get_events
Retrieve Keycloak events filtered by type, username, client, IP, or date range. Supports pagination with max results.
Instructions
Get KeyCloak events with optional filters.
Args: event_type: Event type filter (e.g., LOGIN, LOGIN_ERROR, UPDATE_PASSWORD). username: Filter by exact username (email). Resolved to user ID internally. client_id: Filter by client ID (SP name). ip_address: Filter events by source IP (client-side filter). date_from: Start date (YYYY-MM-DD). Defaults to last 24h when omitted (KEYCLOAK_DEFAULT_DATE_FROM_HOURS). date_to: End date (YYYY-MM-DD). max_results: Maximum results (default 50).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| date_to | No | ||
| username | No | ||
| client_id | No | ||
| date_from | No | ||
| event_type | No | ||
| ip_address | No | ||
| max_results | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |