The information in the Access log API is built to answer 3 questions:

• Who looked at a ticket
• Who looked at a user profile
• What searches did an agent make (including the search term)

Below are the API responses that answer these questions. There are many many more access requests included in the Access log API, but these are currently undocumented and outside of the scope of the EAP.

Who looked at a ticket

In this example, agent with the user_id 1213456789 opened ticket number 937.

timestamp: “2023-02-16T19:00:00Z”,
user_id: 1213456789,
ip_address: “00.00.000.00”,
url: “/graphql”,
method: “POST”,
status: 200,
    graphql: 
       operation_name: “ticket”,
       [...]
       variables:
           id: “937”,
           [...]

Who looked at a user profile

In this example, agent with the user_id 1213456789 opened the profile belonging to the user_id 9878654.

timestamp: “2023-02-16T19:00:00Z”,
user_id: 1213456789,
ip_address: “00.00.000.00”,
url: “/api/v2/users/9878654?[...]
method: “GET”, 
status: 304

What searches did an agent make

Today, making a search through the search bar located at the top navigation bar in Support, makes a query against Tickets, Articles, Users and Organizations for the search term you entered. 

In this example, agent with the user_id 1213456789 made a search for the term “voicemail”. The Access log API captures the request made to the Articles endpoint because it queries against Ticket, Articles, Users and Organizations. 

timestamp: “2023-02-16T19:00:00Z”,
user_id: 1213456789,
ip_address: “00.00.000.00”,
url: “/hc/api/v2/articles/search.json?count_only=true&exclude=body&locale=%2A&multibrand=true&page=1&per_page=30&query=voicemail”,
method: “GET”,
status: 200