Filtering Audit Events

npm i --save @descope/node-sdk

pip3 install descope

go get github.com/descope/go-sdk

// Include the following in your `pom.xml` (Maven)
<dependency>
    <artifactId>java-sdk</artifactId>
    <groupId>com.descope</groupId>
    <version>sdk-version</version> // Check https://github.com/descope/descope-java/releases for the latest versions
</dependency>

gem install descope

composer require descope/descope-php

dotnet add package descope

import DescopeClient from '@descope/node-sdk';
try{
    //  baseUrl="<URL>" // When initializing the Descope client, you can also configure the baseUrl ex: https://auth.company.com  - this is useful when you utilize a custom domain within your Descope project.
    const descopeClient = DescopeClient({ projectId: '__ProjectID__' });
} catch (error) {
    // handle the error
    console.log("failed to initialize: " + error)
}

from descope import (
    REFRESH_SESSION_TOKEN_NAME,
    SESSION_TOKEN_NAME,
    AuthException,
    DeliveryMethod,
    DescopeClient,
    AssociatedTenant,
    RoleMapping,
    AttributeMapping,
    LoginOptions
)
try:
    # You can configure the baseURL by setting the env variable Ex: export DESCOPE_BASE_URI="https://auth.company.com  - this is useful when you utilize custom domain within your Descope project."
    descope_client = DescopeClient(project_id='__ProjectID__')
except Exception as error:
    # handle the error
    print ("failed to initialize. Error:")
    print (error)

import "github.com/descope/go-sdk/descope"
import "github.com/descope/go-sdk/descope/client"

// Utilizing the context package allows for the transmission of context capabilities like cancellation
//      signals during the function call. In cases where context is absent, the context.Background()
//      function serves as a viable alternative.
//      Utilizing context within the Descope GO SDK is supported within versions 1.6.0 and higher.
import (
	"context"
)

// DescopeBaseURL // within the client.Config, you can also configure the baseUrl ex: https://auth.company.com  - this is useful when you utilize a custom domain within your Descope project.

descopeClient, err := client.NewWithConfig(&client.Config{ProjectID:"__ProjectID__"})
if err != nil {
    // handle the error
    log.Println("failed to initialize: " + err.Error())
}

import com.descope.client.Config;
import com.descope.client.DescopeClient;

var descopeClient = new DescopeClient(Config.builder().projectId("__ProjectID__").build());

require 'descope'

@project_id = ENV['__ProjectID__']
@client = Descope::Client.new({ project_id: @project_id})

require 'vendor/autoload.php';
use Descope\SDK\DescopeSDK;
 
$descopeSDK = new DescopeSDK([
    'projectId' => $_ENV['__ProjectID__'],
]);

// appsettings.json

{
  "Descope": {
    "ProjectId": "__ProjectID__",
    "ManagementKey": "DESCOPE_MANAGEMENT_KEY"
  }
}

// Program.cs

using Descope;
using Microsoft.Extensions.Configuration;

// ... In your setup code
var config = new ConfigurationBuilder()
  .AddJsonFile("appsettings.json")
  .Build();

var descopeProjectId = config["Descope:ProjectId"];
var descopeManagementKey = config["Descope:ManagementKey"];

var descopeConfig = new DescopeConfig(projectId: descopeProjectId);
var descopeClient = new DescopeClient(descopeConfig)
{
    ManagementKey = descopeManagementKey,
};

const searchOptions = {
  actions: ["LoginSucceed", "LoginFailed"], // Filter to specific event actions/types
  excludedActions: ["UserRefresh"],          // Optionally exclude specific actions
}

const resp = await descopeClient.management.audit.search(searchOptions)
if (!resp.ok) {
  console.log("Failed to search audits.")
} else {
  console.log("Successfully searched audits.")
  console.log(resp)
}

try:
    resp = descope_client.mgmt.audit.search(
        actions=["LoginSucceed", "LoginFailed"],
        excluded_actions=["UserRefresh"],
    )
    print("Successfully searched audits")
    print(resp)
except AuthException as error:
    print("Failed to search audits")
    print("Status Code: " + str(error.status_code))
    print("Error: " + str(error.error_message))

ctx := context.Background()
searchOptions := &descope.AuditSearchOptions{
    Actions:         []string{"LoginSucceed", "LoginFailed"},
    ExcludedActions: []string{"UserRefresh"},
}

res, err := descopeClient.Management.Audit().Search(ctx, searchOptions)
if err != nil {
    fmt.Println("Unable to search audits: ", err)
} else {
    fmt.Println("Successfully searched audits:")
    for _, auditEvent := range res {
        fmt.Println(auditEvent)
    }
}

AuditService as = descopeClient.getManagementServices().getAuditService();
try {
    AuditSearchResponse resp = as.search(AuditSearchRequest.builder()
            .actions(Arrays.asList("LoginSucceed", "LoginFailed"))
            .from(Instant.now().minus(Duration.ofDays(7))));
} catch (DescopeException de) {
    // Handle the error
}

$response = $descopeSDK->management->audit->search(
  actions: ["LoginSucceed", "LoginFailed"],
  excludedActions: ["UserRefresh"],
);
print_r($response);

const searchOptions = {
  userIDs: ["U2abc123xyz"],
  actions: ["LoginFailed"],
  from: new Date(Date.now() - 7 * 24 * 60 * 60 * 1000),
}

const resp = await descopeClient.management.audit.search(searchOptions)

from datetime import datetime, timedelta

try:
    resp = descope_client.mgmt.audit.search(
        user_ids=["U2abc123xyz"],
        actions=["LoginFailed"],
        from_ts=datetime.utcnow() - timedelta(days=7),
    )
    print(resp)
except AuthException as error:
    print("Error: " + str(error.error_message))

ctx := context.Background()
from := time.Now().AddDate(0, 0, -7)
searchOptions := &descope.AuditSearchOptions{
    UserIDs: []string{"U2abc123xyz"},
    Actions: []string{"LoginFailed"},
    From:    from,
}

res, err := descopeClient.Management.Audit().Search(ctx, searchOptions)

AuditService as = descopeClient.getManagementServices().getAuditService();
try {
    AuditSearchResponse resp = as.search(AuditSearchRequest.builder()
            .userIds(Arrays.asList("U2abc123xyz"))
            .actions(Arrays.asList("LoginFailed"))
            .from(Instant.now().minus(Duration.ofDays(7))));
} catch (DescopeException de) {
    // Handle the error
}

$response = $descopeSDK->management->audit->search(
  userIds: ["U2abc123xyz"],
  actions: ["LoginFailed"],
  fromTs: (new DateTime())->modify('-7 days'),
);
print_r($response);