Activity API

What happens to files and file requests on the service account’s domains, on every plan. Every request sends a token in the Authorization: Bearer header; see Get started with the API.

Read the activity feed

GET /api/admin/activity/feed

Returns file and file request events (file.* and file_request.*) on the service account’s domains, oldest first, on every plan. Use it to react to uploads, downloads and files received through file requests. It works like the audit feed: store next_after_id, send it as after_id next time, and poll again right away while has_more is true. Service account tokens only.

Permission: Monitoring: File activity (activity:read)
Service account tokens only, without Dew-Act-As.

Parameters

Name	In	Type	Description
`after_id`	query	integer (int64)	Return events with an `id` above this. Start at 0, then send the `next_after_id` of the previous response. Default `0`. Minimum 0.
`limit`	query	integer	Most events to return. Default `500`. Minimum 1. Maximum 1000.

Response 200

Success.

data is AuditFeedPage.

{
  "success": true,
  "data": {
    "entries": [
      {
        "id": 48213,
        "event_id": "3f6c2a1e-8b4d-4c7a-9e21-5d0f7b6a9c34",
        "timestamp": "2026-10-02T14:03:11.120000Z",
        "event_type": "file.downloaded",
        "category": "file",
        "outcome": "success",
        "severity": "info",
        "description": "File downloaded",
        "actor": {
          "type": "external",
          "email": "bob@example.com"
        },
        "target": {
          "type": "file",
          "id": "kT9xQ2aZ",
          "name": "Q4 invoices.pdf"
        },
        "domain": "files.example.com",
        "client_ip": "203.0.113.24",
        "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)",
        "request_id": "a3f8b2c1d4e5f60718293a4b5c6d7e8f",
        "metadata": {
          "via": "link",
          "size_bytes": 2483021,
          "owner_email": "anna@example.com"
        }
      }
    ],
    "next_after_id": 48213,
    "has_more": false
  }
}

Errors

Status	When	Example message
400	The request is invalid; `message` says what to change.	“Dew-Act-As can’t be used for admin actions.” “after_id must be a whole number of 0 or more.” “limit must be between 1 and 1000.”
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, is a personal token, the caller’s network is not allowed, or the caller signed in as a person.	“This API token doesn’t have permission for this action.” “Personal API tokens can’t be used for admin actions.” “Admin access is not allowed from this network.” “Use a service account token to read the activity feed.”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.