{ "info": { "_postman_id": "3818084c-20ea-4707-a5c9-829a6d65870e", "name": "SaaS Alerts Events API", "description": "The SaaS Alerts API provides programmatic access to the SaaS Alerts security monitoring platform for MSPs. The API enables querying of security events, alerts, and user behavior data detected across monitored SaaS applications including Microsoft 365, Google Workspace, Salesforce, Slack, and Dropbox. Authentication uses API keys generated from the SaaS Alerts management interface.\n\nContact Support:\n Name: SaaS Alerts Support", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json", "createdAt": "2026-07-28T02:49:42.000Z", "updatedAt": "2026-07-28T02:49:42.000Z", "lastUpdatedBy": "35240", "uid": "35240-3818084c-20ea-4707-a5c9-829a6d65870e" }, "item": [ { "name": "reports", "item": [ { "name": "events", "item": [ { "name": "List Security Events", "id": "5536f837-6a0b-4903-ad97-d77b466993c5", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "apikey", "apikey": [ { "key": "key", "value": "X-API-Key", "type": "string" }, { "key": "value", "value": "{{apiKey}}", "type": "string" }, { "key": "in", "value": "header", "type": "string" } ] }, "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/reports/events?eventType=mail.forwarding.added&alertStatus=medium&startDate=&endDate=&customerId=&application=microsoft365&pageSize=25&page=1", "host": [ "{{baseUrl}}" ], "path": [ "reports", "events" ], "query": [ { "description": "Filter by event type", "key": "eventType", "value": "mail.forwarding.added" }, { "description": "Filter by alert severity", "key": "alertStatus", "value": "medium" }, { "description": "Filter events from this date (ISO 8601 format)", "key": "startDate", "value": "" }, { "description": "Filter events up to this date (ISO 8601 format)", "key": "endDate", "value": "" }, { "description": "Filter by MSP customer/tenant identifier", "key": "customerId", "value": "" }, { "description": "Filter by monitored SaaS application", "key": "application", "value": "microsoft365" }, { "description": "Number of events per page (max 100)", "key": "pageSize", "value": "25" }, { "description": "Page number for pagination", "key": "page", "value": "1" } ] }, "description": "Returns a list of security events detected across monitored SaaS applications. Supports filtering by event type, application, customer, date range, and severity." }, "response": [ { "id": "2f1c8c56-2a0c-40fe-b868-003f968a3ba8", "name": "List of security events", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "X-API-Key", "value": "" } ], "url": { "raw": "{{baseUrl}}/reports/events?eventType=mail.forwarding.added&alertStatus=medium&startDate=&endDate=&customerId=&application=microsoft365&pageSize=25&page=1", "host": [ "{{baseUrl}}" ], "path": [ "reports", "events" ], "query": [ { "description": "Filter by event type", "key": "eventType", "value": "mail.forwarding.added" }, { "description": "Filter by alert severity", "key": "alertStatus", "value": "medium" }, { "description": "Filter events from this date (ISO 8601 format)", "key": "startDate", "value": "" }, { "description": "Filter events up to this date (ISO 8601 format)", "key": "endDate", "value": "" }, { "description": "Filter by MSP customer/tenant identifier", "key": "customerId", "value": "" }, { "description": "Filter by monitored SaaS application", "key": "application", "value": "microsoft365" }, { "description": "Number of events per page (max 100)", "key": "pageSize", "value": "25" }, { "description": "Page number for pagination", "key": "page", "value": "1" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"events\": [\n {\n \"eventId\": \"\",\n \"eventType\": \"\",\n \"jointDesc\": \"\",\n \"alertStatus\": \"low\",\n \"application\": \"\",\n \"customerId\": \"\",\n \"customerName\": \"\",\n \"userId\": \"\",\n \"sourceIp\": \"\",\n \"timestamp\": \"\",\n \"details\": {\n \"non_7\": 49479328.40578169,\n \"cupidatat5\": \"consectetur anim\",\n \"inc3f\": 85985962\n }\n },\n {\n \"eventId\": \"\",\n \"eventType\": \"\",\n \"jointDesc\": \"\",\n \"alertStatus\": \"low\",\n \"application\": \"\",\n \"customerId\": \"\",\n \"customerName\": \"\",\n \"userId\": \"\",\n \"sourceIp\": \"\",\n \"timestamp\": \"\",\n \"details\": {\n \"laborec2\": \"sunt