Chat now with support
Chat with Support

One Identity Safeguard for Privileged Sessions 8.0 LTS - REST API Reference Guide

Introduction Using the SPS REST API Basic settings User management and access control Managing SPS General connection settings HTTP connections Citrix ICA connections MSSQL connections RDP connections SSH connections Telnet connections VNC connections Search, retrieve, download, and index sessions Reporting Health and maintenance Advanced authentication and authorization Completing the Welcome Wizard using REST Enable and configure analytics using REST REST API examples

Download audit trails

You can download the audit trail of a session from the /api/audit/sessions/<session-id>/audit_trail endpoint. To find a specific audit trail, see Searching in the session database with the basic search method. You can download audit trails that are available on SPS, and also audit trails that have been archived (if SPS can access the archived audit trail).

curl --cookie cookies.txt "https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/audit_trail"

To actually create a file, you must save the downloaded data into a file (use the .zat file extension), for example:

curl --cookie cookies.txt "https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/audit_trail" > my-downloaded-trail.zat

You can replay the downloaded audit trails with the Safeguard Desktop Player application. For details, see Safeguard Desktop Player User Guide.

If you want to replay an ongoing session in follow mode, you have to download the audit trail in .srs format. Use the ?format=srs option:

curl --cookie cookies.txt "https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/audit_trail?format=srs" > my-downloaded-trail.srs

For details, see Replaying audit files in follow mode in the Safeguard Desktop Player User Guide.

Searching in the session database with the basic search method

You can list, search, and filter the SPS session database at the /api/audit/sessions endpoint.

Limitations

NOTE: Searching in the session database with the basic search method has the limitation of returning a maximum of 10000 sessions from the session database. With pagination, you can only iterate through the first 10000 results. If you have to retrieve all sessions from the database that match your specified query and results in a match count of 10000 (or more), use Retrieving all sessions from the session database with the advanced search method.

Actions available with the basic search method

You can use the following actions:

  • ?start

    Display sessions that started after the specified date. Use the ISO 8601 format for the date, for example, 2017-01-25T10:00.

  • ?end

    Display sessions that ended before the specified date. Use the ISO 8601 format for the date, for example, 2017-01-25T10:00.

  • ?fields

    Display the selected properties (elements and values) of the listed sessions.

  • ?q

    Filter the list using one or more properties (elements) of the sessions.

  • ?limit

    Configure the pagination of the displayed results using the ?offset and ?limit parameters.

    The ?limit parameter allows you to configure the maximum number of results to display on a page at once.

    The default value of ?limit is 500.

    NOTE: The default value of 500 is the maximum permitted value you can set for ?limit. If you set the ?limit parameter to a value bigger than 500, only the first 500 results will be displayed.

  • ?offset

    Configure the pagination of the displayed results using the ?offset and ?limit parameters.

    The ?offset parameter allows you to configure the offset from the first result that is displayed. This can be useful if the number of items returned exceeds the number of items displayed on the first page, and you want to navigate to any of the subsequent items displayed on other pages.

    The default value of ?offset is null.

    NOTE: The maximum number of search results in One Identity Safeguard for Privileged Sessions is 10000. As a result, any ?offset values set to larger than 10000 will be ignored and the results exceeding the value of 10000 will not be displayed.

  • ?sort

    Sort the results based on the values of the fields.

  • ?format

    Configure the format of the displayed results.

    The default value of ?format is json. If you do not configure the ?format parameter, the results will be displayed in JSON format.

    To display search results in a CSV format, enter csv as a value.

To combine multiple expressions, use the & (ampersand) character, for example:

Display the target server and port of each active session:

curl --cookie cookies.txt "https://<IP-address-of-SPS>/api/audit/sessions?fields=psm.target.address,psm.target.port&q=active:true"

Display 10 sessions at once, and navigate to 31-40:

curl --cookie cookies.txt "https://<IP-address-of-SPS>/api/audit/sessions?limit=10&offset=31"

Search in metadata and session content at the same time:

curl --cookie cookies.txt "https://<IP-address-of-SPS>/api/audit/sessions?q=protocol:ssh&content=sudo"

NOTE: If you use curl, use quotation marks for the URL to avoid problems with the & (ampersand) character.

Response

The response to search or filtering action contains a list of the matching sessions, as well as some additional meta fields. For example:

{
    "items": [
        {
            "body": {
                "duration": 0,
                "name": "myname",
                "start_time": "2017-01-25T11:11:52.000+01:00"
            },
            "key": "2",
            "meta": {
                "href": "/api/audit/sessions/2"
            }
        },
        {
            "body": {
                "duration": 34,
                "name": "myname",
                "start_time": "2017-01-25T11:11:11.000+01:00"
            },
            "key": "10",
            "meta": {
                "href": "/api/audit/sessions/10"
            }
        }
    ],
    "meta": {
        "fields": [
            "start_time",
            "name",
            "duration"
        ],
        "first": "/api/audit/sessions?limit=500&offset=0&fields=start_time,name,duration&q=name%3Amyname&=duration",
        "href": "/api/audit/sessions",
        "last": "/api/audit/sessions?limit=500&offset=0&fields=start_time,name,duration&q=name%3Amyname&sort=duration",
        "limit": 500,
        "match_count": 2,
        "next": null,
        "offset": 0,
        "parent": "/api/audit",
        "previous": null
    }
Element Type Description
items list Top level element, a list containing the details of the matching sessions.
body JSON object

