Event Reporting via LastPass API

Use this reporting API to gather information about events that have taken place in your LastPass Business account.

API command

reporting

Additional details

You can retrieve 10,000 users at a time. Use the 'next' parameter to paginate over a larger dataset. Events are sorted by time, in descending order. All times should be represented in this time zone: US/Eastern.

from: Pull reporting data starting from this date.
to: Pull reporting data until this date.
search: A search string to filter the reporting data.
user: To pull data for a specific user, enter their username. To pull data for all users, enter 'allusers'.
admin: To retrive only admin events, set this value to '1'.
next: This serves as a paginator when more than 10,000 events occur in the time interval between the 'from' and 'to' parameters. It's a timestamp with microsecond precision. Respond with those events that occur within this time or earlier. The response also contains a 'next' field that is to be used as the value of this parameter.
format: The response is in a format that works well with security information and event management systems.

Request sample

{
    "cid": 12345678,
    "provhash": "<Your API Secret>",
    "cmd": "reporting",
    "data": {
        "from": "2015-07-17 09:45:00",
        "to": "2015-07-17 10:00:00"
    }
}

Response sample

{
    "status": "OK",
    "next": null,
    "data": {
        "Event1": {
            "Time": "2015-07-17 09:51:51",
            "Username": "j.user@example.com",
            "IP_Address": "10.16.21.21",
            "Action": "Failed Login Attempt",
            "Data": ""
        },
        "Event2": {
            "Time": "2015-07-17 09:51:56",
            "Username": "j.user@example.com",
            "IP_Address": "10.16.21.21",
            "Action": "Failed Login Attempt",
            "Data": ""
        }
    }
}