Obtenez le contexte d'entité récemment mis à jour

GET https://api.ap1.datadoghq.com/api/v2/security_monitoring/entity_context/recently_updatedhttps://api.ap2.datadoghq.com/api/v2/security_monitoring/entity_context/recently_updatedhttps://api.datadoghq.eu/api/v2/security_monitoring/entity_context/recently_updatedhttps://api.ddog-gov.com/api/v2/security_monitoring/entity_context/recently_updatedhttps://api.us2.ddog-gov.com/api/v2/security_monitoring/entity_context/recently_updatedhttps://api.uk1.datadoghq.com/api/v2/security_monitoring/entity_context/recently_updatedhttps://api.datadoghq.com/api/v2/security_monitoring/entity_context/recently_updatedhttps://api.us3.datadoghq.com/api/v2/security_monitoring/entity_context/recently_updatedhttps://api.us5.datadoghq.com/api/v2/security_monitoring/entity_context/recently_updated

Présentation

Get the entities with the most recent updates in the Cloud SIEM entity context store. Entities are ranked by the time of their most recent revision in the requested time range, and the top limit entities are returned in that order. This endpoint is not paginated. This endpoint requires the siem_entities_read permission.

OAuth apps require the siem_entities_read authorization scope to access this endpoint.

Arguments

Chaînes de requête

Réponse

• 200
• 400
• 403
• 429

{
  "data": [
    {
      "attributes": {
        "revisions": [
          {
            "attributes": {
              "accounts": [
                "linked-account-123"
              ],
              "display_name": "Test User",
              "email": "user@example.com",
              "principal_id": "user@example.com"
            },
            "first_seen_at": "2026-04-01T00:00:00Z",
            "last_seen_at": "2026-05-01T00:00:00Z"
          }
        ]
      },
      "id": "user@example.com",
      "type": "siem_entity_identity"
    }
  ]
}

{
  "errors": [
    "Bad Request"
  ]
}

{
  "errors": [
    "Bad Request"
  ]
}

{
  "errors": [
    "Bad Request"
  ]
}

Exemple de code

                  # Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

# Curl command
curl -X GET "https://api.ap1.datadoghq.com"https://api.ap2.datadoghq.com"https://api.datadoghq.eu"https://api.ddog-gov.com"https://api.us2.ddog-gov.com"https://api.uk1.datadoghq.com"https://api.datadoghq.com"https://api.us3.datadoghq.com"https://api.us5.datadoghq.com/api/v2/security_monitoring/entity_context/recently_updated" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"