sint\",\n \"reprehenderit_a1\": 33142979,\n \"qui80c\": -48174634.8224096\n }\n }\n ],\n \"pagination\": {\n \"page\": \"\",\n \"pageSize\": \"\",\n \"totalPages\": \"\",\n \"totalCount\": \"\"\n }\n}", "createdAt": "2026-07-28T02:49:42.000Z", "updatedAt": "2026-07-28T02:49:42.000Z", "uid": "35240-2f1c8c56-2a0c-40fe-b868-003f968a3ba8" }, { "id": "279c14bf-5043-42ff-8581-4be18334ddc0", "name": "Unauthorized - invalid or missing API key", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: apikey", "key": "X-API-Key", "value": "" } ], "url": { "raw": "{{baseUrl}}/reports/events?eventType=mail.forwarding.added&alertStatus=medium&startDate=&endDate=&customerId=&application=microsoft365&pageSize=25&page=1", "host": [ "{{baseUrl}}" ], "path": [ "reports", "events" ], "query": [ { "description": "Filter by event type", "key": "eventType", "value": "mail.forwarding.added" }, { "description": "Filter by alert severity", "key": "alertStatus", "value": "medium" }, { "description": "Filter events from this date (ISO 8601 format)", "key": "startDate", "value": "" }, { "description": "Filter events up to this date (ISO 8601 format)", "key": "endDate", "value": "" }, { "description": "Filter by MSP customer/tenant identifier", "key": "customerId", "value": "" }, { "description": "Filter by monitored SaaS application", "key": "application", "value": "microsoft365" }, { "description": "Number of events per page (max 100)", "key": "pageSize", "value": "25" }, { "description": "Page number for pagination", "key": "page", "value": "1" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T02:49:42.000Z", "updatedAt": "2026-07-28T02:49:42.000Z", "uid": "35240-279c14bf-5043-42ff-8581-4be18334ddc0" }, { "id": "9c73a1ff-ef0c-44c2-947e-b0555fa3e02c", "name": "Forbidden - insufficient permissions", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: apikey", "key": "X-API-Key", "value": "" } ], "url": { "raw": "{{baseUrl}}/reports/events?eventType=mail.forwarding.added&alertStatus=medium&startDate=&endDate=&customerId=&application=microsoft365&pageSize=25&page=1", "host": [ "{{baseUrl}}" ], "path": [ "reports", "events" ], "query": [ { "description": "Filter by event type", "key": "eventType", "value": "mail.forwarding.added" }, { "description": "Filter by alert severity", "key": "alertStatus", "value": "medium" }, { "description": "Filter events from this date (ISO 8601 format)", "key": "startDate", "value": "" }, { "description": "Filter events up to this date (ISO 8601 format)", "key": "endDate", "value": "" }, { "description": "Filter by MSP customer/tenant identifier", "key": "customerId", "value": "" }, { "description": "Filter by monitored SaaS application", "key": "application", "value": "microsoft365" }, { "description": "Number of events per page (max 100)", "key": "pageSize", "value": "25" }, { "description": "Page number for pagination", "key": "page", "value": "1" } ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T02:49:42.000Z", "updatedAt": "2026-07-28T02:49:42.000Z", "uid": "35240-9c73a1ff-ef0c-44c2-947e-b0555fa3e02c" } ], "createdAt": "2026-07-28T02:49:42.000Z", "updatedAt": "2026-07-28T02:49:42.000Z", "uid": "35240-5536f837-6a0b-4903-ad97-d77b466993c5" } ], "id": "41c8994c-2744-46c1-9f95-4951ed093e29", "createdAt": "2026-07-28T02:49:42.000Z", "updatedAt": "2026-07-28T02:49:42.000Z", "uid": "35240-41c8994c-2744-46c1-9f95-4951ed093e29" }, { "name": "event", "item": [ { "name": "query", "item": [ { "name": "Query Security Events", "id": "d5cc4a3a-58c3-45b6-8836-2cf13867208c", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "apikey", "apikey": [ { "key": "key", "value": "X-API-Key", "type": "string" }, { "key": "value", "value": "{{apiKey}}", "type": "string" }, { "key": "in", "value": "header", "type": "string" } ] }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"eventTypes\": [\n \"\",\n \"\"\n ],\n \"alertStatus\": [\n \"critical\",\n \"low\"\n ],\n \"jointDesc\": [\n \"\",\n \"\"\n ],\n \"startDate\": \"\",\n \"endDate\": \"\",\n \"customerIds\": [\n \"\",\n \"\"\n ],\n \"applications\": [\n \"\",\n \"\"\n ],\n \"pageSize\": 25,\n \"page\": 1\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/reports/event/query", "host": [ "{{baseUrl}}" ], "path": [ "reports", "event", "query" ] }, "description": "Executes a structured JSON query against the SaaS Alerts event data indexes. Supports complex filtering with multiple conditions, date ranges, event types, and severity levels. Returns matching events in JSON format." }, "response": [ { "id": "b9afa765-1548-459c-aa51-2cd8a7db1fc1", "name": "Query results", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "X-API-Key", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"eventTypes\": [\n \"\",\n \"\"\n ],\n \"alertStatus\": [\n \"critical\",\n \"low\"\n ],\n \"jointDesc\": [\n \"\",\n \"\"\n ],\n \"startDate\": \"\",\n \"endDate\": \"\",\n \"customerIds\": [\n \"\",\n \"\"\n ],\n \"applications\": [\n \"\",\n \"\"\n ],\n \"pageSize\": 25,\n \"page\": 1\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/reports/event/query", "host": [ "{{baseUrl}}" ], "path": [ "reports", "event", "query" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"events\": [\n {\n \"eventId\": \"\",\n \"eventType\": \"\",\n \"jointDesc\": \"\",\n \"alertStatus\": \"low\",\n \"application\": \"\",\n \"customerId\": \"\",\n \"customerName\": \"\",\n \"userId\": \"\",\n \"sourceIp\": \"\",\n \"timestamp\": \"\",\n \"details\": {\n \"non_7\": 49479328.40578169,\n \"cupidatat5\": \"consectetur anim\",\n \"inc3f\": 85985962\n }\n },\n {\n \"eventId\": \"\",\n \"eventType\": \"\",\n \"jointDesc\": \"\",\n \"alertStatus\": \"low\",\n \"application\": \"\",\n \"customerId\": \"\",\n \"customerName\": \"\",\n \"userId\": \"\",\n \"sourceIp\": \"\",\n \"timestamp\": \"\",\n \"details\": {\n \"laborec2\": \"sunt sint\",\n \"reprehenderit_a1\": 33142979,\n \"qui80c\": -48174634.8224096\n }\n }\n ],\n \"pagination\": {\n \"page\": \"\",\n \"pageSize\": \"\",\n \"totalPages\": \"\",\n \"totalCount\": \"\"\n }\n}", "createdAt": "2026-07-28T02:49:42.000Z", "updatedAt": "2026-07-28T02:49:42.000Z", "uid": "35240-b9afa765-1548-459c-aa51-2cd8a7db1fc1" }, { "id": "e994914f-8b2d-412a-a936-62b3727fe401", "name": "Invalid query format", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "X-API-Key", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"eventTypes\": [\n \"\",\n \"\"\n ],\n \"alertStatus\": [\n \"critical\",\n \"low\"\n ],\n \"jointDesc\": [\n \"\",\n \"\"\n ],\n \"startDate\": \"\",\n \"endDate\": \"\",\n \"customerIds\": [\n \"\",\n \"\"\n ],\n \"applications\": [\n \"\",\n \"\"\n ],\n \"pageSize\": 25,\n \"page\": 1\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/reports/event/query", "host": [ "{{baseUrl}}" ], "path": [ "reports", "event", "query" ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T02:49:42.000Z", "updatedAt": "2026-07-28T02:49:42.000Z", "uid": "35240-e994914f-8b2d-412a-a936-62b3727fe401" }, { "id": "5e709b07-af06-4cab-9320-a7547f0f5fcb", "name": "Unauthorized", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "X-API-Key", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"eventTypes\": [\n \"\",\n \"\"\n ],\n \"alertStatus\": [\n \"critical\",\n \"low\"\n ],\n \"jointDesc\": [\n \"\",\n \"\"\n ],\n \"startDate\": \"\",\n \"endDate\": \"\",\n \"customerIds\": [\n \"\",\n \"\"\n ],\n \"applications\": [\n \"\",\n \"\"\n ],\n \"pageSize\": 25,\n \"page\": 1\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/reports/event/query", "host": [ "{{baseUrl}}" ], "path": [ "reports", "event", "query" ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T02:49:42.000Z", "updatedAt": "2026-07-28T02:49:42.000Z", "uid": "35240-5e709b07-af06-4cab-9320-a7547f0f5fcb" } ], "createdAt": "2026-07-28T02:49:42.000Z", "updatedAt": "2026-07-28T02:49:42.000Z", "uid": "35240-d5cc4a3a-58c3-45b6-8836-2cf13867208c" } ], "id": "372b5db0-4401-45d6-a192-b951e30cca80", "createdAt": "2026-07-28T02:49:42.000Z", "updatedAt": "2026-07-28T02:49:42.000Z", "uid": "35240-372b5db0-4401-45d6-a192-b951e30cca80" } ], "id": "38b45fd1-57c0-4a64-b8fc-8d85f0b06b4e", "createdAt": "2026-07-28T02:49:42.000Z", "updatedAt": "2026-07-28T02:49:42.000Z", "uid": "35240-38b45fd1-57c0-4a64-b8fc-8d85f0b06b4e" } ], "id": "a971ca70-8e6f-4529-8f03-6cf9de247546", "createdAt": "2026-07-28T02:49:42.000Z", "updatedAt": "2026-07-28T02:49:42.000Z", "uid": "35240-a971ca70-8e6f-4529-8f03-6cf9de247546" } ], "variable": [ { "key": "baseUrl", "value": "https://api.saasalerts.com" } ] }