Asset Logs API

Retrieves activity log entries recorded for a device. Log entries are written automatically by the platform when remote actions are taken, terminal sessions are opened or closed, automated tasks run, patch activity occurs, or software is deployed on a device.

For the complete, always-current list of endpoints, parameters, and response fields for the version you are running, use the interactive OpenAPI (Swagger) interface at https://<your-octoja-instance>/openapi/index.html.

Endpoint

Request body

{ "assetId": "uuid", "sourceType": "RealtimeAction", "sourceId": "string", "userId": "uuid", "since": "2026-01-01T00:00:00Z", "page": 1, "pageSize": 50 }

Required: since (return only entries at or after this timestamp). Either assetId or sourceType (or both) must also be provided. sourceId filters within a given sourceType and is only valid together with sourceType; sending it alone returns 400. page defaults to 1 and pageSize defaults to 50 (capped at 500). You can also narrow results with severity and a free-text search, and control ordering with sortBy (Timestamp or SourceType) and sortDir (Asc or Desc). The full field list and types are in Swagger.

Source types

sourceType is one of a fixed set of values (see Swagger), each written for a different kind of activity:

• RealtimeAction — a user starts, stops, restarts a service, or kills a process on a device.
• DirectSession — a terminal session is opened or closed on a device.
• Task — an automated task runs against the device.
• WindowsPatchManagement — Windows patch activity on the device.
• MacOSPatchManagement — macOS patch activity on the device.
• SoftwareDeployment — software deployment activity on the device.
• Configuration — configuration and automation activity on the device.

Response

{ "items": [ { "id": "uuid", "assetId": "uuid", "timestamp": "2026-04-06T10:00:00Z", "severity": "Info", "content": "Opened Terminal session abc-123.", "userId": "user-uuid", "userName": "Alice Example", "source": { "id": "session-abc-123", "sourceType": "DirectSession" } } ], "total": 123 }

Returns a paged result. items holds the log entries for the requested page (ordered by timestamp descending by default), and total is the overall number of matching entries across all pages. Fields worth knowing:

• severity is one of Info, Warning, or Error.
• userId / userName are null when the event had no acting user; userName is the display name captured at the time the entry was written, not the user's current name.
• source.id is the identifier of the originating source object (for example a patch, task, or session ID), not the acting user.