Categories:

Table functions

REST_EVENT_HISTORY¶

Returns a list of SCIM REST API requests made to Snowflake over a specified time interval.

Syntax¶

REST_EVENT_HISTORY(
      REST_SERVICE_TYPE => 'scim'
      [, TIME_RANGE_START => <constant_expr> ]
      [, TIME_RANGE_END => <constant_expr> ]
      [, RESULT_LIMIT => <integer> ] )
Copy

Arguments¶

Required:

REST_SERVICE_TYPE => 'scim'

The type of REST API service. Currently, Snowflake only supports SCIM.

Optional:

TIME_RANGE_START => <constant_expr>, . TIME_RANGE_END => <constant_expr>

Time range (in TIMESTAMP_LTZ format), within the last 7 days, in which the login event occurred.

  • If TIME_RANGE_START is not specified, all logs from the last seven days are returned.

  • If TIME_RANGE_END is not specified, all logs are returned.

If the time range does not fall within the last 7 days, an error is returned.

For more information on functions that you can use, see Date & time functions.

RESULT_LIMIT => <integer>

A number specifying the maximum number of rows returned by the function.

If the number of matching rows is greater than this limit, the queries with the most recent end time (or those that are still executing) are returned, up to the specified limit.

Range: 1 to 10000

Default: 100.

Usage notes¶

  • Currently, the REST_EVENT_HISTORY table function can only be used with SCIM.

  • Only account administrators (i.e. users with the ACCOUNTADMIN role) can obtain query results.

Output¶

The function returns the following columns:

Column Name

Data Type

Description

EVENT_TIMESTAMP

TIMESTAMP_LTZ

Time of the event occurrence.

EVENT_ID

NUMBER

The unique identifier for the request.

EVENT_TYPE

TEXT

The REST API event category. Currently, SCIM is the only possible value.

ENDPOINT

TEXT

The endpoint in the API request (e.g. scim/v2/Users/<id>).

METHOD

TEXT

The HTTP method used in the request.

STATUS

TEXT

The HTTP status result of the request.

ERROR_CODE

TEXT

Error code, if the request was not successful.

DETAILS

TEXT

A description of the result of the API request in JSON format.

CLIENT_IP

TEXT

The IP address where the request originated from.

ACTOR_NAME

TEXT

The name of the actor making the request.

ACTOR_DOMAIN

TEXT

The domain (i.e. security integration) in which the request was made.

RESOURCE_NAME

TEXT

The name of the object making the request.

RESOURCE_DOMAIN

TEXT

The object type (e.g. user) making the request.

Examples¶

Return the SCIM REST API requests made in the last five minutes, up to 200 requests.

use role accountadmin;
use database my_db;
use schema information_schema;
select *
  from table(rest_event_history(
      rest_service_type => 'scim',
      time_range_start => dateadd('minutes',-5,current_timestamp()),
      time_range_end => current_timestamp(),
      200))
  order by event_timestamp;
Copy