ParticipantHi - Where would a person find the last login time for accounts that login with the API? I have checked Access Sessions and the report Inactive User and the API sessions do not get logged. I am not able to load Audit Logs without a timeout to see if the API sessions would be available there.
Thanks
Contributor III don't think you can get that from the API,
Only these are available for a user account.
"fields": [
"_id",
"active",
"address",
"admin",
"all_orgs",
"autodetect_timezone",
"barred",
"billing_id",
"cell",
"city",
"codehighlight",
"console_height",
"contact_fname",
"contact_lname",
"country",
"create_date",
"created_by",
"critical",
"crm_id",
"date_format",
"default_map",
"default_map_type",
"dept",
"dev_html5_graph",
"edit_date",
"email",
"email_2",
"email_3",
"event_severity",
"events_beta",
"events_collapse_orgs",
"events_default_view",
"events_show_masked",
"fax",
"graph_scale_to_100",
"if_graph_perc",
"iflabel_pref",
"im",
"im_type",
"is_email_select",
"ldap",
"login_state",
"mf_user",
"navbar_autohide_disabled",
"network_hide_empty",
"notes",
"office",
"organization",
"page_results",
"pager",
"passwd_expiration",
"passwd_prev_count",
"passwd_reset_required",
"passwd_set_date",
"passwd_strength",
"phone",
"recent_timezone",
"refresh",
"resource_id",
"restrict_ip",
"role",
"show_severity_badges",
"state",
"table_row_height",
"theme",
"ticket_comment_cloaking",
"ticket_note_sort",
"ticket_view_assigned_only",
"timezone",
"title",
"tollfree",
"updated_by",
"user",
"user_policy",
"userdisplayname",
"userprincipalname",
"verification_answer",
"verification_question",
"zip"
ModeratorHello Miles,
To determine the last time a user logged in, you would either need to view the Access or Audit logs. Unfortunately, neither of these are accessible from the API. You can request for the API to gain access to the Access and Audit logs via our Ideas Hub here in the community.
Regards,
Antonio Andres
Senior Technical Support Engineer | ScienceLogic
Contributor IIOthers have said it is not possible via the API, but that information is available via a GQL query if you are familiar with that. It would return the UNIX epoch time for their last login in the results, which can easily be converted with some programming. Let me know if you would like some more details on it. Here is a simple query you can run by going to https://{yourSL1URL}/gql
{
accounts{
edges{
node{
id
user
lastLoginTime
}
}
}
}
This only returns the first 10 results by default, and there are some search options you can do with it as well. Lots of fun stuff with it really.
