List Alerts

Returns alert events that have occurred when alerts were triggered — with full details for each event including what activity caused the trigger and a deep-link into the Session Viewer to review the recording. Paginated with up to 1000 events per request.

GET https://<hostname>/ekranapi/alerts

Authentication

string

required

Your Active API Key from the Management Tool.

Query parameters

string

Alert events that occurred after this time are included.Accepted formats: 2021-04-01, 2021-04-01T12:00, 2021-04-01T12:00:00.

string

Alert events that occurred before this time are included.

int

default:"1000"

Number of alert events to return per request.Default: 1000. Maximum: 1000.

int

Cursor for pagination — the ID after which to start returning records. Use the afterActivityId from a previous response to fetch the next batch.

Requesting more than 1000 alert events (alertCount > 1000) returns HTTP 400 Bad Request.

If both start and end are omitted, all alert events in the database are returned (subject to pagination).

Response (200 OK)

int

The ID of the first alert event in the batch. Use this value as the afterActivityId parameter in the next request to fetch the following 1000 events.

array

Array of alert event objects:

Show Alert event

int

The ID of the alert (i.e. the alert rule that was triggered).

int

The ID of the alert event itself (i.e. the specific occurrence when the alert was triggered).

date

When the alert was triggered.

string

The name of the alert.

string

The alert description (typically describes the condition that triggers it).

string

The user name of the user that triggered the alert.

string

The name of the Client computer where the alert was triggered.

string

What user activity caused the alert to fire — e.g. keystroke text, URL, window title, application name.

string

A direct link to open the session in the Session Viewer at the moment the alert was triggered. Format: https://<management-tool-host>/EkranSystem/Player?id=<sessionId>&startSlideId=<activityId>&play=false&mode=0.

The playerLink field contains a legacy URL with /EkranSystem/Player?... — this is the literal current Session Viewer URL preserved verbatim in the API response. Use it exactly as returned by the API.

Example

curl -X GET "https://<hostname>/ekranapi/alerts?start=2022-09-01&end=2022-09-30&alertCount=1000" \
  -H "ApiKey: xJ)tsCNcpj)l+]}(@_|lt!t………"

{
  "afterActivityId": 20223,
  "alerts": [
    {
      "alertId": 88,
      "activityId": 29,
      "date": "2022-09-05T12:33:32.548",
      "alertName": "application alert",
      "alertDescription": "check application equal cmd",
      "userName": "WINDEV2106EVAL\\User",
      "clientName": "WinDev2106Eval",
      "what": "Command Prompt - cmd.exe - cmd",
      "playerLink": "https://localhost/EkranSystem/Player?id=5&startSlideId=29&play=false&mode=0"
    },
    {
      "alertId": 91,
      "activityId": 20223,
      "date": "2022-09-19T16:11:24.356",
      "alertName": "username alert",
      "alertDescription": "check username equal WINDEV2106EVAL\\User",
      "userName": "WINDEV2106EVAL\\User",
      "clientName": "WinDev2106Eval",
      "what": "explorer.exe",
      "playerLink": "https://localhost/EkranSystem/Player?id=1013&startSlideId=20223&play=false&mode=0"
    }
  ]
}

Pagination loop: call the endpoint with alertCount=1000 and no afterActivityId. From the response, take afterActivityId and pass it as the parameter in the next call. Continue until the response contains fewer than 1000 alerts — that’s the last page.

Errors

See Status codes. Common errors:

400 Bad Request — invalid time format, or alertCount > 1000.
403 Forbidden — Data Connector not registered.

Alerts (Management Tool)

The Alerts UI for the rules that produce these events.

Alert events tab

The Management Tool’s view of the same alert events.

List sessions with productivity

Sessions during which alerts fired.

API reference

Base URL, authentication, status codes.

Overview

Application Credentials Broker

Data Connector API

SSO & LDAP

SIEM & Ticketing systems

Authentication

Query parameters

Response (200 OK)

Example

Errors

Alerts (Management Tool)

Alert events tab

List sessions with productivity

API reference

​Authentication

​Query parameters

​Response (200 OK)

​Example

​Errors

​Related

Alerts (Management Tool)

Alert events tab

List sessions with productivity

API reference

Authentication

Query parameters

Response (200 OK)

Example

Errors

Related