Contains the information returned about a session, that is, the fields selected with the ?fields expression. For example, if you used the fields=start_time,psm.gateway_username,duration expression in your query, then the body element contains these fields for each returned session:

"body": {
                "duration": 0,
                "name": null,
                "start_time": "2017-01-25T11:11:52.000+01:00"
            },
key string

A globally unique string that identifies the session. This session ID has the following format: svc/<unique-random-hash>/<name-of-the-connection-policy>:<session-number-since-service-started>/<protocol>, for example, svc/5tmEaM7xdNi1oscgVWpbZx/ssh_console:1/ssh.

Log messages related to the session also contain this ID. For example:

2015-03-20T14:29:15+01:00 demo.example
zorp/scb_ssh[5594]: scb.audit(4):
(svc/5tmEaM7xdNi1oscgVWpbZx/ssh_console:0/ssh):
Closing connection; connection='ssh_console',
protocol='ssh', connection_id='409829754550c1c7a27e7d',
src_ip='10.40.0.28', src_port='39183',
server_ip='10.10.20.35', server_port='22',
gateway_username='', remote_username='example-username',
verdict='ZV_ACCEPT'

Note that when using the session ID in a REST call, you must replace the special characters in the ID with the hyphen (-) character. For example, if the session ID in the log message is svc/fNLgRmAyf5EtycgUYnKc1B/ssh_demo2:2, use the svc-fNLgRmAyf5EtycgUYnKc1B-ssh_demo2-2 ID in REST calls.

In addition to the usual meta elements of other endpoints, search results can contain the following additional elements.

Element Type Description
meta JSON object Top level element, a list containing meta information about the response.
fields list

Contains the list of data fields returned about each session, that is, the fields selected with the ?fields expression. For example, if you used the fields=start_time,psm.gateway_username,duration expression in your query, then the body element contains these fields for each returned session:

"fields": [
            "start_time",
            "name",
            "duration"
        ],
limit integer The maximum number of sessions returned in a the response (by default, 500).
match_count integer

The number of results matching the query.

NOTE: Searching in the session database with the basic search method has the limitation of returning a maximum of 10000 sessions from the session database. With pagination, you can only iterate through the first 10000 results. If you have to retrieve all sessions from the database that match your specified query and results in a match count of 10000 (or more), use Retrieving all sessions from the session database with the advanced search method.

next string A query to retrieve the next set of search results, if match_count is higher than limit.
offset integer Indicates the position of the results in this response, relative to the total number of results (match_count). Otherwise, its value is null.
previous string A query to retrieve the previous set of search results, if match_count is higher than limit, and offset is higher than 0. Otherwise, its value is null.
Filtering

You can use the ?q option to filter the list using one or more property (element) of the sessions.

?q=protocol:ssh

You can escape special characters using the backslash character.

?q=server_username:\"Windows User\"

To add multiple elements to the filter, you can use the AND, AND NOT, and OR operators.

?q=protocol:ssh AND verdict:accept AND NOT name:admin

You can create groups using () (parentheses).

?q=(client.address:10.20.30.40 OR target.address:10.20.30.40) AND verdict:accept

You can also use () (parentheses) to add multiple possible values for a property.

?q=protocol:(ssh rdp)

You can use the * (asterisk) and ? (question mark) wildcards for string-type values.

?q=name:?dmi*

You can define ranges using [] (brackets) or {} (braces) and the TO operator. This only works for numeric (int) values.

  • [ means equal or higher than the following value

  • ] means equal or lower than the preceding value

  • { means higher than the following value

  • }means lower than the preceding value

For example, the following range resolves to 22:

?q=port:{21 TO 23}

You can also use the * (asterisk) wildcard in the range.

?q=start_time:[* TO 1461654799]

Note that not all connection data can be used for filtering. The available elements are:

  • active

    Boolean, true means the session is ongoing (it is still active).

  • auth_method

    String, the authentication method used.

  • channel_policy

    String, the key of the channel policy.

  • client.address

    String, the IP address of the client.

  • client.port

    Integer, the port of the client.

  • psm.connection_policy

    String, the key of the connection policy.

  • end_time

    The date of the end of the session in ISO 8601 format.

  • name

    String, the username used for authenticating against the gateway.

  • protocol

    String, the protocol of the session.

  • server.address

    String, the IP of the remote server.

  • psm.server_local.address

    String, the IP of SPS.

  • psm.server_local.port

    String, the port of SPS.

  • server.port

    String, the port of the remote server.

  • server_username

    String, the username used for authenticating on the remote server.

  • session_id

    String, the identifier of the session.

  • start_time

    The date of the start of the session in ISO 8601 format.

  • target.address

    String, the IP the client targeted in the session.

  • target.port

    Integer, the port the client targeted in the session.

