"Get Activity Events" REST API only returns 1 entry at a time

[alexschindler]

Hi all

I am using the "Get Activity Events" REST API in order to extract and archive audit logs. I am using the API according to this documentation [1]. I am using a service principal and I believe I have given it all the necessary rights in the Admin portal.

The REST API works, but it only gives me 1 entry at a time - together with a continuation token (see screenshot below). If I use the continuation token I get another single entry with another continuation token.

According to [2] the API should return 5000-10000 entries at a time, which seems more reasonable.

Does anyone have an idea what could cause this? Minimal code is as in [3].

Very grateful for any hints!

Thanks
Alex

[1] https://learn.microsoft.com/en-us/rest/api/power-bi/admin/get-activity-events

[2] https://powerbi.microsoft.com/de-ch/blog/the-power-bi-activity-log-makes-it-easy-to-download-activit...

[3] 
$bearer_token="MY_BEARER_TOKEN"

$postParams = @{
 "Authorization"="Bearer $bearer_token"
 }
$url_get_logs = "https://api.powerbi.com/v1.0/myorg/admin/activityevents?startDateTime='2023-09-11T00:00:00'&endDateT...'"
$response = Invoke-RestMethod -Uri $url_get_logs -Method get -Headers $postParams
$response | ConvertTo-Json

[alexschindler · Accepted solution]

Hi all

Found a solution ... and documenting it for posternity. I tried to go all the way and see what happens if I keep using the continuation token with a while loop.

$url_get_logs = "https://api.powerbi.com/v1.0/myorg/admin/activityevents?startDateTime='2023-09-01T00:00:00'&endDateTime='2023-09-01T09:59:59'"
$response = Invoke-RestMethod -Uri $url_get_logs -Method get -Headers $postParams
$completeListOfActivityEvents = @()
$completeListOfActivityEvents += $response.ActivityEventEntities
$continuationToken = $response.continuationToken
$continuationUri = $response.continuationUri
while ($ContinuationToken -ne $null)
{
  $response = Invoke-RestMethod -Uri $continuationUri -Method get  -Headers $postParams
  $continuationUri = $response.continuationUri
  $continuationToken = $response.continuationToken
  $completeListOfActivityEvents += $response.ActivityEventEntities
}

Turns out this REST API is quite whimsical. Very stingy at the beginning – and then it starts going. It gave me 1 entry, then another 1, then 4, then 10, then 33, then 523, ...

So everything ok at the end ... but I feel like it would be good if this behaviour was documented.

Thanks

Alex

[alexschindler]

Hi @v-yiuran-msft

Thanks for your answer.

- I think the query parameters are correct. I am trying to get the events from a whole day. There is more than 1 entry per day.

- I'm not sure about the continuation token: the problem is alreay with the very first request. I would expect that the first request gives me 5000-10000 entries.

- I tried using different days. On one of the days I got 2 entries instead of 1, but still ...

- I also tried the PowerBI commandlet (Get-PowerBIActivityEvent) this works great. However, I would like to use the REST API with a service principal, so the commandlet is not an option for me.

Any other ideas about the REST API?

I was also wondering if it could have to do with the scope of the token. I am using:

scope='https://analysis.windows.net/powerbi/api/.default'

Thanks

Alex

[v-yiruan-msft]

Hi @alexschindler ,

If I understand correctly, you can only get one entry when calling the "Get Activity Events" REST API using a service principal and a continuation token. And you want to know the cause. In order to make troubleshooting, could you please try the following things:

• Check the query parameters: Make sure that the query parameters you specified in the API call are correct and match the events you are trying to retrieve. As checked the info in the screenshot, the date range is between '2023-9-11 00:00:00' and '2023-9-11 23:59:59', please refer this link to check and confirm the events info of that date .
• Check the continuation token: Double-check the continuation token to ensure that it is being passed correctly in the API call.
• Test with different parameters: Try testing the API call with different query parameters to see if you get the expected results.
• Using Powersell:

Best Regards