ARAM Events

Retrieve enterprise audit and security event data via the Admin REST API

Description

The ARAM Events endpoint provides programmatic access to enterprise audit logs and security events captured by Keeper's Advanced Reporting and Alerts Module (ARAM). This endpoint enables administrators and security teams to retrieve, filter, and export audit event data for compliance monitoring, security analysis, and SIEM integration.

ARAM captures over 300 distinct event types across the Keeper platform, including authentication events, administrative actions, record operations, sharing activities, and KeeperPAM privileged access events. The Audit Events endpoint exposes this data through a RESTful interface, allowing simple integration with custom applications, automation workflows, and third-party security tools.

Prerequisites

• Active Keeper Enterprise subscription

• Advanced Reporting and Alerts Module (ARAM) add-on enabled

• Administrative privileges with reporting permissions

• Valid Admin REST API authentication credentials

Endpoints

The endpoint for the ARAM Admin API depends on the region of your Keeper Enterprise, ending with /api/rest/public/events:

US:

https://keepersecurity.com/api/rest/public/events

EU:

https://keepersecurity.eu/api/rest/public/events

AU:

https://keepersecurity.com.au/api/rest/public/events

CA:

https://keepersecurity.ca/api/rest/public/events

JP:

https://keepersecurity.jp/api/rest/public/events

GOV:

https://govcloud.keepersecurity.us/api/rest/public/events

In the rest of this guide, we will use the US address. If a call is made to the wrong address for the Enterprise region, an Invalid Token error will be returned.

Event Categories

The endpoint returns events across the following categories:

Category	Description
Security Events	Login attempts, 2FA changes, master password modifications, failed authentications
Administrative Actions	User provisioning, role assignments, policy changes, node management
Record Operations	Record creation, updates, deletions, and access events
Sharing Activities	Record sharing, shared folder operations, team membership changes
KeeperPAM Events	Privileged session recordings, connection events, secret access
Secrets Manager Events	KSM application access, secret retrieval, rotation events
BreachWatch Events	High-risk password detection, resolution tracking

Get Audit Events

Retrieves a paginated list of audit events for a specific enterprise between two dates. This endpoint is primarily used for SIEM integrations (e.g., Azure Sentinel) and is compatible with other log aggregation tools. Results are returned in pages. Use the `continuation_token` from the response to retrieve the next page. When there are no more results, `continuation_token` will be `null` and `has_more` will be `false`. Example: curl --location 'https://keepersecurity.com/api/rest/public/events?start_date=2025-11-24T00%3A00%3A00Z&limit=20&end_date=2025-11-26T23%3A59%3A59Z' \ --header 'x-api-token: Bearer YOUR_API_TOKEN'

{"openapi":"3.0.3","info":{"title":"Keeper Integration API","version":"1.0.0"},"servers":[{"url":"https://keepersecurity.com/api/rest","description":"Production environment"}],"security":[{"ApiTokenAuth":[]}],"components":{"securitySchemes":{"ApiTokenAuth":{"type":"apiKey","in":"header","name":"x-api-token"}}},"paths":{"/public/events":{"get":{"summary":"Get Audit Events","description":"Retrieves a paginated list of audit events for a specific enterprise between two\ndates. This endpoint is primarily used for SIEM integrations (e.g., Azure Sentinel)\nand is compatible with other log aggregation tools.\n\nResults are returned in pages. Use the `continuation_token` from the response\nto retrieve the next page. When there are no more results, `continuation_token`\nwill be `null` and `has_more` will be `false`.\n\nExample:\n\ncurl --location 'https://keepersecurity.com/api/rest/public/events?start_date=2025-11-24T00%3A00%3A00Z&limit=20&end_date=2025-11-26T23%3A59%3A59Z' \\\n--header 'x-api-token: Bearer YOUR_API_TOKEN'\n","tags":["Audit Events"],"parameters":[{"name":"start_date","in":"query","required":true,"schema":{"type":"string","format":"date-time"}},{"name":"end_date","in":"query","required":true,"schema":{"type":"string","format":"date-time"}},{"name":"limit","in":"query","required":false,"schema":{"type":"integer","minimum":1,"maximum":1000,"default":100}},{"name":"continuation_token","in":"query","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"A paginated list of audit events","content":{"application/json":{"schema":{"type":"object","properties":{"continuation_token":{"type":"string","nullable":true},"has_more":{"type":"boolean"},"events":{"type":"array","items":{"type":"object","properties":{"audit_event":{"type":"string"},"remote_address":{"type":"string"},"category":{"type":"string"},"client_version":{"type":"string"},"enterprise_id":{"type":"integer"},"username":{"type":"string"},"timestamp":{"type":"integer"}}}}}}}}},"400":{"description":"Bad request"},"401":{"description":"Unauthorized"},"500":{"description":"Server error"}}}}}}

Endpoint

GET /api/rest/public/events

Purpose Retrieve audit events within a specified date range for your enterprise.

Authentication Send your API key in the x-api-token header: x-api-token: Bearer <API_TOKEN>

Query parameters

Name	Type	Required	Description
start_date	ISO 8601	Yes	Start of the date range (e.g., 2024-07-09T00:00:00Z).
end_date	ISO 8601	Yes	End of the date range (e.g., 2025-07-10T19:45:00Z).
continuation_token	String	Only for pagination	Use the token returned by the API to fetch the next page of events.

Headers

Header	Example
x-api-token	Bearer <API_TOKEN>

Example requests

Without pagination

curl --location 'https://keepersecurity.com/api/rest/public/events?start_date=2024-07-09T00%3A00%3A00Z&end_date=2025-07-10T19%3A45%3A00Z' \
  --header 'x-api-token: Bearer <API_TOKEN>'

With pagination

curl --location 'https://keepersecurity.com/api/rest/public/events?start_date=2024-07-09T00%3A00%3A00Z&end_date=2025-07-10T19%3A45%3A00Z&continuation_token=<CONT_TOKEN>' \
  --header 'x-api-token: Bearer <API_TOKEN>'

Example success response (200)

{
  "has_more": true,
  "events": [
    {
      "audit_event": "login_failure",
      "remote_address": "10.15.12.197",
      "category": "ADMIN",
      "client_version": "Commander 17.1.0",
      "enterprise_id": 8560,
      "username": "[e-mail]",
      "timestamp": 1751910807587
    }
  ],
  "continuation_token": "vWiXa0eu2edoe_fonw5IJHwEbLmxXOACIvuoQRh7j4XiKuu1"
}

Error codes

Code	Message	Cause
400	Missing start date	start_date query parameter is missing
400	Missing end date	end_date query parameter is missing
401	Unauthorized	Invalid or missing API token
500	Internal Server Error	Unexpected server error

Appendix: Quick Reference (Commander)

# List
public-api-key list [--format table|json|csv] [--output <file>]

# Generate
public-api-key generate \
  --name "<name>" \
  --roles "SIEM:1" \
  --expires 24h|7d|30d|1y|never \
  [--format json|csv] [--output <file>]

# Revoke
public-api-key revoke <token_value> [--force]