HELP FILE

Event Reporting via LastPass API

Event Reporting via LastPass API

    Use this reporting API to gather information about events that have taken place in your LastPass Business account.

    API command

    reporting

    Additional details

    You can retrieve 10,000 users at a time. Use the 'next' parameter to paginate over a larger dataset. Events are sorted by time, in descending order. All times should be represented in this time zone: US/Eastern.

    from
    Pull reporting data starting from this date.
    to
    Pull reporting data until this date.
    search
    A search string to filter the reporting data.
    user
    To pull data for a specific user, enter their username. To pull data for all users, enter 'allusers'.
    admin
    To retrive only admin events, set this value to '1'.
    next
    This serves as a paginator when more than 10,000 events occur in the time interval between the 'from' and 'to' parameters. It's a timestamp with microsecond precision. Respond with those events that occur within this time or earlier. The response also contains a 'next' field that is to be used as the value of this parameter.
    format

    The response is in a format that works well with security information and event management systems.

    Request sample

    {
        "cid": 12345678,
        "provhash": "<Your API Secret>",
        "cmd": "reporting",
        "data": {
            "from": "2015-07-17 09:45:00",
            "to": "2015-07-17 10:00:00"
        }
    }

    Response sample

    {
        "status": "OK",
        "next": null,
        "data": {
            "Event1": {
                "Time": "2015-07-17 09:51:51",
                "Username": "j.user@example.com",
                "IP_Address": "10.16.21.21",
                "Action": "Failed Login Attempt",
                "Data": ""
            },
            "Event2": {
                "Time": "2015-07-17 09:51:56",
                "Username": "j.user@example.com",
                "IP_Address": "10.16.21.21",
                "Action": "Failed Login Attempt",
                "Data": ""
            }
        }
    }