Contents
On this page

List Events - Plugixa Activity Log

GET /plugixa-activity-log/v1/events

A page of events, newest first, filtered by any combination of severity, event, person, address, object and date.

Needs the view access level (who can call what).

Request

GET https://your-site.example/wp-json/plugixa-activity-log/v1/events?group=authentication&action=failed&with_total=1

Query parameters

The paging parameters per_page, before_id, after_id and with_total are described under lists and pagination.

Filter parameters

Name Type Description
severity string Exact severities, comma separated or repeated: informational, low, medium, high, critical
min_severity string At least this severe
event_code string Event codes, comma separated or repeated
group string An event group key, such as authentication, users or content
module string The id of the module that owns the events, such as content
user_id integer The WordPress user id of the person who acted
user_login string The login recorded at the time. Also matches a failed sign-in by the name that was typed
user_role string The role the person had at the time
ip string An exact client address
object_type string The kind of object: user, post, media, comment, term, plugin, theme, option and others
object_id integer The id of the object
action string The verb: created, modified, deleted, login, failed, activated and others
search string Free text over the message, the object and the login. At most 100 characters
date_from string Start: Y-m-d or ISO 8601, read in the site’s time zone. A bare date means the start of that day
date_to string End, inclusive: Y-m-d or ISO 8601, read in the site’s time zone. A bare date means the end of that day
site_id integer A network site id. Only network administrators can see other sites

Filters combine with AND. group and module together narrow event_code: a group that matches nothing returns nothing.

search works three ways. A term made only of digits, dots and colons, with at least one dot or colon, matches the start of the IP address. Words of three characters or more match whole-word prefixes, so publi finds published. A term with a shorter word falls back to a plain substring match.

Note. A filter value the server does not understand is dropped, not refused: an unknown severity, a non-numeric user_id or an invalid ip widens the result instead of failing. Check the result when a filter seems to have been ignored.

Responses

200 OK. data is one page of events.

{
  "success": true,
  "data": [
    {
      "id": 48211,
      "occurred_at": "2026-11-12T09:14:02Z",
      "event_code": 1003,
      "severity": "medium",
      "group": "authentication",
      "group_label": "Sign-ins",
      "site_id": 1,
      "user": { "id": 5, "login": "sam", "name": "Sam Lee", "exists": true },
      "user_role": "editor",
      "ip": "203.0.113.9",
      "object": { "type": "user", "id": 5, "label": "sam", "url": "" },
      "action": "failed",
      "message": "Failed sign-in attempt for “sam”: the password was wrong."
    }
  ],
  "meta": {
    "has_more": true,
    "next_before_id": 48211,
    "newest_id": 48211,
    "gap": false,
    "total": 37,
    "total_capped": false,
    "total_approximate": false
  }
}
Field Type Meaning
data[].id integer The event’s id. Higher is newer
data[].occurred_at string UTC, ISO 8601
data[].event_code integer What kind of event this is. See Events
data[].severity string informational, low, medium, high or critical
data[].group string The group key, as the group filter takes it
data[].group_label string The group’s name
data[].user.id integer 0 when nobody was signed in
data[].user.login string The login recorded at the time
data[].user.name string|null The person’s name, following the how people are named setting. The recorded login when the account is gone
data[].user.exists boolean Whether the account still exists
data[].object.id integer|null The object’s id, when it has one
data[].object.url string Always empty in a list. Get Event fills it in
data[].message string The sentence stored when the event happened. It never changes
meta See lists and pagination. total, total_capped and total_approximate appear only with with_total

Errors

Status Code When
400 rest_invalid_param per_page is not between 1 and 200, before_id is below 1, after_id is below 0, or one of them is not a number.

Plus the errors every endpoint can return.

Examples

curl -s "https://your-site.example/wp-json/plugixa-activity-log/v1/events?group=authentication&action=failed&with_total=1" \
  -u "admin:$WP_APP_PASSWORD"

<?php
$query = http_build_query(['group' => 'authentication', 'action' => 'failed', 'with_total' => 1]);
$ch = curl_init('https://your-site.example/wp-json/plugixa-activity-log/v1/events?' . $query);
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_USERPWD        => 'admin:' . getenv('WP_APP_PASSWORD'),
]);
$response = json_decode(curl_exec($ch), true);
curl_close($ch);

const auth = Buffer.from(`admin:${process.env.WP_APP_PASSWORD}`).toString('base64');
const query = new URLSearchParams({ group: 'authentication', action: 'failed', with_total: '1' });
const response = await fetch(`https://your-site.example/wp-json/plugixa-activity-log/v1/events?${query}`, {
  headers: {
    'Authorization': `Basic ${auth}`,
  },
});
const { data, meta } = await response.json();

Quick Links

Share