  • verdict

    String, the connection verdict. Possible values are:

    • accept

      The connection attempt was successful.

    • accept-terminated

      The connection violated a content policy, and was terminated by SPS.

    • auth-fail

      Authentication failure.

    • deny

      The connection was denied.

    • fail

      The connection attempt failed.

    • gw-auth-fail

      Gateway authentication failure.

    • key-error

      The connection attempt failed due to a host key mismatch.

    • user-mapping-fail

      The connection attempt failed due to a user mapping failure.

Content search in indexed audit trails

You can use the ?q=screen.content option to search for keywords that appear in the screen content of the audit trails. Such content is any text that appeared on the screen in terminal or graphical sessions, or commands that the user entered in terminal sessions. Note that content search works only if:

  • Indexing was enabled in the connection policy related to the audit trail during the session, and

  • the audit trail has already been indexed.

?q=screen.content:"my-search-expression"

You can use the Apache Lucene query syntax to create the search expression, but note the following points.

  • You must format the search expression as an URL, and escape special characters accordingly. For example, if your search expression is man iptables, you must escape the whitespace: man%20iptables

    For a list of special (reserved) URL characters, see RFC3986.

  • Do not begin the expression with the * wildcard.

Examples:

Search for the word example

?q=screen.content:example

Search for the words example, examples, and so on:

?q=screen.content:example%3F

Search for the words example, examine, and so on:

?q=screen.content:exam%2A

Search in metadata and session content at the same time:

curl --cookie cookies.txt "https://<IP-address-of-SPS>/api/audit/sessions?q=protocol:ssh&content=sudo"

For further details and examples, see Searching in the contents of audit trails in the Administration Guide.

Displaying session data

You can use the ?fields option to display the selected data (body elements) of each session.

?fields=protocol

To list multiple elements, use the , (comma) character. Note that the response includes the selected fields in alphabetic order, not in the order they were specified.

?fields=protocol,name

To list all possible elements, use the fields=* expression.

?fields=*

Note that not all connection data can be displayed in the generated list. The available elements are:

  • active

    Boolean, true means the connection is ongoing.

  • archived

    Boolean, true means the session has been archived.

  • auth_method

    String, the authentication method used.

  • channel_policy

    String, the key of the channel policy.

  • client.address

    String, the IP address of the client.

  • client.port

    Integer, the port of the client.

  • connection_policy

    String, the key of the connection policy.

  • duration

    Integer, the duration of the session. Computed value.

  • end_time

    The date of the end of the session in ISO 8601 format.

  • name

    String, the username used for authenticating against the gateway.

  • protocol

    String, the protocol of the session.

  • server.address

    String, the IP of the remote server.

  • server_local.address

    String, the IP of SPS.

  • server_local.port

    Integer, the port of SPS.

  • server.port

    Integer, the port of the remote server.

  • server_username

    String, the username used for authenticating on the remote server.

  • session_id

    String, the identifier of the session.

  • start_time

    The date of the start of the session in ISO 8601 format.

  • target.address

    String, the IP the client targeted in the session.

  • target.port

    Integer, the port the client targeted in the session.

Date-specific search

To display search results only for specific date intervals, you can use the ?start and ?end options.

  • The ?start option selects the sessions that started after the specified date (based on the value of the start_time field).

  • The ?end option selects the sessions that ended before the specified date (based on the value of the end_time field).

  • Both options accept the date in ISO 8601 format.

?start=2017-01-25T11:11:52.000+01:00
?end=2017-01-25T11:41:52.000+01:00
?start=2017-01-24&end=2017-01-25
Examples:

Select sessions that started on January 20, 2017, or later:

?start=2017-01-20

Select sessions that started on 11:00 January 20, 2017, or later:

?start=2017-01-20T11:00

Select sessions that ended on January 20, 2017:

?end=2017-01-20

Select sessions started and ended on January 20, 2017:

?start=2017-01-20&end=2017-01-20

Select sessions started after 11:00, January 20, 2017, and ended before 09:00, January 21, 2017:

?start=2017-01-20T11:00&end=2017-01-21T09:00
Changing the display limit

You can use the ?limit option to change the number of items displayed at once. The default maximum limit is 500.

?limit=100

To navigate beyond the displayed set, use the offset option.

Navigating large datasets

You can use the ?offset option to navigate data sets that extend beyond the display limit. The default value of the offset is 0, this is the initially displayed set. To move to other items beyond the initial set, increase the value to a number that corresponds to the item where you want to start displaying results from.

Example: the display limit is the default 500, and the number of sessions is 1012. The initial 500 sessions are listed at:

?offset=0

To view sessions from 501 to 1000, change the offset to 501:

?offset=501

To display the remaining 12 sessions, change the offset to 1001:

?offset=1001
Sort the results

You can sort the search results using the sort expression, for example, based on the length of the sessions:

?sort=duration

You can use any field to sort the results. By default, sorting returns the results in ascending order, if you use ?sort=duration, then the shortest session is at the beginning of the list. To sort the results in descending order, add the minus sign (-) before the field name. For example, the response to the following expression starts with the longest session:

?sort=-duration

You can specify multiple fields to order the list. In this case, the list is first ordered using the first field, then the second, and so on. For example, to order the list first by duration, then by start time, use the following expression.

