ThousandEyes Endpoint Agent Log Items API

openapi: 3.2.0
info:
  version: 7.0.100
  title: ThousandEyes Endpoint Agent Log Items API
  x-provenance:
    method: harvested
    authored_by: Cisco ThousandEyes
    harvested_by: API Evangelist
    harvested_on: '2026-08-19'
    first_party: true
    provider_published: true
    source_host: pubhub.devnetcloud.com
    note: 27 OpenAPI 3.0 documents (26 per-area plus a unified 326-operation document) served anonymously from Cisco's DevNet CDN. api.thousandeyes.com itself 401s every path, so the contract is public while the API host is gated.
  x-evidence:
  - type: source
    url: https://pubhub.devnetcloud.com/media/000-v7-apis/docs/reference/
  - type: source
    url: https://developer.cisco.com/docs/thousandeyes/
servers:
- description: ThousandEyes API production URL
  url: https://api.thousandeyes.com/v7
tags:
- name: Endpoint Agent Log Items
  x-displayName: Endpoint Agent Log Items
paths:
  /endpoint/agents/{agentId}/logs:
    get:
      tags:
      - Endpoint Agent Log Items
      summary: List endpoint agent log items
      operationId: getEndpointAgentLogItems
      description: Returns paginated logs for an endpoint agent within the requested time range.
      parameters:
      - $ref: '#/components/parameters/Endpoint_Agents_API_EndpointAgentIdPath'
      - $ref: '#/components/parameters/Endpoint_Agents_API_AccountGroupId'
      - $ref: '#/components/parameters/Endpoint_Agents_API_LogItemsMax'
      - $ref: '#/components/parameters/Endpoint_Agents_API_LogItemsCursor'
      - $ref: '#/components/parameters/Endpoint_Agents_API_Window'
      - $ref: '#/components/parameters/Endpoint_Agents_API_StartDateParameter'
      - $ref: '#/components/parameters/Endpoint_Agents_API_EndDateParameter'
      responses:
        '200':
          description: Paginated logs for the endpoint agent.
          content:
            application/hal+json:
              schema:
                $ref: '#/components/schemas/Endpoint_Agents_API_EndpointAgentLogItemsResponse'
        '400':
          $ref: '#/components/responses/Endpoint_Agents_API_400'
        '401':
          $ref: '#/components/responses/Endpoint_Agents_API_401'
        '403':
          $ref: '#/components/responses/Endpoint_Agents_API_403'
        '429':
          $ref: '#/components/responses/Endpoint_Agents_API_429'
        '500':
          $ref: '#/components/responses/Endpoint_Agents_API_500'
        '502':
          $ref: '#/components/responses/Endpoint_Agents_API_502'
        default:
          $ref: '#/components/responses/Endpoint_Agents_API_GeneralError'
      security:
      - Endpoint_Agents_API_BearerAuth: []
components:
  schemas:
    Endpoint_Agents_API_PaginationNextAndSelfLink:
      type: object
      description: A links object containing a related link for forward pagination.
      properties:
        next:
          $ref: '#/components/schemas/Endpoint_Agents_API_Link'
        self:
          $ref: '#/components/schemas/Endpoint_Agents_API_Link'
    Endpoint_Agents_API_EndpointStateChangesLogItemType:
      type: string
      description: State change log item type.
      enum:
      - recover
      - enabled
      - deleted
      - disabled
      example: enabled
      readOnly: true
    Endpoint_Agents_API_EndpointWifiLogItem:
      type:
      - object
      - 'null'
      properties:
        logItemType:
          $ref: '#/components/schemas/Endpoint_Agents_API_EndpointWifiLogItemType'
        ssid:
          type:
          - string
          - 'null'
          description: Wireless network SSID.
          example: CorpWiFi
          readOnly: true
        bssid:
          type:
          - string
          - 'null'
          description: Wireless access point BSSID.
          example: 00:11:22:33:44:55
          readOnly: true
        bssidFrom:
          type:
          - string
          - 'null'
          description: Previous wireless access point BSSID.
          example: 00:11:22:33:44:54
          readOnly: true
        channel:
          type:
          - string
          - 'null'
          description: Wireless channel.
          example: '36'
          readOnly: true
        channelFrom:
          type:
          - string
          - 'null'
          description: Previous wireless channel.
          example: '11'
          readOnly: true
        physicalMode:
          type:
          - string
          - 'null'
          description: Wireless physical mode.
          example: 802.11ac
          readOnly: true
        physicalModeFrom:
          type:
          - string
          - 'null'
          description: Previous wireless physical mode.
          example: 802.11n
          readOnly: true
        failure:
          $ref: '#/components/schemas/Endpoint_Agents_API_EndpointWirelessConnectionFailure'
    Endpoint_Agents_API_EndpointAgentLogItemsResponse:
      type: object
      required:
      - logs
      properties:
        logs:
          x-paginated-items: true
          type: array
          description: Log items for the endpoint agent.
          items:
            $ref: '#/components/schemas/Endpoint_Agents_API_EndpointAgentLogItem'
        _links:
          $ref: '#/components/schemas/Endpoint_Agents_API_PaginationNextAndSelfLink'
    Endpoint_Agents_API_Link:
      type: object
      description: A hyperlink from the containing resource to a URI.
      required:
      - href
      properties:
        href:
          type: string
          description: Its value is either a URI [RFC3986] or a URI template [RFC6570].
          example: https://api.thousandeyes.com/v7/link/to/resource/id
        templated:
          type: boolean
          description: Should be true when the link object's "href" property is a URI template.
        type:
          type: string
          description: Used as a hint to indicate the media type expected when dereferencing the target resource.
        deprecation:
          type: string
          description: Its presence indicates that the link is to be deprecated at a future date. Its value is a URL that should provide further information about the deprecation.
        name:
          type: string
          description: Its value may be used as a secondary key for selecting link objects that share the same relation type.
        profile:
          type: string
          description: A URI that hints about the profile of the target resource.
        title:
          type: string
          description: Intended for labelling the link with a human-readable identifier
        hreflang:
          type: string
          description: Indicates the language of the target resource
    Endpoint_Agents_API_EndpointAgentLogItem:
      type: object
      properties:
        id:
          type: string
          description: Unique ID of the log item.
          example: 8d23f1b7-74ef-4e0c-925c-58601fc0662d
          readOnly: true
        agentLogItemType:
          $ref: '#/components/schemas/Endpoint_Agents_API_EndpointAgentLogItemType'
        timestampMs:
          type: integer
          format: int64
          description: Time when the log item was recorded, in milliseconds since the Unix epoch.
          example: 1709240000000
          readOnly: true
        wifiLogItem:
          $ref: '#/components/schemas/Endpoint_Agents_API_EndpointWifiLogItem'
        vpnLogItem:
          $ref: '#/components/schemas/Endpoint_Agents_API_EndpointVpnLogItem'
        onlineOfflineLogItem:
          $ref: '#/components/schemas/Endpoint_Agents_API_EndpointOnlineOfflineLogItem'
        stateChangesLogItem:
          $ref: '#/components/schemas/Endpoint_Agents_API_EndpointStateChangesLogItem'
    Endpoint_Agents_API_EndpointAgentId:
      type: string
      format: uuid
      description: Unique ID of endpoint agent, from `/endpoint/agents` endpoint.
      example: 861b7557-cd57-4bbb-b648-00bddf88ef49
      readOnly: true
    Endpoint_Agents_API_EndpointWirelessConnectionFailureType:
      type: string
      description: Wireless connection failure phase.
      enum:
      - init
      - auth
      - assoc
      - eap
      - dhcp
      - unknown
      example: auth
      readOnly: true
    Endpoint_Agents_API_UnauthorizedError:
      type: object
      properties:
        error:
          type: string
          example: invalid_token
        error_description:
          type: string
          example: Invalid access token
    Endpoint_Agents_API_EndpointVpnType:
      type: string
      description: VPN vendor or type.
      enum:
      - openvpn
      - cisco-anyconnect
      - palo-alto-globalprotect
      - viscosity
      - ivanti-connect-secure
      - zscaler-internet-access
      - f5-big-ip
      - pptp
      - l2tp
      - sstp
      - ikev2
      - auto
      - unknown
      example: cisco-anyconnect
      readOnly: true
    Endpoint_Agents_API_Error:
      type: object
      properties:
        type:
          type: string
          description: A URI reference that identifies the problem type. When this member is not present, its value is assumed to be "about:blank".
        title:
          type: string
          description: A short, human-readable summary of the problem type.
        status:
          type: integer
          description: The HTTP status code generated by the origin server for this occurrence of the problem.
        detail:
          type: string
          description: A human-readable explanation specific to this occurrence of the problem.
        instance:
          type: string
          description: A URI reference that identifies the specific occurrence of the problem.
    Endpoint_Agents_API_EndpointWifiLogItemType:
      type: string
      description: Wi-Fi log item type.
      enum:
      - wifi-change
      - wifi-connect
      - wifi-disconnect
      - wifi-connection-failure
      - unknown
      example: wifi-connect
      readOnly: true
    Endpoint_Agents_API_EndpointWirelessConnectionFailure:
      type:
      - object
      - 'null'
      properties:
        type:
          $ref: '#/components/schemas/Endpoint_Agents_API_EndpointWirelessConnectionFailureType'
        context:
          type:
          - string
          - 'null'
          description: Additional context for the wireless connection failure.
          example: WPA authentication failed
          readOnly: true
        code:
          type:
          - integer
          - 'null'
          format: int64
          description: Wireless connection failure code.
          example: 4
          readOnly: true
    Endpoint_Agents_API_EndpointOnlineOfflineLogItem:
      type:
      - object
      - 'null'
      properties:
        logItemType:
          $ref: '#/components/schemas/Endpoint_Agents_API_EndpointOnlineOfflineLogItemType'
    Endpoint_Agents_API_ValidationError:
      type: object
      allOf:
      - $ref: '#/components/schemas/Endpoint_Agents_API_Error'
      - type: object
        properties:
          errors:
            type:
            - array
            - 'null'
            description: (Optional) When multiple errors occur, the details for each error are listed.
            items:
              $ref: '#/components/schemas/Endpoint_Agents_API_ValidationErrorItem'
    Endpoint_Agents_API_EndpointStateChangesLogItem:
      type:
      - object
      - 'null'
      properties:
        logItemType:
          $ref: '#/components/schemas/Endpoint_Agents_API_EndpointStateChangesLogItemType'
    Endpoint_Agents_API_EndpointVpnLogItem:
      type:
      - object
      - 'null'
      properties:
        logItemType:
          $ref: '#/components/schemas/Endpoint_Agents_API_EndpointVpnLogItemType'
        vpnType:
          $ref: '#/components/schemas/Endpoint_Agents_API_EndpointVpnType'
        vpnServerName:
          type:
          - string
          - 'null'
          description: VPN server name.
          example: vpn-us-west
          readOnly: true
        vpnServerAddress:
          type:
          - string
          - 'null'
          description: VPN server address.
          example: 192.0.2.10
          readOnly: true
    Endpoint_Agents_API_ValidationErrorItem:
      type: object
      properties:
        code:
          type: string
          description: (Optional) A unique error type/code that can be referenced in the documentation for further details.
        field:
          type: string
          description: Identifies the field that triggered this particular error.
        message:
          type: string
          description: A short, human-readable summary of the error.
    Endpoint_Agents_API_EndpointOnlineOfflineLogItemType:
      type: string
      description: Online/offline log item type.
      enum:
      - online
      - offline
      - unknown
      example: online
      readOnly: true
    Endpoint_Agents_API_EndpointAgentLogItemType:
      type: string
      description: Agent log item category.
      enum:
      - wifi
      - vpn
      - online-offline
      - state-changes
      example: wifi
      readOnly: true
    Endpoint_Agents_API_EndpointVpnLogItemType:
      type: string
      description: VPN log item type.
      enum:
      - vpn-connect
      - vpn-disconnect
      - unknown
      example: vpn-connect
      readOnly: true
  responses:
    Endpoint_Agents_API_400:
      description: Bad Request
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/Endpoint_Agents_API_ValidationError'
          example:
            type: about:blank
            title: Request validation failed. There are invalid or missing fields
            status: 400
            detail: Your request object contains invalid fields.
            instance: /v7
            errors:
            - code: AM-5432
              field: firstName
              message: firstName cannot have fancy characters
            - code: DASH-5622
              field: password
              message: Password cannot be blank
    Endpoint_Agents_API_403:
      description: Insufficient permissions to query endpoint
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/Endpoint_Agents_API_Error'
    Endpoint_Agents_API_GeneralError:
      description: An error occurred
    Endpoint_Agents_API_401:
      description: Unauthorized
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/Endpoint_Agents_API_UnauthorizedError'
    Endpoint_Agents_API_502:
      description: Bad Gateway
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/Endpoint_Agents_API_Error'
    Endpoint_Agents_API_500:
      description: Internal server error
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/Endpoint_Agents_API_Error'
          example:
            type: about:blank
            title: Internal server error
            status: 500
            detail: Optional detail about the internal error message.
            instance: /v7
    Endpoint_Agents_API_429:
      description: Exhausted rate limit for the organization
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/Endpoint_Agents_API_Error'
  parameters:
    Endpoint_Agents_API_StartDateParameter:
      name: startDate
      in: query
      description: Use with the `endDate` parameter. Include the complete time (hours, minutes, and seconds) in UTC time zone, following the ISO 8601 date-time format. See the example for reference. Please note that this parameter can't be used with `window`.
      schema:
        type: string
        format: date-time
        example: '2022-07-17T22:00:54Z'
    Endpoint_Agents_API_AccountGroupId:
      name: aid
      in: query
      description: A unique identifier associated with your account group. You can retrieve your `AccountGroupId` from the `/account-groups` endpoint. Note that you must be assigned to the target account group. Specifying this parameter without being assigned to the target account group will result in an error response.
      required: false
      schema:
        type: string
        example: '1234'
    Endpoint_Agents_API_EndDateParameter:
      name: endDate
      in: query
      description: Defaults to current time the request is made. Use with the `startDate` parameter. Include the complete time (hours, minutes, and seconds) in UTC time zone, following the ISO 8601 date-time format. See the example for reference. Please note that this parameter can't be used with `window`.
      schema:
        type: string
        format: date-time
        example: '2022-07-18T22:00:54Z'
    Endpoint_Agents_API_LogItemsCursor:
      name: cursor
      in: query
      required: false
      description: Opaque cursor from the `_links.next.href` URL in the previous response.
      schema:
        type: string
        example: WyIxNzA5MjQwMDAwMDAwIl0=
    Endpoint_Agents_API_Window:
      name: window
      in: query
      description: 'A dynamic time interval up to the current time of the request. Specify the interval as a number followed by an optional type: `s` for seconds (default if no type is specified), `m` for minutes, `h` for hours, `d` for days, and `w` for weeks.

        For a precise date range, use `startDate` and `endDate`.'
      schema:
        type: string
        pattern: ^\d+(?:[smhdw]{1})?$
        example: 12h
    Endpoint_Agents_API_LogItemsMax:
      name: max
      in: query
      required: false
      description: Maximum number of log items returned per page.
      schema:
        type: integer
        minimum: 1
        maximum: 5000
        default: 1000
        example: 1000
    Endpoint_Agents_API_EndpointAgentIdPath:
      name: agentId
      in: path
      required: true
      description: The identifier of the agent to operate on.
      schema:
        $ref: '#/components/schemas/Endpoint_Agents_API_EndpointAgentId'
  securitySchemes:
    Tests_API_BearerAuth:
      type: http
      scheme: bearer
      description: Bearer authentication token
    Test_Results_API_BearerAuth:
      type: http
      scheme: bearer
      description: Bearer authentication token
    Instant_Tests_API_BearerAuth:
      type: http
      scheme: bearer
      description: Bearer authentication token
    ThousandEyes_for_OpenTelemetry_API_BearerAuth:
      type: http
      scheme: bearer
      description: Bearer authentication token
    Test_Snapshots_API_BearerAuth:
      type: http
      scheme: bearer
      description: Bearer authentication token
    Usage_API_BearerAuth:
      type: http
      scheme: bearer
      description: Bearer authentication token
    Templates_API_BearerAuth:
      type: http
      scheme: bearer
      description: Bearer authentication token
    BGP_Monitors_API_BearerAuth:
      type: http
      scheme: bearer
      description: Bearer authentication token
    Internet_Insights_API_BearerAuth:
      type: http
      scheme: bearer
      description: Bearer authentication token
    Tags_API_BearerAuth:
      type: http
      scheme: bearer
      description: Bearer authentication token
    Integrations_API_BearerAuth:
      type: http
      scheme: bearer
      description: Bearer authentication token
    Event_Detection_API_BearerAuth:
      type: http
      scheme: bearer
      description: Bearer authentication token
    Endpoint_Tests_API_BearerAuth:
      type: http
      scheme: bearer
      description: Bearer authentication token
    Endpoint_Test_Results_API_BearerAuth:
      type: http
      scheme: bearer
      description: Bearer authentication token
    Endpoint_Agent_Labels_API_BearerAuth:
      type: http
      scheme: bearer
      description: Bearer authentication token
    Endpoint_Instant_Scheduled_Tests_API_BearerAuth:
      type: http
      scheme: bearer
      description: Bearer authentication token
    Endpoint_Agents_API_BearerAuth:
      type: http
      scheme: bearer
      description: Bearer authentication token
    Emulation_API_BearerAuth:
      type: http
      scheme: bearer
      description: Bearer authentication token
    Dashboards_API_BearerAuth:
      type: http
      scheme: bearer
      description: Bearer authentication token
    Credentials_API_BearerAuth:
      type: http
      scheme: bearer
      description: Bearer authentication token
    Cloud_Insights_Integrations_API_BearerAuth:
      type: http
      scheme: bearer
      description: Bearer authentication token
    Autonomous_Systems_API_BearerAuth:
      type: http
      scheme: bearer
      description: Bearer authentication token
    API_Token_Management_API_BearerAuth:
      type: http
      scheme: bearer
      description: Bearer authentication token
    Alerts_API_BearerAuth:
      type: http
      scheme: bearer
      description: Bearer authentication token
    Agents_API_BearerAuth:
      type: http
      scheme: bearer
      description: Bearer authentication token
    Administrative_API_BearerAuth:
      type: http
      scheme: bearer
      description: Bearer authentication token
externalDocs:
  description: Find out more about ThousandEyes
  url: https://developer.thousandeyes.com/
x-tagGroups:
- name: Tests API
  tags:
  - Tests
  - Agent to Server Tests
  - Agent to Agent Tests
  - BGP Tests
  - DNS Server Tests
  - DNS Trace Tests
  - DNSSEC Tests
  - HTTP Server Tests
  - Page Load Tests
  - Web Transaction Tests
  - API Tests
  - FTP Server Tests
  - SIP Server Tests
  - Voice Tests
  - Path Visualization Interface Groups
- name: Test Results API
  tags:
  - Network Test Results
  - Web HTTP Server Test Results
  - Web Page Load Test Results
  - Web Transactions Test Results
  - API Test Results
  - Web FTP Server Test Results
  - DNS Trace Test Results
  - DNS Server Test Results
  - DNSSEC Test Results
  - Voice SIP Server Test Results
  - Voice RTP Server Test Results
  - Network BGP Test Results
- name: Instant Tests API
  tags:
  - Instant Tests
  - Agent to Agent Instant Tests
  - Agent to Server Instant Tests
  - DNS Server Instant Tests
  - DNS Trace Instant Tests
  - DNSSEC Instant Tests
  - HTTP Server Instant Tests
  - HTTP Page Load Instant Tests
  - Web Transaction Instant Tests
  - API Instant Tests
  - FTP Server Instant Tests
  - SIP Server Instant Tests
  - Voice Instant Tests
- name: ThousandEyes for OpenTelemetry API
  tags:
  - Streaming
- name: Test Snapshots API
  tags:
  - Test Snapshots
- name: Usage API
  tags:
  - Usage
  - Quotas
- name: Templates API
  tags:
  - Templates
- name: BGP Monitors API
  tags:
  - BGP monitors
- name: Internet Insights API
  tags:
  - Internet Insights Catalog Providers
  - Internet Insights Outages
- name: Tags API
  tags:
  - Tags
  - Tag Assignment
- name: Integrations API
  tags:
  - Credential Vault Operations
  - Operation Connectors
  - CyberArk Conjur Connectors
  - Webhook Operations
  - Generic Connectors
  - Panorama Connectors
- name: Event Detection API
  tags:
  - Events
- name: Endpoint Tests API
  tags:
  - Endpoint Scheduled Tests
  - Agent to Server Endpoint Scheduled Tests
  - HTTP Server Endpoint Scheduled Tests
  - Agent To Server Endpoint Dynamic Tests
  - Endpoint Real User Tests
- name: Endpoint Test Results API
  tags:
  - Network Endpoint Scheduled Test Results
  - HTTP Server Endpoint Scheduled Test Results
  - Network Dynamic Endpoint Test Results
  - Real User Endpoint Test Results
  - Local Network Endpoint Test Results
- name: Endpoint Agent Labels API
  tags:
  - Endpoint Agent Labels
- name: Endpoint Instant Scheduled Tests API
  tags:
  - Agent to Server Endpoint Instant Scheduled Tests
  - HTTP Server Endpoint Instant Scheduled Tests
  - Run Endpoint Instant Scheduled Tests
- name: Endpoint Agents API
  tags:
  - Endpoint Agents
  - Endpoint Agent Log Items
  - Endpoint Proxies
  - Endpoint Agents Transfer
- name: Emulation API
  tags:
  - Emulation
- name: Dashboards API
  tags:
  - Dashboards
  - Dashboard Snapshots
  - Dashboards Filters
- name: Credentials API
  tags:
  - Credentials
- name: Cloud Insights Integrations API
  tags:
  - Cloud Insights Integrations
  - Cloud Insights Integration Policy Settings
- name: Autonomous Systems API
  tags:
  - Autonomous Systems
  - Autonomous System Prefixes
- name: API Token Management API
  tags:
  - API Token
- name: Alerts API
  tags:
  - Alerts
  - Alert Rules
  - Alert Suppression Windows
- name: Agents API
  tags:
  - Cloud and Enterprise Agents
  - Local Problems
  - Enterprise Agent Cluster
  - Cloud and Enterprise Agent Notification Rules
  - Agent Proxies
  - Tests Assignment on Agents
- name: Administrative API
  tags:
  - Account Groups
  - Users
  - Roles
  - Permissions
  - User Events