Activity Log
Paginated record of the calling user's own account activity, newest first: sign-ins (successful and failed) and security changes (password, email, two-factor, "signed out other sessions"). Always scoped to the authenticated caller.
This is the user-facing counterpart of the Account Audit Log: same underlying log, but this endpoint returns the personal sign-in/security events (event_type auth or security), whereas the account audit log returns resource actions (endpoints, domains, certificates, …).
Query parameters
page int
1-based page number. Default
1.page_size int
Rows per page, 1–100. Default
25.type string
Optional filter —
auth (sign-ins) or security (account-security changes). Omit for both.Response (200 OK)
entries[].event_type string
auth (sign-in) or security (password / email / 2FA / session change).entries[].description string
Human-readable line, e.g.
User logged in successfully, Failed sign-in: Invalid MFA token, Two-factor authentication enabled.entries[].actor string
Always
"" here: every entry is your own. (The account audit log fills it with the member who acted.)entries[].sign_in_method string?
On
auth entries: how the sign-in was made — password, sso or sso:<provider> (e.g. sso:google), and for a sign-in completed with a second factor password+mfa, sso+mfa or sso+mfa:<provider> (e.g. sso+mfa:google). Omitted on security entries and when unknown.entries[].auth_method string?
How the request that caused the event authenticated —
cookie, bearer, or api_key. Omitted when unset (a sign-in request has no auth source yet).entries[].ip_address string
Real client IP.
entries[].device string
Parsed from the User-Agent — e.g.
Chrome on Windows.entries[].location string
ISO-3166 alpha-2 country code (e.g.
FI). Unknown when unresolved.entries[].location_detail string
Richer GeoIP detail —
"ISP · timezone". May be empty.entries[].created_at datetime
RFC 3339 UTC timestamp.
page, page_size, total int
Pagination metadata (respects the active
type filter).Deprecated: until the sunset each entry also carries a legacy integer id. Activity entries have no public id; don't use it.
Errors
401 Unauthorized
Missing or invalid auth.
Request
curl "https://api.ngris.com/v1/user/activity-log?page=1&page_size=25&type=security" \
-H "X-API-KEY: <your_api_key>"
Response — 200 OK
{
"entries": [
{
"event_type": "security",
"description": "Two-factor authentication enabled",
"actor": "",
"auth_method": "cookie",
"ip_address": "203.0.113.24",
"device": "Chrome on Windows",
"location": "FI",
"location_detail": "Example ISP · Europe/Helsinki",
"created_at": "2026-05-29T08:14:02Z"
},
{
"event_type": "auth",
"description": "User logged in successfully",
"actor": "",
"sign_in_method": "sso:google",
"ip_address": "203.0.113.24",
"device": "Chrome on Windows",
"location": "FI",
"location_detail": "Example ISP · Europe/Helsinki",
"created_at": "2026-05-29T08:12:40Z"
}
],
"page": 1,
"page_size": 25,
"total": 137
}
Was this helpful?