?sort=duration,start_time

The following example sorts the results by duration, and displays the start time, gateway username, and duration fields.

curl --cookie cookies.txt "https://<IP-address-of-SPS>/api/audit/sessions?sort=duration&fields=start_time,psm.gateway_username,duration"
Configure the format of the displayed results

The default value of ?format is json. If you do not configure the ?format parameter, the results will be displayed in JSON format.

?format=json

To display search results in a CSV format, enter csv as a value.

?format=csv
Example: querying sessions in CSV result format

Given that the following sessions were recorded:

{
  "1": {
    "channel": [
      {"channel_id": 1},
      {"channel_id": 2}
    ],
    "recording": {
      "session_id": 1,
      "archived": false,
      "channel_policy": "policy1",
      "content_reference_id": 1,
      "connection_policy": "connection1",
      "auth_method": "password",
      "target": {
        "port": 2222,
        "ip": "1.1.1.1",
        "name": "1.1.1.1"
      },
      "server_local": {
        "port": 46,
        "ip": "1.1.1.1",
        "name": "1.1.1.1"
      }
    },
    "user": {
      "server_username": "user1",
      "gateway_username": "user1"
    },
    "client": {
      "port": 48679,
      "ip": "2.2.2.2",
      "name": "2.2.2.2"
    },
    "active": false,
    "start_time": 1,
    "duration": 4,
    "server": {
      "port": 22,
      "ip": "2.2.2.2",
      "name": "2.2.2.2"
    },
    "end_time": 5,
    "protocol": "ssh"
  },
  "2": {
    "channel": [
      {"channel_id": 3},
      {"channel_id": 4}
    ],
    "recording": {
      "session_id": 2,
      "archived": false,
      "channel_policy": "policy2",
      "content_reference_id": 2,
      "connection_policy": "connection2",
      "auth_method": "password",
      "target": {
        "port": 2222,
        "ip": "1.1.1.1",
        "name": "1.1.1.1"
      },
      "server_local": {
        "port": 46,
        "ip": "1.1.1.1",
        "name": "1.1.1.1"
      }
    },
    "user": {
      "server_username": "user2",
      "gateway_username": "user2"
    },
    "client": {
      "port": 48680,
      "ip": "3.3.3.3",
      "name": "3.3.3.3"
    },
    "active": false,
    "start_time": 1,
    "duration": 4,
    "server": {
      "port": 24,
      "ip": "2.2.2.2",
      "name": "2.2.2.2"
    },
    "end_time": 7,
    "protocol": "ssh"
  }
}

When the query is the following:

curl --cookie cookies.txt "https://<IP-address-of-SPS>/api/audit/sessions?format=csv&fields=protocol,end_time,user.gateway_username,server.ip,client.ip,client.port"

The response is the following:

"Key","Protocol","End time","Gateway username","Server IP","Client IP","Client port"
"2","ssh","7","user2","2.2.2.2","3.3.3.3","48680"
"1","ssh","5","user1","2.2.2.2","2.2.2.2","48679"
Example: querying sessions in CSV result format with interesting events

Given that the following sessions were recorded:

{
  "1":{
    "origin": "RECORDING",
    "protocol": "SSH",
    "analytics": {
      "interesting_events": ["ssh", "sudo"],
      "similar_sessions": []
    },
    "recording": {
      "session_id": "1",
      "verdict": "ACCEPT",
      "audit_trail": "/var/lib/zorp/audit/532078660569910c6542b2/01/audit-scb_ssh-1451900800-1.zat",
      "connection_policy": "ssh1",
      "content_reference_id": 1
    }
  },
  "2":{
    "origin": "RECORDING",
    "protocol": "SSH",
    "analytics": {
      "interesting_events": ["sudo", "systemctl"],
      "similar_sessions": []
    },
    "recording": {
      "session_id": "2",
      "verdict": "ACCEPT",
      "connection_policy": "ssh2",
      "content_reference_id": 2
    }
  }
}

When the query is the following:

curl --cookie cookies.txt "https://<IP-address-of-SPS>/api/audit/sessions?sort=recording.session_id&format=csv&fields=recording.session_id,analytics.interesting_events,analytics.similar_sessions"

The response is the following:

"Key","Recording Session ID","Analytics Interesting events","Similar Sessions"
"1","1","ssh",""
"1","1","sudo",""
"2","2","sudo",""
"2","2","systemctl",""
Example: querying sessions in CSV result format with audit trail link

Given that the following sessions were recorded:

{
  "svc-paKzcMJwXghEFJ9UvsdqFU-sid-1": {
    "origin": "RECORDING",
    "protocol": "SSH",
    "recording": {
      "session_id": "1",
      "verdict": "ACCEPT",
      "audit_trail": "/var/lib/zorp/audit/532078660569910c6542b2/01/audit-scb_ssh-1451900800-1.zat",
      "connection_policy": "ssh1",
      "content_reference_id": 1
    }
  },
  "svc-paKzcMJwXghEFJ9UvsdqFU-sid-2": {
   "origin": "RECORDING",
    "protocol": "SSH",
    "recording": {
      "session_id": "2",
      "verdict": "ACCEPT",
      "connection_policy": "ssh2",
      "content_reference_id": 2
    }
  }
}

