Retrieves all Activities performed on Endpoints.

This API provides a comprehensive list of all activities performed on endpoints, including actions taken by Leak Prevention, boundary types involved, and sensitivity classifications. It supports filters for action type and includes pagination for managing result sets.

Endpoints

get /api/1.4/reports/dlp/endpointactivityreport

Copy full URL

Request URL

https://{serverurl}/api/1.4/reports/dlp/endpointactivityreport

Scope

DesktopCentralCloud.EndpointDLP.READCopied!

Header

Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52

Request Parameters

- Request Headers

AcceptstringMandatory

application/jsonCopied!

Content-TypestringMandatory

application/jsonCopied!

- Query Parameters

pagestringOptional

This is for navigating to specific pages. This field denotes the current page.

pagelimitstringOptional

specify the number of records to be displayed per page.

actionFilterstringOptional

filter endpoint activity report records based on Leak Prevention action performed. 0 - Allowed 1 - Blocked 2 - Self Override 3 - Reported False Positive

Sample Request

Curl

Java

Python

Deluge

PowerShell

Copied!

curl --request GET \
  --url https://appdomains/api/1.4/reports/dlp/endpointactivityreport \
  --header 'Accept: application/json' \
  --header 'Authorization: Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/json'

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.io.IOException;
import java.net.http.HttpTimeoutException;

public class Main {
  public static void main(String[] args) {

    HttpRequest request = HttpRequest.newBuilder()
        .uri(URI.create("https://appdomains/api/1.4/reports/dlp/endpointactivityreport"))
        .header("Accept", "application/json")
        .header("Content-Type", "application/json")
        .header("Authorization", "Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52")
        .method("GET", HttpRequest.BodyPublishers.noBody())
        .build();
    HttpResponse response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());
    System.out.println(response.body());
  
  }
}

import http.client

conn = http.client.HTTPSConnection("appdomains")

headers = {
    'Accept': "application/json",
    'Content-Type': "application/json",
    'Authorization': "Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52"
    }

conn.request("GET", "/api/1.4/reports/dlp/endpointactivityreport", headers=headers)

res = conn.getresponse()
data = res.read()

print(data.decode("utf-8"))


    headersMap = Map();
    headersMap.put("Accept", "application/json");
    headersMap.put("Content-Type", "application/json");

    response = invokeUrl
    [
        url: "https://appDomains/api/1.4/reports/dlp/endpointactivityreport"
        type: GET
        headers: headersMap
        connection: connection_name
    ]

    info response;

$headers=@{}
$headers.Add("Accept", "application/json")
$headers.Add("Content-Type", "application/json")
$headers.Add("Authorization", "Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52")
$response = Invoke-WebRequest -Uri 'https://appdomains/api/1.4/reports/dlp/endpointactivityreport' -Method GET -Headers $headers

Response Parameters

- HTTP code 200

Response Body - application/json

JSON Object

Hide Sub-Attributes

message_typeinteger

Module Code

message_responseJSON Object

Response.

Show Sub-Attributes

totalinteger

Total Number of Records.

limitinteger

Maximum number of records included in this single response.

dlpJSON Array

DLP.

Show Sub-Attributes

JSON Object

Show Sub-Attributes

resfileaudit.userstring

User performing action

file_pathstring

File path involved in activity

resfileaudit.event_typeinteger

0-Allowed,
1-Blocked,
2-Self Override,
3-Reported False Positive

resfileaudit.boundary_valuestring

Boundary application/domain involved (e.g., powershell.exe)

override_commentstring

User override comment

resfileaudit.event_timelong

Timestamp of event

classification_rulestring

Matched classification rule

classification_categorystring

Category of classification (e.g., Custom rules)

classification_typeinteger

64-Password protected files,
128-Trusted application,
256-Trusted email domain,
1024-Trusted web domain

pageinteger

Page Number.

message_versioninteger

Api Version.

statusinteger

Status of Api call.

response_codeinteger

Response code.

Possible Response Codes

200HTTP code

Sample Response: HTTP 200

Copied!

  {
    "response_code": 200,
    "message_type": "dlp",
    "message_response": {
      "total": 1,
      "limit": 25,
      "dlp": [
        {
          "resfileaudit.user": "John",
          "classification_source": "--",
          "file_path": "C:\\USERS\\John\\DOCUMENTS\\POWERSHELL_TRANSCRIPT.John.VTIVDCST.20250824165748.TXT",
          "resfileaudit.event_type": 1,
          "resfileaudit.boundary_value": "powershell.exe",
          "override_comment": "--",
          "resfileaudit.event_time": 1756113369790,
          "classification_category": "Custom rules",
          "resfileaudit.boundary_type": 64,
          "classification_type": 16,
          "justication_value": "--",
          "resource_name": "John",
          "classification_rule": "r1"
        }
      ],
      "page": 1
    },
    "message_version": "1.4",
    "status": "success"
  }

▼ Show full