Getting zoom activity sign in/out logs

Using this template helps us debug your issues more effectively :slight_smile:

Newbie to API’s, trying to get the above info in to our QRadar SEIM platform which does support a Cloud REST API.

It appears I need to use pagination, but that newbie thing is stopping me.

Which App Type (OAuth / Chatbot / JWT / Webhook)?

Which Endpoint/s?

I think I just need help with how to add pagination code to this, which someone else wrote:

<?xml version="1.0" encoding="UTF-8" ?>
    <Parameter name="host" label="Host" required="true" default="" />
    <Parameter name="api_key" label="API Key" required="true" />
    <Parameter name="api_secret" label="API Secret" required="true" secret="true" />


    <!-- Initialize the Bookmark -->
    <Initialize path="/bookmark" value="1970-01-01" />

    <!-- Create an Access Token -->
    <CreateJWTAccessToken savePath="/access_token">
            <Value name="alg" value="HS256" />
            <Value name="typ" value="JWT" />
            <Value name="iss" value="${/api_key}" />
        <Secret value="${/api_secret}" />

    <!-- Fetch Events -->
    <CallEndpoint url="https://${/host}/v2/report/activities" method="GET" savePath="/get_events">
        <BearerAuthentication token="${/access_token}" />
        <QueryParameter name="from" value="${/bookmark}" omitIfEmpty="true" />
<QueryParameter name="page_size" value="300" />

    <!-- Handle Errors -->
    <If condition="/get_events/status_code != 200">
        <Abort reason="${/get_events/body/code}: ${/get_events/body/message}" />

    <!-- Post Events, if any -->
    <If condition="count(/get_events/body/activity_logs) > 0">

        <PostEvents path="/get_events/body/activity_logs" source="${/host}" />

        <!-- Update the bookmark -->
        <ParseDate pattern="yyyy-MM-dd'T'HH:mm:ss'Z'" timeZone="UTC" date="${max(/get_events/body/activity_logs/time)}" savePath="/last_event_time" />
        <FormatDate pattern="yyyy-MM-dd" timeZone="UTC" time="${/last_event_time + 86400000}" savePath="/bookmark" />



    <DNSResolutionTest host="${/host}" />
    <TCPConnectionTest host="${/host}" />
    <SSLHandshakeTest host="${/host}" />
    <HTTPConnectionThroughProxyTest url="https://${/host}" />

Hey @bryanscu,

It sounds like you’re calling our GET Sign In/Sign Out activity endpoint, right?

I recommend setting the page_size to value of 300:

If there are more than 300 records to return, the JSON API response will include a next_page_token value. You will need to copy that and make a subsequent request that includes this in the request URL, such as:

This will then return the next page of records.

Let me know if this helps—thanks!

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.