When the query is the following:

curl --cookie cookies.txt "https://<IP-address-of-SPS>/api/audit/sessions?format=csv&fields=trail_download_link"

The response is the following:

"Key","Audit trail download link"
"svc-paKzcMJwXghEFJ9UvsdqFU-sid-2",""
"svc-paKzcMJwXghEFJ9UvsdqFU-sid-1","https://127.0.0.1/api/audit/sessions/svc-paKzcMJwXghEFJ9UvsdqFU-sid-1/audit_trail"

Retrieving all sessions from the session database with the advanced search method

You can retrieve sessions from the session database by using a refined query, with the basic search method. However, the basic search method has limitations due to match count restraints and pagination methods. If you have to work outside these limitations, you can also retrieve all session metadata stored at a specified moment from the sessions database, with the advanced search method. This method builds on session database snapshots.

Using the advanced search method has the following workflow:

  1. Creating a new session database snapshot

  2. Querying the new session database snapshot

Creating a new session database snapshot

Before you can retrieve all sessions from the session database, you must create a new session database snapshot.

URL
GET https://<IP-address-of-SPS>/api/audit/sessions/_snapshot
Cookies
Cookie name Description Required Values
session_id Contains the authentication token of the user Required

The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For more information on authentication, see Authenticate to the SPS REST API.

NOTE: This session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format).

Prerequisites

Before creating a new snapshot, consider the following:

  • You must have search rights to create a new snapshot. For more information, see Assigning search privileges in the SPS Administration Guide.

  • You can use a cached snapshot for further queries if you included the Remote-Addr and User-Agent parameter values in the header of your request and the snapshot ID is associated with you. You can use a snapshot from the cache until it expires. Snapshots expire in 5 minutes, but all subsequent queries you make in a given snapshot extend its validity by 5 more minutes.

Limitations

Creating a new session database snapshot has the following limitations:

  • You can only have one snapshot open at the same time.

  • If you want to create a new snapshot, but you already have another snapshot open, you must not query the previously opened snapshot for at least 5 minutes.

  • If you do not set the Remote-Addr and the User-Agent parameters in the header, the endpoint creates the snapshot, but it associates the snapshot ID with an unknown user. If several unknown users use the endpoint, the endpoint can provide you a snapshot from the cache that was created by another unknown user.

Cache handling logic

If you create a snapshot, the snapshot ID is stored in an internal cache of the endpoint and the ID is associated with you.

You are identified by the values of the Remote-Addr and User-Agent header parameters.

NOTE: By default, the Remote-Addr and the User-Agent values are not included in the header of your request. Therefore, before sending the request, set the values for the Remote-Addr and the User-Agent parameters so that the endpoint can associate the snapshot ID with you.

If there is a cached snapshot ID associated with you, you can use the cached snapshot for further queries.

If there is no cached snapshot ID associated with you, the endpoint creates a new snapshot.

Sample request

The following example illustrates the sample request for creating a new session database snapshot.

Creating a new session database snapshot

Sample request:

curl --cookie cookies.txt 'https://<IP-address-of-SPS>/api/audit/sessions/_snapshot' \
-H "Remote-Addr: 10.10.10.10" \
-H "User-Agent: Agent-1/1.0"

Where:

  • Remote-Addr is your IP address.

  • User-Agent is the identifier of the application that you are using.

Sample response

The following example illustrates the sample response for creating a new session database snapshot.

Creating a new session database snapshot

Sample response:

{ 
  "body": {
    "snapshot": "55cdf68f6d"
  },
  "key": "_snapshot",
  "meta": {
    "href": "/api/audit/sessions/_snapshot",
    "parent": "/api/audit/sessions"
  }
}
HTTP response codes

HTTP response codes comprise of standard or endpoint-specific HTTP status and error codes. The following table lists the endpoint-specific HTTP response codes for creating a snapshot.

Code Description Notes
200 Ok

You have successfully opened the snapshot.

400 InvalidSearchClientId

The search client identifier is invalid.

The value you specified in the Remote-Addr request header is too long.

Provide a value for the Remote-Addr request header that it is at maximum 45 characters long.

400

InvalidSearchClientId

The search client identifier is invalid.

The value you specified in the User-Agent request header is too long.

Provide a value for the User-Agent request header that it is at the maximum 128characters long.

429

AdvancedSearchSnapshotQuotaExceeded

"time_to_elapse": 5,

An open snapshot already exists and you can not open a new one for at least 5 minutes.

500 SearchUnavailable

The search backend is inaccessible.

500 DatabaseConsistencyError

The search database returned an invalid response.

The standard HTTP response codes for this request are:

  • 401 Unauthenticated

  • 403 Unauthorized

For more information and a complete list of standard HTTP response codes, see Application level error codes.

Querying the new session database snapshot

After you have created a new session database snapshot, you can start querying it through the /api/audit/sessions endpoint.

