "admin_export_org_members_list_csv_request", "admin_failed_login", "admin_login", "admin_login_outside_IP_allowlist", "admin_logout", "admin_magic_link_login_during_sso", "admin_recovery_otp_code_generated", "admin_remove_role_groups", "admin_remove_roles", "admin_remove_user_from_org", "admin_resend_user_invitation_link", "admin_reset_user_password", "admin_saml_certificate_activated", "admin_saml_certificate_deleted", "admin_saml_certificate_generated", "admin_send_user_passkey_registration", "admin_suspend_user_from_org_app", "admin_terminate_user_session", "admin_unsuspend_user_from_org_app", "admin_update_custom_user_schema", "admin_update_managed_org", "admin_update_organization", "admin_update_role", "admin_update_role_group", "admin_update_security_insight_assignee", "admin_update_security_insight_status", "admin_update_tenant", "admin_update_user", "admin_update_user_org_roles", "allow_by_restriction_criterion", "app_settings_updated", "certificates_create", "certificates_delete", "certificates_download", "certificates_export", "Create custom action", "Create label", "Create labels", "Create list", "Create rule", "create_app", "create_mgmt_app", "credentials_create", "credentials_delete", "credentials_export", "credentials_import", "credentials_revoke", "customer_get_results", "Delete custom action", "Delete list", "Delete rule", "delete_app", "delete_fraud_image_data", "delete_image_from_entity", "delete_mgmt_app", "deny_by_restriction_criterion", "disable_app_specific_signing_key", "Edit preview policy", "edit_auth_settings", "enable_app_specific_signing_key", "environment_variable_create", "environment_variable_delete", "environment_variable_export", "environment_variable_import", "environment_variable_update", "Event stream collection started", "Event stream collection stopped", "Event stream created", "Event stream deleted", "experiences_management_branding_page_updated", "experiences_management_branding_page_viewed", "experiences_management_logo_updated", "experiences_management_setting_page_updated", "experiences_management_settings_page_viewed", "export fail", "Export recommendations", "export success", "export_users_list_csv_download", "export_users_list_csv_request", "external_connection_create", "external_connection_delete", "external_connection_export", "external_connection_import", "external_connection_reload", "external_connection_update", "face_auth_face_unregistered", "force import fail", "force import success", "Get list", "Get lists", "Get network membership status", "image_uploaded", "import fail", "import success", "journey_create", "journey_delete", "journey_duplicate", "journey_export", "journey_import", "journey_update", "keys_delete", "keys_download", "keys_export", "keys_generate", "keys_import", "keys_revoke", "keys_upload", "partial export fail", "partial export success", "partial force import fail", "partial force import success", "partial import fail", "partial import success", "Push policy to production", "read_fraud_entity_data", "read_fraud_image_data", "read_image_data", "Remove list items", "remove_admin", "restriction_criteria_added", "restriction_criteria_deleted", "restriction_criteria_updated", "scim", "search_multiple_session_detector_data", "security_insight_added", "session_deleted", "sub_journey_create", "sub_journey_delete", "sub_journey_duplicate", "sub_journey_export", "sub_journey_import", "sub_journey_update", "Update list", "Update network membership", "Update rule", "update_app" - `ip` (string) The IP address of the actor - `user_agent` (string) The user agent string of the actor's device - `actor_id` (string) The unique ID of the actor that performed the event - `actor_type` (string) The type of the actor Enum: "user", "app" - `target_resource_id` (string) The target resource affected by the activity - `target_resource_type` (string) The type of the target resource affected by the activity Enum: "user", "app", "tenant" - `original_actor_id` (string) The hashed value of the actor ID before enrichment ## Response 401: - `401` (unknown) Unauthorized ## Response 403: - `403` (unknown) Cannot handle request without performing start collect action first. ## Response 404: - `404` (unknown) Stream not found. ## Response 406: - `406` (unknown) stream_id parameter is required and must be a continuous non-empty string. ## Response 500: - `500` (unknown) Internal server error