The subscription service provides an interface for third-party auditing tools to subscribe to and consume PingOne audit activity events. The service listens for translated audit activities as the source of events and transmits messages about these events to the subscribing audit application.

Subscriptions data model

Property Description
createdAt The date and time at which the subscription resource was created (ISO 8601 format).
enabled A boolean that specifies whether a created or updated subscription should be active or suspended. A suspended state ("enabled":false) accumulates all matched events, but these events are not delivered until the subscription becomes active again ("enabled":true). For suspended subscriptions, events accumulate for a maximum of two weeks. Events older than two weeks are deleted. Restarted subscriptions receive the saved events (up to two weeks from the restart date). This is a required property.
environment.id A string that specifies the environment resource’s unique identifier associated with the subscription.
filterOptions.includedActionTypes A non-empty array that specifies the list of action types that should be matched for the subscription. This is a required property.
filterOptions.includedApplications An array that specifies the list of applications (by ID) whose events are monitored by the subscription (maximum of 10 IDs in the array). This is an optional property. If a list of applications is not provided, events are monitored for all applications in the environment.
filterOptions.includedPopulations An array that specifies the list of populations (by ID) whose events are monitored by the subscription (maximum of 10 IDs in the array). This property matches events for users in the specified populations, as opposed to events generated in which the user in one of the populations is the actor. This is an optional property.
filterOptions.includedTags (Optional) An array of tags that events must have to be monitored by the subscription. If tags are not specified, all events are monitored. Currently, the available tags are:
  • adminIdentityEvent. Identifies the event as the action of an administrator on other administrators.
format A string that specifies one of the supported subscription formats. Options are ACTIVITY, SPLUNK, and NEWRELIC. This is a required property.
id A string that specifies the resource’s unique identifier.
httpEndpoint.url A string that specifies a valid HTTPS URL to which event messages are sent. This is a required property.
httpEndpoint.headers An array that specifies the headers applied to the outbound request (for example: "Authorization": "Basic username:password"). This is a required property. The purpose of these headers is for the HTTPS endpoint to authenticate the PingOne service, ensuring that the information from PingOne is from a trusted source.
name A string that specifies the subscription name. This is a required property.
updatedAt The date and time at which the subscription resource was last updated (ISO 8601 format).
verifyTlsCertificates A boolean that specifies whether a certificates should be verified. If this property’s value is set to false, then all certificates are trusted. (Setting this property’s value to false introduces a security risk.) This is a required property.

Response codes

Code Message
200 Successful operation.
201 Successfully created.
204 Successfully removed. No content.
400 The request could not be completed.
401 You do not have access to this resource.
403 The request could not be completed. You do not have access to this resource.
404 The requested resource was not found.