> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Migrate activity logs and identity events

> Moving activity-log and identity-event reads from v0 to v1: page-token pagination in place of v0 offsets and cursors, who can read the activity log, and log shipper setup.

Both endpoints return the same entries and events on v1. What changes is pagination and, for the
activity log, who can read it and a new `product_area` filter. The changes every endpoint shares are in
[What changes in v1](https://docs.lumos.com/reference/v1/migrate/what-changes.md).

## Activity logs

| v0 | v1 |
| - | - |
| `GET /activity_logs` | [`GET /v1/activity-logs`](https://docs.lumos.com/api-reference/v1/activity-logs/list-activity-logs) |

Entries have the same fields on both versions, but v1 timestamps end in `Z`. `since` and `until`
work the same way.
[The time window](https://docs.lumos.com/reference/v1/objects/activity-log.md#the-time-window) describes them.

### Paging

Replace the offset arithmetic with the page token, as [Pagination](https://docs.lumos.com/reference/v1/pagination.md)
describes. Pages never repeat an entry.

```bash theme={null}
curl -s 'https://api.lumos.com/v1/activity-logs?since=2026-09-24T00:00:00&until=2026-09-24T01:00:00&page_size=100&page_token=PjF-YWNtZQ%3D%3D' \
  --header 'Authorization: Bearer lsk_your_token'
```

The call returns entries under `activity_logs`, with a response like this:

```json theme={null}
{
  "activity_logs": [
    {
      "event_hash": "b01c7e7c24c786b087ae1121a0cb1640da2aaf65060b471ebf0b6e3df81d18020fca6d495c8852b365b467aa5215615dd4503855dcdccca0d1955ed62f7289d7",
      "event_type": "ADMIN_DISCONNECTS_INTEGRATION",
      "event_type_user_friendly": "A user attempted to disconnect an integration",
      "outcome": "Succeeded",
      "targets": [
        { "target_type": "App class", "app_id": "okta.com", "name": "Okta" }
      ],
      "actor": {
        "actor_type": "Lumos user",
        "email": "jane.smith@example.com",
        "given_name": "Jane",
        "family_name": "Smith"
      },
      "event_began_at": "2026-09-24T00:42:11Z",
      "event_metadata": {}
    }
  ],
  "next_page_token": null
}
```

### Who can read the log

On v1, a user with the Auditor or AppStore Read Only Admin role must send `product_area` with each
request, and can read only their own product area, as
[Who can read the log](https://docs.lumos.com/reference/v1/objects/activity-log.md#who-can-read-the-log) describes. Without
`product_area`, v1 returns `403` to them.

### Log shippers

v1 has no offset to increment, so reconfigure pagination on any log shipper that polls
`/activity_logs`. That includes Elastic Filebeat's `httpjson` input and a Cribl REST Collector. Read
entries from `activity_logs`, not `items`. Then follow the steps in
[Reading the log from a log shipper](https://docs.lumos.com/reference/v1/objects/activity-log.md#reading-the-log-from-a-log-shipper).
That section also has notes for Filebeat and Cribl.

## Identity events

| v0 | v1 |
| - | - |
| `GET /identity_events` | [`GET /v1/identity-events`](https://docs.lumos.com/api-reference/v1/identity-events/list-identity-events) |

Events have the same fields on both versions. The filters `identity_ids`, `changed_fields`,
`start_time`, and `end_time` are unchanged, and so is who can read events.

Replace the cursor with the page token, as [Pagination](https://docs.lumos.com/reference/v1/pagination.md) describes.
[Reading to the end](https://docs.lumos.com/reference/v1/objects/identity-event.md#reading-to-the-end) explains how to tell
that you've read every page.

```bash theme={null}
curl -s 'https://api.lumos.com/v1/identity-events?changed_fields=Status&start_time=2026-09-01T00:00:00Z&page_size=100' \
  --header 'Authorization: Bearer lsk_your_token'
```