This API fetches a detailed list of file-related operations (create, open, modify, delete, etc.) occurring across all network devices. It also provides filters to narrow results by event type, device, file extension, domain, computer/group, and time range.
get /api/1.4/reports/dcm/filetrace
https://{serverurl}/api/1.4/reports/dcm/filetrace
Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52
Current page number for pagination
Number of records per page
Filter based on time period
0 - This week
1 - This month
2 - This year
3 - Last week
4 - Last month
5 - Last 2 months
6 - Last 3 months
7 - Last 6 months
8 - Last 9 months
9 - Last year
Filter based on file event type
0 - Unknown
1 - Create
2 - Open
3 - Delete
4 - Rename
5 - Modify
6 - Read
7 - Move
8 - Copy
0 - Allowed
1 - Blocked
Filter devices connected to a particular group of computers. Group IDs can be obtained from /api/1.4/customgroup/getCGList
Filter file activities of a particular device using its device instance path
Filter file activities by file extension
Filter file activities by file extension group
Filter the records based on domain names
Filter file activities that occurred in the last N days
Start timestamp for date range filter
End timestamp for date range filter
Filter devices connected to a particular computer. Resource IDs can be obtained from /api/1.0/som/computers
Filter by user resource ID
curl --request GET \
--url https://appdomains/api/1.4/reports/dcm/filetrace \
--header 'Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52'Module code identifier
Response data container
Total number of records
Maximum number of records in this response
Current page number
Array of file trace records
File name or path
File extension
File size in bytes
Original file path
Process accessing the file
If file operation was blocked (0=Allowed, 1=Blocked)
Type of file event (1=Create, 2=Open, 3=Delete, 4=Rename, 5=Modify, 6=Read, 7=Move, 8=Copy)
Timestamp when event was detected
Name of device accessed
Computer friendly name
User performing action
Domain/workgroup
Computer name
Name of the newly created/renamed file
File modified timestamp
Whether the entry is a directory (1=yes, 0=no)
File created timestamp
File accessed timestamp
API version
Status of API call (success/failure)
HTTP response code
File trace report response
{
"response_code": 200,
"message_type": "dcm",
"message_response": {
"total": 1,
"limit": 25,
"page": 1,
"dcm": [
{
"created_time": 315513000000,
"is_directory": 1,
"extension": "folder",
"file_name": "E:\\",
"managedcomputer.friendly_name": "John",
"domain_netbios_name": "WORKGROUP",
"userresource.name": "John",
"file_size": 0,
"event_notified_time": 1755869433000,
"device_name": "USB SanDisk 3.2Gen1 USB Device",
"event_type": 5,
"modified_time": 315513000000,
"operation_blocked": 0,
"new_file_name": "",
"process_name": "C:\\Windows\\explorer.exe",
"accessed_time": 315513000000,
"resource_name": "John"
}
]
},
"message_version": "1.4",
"status": "success"
}
© 2026, Zoho Corporation Pvt. Ltd. All Rights Reserved.