# Activity Object Format

When interacting with Kloudless' Activity Monitoring endpoints, it's crucial to understand how the response data is structured and what that data represents. Here is an example object for activity generated by a Google Drive user who has created a new file:

{
  "count": 1,
  "cursor": 123456789,
  "objects": [
    {
      "id": "user_id",
      "account": 123456789,
      "action": "+",
      "ip": null,
      "modified": "2019-06-26T21:15:22.122000Z",
      "type": "add",
      "user_id": null,
      "metadata": {
        "id": "file_id_string",
        "raw_id": "cloud-service_id",
        "created": "2019-06-08T21:29:30.054000Z",
        "modified": "2019-06-26T21:15:18.597000Z",
        "name": "Some File",
        "type": "file",
        "size": null,
        "path": null,
        "mime_type":
"application/vnd.openxmlformats-officedocument.wordprocessingml.document",
        "downloadable": true,
        "last_modifier": {
          "api": "team",
          "type": "user",
          "id": "id_string",
          "name": "User Name",
          "email": "user_name@gmail.com",
          "id_type": "login"
        },
        "parent": {
          "id": "folder_id",
          "name": null
        },
        "owner": {
          "api": "team",
          "type": "user",
          "id": "user_id",
          "email": "owner_name@gmail.com",
          "id_type": "login"
        },
        "ancestors": null,
        "account": 123456789
      }
    }
  ],
  "type": "object_list",
  "api": "activity"
}

# Important Attributes

A full overview of the object format and its attributes is available in our docs. Here are some of the important attributes:

  • count This attribute will enumerate the number of Activity objects the data describes. This structure can help confirm your logic is processing all the activity or moderating your reporting.

  • objects This attribute contains data describing the monitored objects. This information will give details describing the activity. The information provided in the unified Activity object can differ between cloud services, due to the differences under-the-hood with how Kloudless generates activity information.

  • cursor This attribute is a string value that identifies a location in the stream that proceeds immediately after the activity described in the objects. Apps must store the cursor in their database to use for subsequent API requests.

Read more about the Activity object format in our documentation.

# Org-wide Audit Events

Individual account activity monitoring can be useful for providing end-user work-flows, but that can quickly become untenable when attempting to work with organization-wide activity monitoring. It is impractical to require every single user to connect their account. Kloudless therefore supports connecting administrator accounts to track audit-type activity across an entire organization or tenant. We created Audit activity monitoring with this in mind. This functionality is supported by the v2 Kloudless Activity API. Currently, Kloudless supports a subset of cloud services:

  • box
  • dropbox
  • gdrive
    • Requires G Suite Enterprise.
  • onedrivebiz
  • sharepoint
  • sharefile
  • egnyte
  • slack
    • Requires Slack Enterprise Grid.

Here is a an example Audit object:

{
  'id': 123456789,  // Identifier of the Kloudless Activity.
  'account': 987654321, // Account identifier of the connected Kloudless Service.
  'api': 'activity',
  'type': 'activity',
  'event_category': '', // A classification of what the event pertains to.
  'event_type': '', // A general action describing the event.
  'event_subtype': '', // A more detailed description of the event.
  'target': {
    ...,
    'api': '',
    'type': ''
  },
  'previous_target': {}
  'impersonate_for_target': null, // ID of the impersonated user
  'timestamp': '2015-10-02T21:38:03Z',
  'session': { // An object that describes the actor’s session.
    'type': 'login',
    'ip': '',
    'user_agent': ,
    ...,
  },
  'actor': { // An object with information describing the origin of the event.
      ...,
      'type': '',
      'api': '',
  },
  'metadata': [{ // Additional data provided on the event details.
      'api': '',
      'type': ''
  }],
  'raw': { // Contains an object attribute with raw data
      'object': {
          ...,
      }
  }
}