Get Reports Data - Netskope Technical Documentation

This endpoint returns the result of a report generated on one of the fields in the summarization database.

Request Endpoint

https://<tenant-URL>/api/v1/report

Valid query parameters are:

Key	Value	Description
`token`	string	Required. The token obtained from the REST API page in the Netskope UI ( Settings > Tools > Rest API v1) is required. We recommend that you place the token in the body of the request, not in the endpoint URL.
`query`	Valid event query.	This acts as a filter for all the cloud app events in the events database.
`type`	`application \| connection \| alert \| network`	Selects application events, connection events or alerts (Policy, DLP, Quarantine, Watchlist).
`groupby`	`application \| user \| device \| activity`	Activity is only available for type = application or alert.
`timeperiod`	`3600` \| `86400 \| 604800 \| 2592000`	Last 60 mins \| Last 24 Hrs \| Last 7 Days \| Last 30 Days
`starttime`	Unix epoch time	Restrict events to those that have timestamps greater than this. Needed only if `timeperiod` or `insertionstarttime/insertionendtime` is not passed.
`endtime`	Unix epoch time	Restrict events to those that have timestamps less than or equal to this. Needed only if `timeperiod` or `insertionstarttime/insertionendtime` is not passed.
`limit`	Positive integer less than 5000	REST API responses can return up to 5000 events in a single response. You can use pagination to retrieve more results.
`skip`	Positive integer	Skip over some of the events (useful for pagination in combination with limit).

Example Report Request

POST https://<tenant-URL>/api/v1/report?query=alert_type%20eq%20DLP&type=alert&groupby=user&timeperiod=3600 
{    "token": "f32a973eddd7bc1602fc0f48dc0a"
}

Query for DLP violations grouped by user:

POST https://<tenant-URL>/api/v1/report?query=alert_type eq DLP&type=alert&groupby=user&timeperiod=2592000
{    "token": "f32a973eddd7bc1602fc0f48dc0a"
}

Set endpoint name as report
Set query=alert_type eq DLP to query for DLP alerts
Set type=alert to query for DLP alerts
Set groupby=user

Key

Value

Description

token

string

Required. The token obtained from the REST API page in the Netskope UI ( Settings > Tools > Rest API v1) is required. We recommend that you place the token in the body of the request, not in the endpoint URL.

query

Valid event query.

This acts as a filter for all the cloud app events in the events database.

type

application | connection | alert | network

Selects application events, connection events or alerts (Policy, DLP, Quarantine, Watchlist).

groupby

application | user | device | activity

Activity is only available for type = application or alert.

timeperiod

3600 | 86400 | 604800 | 2592000

Last 60 mins | Last 24 Hrs | Last 7 Days | Last 30 Days

starttime

Unix epoch time

Restrict events to those that have timestamps greater than this. Needed only if timeperiod or insertionstarttime/insertionendtime is not passed.

endtime

Unix epoch time

Restrict events to those that have timestamps less than or equal to this. Needed only if timeperiod or insertionstarttime/insertionendtime is not passed.

limit

Positive integer less than 5000

REST API responses can return up to 5000 events in a single response. You can use pagination to retrieve more results.

skip

Positive integer

Skip over some of the events (useful for pagination in combination with limit).