get_admin_events
Retrieve Keycloak admin events to view operations performed by admins, such as user attribute updates, role assignments, and client configuration changes. Useful when user events do not reflect the changes.
Instructions
Get KeyCloak admin events (changes performed via the Admin REST API).
Admin events record operations performed by service accounts or admin users
— e.g. custom user attribute updates (temp_password), role / group
assignments, client configuration changes. These are distinct from user
events (login / password change). Use this when UPDATE_PROFILE in
get_events is empty but an attribute is known to have changed.
Args: operation_types: Comma-separated list of CREATE, UPDATE, DELETE, ACTION. resource_types: Comma-separated list of USER, CLIENT, ROLE, GROUP, REALM_ROLE, etc. resource_path: Filter by resource path (e.g. "users/{userId}"). date_from: Start date (YYYY-MM-DD). Defaults to last 24h when omitted (KEYCLOAK_DEFAULT_DATE_FROM_HOURS). date_to: End date (YYYY-MM-DD). max_results: Maximum results (default 50). max_repr: Max chars of the representation field. 0 = omit, -1 = full.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| operation_types | No | ||
| resource_types | No | ||
| resource_path | No | ||
| date_from | No | ||
| date_to | No | ||
| max_results | No | ||
| max_repr | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |