Cisco Catalyst SD-WAN Monitoring - Events API

openapi: 3.2.0
info:
  title: Monitoring and Troubleshooting Monitoring - Events API
  description: "Includes API operations for the following:\n  Real-time monitoring\n  Accessing statistics APIs and statistics bulk APIs\n  Retrieving device state\n  Managing alarms and events"
  contact:
    email: vmanage@cisco.com
  license:
    name: Commercial License
    url: https://www.cisco.com/c/en/us/solutions/enterprise-networks/sd-wan/index.html
  version: 26.1.0+2026-01-06
  x-provenance:
    method: harvested
    authored_by: Cisco Catalyst SD-WAN
    harvested_by: API Evangelist
    harvested_on: '2026-08-19'
    first_party: true
    provider_published: true
    source_host: pubhub.devnetcloud.com
    note: 4,138 operations across 2,841 paths, published by Cisco as self-contained per-operation OpenAPI 3.1.0 fragments on the DevNet CDN and consolidated here into 13 documents. Ownership verified from info.contact vmanage@cisco.com and the Cisco license URL rather than from the fetch host.
  x-evidence:
  - type: source
    url: https://pubhub.devnetcloud.com/media/cisco-catalyst-sd-wan-26-1-api-guide/docs/
  - type: source
    url: https://developer.cisco.com/docs/sdwan/
servers:
- url: /dataservice
tags:
- name: Monitoring - Events
paths:
  /event:
    post:
      tags:
      - Monitoring - Events
      description: Get events for given query.
      operationId: postEvents
      parameters:
      - name: page
        in: query
        description: Specify page number. Value should be a positive integer
        schema:
          minimum: 1
          type: integer
          format: int64
      - name: pageSize
        in: query
        description: Specify page size. Value should be a positive integer
        schema:
          minimum: 1
          type: integer
          format: int64
      - name: sortBy
        in: query
        description: Specify a field by which alarms need to be sorted
        schema:
          pattern: ^[a-zA-Z-_]+$
          type: string
      - name: sortOrder
        in: query
        description: Select sorting order. Use ASC for ascending and DESC for descending
        schema:
          type: string
      - name: site-id
        in: query
        description: Specify the site-id to filter the events
        schema:
          pattern: ^[0-9]+$
          type: string
      - name: includeTenants
        in: query
        schema:
          type: boolean
      requestBody:
        description: Event query string
        content:
          application/json:
            schema:
              type: object
            examples:
              Get events filter by hours:
                description: Get events filter by hours
                value:
                  query:
                    condition: AND
                    rules:
                    - field: entry_time
                      operator: last_n_hours
                      type: date
                      value:
                      - '10'
                  size: 100
                $$ref: '#/components/examples/ComViptelaVmanageServerEventRequestFilterByHours'
              Get events filter between dates:
                description: Get events filter between dates
                value:
                  query:
                    condition: AND
                    rules:
                    - field: entry_time
                      type: date
                      value:
                      - 2024-04-30T19:30:00 UTC
                      - 2024-05-30T17:30:00 UTC
                      operator: between
                  size: 100
                $$ref: '#/components/examples/ComViptelaVmanageServerEventRequestFilterBetweenDates'
              Get events filter by type:
                description: Get events filter by type
                value:
                  query:
                    condition: AND
                    rules:
                    - field: entry_time
                      operator: last_n_hours
                      type: date
                      value:
                      - '10'
                    - field: eventname
                      operator: in
                      type: string
                      value:
                      - memory-usage
                  size: 100
                $$ref: '#/components/examples/ComViptelaVmanageServerEventRequestFilterByType'
              Get events filter by system ip:
                description: Get events filter by system ip
                value:
                  query:
                    condition: AND
                    rules:
                    - field: entry_time
                      operator: last_n_hours
                      type: date
                      value:
                      - '10'
                    - field: system_ip
                      operator: in
                      type: string
                      value:
                      - 1.1.1.1
                  size: 100
                $$ref: '#/components/examples/ComViptelaVmanageServerEventRequestFilterBySystemIp'
              Get events filter by severity:
                description: Get events filter by severity
                value:
                  query:
                    condition: AND
                    rules:
                    - field: entry_time
                      operator: last_n_hours
                      type: date
                      value:
                      - '10'
                    - field: severity_level
                      operator: in
                      type: string
                      value:
                      - critical
                  size: 100
                $$ref: '#/components/examples/ComViptelaVmanageServerEventRequestFilterBySeverity'
              Get events filter by site-id:
                description: Get events filter by site-id
                value:
                  query:
                    condition: AND
                    rules:
                    - field: entry_time
                      operator: last_n_hours
                      type: date
                      value:
                      - '10'
                    - field: site_id
                      operator: in
                      type: string
                      value:
                      - '400'
                      - '500'
                  size: 100
                $$ref: '#/components/examples/ComViptelaVmanageServerEventRequestFilterBySites'
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: object
              examples:
                Events:
                  description: Events
                  value:
                    data:
                    - system_ip: 172.16.255.11
                      vmanage_system_ip: 172.16.255.11
                      tenant: default
                      device_type: vedge
                      entry_time: 1666259117528
                      statcycletime: 1666259117528
                      eventname: bfd-state-change
                      component: BFD
                      severity_level: major
                      host_name: vm1
                      event:
                        bfd-state-change:
                          src-ip: 10.0.5.11
                          dst-ip: 10.1.16.16
                          local-system-ip: 172.16.255.11
                          src-port: 12347
                          system-ip: 172.16.255.11
                          dst-port: 12346
                          remote-color: lte
                          host-name: vm1
                          remote-system-ip: 172.16.255.16
                          severity-level: major
                          local-color: lte
                          xmlns: http://viptela.com/bfd
                          deleted: false
                          flap-reason: na
                          proto: ipsec
                          new-state: down
                      details: host-name=vm1; src-ip=10.0.5.11; dst-ip=10.1.16.16; proto=ipsec; src-port=12347; dst-port=12346; local-system-ip=172.16.255.11; local-color=lte; remote-system-ip=172.16.255.16; remote-color=lte; new-state=down; deleted=false; flap-reason=na
                      id: xh_I9IMBLPMz2to0aA3r
                    pageInfo:
                      startTime: '1589073783045'
                      endTime: '1589072535795'
                      count: 15
                  $$ref: '#/components/examples/ComViptelaVmanageServerEventResponseEvent'
        '400':
          description: Bad Request
        '403':
          description: Forbidden
        '500':
          description: Internal Server Error
      x-roles-required: default
    get:
      tags:
      - Monitoring - Events
      description: Get events for given query. If query is empty then last 30 mins data will be returned.
      operationId: getEvents_MonitoringEvents_603
      parameters:
      - name: query
        in: query
        description: Query
        allowEmptyValue: true
        schema:
          type: string
        examples:
          Empty:
            description: Empty
          Get events filter by hours:
            description: Get events filter by hours
            value:
              query:
                condition: AND
                rules:
                - field: entry_time
                  operator: last_n_hours
                  type: date
                  value:
                  - '10'
              size: 100
            $$ref: '#/components/examples/ComViptelaVmanageServerEventRequestFilterByHours'
          Get events filter between dates:
            description: Get events filter between dates
            value:
              query:
                condition: AND
                rules:
                - field: entry_time
                  type: date
                  value:
                  - 2024-04-30T19:30:00 UTC
                  - 2024-05-30T17:30:00 UTC
                  operator: between
              size: 100
            $$ref: '#/components/examples/ComViptelaVmanageServerEventRequestFilterBetweenDates'
          Get events filter by type:
            description: Get events filter by type
            value:
              query:
                condition: AND
                rules:
                - field: entry_time
                  operator: last_n_hours
                  type: date
                  value:
                  - '10'
                - field: eventname
                  operator: in
                  type: string
                  value:
                  - memory-usage
              size: 100
            $$ref: '#/components/examples/ComViptelaVmanageServerEventRequestFilterByType'
          Get events filter by system ip:
            description: Get events filter by system ip
            value:
              query:
                condition: AND
                rules:
                - field: entry_time
                  operator: last_n_hours
                  type: date
                  value:
                  - '10'
                - field: system_ip
                  operator: in
                  type: string
                  value:
                  - 1.1.1.1
              size: 100
            $$ref: '#/components/examples/ComViptelaVmanageServerEventRequestFilterBySystemIp'
          Get events filter by severity:
            description: Get events filter by severity
            value:
              query:
                condition: AND
                rules:
                - field: entry_time
                  operator: last_n_hours
                  type: date
                  value:
                  - '10'
                - field: severity_level
                  operator: in
                  type: string
                  value:
                  - critical
              size: 100
            $$ref: '#/components/examples/ComViptelaVmanageServerEventRequestFilterBySeverity'
          Get events filter by site-id:
            description: Get events filter by site-id
            value:
              query:
                condition: AND
                rules:
                - field: entry_time
                  operator: last_n_hours
                  type: date
                  value:
                  - '10'
                - field: site_id
                  operator: in
                  type: string
                  value:
                  - '400'
                  - '500'
              size: 100
            $$ref: '#/components/examples/ComViptelaVmanageServerEventRequestFilterBySites'
      - name: page
        in: query
        description: Specify page number. Value should be a positive integer
        schema:
          minimum: 1
          type: integer
          format: int64
      - name: pageSize
        in: query
        description: Specify page size. Value should be a positive integer
        schema:
          minimum: 1
          type: integer
          format: int64
      - name: sortBy
        in: query
        description: Specify a field by which alarms need to be sorted
        schema:
          pattern: ^[a-zA-Z-_]+$
          type: string
      - name: sortOrder
        in: query
        description: Select sorting order. Use ASC for ascending and DESC for descending
        schema:
          type: string
      - name: site-id
        in: query
        description: Specify the site-id to filter the events
