Get Enterprise Events

To get a enterprise's events, authenticate a user with admin permission and make a call to the GET /events API with the stream_type set to admin_logs.

curl https://api.box.com/2.0/events?stream_type=admin_logs \
  -H "authorization: Bearer <ACCESS_TOKEN>"

// get the last two hours of unfiltered enterprise events
Date startDate = new Date(System.currentTimeMillis() - (1000 * 60 * 60 * 2));
Date endDate = new Date(System.currentTimeMillis());
EventLog eventLog = EventLog.getEnterpriseEvents(api, startDate, endDate);
for (BoxEvent event : eventLog) {
    System.out.println("Enterprise Event Created by User: "
            + event.getCreatedBy().getName()
            + " Login: " + event.getCreatedBy().getLogin()
            + " Event Type: " + event.getType()
            + " Created at: " + event.getCreatedAt().toString());
};

events = client.events()
    .get_admin_events(created_after='2019-07-01T22:02:24-07:00')
 for event in events['entries']:
    print('Got {0} event that occurred at {1}'.format(event.event_type, event.created_at))

Filter by Event Type

The enterprise event feed support filtering by event type.

curl https://api.box.com/2.0/events?stream_type=admin_logs&event_type=LOGIN,FAILED_LOGIN \
  -H "authorization: Bearer <ACCESS_TOKEN>"

events = client.events()
    .get_admin_events(created_after='2019-07-01T22:02:24-07:00', event_types=['ITEM_CREATE'])
 for event in events['entries']:
    print('Got {0} event that occurred at {1}'.format(event.event_type, event.created_at))

A full list of event types can be found below.

Limitations

The admin event feed does not support long polling. To long poll for events, use the user event feed.

Box does not store events indefinitely.

User events are stored for between two weeks and two months, after which the user events are removed. Enterprise events are accessible for one year via the API and seven years via exported reports in the Box Admin Console.

The emphasis for this feed is on completeness over latency, which means that Box may deliver admin events with higher latency than the user feed. Unlike the user events stream, the admin events stream supports filtering for specific events but does not support long polling.

Event Types

The following events can be triggered for an enterprise.

Anonymous Users

In some cases, the event feed might list a user with an ID of 2. This is Box's internal identifier for anonymous users.

An anonymous user is a user that is not logged in. This can happen any time a user interacts with content and they aren't asked to log in first. An example would be when a user downloads a file through an open shared link.