Sign in

v1

latestOpenAPI 3.0.02026-07-141,4077,1665.2 MB
Security Monitoring

Get a single entity context

Get a single entity from the Cloud SIEM entity context store by its identifier, returning the historical revisions of the entity in the requested time range. The endpoint can either return revisions across an interval (from / to) or the snapshot of the entity at a single point in time (as_of); the two modes are mutually exclusive.

get/api/v2/security_monitoring/entity_context/{id}

Path parameters

idstring required
Example:user@example.com

The unique identifier of the entity to retrieve.

Query parameters

fromstring
Example:now-7d

The start of the time range to query, as an RFC3339 timestamp or a relative time (for example, now-7d). Defaults to now-7d. Ignored when as_of is set.

tostring
Example:now

The end of the time range to query, as an RFC3339 timestamp or a relative time (for example, now). Defaults to now. Ignored when as_of is set.

as_ofstring

A point in time at which to query the entity revisions, as an RFC3339 timestamp, a Unix timestamp (in seconds), or a relative time (for example, now-1d). When set, from and to are ignored. Cannot be combined with custom from / to values.

Response

OK

Example response

{
  "data": {
    "attributes": {
      "revisions": [
        {
          "attributes": {
            "accounts": [
              "linked-account-123"
            ],
            "display_name": "Test User",
            "email": "user@example.com",
            "principal_id": "user@example.com"
          },
          "first_seen_at": "2026-04-01T00:00:00Z",
          "last_seen_at": "2026-05-01T00:00:00Z"
        }
      ]
    },
    "id": "user@example.com",
    "type": "siem_entity_identity"
  }
}