        schema:
          pattern: ^[0-9]+$
          type: string
      - name: includeTenants
        in: query
        schema:
          type: boolean
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: object
              examples:
                Events:
                  description: Events
                  value:
                    data:
                    - system_ip: 172.16.255.11
                      vmanage_system_ip: 172.16.255.11
                      tenant: default
                      device_type: vedge
                      entry_time: 1666259117528
                      statcycletime: 1666259117528
                      eventname: bfd-state-change
                      component: BFD
                      severity_level: major
                      host_name: vm1
                      event:
                        bfd-state-change:
                          src-ip: 10.0.5.11
                          dst-ip: 10.1.16.16
                          local-system-ip: 172.16.255.11
                          src-port: 12347
                          system-ip: 172.16.255.11
                          dst-port: 12346
                          remote-color: lte
                          host-name: vm1
                          remote-system-ip: 172.16.255.16
                          severity-level: major
                          local-color: lte
                          xmlns: http://viptela.com/bfd
                          deleted: false
                          flap-reason: na
                          proto: ipsec
                          new-state: down
                      details: host-name=vm1; src-ip=10.0.5.11; dst-ip=10.1.16.16; proto=ipsec; src-port=12347; dst-port=12346; local-system-ip=172.16.255.11; local-color=lte; remote-system-ip=172.16.255.16; remote-color=lte; new-state=down; deleted=false; flap-reason=na
                      id: xh_I9IMBLPMz2to0aA3r
                    pageInfo:
                      startTime: '1589073783045'
                      endTime: '1589072535795'
                      count: 15
                  $$ref: '#/components/examples/ComViptelaVmanageServerEventResponseEvent'
        '400':
          description: Bad Request
        '403':
          description: Forbidden
        '500':
          description: Internal Server Error
      x-roles-required: Events-read
  /event/aggregation:
    get:
      tags:
      - Monitoring - Events
      description: Get aggregated count of events based on given query.
      operationId: getAggregationData_MonitoringEvents_1803
      parameters:
      - name: query
        in: query
        description: Query
        required: true
        schema:
          type: string
        examples:
          Aggregation by severity:
            description: Aggregation by severity
            value:
              query:
                condition: AND
                rules:
                - field: entry_time
                  type: date
                  value:
                  - '24'
                  operator: last_n_hours
              aggregation:
                field:
                - property: severity_level
                  order: asc
                  sequence: 1
                histogram:
                  property: entry_time
                  type: minute
                  interval: 60
                  order: asc
            $$ref: '#/components/examples/ComViptelaVmanageServerEventRequestAggregationBySeverity'
      - name: site-id
        in: query
        description: Specify the site-id to filter the events
        schema:
          pattern: ^[0-9]+$
          type: string
      - name: includeTenants
        in: query
        schema:
          type: boolean
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties:
                      count:
                        type: integer
                        format: int64
                        example: 6
                      entry_time:
                        type: integer
                        format: int64
                        example: 1653575400000
                      severity:
                        type: string
                        enum:
                        - MINOR
                        - MAJOR
                        - MEDIUM
                        - CRITICAL
                    $$ref: '#/components/schemas/AlarmAggregation'
                  entryTimeList:
                    type: array
                    items:
                      type: integer
                      format: int64
                $$ref: '#/components/schemas/AlarmAggregationResponse'
              examples:
                Aggregation by severity:
                  description: Aggregation by severity
                  value:
                    header:
                      generatedOn: 1718014129437
                      columns:
                      - property: entry_time
                        title: Entry_time
                        dataType: date
                        isDisplay: true
                      - property: severity_level
                        title: Severity_level
                        dataType: string
                        isDisplay: true
                      fields:
                      - property: entry_time
                        dataType: date
                      - property: severity_level
                        dataType: string
                    entryTimeList:
                    - 1717927200000
                    - 1717930800000
                    - 1717934400000
                    - 1717938000000
                    - 1717941600000
                    data:
                    - entry_time: 1717988400000
                      severity_level: major
                      count: 878
                    - entry_time: 1717988400000
                      severity_level: minor
                      count: 1104
                    - entry_time: 1717988400000
                      severity_level: critical
                      count: 7
                    - entry_time: 1717992000000
                      severity_level: minor
                      count: 385
                    - entry_time: 1717992000000
                      severity_level: major
                      count: 548
                  $$ref: '#/components/examples/ComViptelaVmanageServerEventResponseAggregationBySeverity'
        '400':
          description: Bad Request
        '403':
          description: Forbidden
        '500':
          description: Internal Server Error
      x-roles-required: Events-read
    post:
      tags:
      - Monitoring - Events
      description: Get aggregated count of events based on given query.
