Intralinks Developer Portal

The events API allows authorized users to retrieve all details about various events that have occured related to an organizations resources.

Events can be retrieved for either activity done by an organizations users or activity done by any user on workspaces or documents owned by the organization.

Events can be returned in a variety of formats for use with differnt tools. The RAW format is the native format for the Intralinks platform. The CEF format is also supported when using SIEM tools like HP ArcSight.

NOTE The events API requires the user credentials to have special rights. To get an ID to use with this API please contact your Intralinks account representative.


Resource Location

GET /v2/events


Authorization Type

OAuth Bearer Token


Request Parameters

Parameter Description Required Example
startDate Earliest date for which you want events returned for. This can be passed as either a date/time string or a millisecond value. Format is of the form yyyy-MM-dd’T’HH:mm:ss.SSSZ

(Example: 2012-05-15T00:01:02.345-08:00).

The timestamp components after yyyy-MM-dd’T’HH:mm:ss are optional.
The time zone designator is Z or +hh:mm or -hh:mm.

If the startDate is not specified, events are retrieved beginning with the
earliest available event.
No &startDate=2015-09-17
-or-
&startDate=123456789
endDate Latest date for which you want events returned for. This can be passed as either a date/time string or a millisecond value. Format is of the form yyyy-MM-dd’T’HH:mm:ss.SSSZ

(Example: 2012-05-15T00:01:02.345-08:00).

The timestamp components after yyyy-MM-dd’T’HH:mm:ss are optional.
The time zone designator is Z or +hh:mm or -hh:mm.

If the endDate is not specified, events are retrieved beginning with the
earliest available event.
No & endDate =2015-09-17
-or-
& endDate=123456789
format Specifies what format you want the results returned in. Valid values are:
RAW
CEF
Yes &format=RAW


Response Format

For the RAW format the response will be a JSON array of event records.

Field Description
workspaceId The ID of the workspace where the event occured.
appName Internal Application name that generated the event
workspaceName Name of the workspace where the event occured
userId ID of user who performed the event
emailAddress Email address of the user who performed the event
firstName First name of the user who performed the event
lastName Last name of the user who performed the event
eventDate Date/time of the event in milliseconds
eventType Type of event that occured. Will be one of the following:
USER_ADDED_TO_WORKSPACE
DELETE
UPDATE_PASSWORD
LOGON_FAILURE
VIEW
LOGON_SUCCESS
assetId ID of the particular asset this event is related to
assetType Type of asset that this event is related to. Will be one of the following:
USER
WORKSPACE
assetStatus Text string of the current status of the asset
assetName Name of the asset related to this event
parentAssetId ID of the parent asset
parentAssetName Name of the parent asset
parentAssetType Type of the parent asset. Will be one of the following:
USER_ORGANIZATION
WORKSPACE_ORGANIZATION

For CEF format responses, the following fields are available. For more detailed descriptions of the CEF format please see the HP Documentation.

Field Description
count Number of events returned
format Format of the response. This will always be set to CEF
version Version of the response format. Currently always set to 0,
timestamp Date/time when the event data was pulled.
links Array of links to fetch additional pages of results. Currently not used
events Array of CEF Event data.


Example Request

curl -X "GET" "https://test-api.intralinks.com/v2/events?client=<CLIENT_ID>&startDate=2015-09-17&endDate=2015-10-01" \
-H "Authorization: Bearer <ACCESS_TOKEN>"


Example Response

{
  "siemEvents": [
    {
      "appName": "Session Tomcat",
      "userId": 12345,
      "emailAddress": "user123@company.com",
      "firstName": "Joe",
      "lastName": "Smith",
      "eventDate": 1443543117000,
      "eventType": "LOGON_SUCCESS",
      "assetId": 7311551,
      "assetType": "USER",
      "assetStatus": "REGISTERED",
      "assetName": "USER123",
      "parentAssetId": 383971234,
      "parentAssetName": "Company Org, LLC",
      "parentAssetType": "USER_ORGANIZATION"
    },
    {
      "workspaceId": 80241,
      "appName": "Gui2",
      "workspaceName": "Corp Documents",
      "userId": 1123,
      "emailAddress": "joe@othercompany.com",
      "firstName": "Joe",
      "lastName": "Lastname",
      "eventDate": 1443517709000,
      "eventType": "DELETE",
      "assetId": 8092341,
      "assetType": "WORKSPACE",
      "assetStatus": "deleted",
      "assetName": "Interesting asset name",
      "parentAssetId": 383971234,
      "parentAssetName": "Company Org, LLC",
      "parentAssetType": "WORKSPACE_ORGANIZATION"
    }
  ]
}