NOTE: Before querying the newly created session database snapshot, consider the following:

  • Unsupported request parameters for the advanced search method

    • The offset parameter is not supported for the advanced search method.

      The offset parameter is not supported for the advanced search method. Instead, you can iterate between search results by specifying the search_after and tiebreaker parameters in your query. Also, One Identity recommends that you do not include the offset parameter in your configuration. If you do include it, you must set the value of offset to 0.

  • Shortcuts in the "meta" field of your response

    • When querying the session database snapshot, the value of the first, last, and previous fields in the response meta will always be null, as they cannot be computed. The "next" field in the response data, however, will always contain a link to the next search result set if there is more session data that can be retrieved.

  • Using search_after

    • The search_after parameter must have at least one sort key-value pair and exactly one tiebreaker key-value pair, in this exact order.

    • The tiebreaker key-value pair is required for the search_after parameter.

    • When used in the search_after parameter, the order of fields in the sort parameter and the keys in the search_after parameter must be exactly the same.

    • Within the search_after parameter, you cannot specify the same key twice.

    • The fields you specify in search_after must be specified in sort as well, in the exact same order (except for tiebreaker).

    • You must use colons (:) as separator values for the key-value pairs within search_after.

    • You must specify the value of date type fields within the search_after parameter in Epoch seconds.

  • Using sort

    • You can use the sort parameter with the same functions as for the basic search method.

  • Consistency of contents: search_after and sort

    • The fields specified in the sort parameter are reference points for the tiebreaker key-value pair.

    • The number and order of the fields specified in the sort parameter must match those specified in search_after (with the exception of tiebreaker, which is an additional required key-value pair element for the search_after parameter only).

Specifying these parameters incorrectly results in errors while querying the /api/audit/sessions endpoint. For more information, see the specific HTTP response codes.

URL
GET https://<IP-address-of-SPS>/api/audit/sessions
Cookies
Cookie name Description Required Values
session_id Contains the authentication token of the user Required

The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For more information on authentication, see Authenticate to the SPS REST API.

NOTE: This session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format).

Prerequisites

Querying the new session database snapshot has the following prerequisites:

  • For querying the session database snapshot, you must create a new session database snapshot first.

Limitations

Querying the new session database snapshot has the following limitations:

  • Displaying your query results in CSV format is possible with the basic search method, but not supported with the advanced search method. As a result, when using the advanced search method, you can only set your format parameter to display your query results in JSON format.

Use case scenarios with the advanced search method

The following examples illustrate the possible use case scenarios with the advanced search method, and their corresponding sample requests and responses:

Querying the session count

Using the _count endpoint, you can query the number of sessions in a snapshot if you include the snapshot ID in the request.

Using the _count endpoint, you can check the number of sessions without having to download the data or to browse through it page by page.

Querying the session count

Sample request:

curl --cookie cookies.txt --request GET https://<IP-address-of-SPS>/api/audit/sessions/_count?snapshot=55cdf68f6d
Querying the session count

Sample response: 

{
  "count": 4,
  "meta": {
     "href": "/api/audit/sessions/_count",
     "parent": "/api/audit/sessions"
   }
}

Using the _count endpoint and defining a snapshot ID and a filter in your query, you can query the number of sessions that match the filter criteria.

Querying the session count using a filter

Sample request:

curl --cookie cookies.txt --request GET https://<IP-address-of-SPS>/api/audit/sessions/_count?snapshot=55cdf68f6d&q=protocol%3ASSH
Querying the session count using a filter

Sample response: 

{
  "count": 2,
  "meta": {
    "href": "/api/audit/sessions/_count",
    "parent": "/api/audit/sessions"
  }
}
HTTP response codes

HTTP response codes comprise of standard or endpoint-specific HTTP status and error codes. The following table lists the endpoint-specific HTTP response codes for creating a snapshot.

Code Description Notes
400 InvalidAdvancedSearchCountQuery

The filter may be invalid. The backend of the sessions endpoint returned an error. Make sure that you enter a valid filter query. The snapshot ID should be the same you received in the response of the _snapshot endpoint. For more information on correct query syntax, see Searching in the session database with the basic search method.

400 InvalidSearchClientId

The search client identifier is invalid.

The value you specified in the Remote-Addr request header is too long.

Provide a value for the Remote-Addr request header that it is at maximum 45 characters long.

400

InvalidSearchClientId

The search client identifier is invalid.

The value you specified in the User-Agent request header is too long.

Provide a value for the User-Agent request header that it is at the maximum 128 characters long.

404

CountQuerySnapshotNotFound

Your count query is invalid. The snapshot you specified in the snapshot request parameter does not exist or has expired. For more information on how to create a valid request to retrieve the exact number of sessions matching a search query, see the REST API Reference Guide.

For more information and a complete list of standard HTTP response codes, see Application level error codes.

Iterating through query results

To retrieve all sessions from the session database snapshot, you have to iterate through the results until your response meta contains a null value for the "next" field.

