Query & Filter Insight Events via LookupInsightEvents API - ActionTrail

Queries Insights events.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

No authorization for this operation. If you encounter issues with this operation, contact technical support.

Request parameters

Parameter	Type	Required	Description	Example
NextToken	string	No	The pagination token that is used in the next request to retrieve a new page of results. You do not need to specify this parameter for the first request. You must specify the token that is obtained from the previous query as the value of `NextToken`.	VjE6dLbnNpVmbz06****
MaxResults	string	No	The maximum number of entries to return. Valid values: 1 to 50. Default value: 20.	20
StartTime	string	No	The beginning of the time range to query. The default value is seven days before the current time. Specify the time in the ISO 8601 standard in the `yyyy-MM-ddTHH:mm:ssZ` format. The time must be in UTC. Note The maximum time range that can be queried is 93 days. If the specified time range is longer than 93 days, only events from the last 93 days are returned.	2026-01-07T04:10:00Z
EndTime	string	No	The end of the time range to query. The default value is the current time. Specify the time in the ISO 8601 standard in the `yyyy-MM-ddTHH:mm:ssZ` format. The time must be in UTC.	2026-01-07T07:10:00Z
LookupAttribute	array<object>	No	An array of fliter conditions. Note You can specify one or two query conditions. For more information, see Limitations.
	object	No	A fliter condition.
Key	string	No	The attribute key. For more information about valid values, see How do I configure the LookupAttribute parameter when calling LookupInsightEvents?	InsightType
Value	string	No	The attribute value. For more information about valid values, see How do I configure the LookupAttribute parameter when calling LookupInsightEvents?	IpInsight

Response elements

Element	Type	Description	Example
	object
Events	array<object>	The Insights events.
	object	The Insight event.	{ "eventId": "408ACD94-4531-4D66-BA14-1F7248AC**", "eventCategory": "Insight", "sharedEventId": "55CF0739-97D8-4221-A6BE-8E60E746", "eventVersion": "1", "eventTime": "2026-01-07T05:40:00Z", "insightDetails": { "insightContext": { "attributions": [ { "insight": [ { "average": 3, "value": "AlibabaCloud API Workbench" } ], "attribute": "userAgent" }, { "insight": [ { "average": 3, "value": "20376656170607**" } ], "attribute": "principalId" }, { "insight": [ { "average": 3, "value": "Actiontrail/EnableInsight" } ], "attribute": "apiRelated" }, { "insight": [ { "average": 3, "value": "null" } ], "attribute": "errorCode" } ], "statistics": { "insight": { "average": 3, "predict": 0 }, "insightDuration": 1, "baseline": { "threshold": 0.6 }, "insightCount": 3 } }, "state": "Start", "insightType": "IpInsight", "insightObject": "xxx.xxx.xxx.xxx" }, "acsRegion": "cn-qingdao", "eventType": "ActionTrailInsight" }
NextToken	string	The pagination token that is used in the next request to retrieve a new page of results. You do not need to specify this parameter for the first request. You must specify the token that is obtained from the previous query as the value of `NextToken`.	VjE6bHJlTGoxdm1M****
RequestId	string	The request ID.	851038F3-33AB-4C49-97D7-6AB37D35****

Examples

Success response

JSON format

{
  "Events": [
    {
      "eventId": "408ACD94-4531-4D66-BA14-1F7248AC****",
      "eventCategory": "Insight",
      "sharedEventId": "55CF0739-97D8-4221-A6BE-8E60E746****",
      "eventVersion": "1",
      "eventTime": "2026-01-07T05:40:00Z",
      "insightDetails": {
        "insightContext": {
          "attributions": [
            {
              "insight": [
                {
                  "average": 3,
                  "value": "AlibabaCloud API Workbench"
                }
              ],
              "attribute": "userAgent"
            },
            {
              "insight": [
                {
                  "average": 3,
                  "value": "20376656170607****"
                }
              ],
              "attribute": "principalId"
            },
            {
              "insight": [
                {
                  "average": 3,
                  "value": "Actiontrail/EnableInsight"
                }
              ],
              "attribute": "apiRelated"
            },
            {
              "insight": [
                {
                  "average": 3,
                  "value": "null"
                }
              ],
              "attribute": "errorCode"
            }
          ],
          "statistics": {
            "insight": {
              "average": 3,
              "predict": 0
            },
            "insightDuration": 1,
            "baseline": {
              "threshold": 0.6
            },
            "insightCount": 3
          }
        },
        "state": "Start",
        "insightType": "IpInsight",
        "insightObject": "xxx.xxx.xxx.xxx"
      },
      "acsRegion": "cn-qingdao",
      "eventType": "ActionTrailInsight"
    }
  ],
  "NextToken": "VjE6bHJlTGoxdm1M****",
  "RequestId": "851038F3-33AB-4C49-97D7-6AB37D35****"
}

Error codes

HTTP status code	Error code	Error message	Description
400	IncompleteSignature	The request signature does not conform to Alibaba Cloud standards.	The request signature does not conform to Alibaba Cloud standards.
400	InvalidParameterCombination	The end time must be later than the start time.	The end time must be greater than the start time.
400	InvalidQueryParameter	The specified query parameter is invalid.	The specified query parameter is not valid.
400	InvalidParameterDateOutOfRange	Query time range exceeds 30 days.
400	InvalidParameterEndTime	The specified EndTime is invalid.
400	InvalidParameterStartTime	The specified StartTime is invalid.
400	InvalidParameterStartTimeExceedsCurrent	The StartTime exceeds the current time. Use GMT time format for queries.
400	InvalidParameterStartTimeOutOfDate	The StartTime exceeds the limit of 90 days.
400	InvalidTimeRangeException	The end time must be later than the start time. The time span cannot exceed 30 days.	The end time must be greater than the start time.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.