      operationId: postAggregationData_MonitoringEvents_1804
      parameters:
      - name: site-id
        in: query
        description: Specify the site-id to filter the events
        schema:
          pattern: ^[0-9]+$
          type: string
      - name: includeTenants
        in: query
        schema:
          type: boolean
      requestBody:
        description: Query
        content:
          application/json:
            schema:
              type: object
            examples:
              Aggregation by severity:
                description: Aggregation by severity
                value:
                  query:
                    condition: AND
                    rules:
                    - field: entry_time
                      type: date
                      value:
                      - '24'
                      operator: last_n_hours
                  aggregation:
                    field:
                    - property: severity_level
                      order: asc
                      sequence: 1
                    histogram:
                      property: entry_time
                      type: minute
                      interval: 60
                      order: asc
                $$ref: '#/components/examples/ComViptelaVmanageServerEventRequestAggregationBySeverity'
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties:
                      count:
                        type: integer
                        format: int64
                        example: 6
                      entry_time:
                        type: integer
                        format: int64
                        example: 1653575400000
                      severity:
                        type: string
                        enum:
                        - MINOR
                        - MAJOR
                        - MEDIUM
                        - CRITICAL
                    $$ref: '#/components/schemas/AlarmAggregation'
                  entryTimeList:
                    type: array
                    items:
                      type: integer
                      format: int64
                $$ref: '#/components/schemas/AlarmAggregationResponse'
              examples:
                Aggregation by severity:
                  description: Aggregation by severity
                  value:
                    header:
                      generatedOn: 1718014129437
                      columns:
                      - property: entry_time
                        title: Entry_time
                        dataType: date
                        isDisplay: true
                      - property: severity_level
                        title: Severity_level
                        dataType: string
                        isDisplay: true
                      fields:
                      - property: entry_time
                        dataType: date
                      - property: severity_level
                        dataType: string
                    entryTimeList:
                    - 1717927200000
                    - 1717930800000
                    - 1717934400000
                    - 1717938000000
                    - 1717941600000
                    data:
                    - entry_time: 1717988400000
                      severity_level: major
                      count: 878
                    - entry_time: 1717988400000
                      severity_level: minor
                      count: 1104
                    - entry_time: 1717988400000
                      severity_level: critical
                      count: 7
                    - entry_time: 1717992000000
                      severity_level: minor
                      count: 385
                    - entry_time: 1717992000000
                      severity_level: major
                      count: 548
                  $$ref: '#/components/examples/ComViptelaVmanageServerEventResponseAggregationBySeverity'
        '400':
          description: Bad Request
        '403':
          description: Forbidden
        '500':
          description: Internal Server Error
      x-roles-required: Events-read
  /event/byuuids:
    post:
      tags:
      - Monitoring - Events
      description: Get Events for given uuids
      operationId: getByUuids
      parameters:
      - name: timeFilter
        in: query
        description: Query
        allowEmptyValue: true
        schema:
          type: string
        examples:
          Empty:
            description: Empty
          Get events filter by hours:
            description: Get events filter by hours
            value:
              field: entry_time
              operator: last_n_hours
              type: date
              value:
              - '10'
          Get events filter between dates:
            description: Get events filter between dates
            value:
              field: entry_time
              type: date
              value:
              - 2024-04-30T19:30:00 UTC
              - 2024-05-30T17:30:00 UTC
              operator: between
      requestBody:
        description: List of event uuids
        content:
          application/json:
            schema:
              type: array
            examples:
              List of event uuids:
                description: List of event uuids
                value:
                - 8ee4a76c-3e45-4e99-b789-dae0fdcdb015
                - 5f22b598-10cd-4162-9c73-6b37540521e5
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: object
              examples:
                Response:
                  description: Response
                  value: TODO
        '400':
          description: Bad Request
        '403':
          description: Forbidden
        '500':
          description: Internal Server Error
      x-roles-required: Alarms-read
  /event/component/keyvalue:
    get:
      tags:
      - Monitoring - Events
      description: Get event component types.