To iterate through query results

  1. Send a GET request to the /api/audit/sessions endpoint.

    Sample request:

    curl --cookie cookies.txt 'https://<IP-address-of-SPS>/api/audit/sessions?limit=2&sort=start_time&snapshot=55cdf68f6d'

    Sample response:

    {
  "items": [
    {
      "key": "sid1",
      "meta": {
        "href": "/api/audit/sessions/sid1"
      }
    },
    {
      "key": "sid2",
      "meta": {
        "href": "/api/audit/sessions/sid2"
      }
    }
  ],
  "meta": {
    "fields": [],
    "first": null,
    "href": "/api/audit/sessions",
    "last": null,
    "limit": 2,
    "next": "/api/audit/sessions?limit=2&sort=start_time&snapshot=55cdf68f6d&search_after=start_time:1643677200,tiebreaker:4294967296",
    "parent": "/api/audit",
    "previous": null,
    "search_after": "start_time:1643677200,tiebreaker:4294967296"
  }
}

    The link in the "next": "/api/audit/sessions?limit=2&sort=start_time&snapshot=55cdf68f6d&search_after=start_time:1643677200,tiebreaker:4294967296" key-value pair is required for the next step in iterating.

  2. Iterate through your query results using the next link URL from your previous query result.

    Sample request:

    curl --cookie cookies.txt 'https://<IP-address-of-SPS><NEXT-LINK-FROM-PREVIOUS-RESPONSE>'

    Continue iterating your query results until your response contains a null value as a "next" link.

    Sample response:

    {
  "items": [],
  "meta": {
    "fields": [],
    "first": null,
    "href": "/api/audit/sessions",
    "last": null,
    "limit": 2,
    "next": null,
    "parent": "/api/audit",
    "previous": null,
    "search_after": null
  }
}
Retrieving sessions' metadata with start-end time filter

With the advanced search method, you can retrieve sessions' metadata with start-end time filter.

Sample request:

curl --cookie cookies.txt 'https://<IP-address-of-SPS>/api/audit/sessions?limit=2&sort=start_time&start=2022-01-15T00%3A00%3A00%2B00%3A00&end=2022-05-15T00%3A00%3A00%2B00%3A00&snapshot=55cdf68f6d'

Sample response:

{
  "items": [
    {"key": "sid2", "meta": {"href": "/api/audit/sessions/sid2"}},
    {"key": "sid3", "meta": {"href": "/api/audit/sessions/sid3"}}
  ],
  "meta": {
    "end": "2022-05-15T00:00:00+00:00",
    "fields": [],
    "first": null,
    "href": "/api/audit/sessions",
    "last": null,
    "limit": 2,
    "next": "/api/audit/sessions?limit=2&sort=start_time&start=2022-01-15T00%3A00%3A00%2B00%3A00&end=2022-05-15T00%3A00%3A00%2B00%3A00&snapshot=55cdf68f6d&search_after=start_time:1646096400,tiebreaker:4294967297",
    "parent": "/api/audit",
    "previous": null,
    "search_after": "start_time:1646096400,tiebreaker:4294967297",
    "start": "2022-01-15T00:00:00+00:00"
  }
}
Retrieving specific metadata from sessions with query filter

With the advanced search method, you can retrieve specific metadata from your sessions with query filter.

Sample request:

curl --cookie cookies.txt 'https://<IP-address-of-SPS>/api/audit/sessions?limit=2&sort=start_time&fields=protocol,verdict&q=protocol%3A%20SSH&snapshot=55cdf68f6d'

Sample response:

{
  "items": [
  {
    "body": {
      "protocol": "SSH",
      "verdict": "ACCEPT"
    },
    "key": "sid1",
    "meta": {
    "href": "/api/audit/sessions/sid1"
    }
  },
  {
    "body": {
      "protocol": "SSH",
      "verdict": "ACCEPT"
    },
    "key": "sid4",
    "meta": {
      "href": "/api/audit/sessions/sid4"
      }
    }
  ],
"meta": {
  "fields": [
    "protocol",
    "verdict"
  ],
  "first": null,
  "href": "/api/audit/sessions",
  "last": null,
  "limit": 2,
  "next": "/api/audit/sessions?limit=2&fields=protocol,verdict&q=protocol%3A%20SSH&sort=start_time&snapshot=55cdf68f6d&search_after=start_time:1648774800,tiebreaker:0",
  "parent": "/api/audit",
  "previous": null,
  "search_after": "start_time:1648774800,tiebreaker:0"
  }
}
Retrieving sessions' metadata with modified sort order

With the advanced search method, you can retrieve sessions' metadata with modified sort order.

Sample request:

curl --cookie cookies.txt 'https://<IP-address-of-SPS>/api/audit/sessions?limit=2&sort=-start_time&start=2022-02-15T00%3A00%3A00%2B00%3A00&snapshot=55cdf68f6d'

Sample response:

{
  "items": [
    {"key": "sid6", "meta": {"href": "/api/audit/sessions/sid6"}},
    {"key": "sid5", "meta": {"href": "/api/audit/sessions/sid5"}}
  ],
  "meta": {
    "fields": [],
    "first": null,
    "href": "/api/audit/sessions",
    "last": null,
    "limit": 2,
    "next": "/api/audit/sessions?limit=2&sort=-start_time&start=2022-02-15T00%3A00%3A00%2B00%3A00&snapshot=55cdf68f6d&search_after=start_time:1651366800,tiebreaker:12884901888",
    "parent": "/api/audit",
    "previous": null,
    "search_after": "start_time:1651366800,tiebreaker:12884901888",
    "start": "2022-02-15T00:00:00+00:00"
  }
}
Retrieving sessions' metadata with multiple sort fields

With the advanced search method, you can retrieve sessions' metadata with multiple sort fields.

