Asset Logs API

Retrieves activity log entries recorded for a device. Log entries are written automatically by the platform when remote actions are taken, direct sessions such as a terminal or remote desktop are opened, automated tasks run, patch activity occurs, or software is deployed on a device.

For the complete, always-current list of endpoints, parameters, and response fields for the version you are running, use the interactive OpenAPI (Swagger) interface at https://<your-octoja-instance>/openapi/index.html.

Endpoint

Request body

{ "assetId": "uuid", "sourceType": "RealtimeAction", "sourceId": "string", "userId": "uuid", "since": "2026-01-01T00:00:00Z", "page": 1, "pageSize": 50 }

Required: since (return only entries at or after this timestamp). Either assetId or sourceType (or both) must also be provided. sourceId filters within a given sourceType and is only valid together with sourceType; sending it alone returns 400. page defaults to 1 and pageSize defaults to 50 (capped at 500). You can also narrow results with severity and a free-text search, and control ordering with sortBy (Timestamp or SourceType) and sortDir (Asc or Desc). The full field list and types are in Swagger.

Source types

sourceType is one of a fixed set of values (see Swagger), each written for a different kind of activity:

• RealtimeAction — a user triggers a remote action on the device. This covers service control (start, stop, restart, change start type), killing a process, sending a notification to the signed-in user, registry edits, local user accounts (create, enable or disable, change password), Active Directory users and group members, ad-hoc scripts and on-demand checks, package install and uninstall, remote file management (rename, delete, zip, extract, create directory), disk cleanup, inventory runs, agent updates, VMware and Hyper-V power actions, snapshots and checkpoints, waking the device, and opening the Web Console.
• DirectSession — a direct session is opened on a device: terminal, remote desktop, file download or upload, storage analyzer scan, log download, registry search, or event log export.
• Task — an automated task runs against the device, such as an automation run, agent enrollment, or an agent update.
• WindowsPatchManagement — Windows patch activity on the device.
• MacOSPatchManagement — macOS patch activity on the device.
• SoftwareDeployment — software deployment activity on the device.
• Configuration — a user changes the device's configuration: device settings, check assignments, whether a vulnerability is ignored, or a maintenance window being set or cleared.

Response

{ "items": [ { "id": "uuid", "assetId": "uuid", "timestamp": "2026-04-06T10:00:00Z", "severity": "Info", "content": "Opened Terminal session abc-123.", "userId": "user-uuid", "userName": "Alice Example", "source": { "id": "session-abc-123", "sourceType": "DirectSession" } } ], "total": 123 }

Returns a paged result. items holds the log entries for the requested page (ordered by timestamp descending by default), and total is the overall number of matching entries across all pages. Fields worth knowing:

• severity is one of Info, Warning, or Error.
• userId / userName are null when the event had no acting user; userName is resolved from the user record when the log is read, so it shows that user's current display name and is null once the user no longer exists.
• source.id identifies what produced the entry, not the acting user. RealtimeAction, Configuration and Task entries use a stable key (for example restart-service, device-check, automation-run); session, patch and deployment entries usually use the ID of the session, patch cycle or deployment configuration.