      operationId: getComponentsAsKeyValue
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: object
                properties:
                  key:
                    type: string
                    example: system
                  value:
                    type: string
                    example: System
                $$ref: '#/components/schemas/SimpleKeyValueMapping'
              examples:
                Response:
                  description: Response
                  value:
                    data:
                    - key: Policy
                      value: Policy
                    - key: Nat
                      value: Nat
                    - key: BFD
                      value: BFD
                    - key: App-Route
                      value: App-Route
                    - key: Nwpi
                      value: Nwpi
                    - key: Security
                      value: Security
                    - key: Statistics
                      value: Statistics
                    - key: System
                      value: System
                    - key: Control
                      value: Control
                    - key: security
                      value: security
                    - key: OMP
                      value: OMP
                    - key: VPN
                      value: VPN
                    - key: PIM
                      value: PIM
                    - key: Software
                      value: Software
                    - key: Hardware
                      value: Hardware
                    - key: CloudExpress
                      value: CloudExpress
                    - key: cloudDock
                      value: cloudDock
                    - key: Firmware
                      value: Firmware
                    - key: Bridge
                      value: Bridge
                    - key: OSPF
                      value: OSPF
                  $$ref: '#/components/examples/ComViptelaVmanageServerEventResponseComponentKeyvalue'
        '400':
          description: Bad Request
        '403':
          description: Forbidden
        '500':
          description: Internal Server Error
      x-roles-required: default
  /event/doccount:
    get:
      tags:
      - Monitoring - Events
      description: Get the count of events as per the query passed.
      operationId: getDocCount_MonitoringEvents_1503
      parameters:
      - name: query
        in: query
        description: Query
        required: true
        schema:
          type: string
        examples:
          Get events filter by hours:
            description: Get events filter by hours
            value:
              query:
                condition: AND
                rules:
                - field: entry_time
                  operator: last_n_hours
                  type: date
                  value:
                  - '10'
              size: 100
            $$ref: '#/components/examples/ComViptelaVmanageServerEventRequestFilterByHours'
          Get events filter between dates:
            description: Get events filter between dates
            value:
              query:
                condition: AND
                rules:
                - field: entry_time
                  type: date
                  value:
                  - 2024-04-30T19:30:00 UTC
                  - 2024-05-30T17:30:00 UTC
                  operator: between
              size: 100
            $$ref: '#/components/examples/ComViptelaVmanageServerEventRequestFilterBetweenDates'
          Get events filter by type:
            description: Get events filter by type
            value:
              query:
                condition: AND
                rules:
                - field: entry_time
                  operator: last_n_hours
                  type: date
                  value:
                  - '10'
                - field: eventname
                  operator: in
                  type: string
                  value:
                  - memory-usage
              size: 100
            $$ref: '#/components/examples/ComViptelaVmanageServerEventRequestFilterByType'
          Get events filter by system ip:
            description: Get events filter by system ip
            value:
              query:
                condition: AND
                rules:
                - field: entry_time
                  operator: last_n_hours
                  type: date
                  value:
                  - '10'
                - field: system_ip
                  operator: in
                  type: string
                  value:
                  - 1.1.1.1
              size: 100
            $$ref: '#/components/examples/ComViptelaVmanageServerEventRequestFilterBySystemIp'
          Get events filter by severity:
            description: Get events filter by severity
            value:
              query:
                condition: AND
                rules:
                - field: entry_time
                  operator: last_n_hours
                  type: date
                  value:
                  - '10'
                - field: severity_level
                  operator: in
                  type: string
                  value:
                  - critical
              size: 100
            $$ref: '#/components/examples/ComViptelaVmanageServerEventRequestFilterBySeverity'
          Get events filter by site-id:
            description: Get events filter by site-id
            value:
              query:
                condition: AND
                rules:
                - field: entry_time
                  operator: last_n_hours
                  type: date
                  value

# --- truncated at 32 KB (143 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cisco-catalyst-sdwan/refs/heads/main/openapi/cisco-catalyst-sdwan-monitoring-events-api-openapi.yml