v1
latestOpenAPI 3.0.02026-07-141,4077,1665.2 MBGet entity context
Search the Cloud SIEM entity context store for entities that match a query, and return the historical revisions of each entity in the requested time range. The endpoint can either return revisions across an interval (from / to) or the snapshot of each entity at a single point in time (as_of); the two modes are mutually exclusive.
Query parameters
A free-text query (for example, an email address or principal ID) used to filter the entities returned.
The start of the time range to query, as an RFC3339 timestamp or a relative time (for example, now-7d). Defaults to now-7d. Ignored when as_of is set.
The end of the time range to query, as an RFC3339 timestamp or a relative time (for example, now). Defaults to now. Ignored when as_of is set.
A point in time at which to query the entity revisions, as an RFC3339 timestamp, a Unix timestamp (in seconds), or a relative time (for example, now-1d). When set, from and to are ignored. Cannot be combined with custom from / to values.
The maximum number of entities to return.
An opaque token used to fetch the next page of results, as returned in meta.page.next_token of a previous response.
Response
OK
Example response
{
"data": [
{
"attributes": {
"revisions": [
{
"attributes": {
"accounts": [
"linked-account-123"
],
"display_name": "Test User",
"email": "user@example.com",
"principal_id": "user@example.com"
},
"first_seen_at": "2026-04-01T00:00:00Z",
"last_seen_at": "2026-05-01T00:00:00Z"
}
]
},
"id": "user@example.com",
"type": "siem_entity_identity"
}
],
"meta": {
"total_count": 1
}
}