Session Commands

Note

Session command endpoints provide access to commands executed during user sessions. This includes sudo commands, shell commands, and other executed operations that were captured and logged by the system during monitored sessions.

Data Structures

SessionCommandModel

Attribute	Type	Required	Description
id	string		Read-only. Unique command identifier.
session_id	string		Read-only. ID of the session this command belongs to.
occurred_at	datetime		Read-only. Timestamp when the command was executed.
command	string		Read-only. The actual command that was executed.
runas_user	string		Read-only. User the command was executed as (for sudo commands).
runas_group	string		Read-only. Group the command was executed as (for sudo commands).
policy_id	string		Read-only. ID of the policy that was applied to this command.
regexp_id	string		Read-only. ID of the regex pattern that matched this command.
approved	boolean		Read-only. Expensive to use. Whether the command was approved by policy.
user_id	string		Read-only. Hidden. Expensive to use. User ID for permission filtering.
created_at	datetime		Read-only. Record creation timestamp.
modified_at	datetime		Read-only. Last modification timestamp.
removed	boolean		Read-only. Soft delete flag.

Retrieve Available Attributes of the SessionCommandModel

Request

Method	GET
Path	/api/v2/objspec/session_command

GET /api/v2/objspec/session_command

Example Request

curl -s -k -X GET \
  -H 'Authorization: <token>' \
  'https://10.33.2.132/api/v2/objspec/session_command'

List Session Commands

Retrieve all commands executed during a specific session.

Request

Method	GET
Path	/api/v2/session/<session_id>/command

GET /api/v2/session/<session_id>/command

Example Request

curl -s -k -X GET \
  -H 'Authorization: <token>' \
  'https://10.33.2.132/api/v2/session/5980780305148018689/command'

Response (With Commands)

{
    "result": "success",
    "session_command": [
        {
            "id": "5980780305148018703",
            "session_id": "5980780305148018739",
            "occurred_at": "2026-06-09 01:09:15.639699-07",
            "command": "\/usr\/bin\/id",
            "runas_user": "testuser1",
            "runas_group": "testuser1",
            "policy_id": "5980780305148018689",
            "regexp_id": "5980780305148018689",
            "approved": true,
            "created_at": "2026-06-09 01:09:15.641225-07",
            "modified_at": "2026-06-09 01:09:15.641225-07"
        },
        {
            "id": "5980780305148018705",
            "session_id": "5980780305148018739",
            "occurred_at": "2026-06-09 01:09:31.990782-07",
            "command": "\/usr\/bin\/id",
            "runas_user": "root",
            "runas_group": "root",
            "policy_id": "5980780305148018689",
            "regexp_id": "5980780305148018689",
            "approved": true,
            "created_at": "2026-06-09 01:09:31.992218-07",
            "modified_at": "2026-06-09 01:09:31.992218-07"
        }
    ]
}

Get Specific Session Command

Retrieve details of a specific command executed during a session.

Request

Method	GET
Path	/api/v2/session/<session_id>/command/<id>

GET /api/v2/session/<session_id>/command/<id>

Example Request

curl -s -k -X GET \
  -H 'Authorization: <token>' \
  'https://10.33.2.132/api/v2/session/5980780305148018689/command/5980780305148018703'

Success Response

{
    "result": "success",
    "session_command": [
        {
            "id": "5980780305148018703",
            "session_id": "5980780305148018689",
            "occurred_at": "2026-06-09 01:09:15.639699-07",
            "command": "\/usr\/bin\/id",
            "runas_user": "testuser1",
            "runas_group": "testuser1",
            "policy_id": "5980780305148018689",
            "regexp_id": "5980780305148018689",
            "approved": true,
            "created_at": "2026-06-09 01:09:15.641225-07",
            "modified_at": "2026-06-09 01:09:15.641225-07"
        }
    ]
}