get_events
Retrieve Keycloak events with optional filters on event type, username, client ID, IP address, and date range. Monitor user activity and security events.
Instructions
Get KeyCloak events with optional filters.
Args: event_type: Event type filter (e.g., LOGIN, LOGIN_ERROR, UPDATE_PASSWORD). username: Filter by exact username (email). Resolved to user ID internally. client_id: Filter by client ID (SP name). ip_address: Filter events by source IP (client-side filter). date_from: Start date (YYYY-MM-DD). Defaults to last 24h when omitted (KEYCLOAK_DEFAULT_DATE_FROM_HOURS). date_to: End date (YYYY-MM-DD). max_results: Maximum results (default 50).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| event_type | No | ||
| username | No | ||
| client_id | No | ||
| ip_address | No | ||
| date_from | No | ||
| date_to | No | ||
| max_results | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |