Events

The Events API lets you track activity in your Egnyte domain. Use it to discover what has happened since a specific point in time, enabling your application to respond to file system changes, note updates, and permission modifications.

Note: The event stream stores the latest 500,000 events, up to a maximum of 30 days. Older events are not accessible via this API.

Base URL

https://{domain}.egnyte.com/pubapi/v1/events

Version 2 endpoints (which include permission change events) use:

https://{domain}.egnyte.com/pubapi/v2/events

Authentication

All requests require an OAuth 2.0 Bearer token in the Authorization header:

Authorization: Bearer {access_token}

See Authentication for details on obtaining a token.

Polling for Events

The Events API uses cursor-based polling to track changes. A cursor is a monotonically increasing number associated with each event. To watch for events:

Get an initial cursor
Poll periodically for new events after that cursor
Update your cursor to the latest event ID received

Note: Poll at intervals of 5 minutes or more to avoid rate limiting.

Get Current Cursor

Retrieve the current cursor position in the event stream.

Request

GET /pubapi/v1/events/cursor

Example Request

curl -i -X GET "https://{domain}.egnyte.com/pubapi/v1/events/cursor" \
     -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

Response

200 OK

Field	Type	Description
`timestamp`	string	ISO-8601 formatted timestamp of the latest event
`latest_event_id`	integer	The most recent event ID available; use this as your starting cursor
`oldest_event_id`	integer	The oldest event ID still available in the stream

Example Response

{
  "latest_event_id": 16342,
  "oldest_event_id": 16321,
  "timestamp": "2025-05-28T11:41:12.000Z"
}

List Events (v1)

Retrieve events that occurred after a specified cursor. This endpoint returns file_system and note events by default.

Request

GET /pubapi/v1/events?id={cursor_id}

Query Parameters

Parameter	Type	Required	Default	Description
`id`	integer	Yes	—	Cursor ID from a previous call; returns events after this position
`folder`	string	No	—	Scope events to a specific folder path (includes subfolders); events are not guaranteed to move with renamed/moved folders
`suppress`	string	No	`none`	Filter out events: `app` (current application), `user` (current user), or `none`
`type`	string	No	`file_system\|note`	Event types to return; use pipe (`\|`) to separate multiple types (e.g., `file_system\|note`)
`count`	integer	No	`50`	Maximum events per page (min: 1, max: 100)
`reverse`	string	No	`0`	Set to `1` to traverse events in reverse order; returns events from `(id - count + 1)` to `id`

Example Request

curl -i -X GET "https://{domain}.egnyte.com/pubapi/v1/events?id=16341" \
     -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

Response

200 OK

Field	Type	Description
`latest_id`	integer	Latest event ID in this response; use as cursor for next poll
`oldest_id`	integer	Oldest event ID in this response
`count`	integer	Number of events returned
`events`	array	Array of event objects

Event Object

Field	Type	Description
`id`	integer	Unique event identifier
`timestamp`	string	ISO-8601 formatted timestamp when the event was recorded
`action_source`	string	Source of the event: `WebUI`, `SyncEngine`, `Mobile`, `PublicAPI`, `WebEdit`, `System`, `VPC`, or `Other`
`actor`	integer	Numeric ID of the user who performed the action
`type`	string	Event type: `file_system` or `note`
`action`	string	Action performed: `create`, `delete`, `restore`, `move`, `copy` (rename is represented as `move`)
`object_detail`	string	(Optional) URI to the affected resource. Present for `file_system` events (except `delete`) linking to the file metadata endpoint, and for `note` `create` events linking to the annotation endpoint. `null` or absent otherwise
`data`	object	Additional data specific to the event type and action

File System Event Data Fields

Field	Type	Description
`target_path`	string	Destination path for move/copy operations
`target_id`	string	Unique identifier of the file version at the target path
`target_group_id`	string	Unique identifier of the file at the target path
`source_path`	string	Original path for move/copy operations
`source_id`	string	Unique identifier of the file version at the source path
`source_group_id`	string	Unique identifier of the file at the source path
`is_folder`	boolean	`true` if the object is a folder, `false` if it's a file

Note Event Data Fields

Field	Type	Description
`note_id`	string	Unique identifier of the note (comment/annotation)

Example Response

{
  "latest_id": 16342,
  "oldest_id": 16342,
  "count": 1,
  "events": [
    {
      "id": 16342,
      "timestamp": "2025-05-28T11:41:12.000Z",
      "action_source": "WebUI",
      "actor": 1,
      "type": "file_system",
      "action": "copy",
      "data": {
        "target_path": "/Shared/Documents/My Contract.docx",
        "target_id": "89b1e9d9-8a04-4277-807c-d68107796c76",
        "target_group_id": "48f2dade-cd0a-472e-ab81-ab4b78135328",
        "source_path": "/Shared/Contracts/My Contract.docx",
        "source_id": "85756cb4-7d82-439c-9ea4-be80eaebaecf",
        "source_group_id": "19f157de-267a-45e9-903a-a34fdf3a3e4e",
        "is_folder": false
      }
    }
  ]
}

204 No Content

No events occurred after the specified cursor for this user access token.

List Events (v2)

Retrieve events that occurred after a specified cursor. This endpoint returns file_system, note, and permission_change events by default.

Note: This is identical to v1 except it includes permission_change events by default. Use v2 if you need to track permission changes.

Request

GET /pubapi/v2/events?id={cursor_id}

Query Parameters

Parameter	Type	Required	Default	Description
`id`	integer	Yes	—	Cursor ID from a previous call; returns events after this position
`folder`	string	No	—	Scope events to a specific folder path (includes subfolders); events are not guaranteed to move with renamed/moved folders
`suppress`	string	No	`none`	Filter out events: `app` (current application), `user` (current user), or `none`
`type`	string	No	`file_system\|note\|permission_change`	Event types to return; use pipe (`\|`) to separate multiple types
`count`	integer	No	`50`	Maximum events per page (min: 1, max: 100)
`reverse`	string	No	`0`	Set to `1` to traverse events in reverse order; returns events from `(id - count + 1)` to `id`

Example Request

curl -i -X GET "https://{domain}.egnyte.com/pubapi/v2/events?id=16320" \
     -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

Response

200 OK

Returns the same structure as v1, with additional fields for permission_change events.

Permission Change Event Data Fields

Field	Type	Description
`target_path`	string	Folder path where permissions were changed
`is_folder`	boolean	`true` if the object is a folder, `false` if it's a file
`eventTypeSpecificAttributes`	object	Additional data specific to permission change events

Event Type Specific Attributes

Field	Type	Description
`changeGroupEvents`	array	Changes that occurred to user groups
`changePermissionEvent`	object	Details about permission changes
`changeContext`	object	Context of the change; contains snapshot-restore ID if changed via snapshot restore
`targetFolderId`	string	Unique identifier of the folder where permissions changed
`groupChange`	boolean	`true` if `changeGroupEvents` contains at least one element

Change Permission Event

Field	Type	Description
`changedPermissions`	array	Array of permission change objects

Changed Permission Object

Field	Type	Description
`action`	string	Type of change: `ADD` or `DELETE`
`entry`	object	Details about the permission change

Permission Entry

Field	Type	Description
`subject`	string	User or group identifier (e.g., `/user/6`)
`priv`	string	Permission level: `NONE`, `VIEWER_ONLY`, `READ`, `READWRITE`, `RWD`, or `MODIFY`

Example Response

{
  "latest_id": 16321,
  "oldest_id": 16321,
  "count": 1,
  "events": [
    {
      "id": 16321,
      "timestamp": "2024-10-21T05:10:53.000Z",
      "action_source": "WebUI",
      "actor": 1,
      "type": "permission_change",
      "action": "permission_change",
      "data": {
        "target_path": "/Shared/Permission Test/Viewer",
        "is_folder": false
      },
      "eventTypeSpecificAttributes": {
        "changeGroupEvents": [],
        "changePermissionEvent": {
          "changedPermissions": [
            {
              "action": "ADD",
              "entry": {
                "subject": "/user/6",
                "priv": "READ"
              }
            },
            {
              "action": "DELETE",
              "entry": {
                "subject": "/user/6",
                "priv": "NONE"
              }
            }
          ]
        },
        "changeContext": null,
        "targetFolderId": "dd3b7523-6851-4977-97a5-265e45004882",
        "groupChange": false
      }
    }
  ]
}

204 No Content

No events occurred after the specified cursor for this user access token.

Event Types

The Events API supports the following event types:

Type	Description	Available In
`file_system`	File and folder operations (create, delete, move, copy, restore)	v1, v2
`note`	Note-related activity	v1, v2
`permission_change`	Permission modifications on files and folders	v2 only (must be explicitly requested in v1)

Action Sources

Events can originate from multiple sources:

Source	Description
`WebUI`	Egnyte web interface
`SyncEngine`	Desktop sync client
`Mobile`	Mobile applications
`PublicAPI`	API calls
`WebEdit`	Online document editors
`System`	System-generated events
`VPC`	Virtual Private Cloud operations
`Other`	FTP, AD_KIT, EGD, OUTLOOK, GDRIVE_INTEG, SALESFORCE, MALWARE_DETECTION, TRASH_CLEANUP, BULK_IMPORT, UNKNOWN

Error Codes

Status	Error	Description	Resolution
400	Bad Request	Invalid cursor ID or malformed parameters	Verify the `id` parameter is a valid integer; check query parameter format
401	Unauthorized	Invalid or expired token	Refresh your OAuth token
403	Forbidden	Insufficient permissions to access events	Ensure the user has appropriate permissions to view domain activity
404	Not Found	Cursor ID is outside the available range	Use `/events/cursor` to get a valid starting cursor
429	Rate Limited	Too many requests	Wait at least 5 minutes between polling requests; implement exponential backoff

Code Examples

GET /pubapi/v1/events/cursor

curl -i -X GET "https://{domain}.egnyte.com/pubapi/v1/events/cursor" \
     -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

GET /pubapi/v1/events?id={cursor}

curl -i -X GET "https://{domain}.egnyte.com/pubapi/v1/events?id={cursor}" \
     -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

GET /pubapi/v2/events?id=16320&type=permission_change&count=100

curl -i -X GET "https://{domain}.egnyte.com/pubapi/v2/events?id=16320&type=permission_change&count=100" \
     -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

Authentication — How to obtain and refresh OAuth tokens
File System API — Manage files and folders
Best Practices — Rate limiting, pagination, and error handling

Reference →Browse all endpoints

Events

Base URL

Authentication

Polling for Events

Get Current Cursor

Request

Response

List Events (v1)

Request

Query Parameters

Response

Event Object

File System Event Data Fields

Note Event Data Fields

List Events (v2)

Request

Query Parameters

Response

Permission Change Event Data Fields

Event Type Specific Attributes

Change Permission Event

Changed Permission Object

Permission Entry

Event Types

Action Sources

Error Codes

Code Examples

Related Resources