Sample request:

curl --cookie cookies.txt 'https://<IP-address-of-SPS>/api/audit/sessions?limit=2&sort=-protocol,-start_time&snapshot=55cdf68f6d'

Sample response:

{
  "items": [
    {"key": "sid6", "meta": {"href": "/api/audit/sessions/sid6"}},
    {"key": "sid4", "meta": {"href": "/api/audit/sessions/sid4"}}
  ],
  "meta": {
    "fields": [],
    "first": null,
    "href": "/api/audit/sessions",
    "last": null,"limit": 2,
    "next": "/api/audit/sessions?limit=2&sort=-protocol,-start_time&snapshot=55cdf68f6d&search_after=protocol:SSH,start_time:1648774800,tiebreaker:0",
    "parent": "/api/audit",
    "previous": null,
    "search_after": "protocol:SSH,start_time:1648774800,tiebreaker:0"
  }
}
HTTP response codes

HTTP response codes comprise of standard or endpoint-specific HTTP status and error codes. The following table lists the HTTP response codes specifically for querying the sessions database snapshot.

NOTE: For more information about why you may encounter these HTTP response codes, see the rules and limitations of querying the session database snapshot with the advanced search method.

Code Description Notes
400 MissingSearchAfterSnapshot

The snapshot ID is missing from your query.

400 MissingSearchAfterSort

The sort parameter is missing from your query.

400 InvalidSearchAfterKeyValue

Possible scenario:

The value of one or more keys in the search_after parameter is not valid. Enter valid values for the keys in the search_after parameter.

The following request results in a 400 InvalidSearchAfterKeyValue error:

GET /api/audit/sessions?snapshot="55cdf68f6d"&sort=start_time&search_after=client.ip:<not-a-valid-ip-address>,tiebreaker:42348
400 DuplicatedSearchAfterKey

The search_after parameter contains one or more duplicated key-value pairs. Enter only one key-value pair for a key in the search_after parameter.

The following request results in a 400 DuplicatedSearchAfterKey error:

GET /api/audit/sessions?snapshot="55cdf68f6d"&sort=start_time&search_after=start_time:1666335341,start_time:1666335342,tiebreaker:42348
400 MissingSearchAfterTiebreaker

You have not specified the tiebreaker key-value pair in your search_after parameter.

Specify the tiebreaker key-value parameter for your query.

400

InvalidSearchAfterKeyValueFormat

The format of your search_after parameter is not a valid key-value format.

Specify key-value pairs for the search_after parameter by using a <key>:<value> format.

400

InconsistentSearchAfterParameters

Your search_after query is not valid.

The number of the sort values is inconsistent with the number of the search_after key-value pairs.

400

MissingSearchAfterKeyValue

There are one or more key-value pairs missing from the search_after parameter. Enter key-value pairs in the search_after parameter for the fields specified in the sort parameter.

The following request results in a 400 MissingSearchAfterKeyValue error:

GET /api/audit/sessions?snapshot="55cdf68f6d"&sort=start_time,protocol&search_after=start_time:1666335341,tiebreaker:42348

400

InconsistentSearchAfterOrder

Your search_after query is not valid. The order of the fields in the sort parameter must be the same as the order of the keys in the search_after parameter.

400

InvalidSearchAfterOffset

You have specified the value of offset to a number other than 0.

400

InvalidSearchAfterResponseFormat

You have requested an unsupported response format (for example, the unsupported csv format) for displaying your query results.

400

InvalidSearchAfterQuery

Possible scenarios:

  • Your tiebreaker key-value pair is not valid.

  • Your filter query is not valid.

400 InvalidSearchClientId

The search client identifier is invalid.

The value you specified in the Remote-Addr request header is too long.

Provide a value for the Remote-Addr request header that it is at maximum 45 characters long.

400

InvalidSearchClientId

The search client identifier is invalid.

The value you specified in the User-Agent request header is too long.

Provide a value for the User-Agent request header that it is at the maximum 128 characters long.

404

SearchQuerySnapshotNotFound

Your advanced search query is invalid.

The snapshot you specified in the snapshot request parameter does not exist or has expired.

For more information on how to create a valid request to query all session data, see the REST API Reference Guide.

The standard HTTP response codes for this request are:

  • 401 Unauthenticated

  • 403 Unauthorized

For more information and a complete list of standard HTTP response codes, see Application level error codes.

Retrieving user information from the recorded sessions

You can use the following endpoints for retrieving user information from the recorded sessions:

  • Use the api/audit/users endpoint for retrieving user list information.

  • Use the api/audit/users/<user-id> endpoint for retrieving detailed user information.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating