Skip to content
Apploye

List Suspicious Activity Logs

Auth required
GET/v1/suspicious_activity_logs/

Detected injection activity (consecutive or partial) logged by the Apploye desktop agent for one user. user_id is always required.

Filter modes (provide at least one besides user_id):

  • Date range: start_date + end_date (max 31-day span) filter by when injection

was detected (start_timestamp). Optional timezone overrides org timezone for day boundaries.

  • Incremental: updated_since alone filters by blacklisted_app_logs.updated_at >=

watermark (no detection-time window).

  • Combined: date range plus updated_since; watermark must fall within the

date window (inclusive, using request/org timezone).

Offset pagination: default limit 50, max 100.

Parameters

Choose how to filter: set both start_date and end_date, set updated_since on its own, or use both together.

Date range

Filter by when injection was detected. Set both start_date and end_date — you cannot send only one.

Filter start date (YYYY-MM-DD)

Filter end date (YYYY-MM-DD)

IANA timezone string; overrides organization timezone for day boundaries

Incremental sync

Filter by last change time. Set updated_since alone to poll for changes, or add it to a date range to narrow results further.

Return only logs whose updated_at is on or after this ISO 8601 UTC datetime. When used alone (with user_id), filters by updated_at only — no detection-time window. When combined with a date range, must fall within start_date/end_date (inclusive). Each log includes updated_at for watermarking the next poll.

Other filters

User whose logs to return. Must be an active non-client org member.

Filter by severity

Filter by status

Filter by injection type

Page number (1-based)

Items per page (max 100)