Event Catalog

GET /api/v1/team/events returns every supported event type in one cursor-paginated stream. Filter it with repeated types parameters, and optionally with a userId, from, or to.

curl --get --fail-with-body \
  --header "Authorization: Bearer $ROGUE_ARENA_TEAM_API_KEY" \
  --data-urlencode "userId=USER_ID" \
  --data-urlencode "types=userAnsweredQuestion" \
  --data-urlencode "types=userUnlockedChapter" \
  "https://arena.roguelabs.io/api/v1/team/events"

Training and lifecycle events

These require team:events:read:

unlockedCertificateOfCompletion
completedScenario
registeredForCertificationTest
unregisteredForCertificationTest
certificationTestFailed
certificationTestPassed
userDeployedScenario
userRemovedScenario
userStartedResumedScenario
userShutdownScenario
idleUserScenarioShutdown
userUnlockedChapter
userAnsweredQuestion

Sensitive activity events

These require team:activity:read:

sharedScenario
unsharedScenario
acceptedShareInvite
uploadedFile
copiedCutFiles
singleSnapshotCaptured
singleSnapshotReverted
singleSnapshotDeleted
revertedScenarioToSnapshot
acceptedWarp
virtualMachineUsage
vpnUsage
keystrokeActivity
videoWatchTime

The four usage types are daily aggregates, with no raw telemetry. They use deterministic IDs, aggregation: "daily", and safe totals such as durationSeconds or count. A usage session counts toward the UTC calendar day on which it started, even when it continues past midnight.

A daily row’s occurredAt is always the start of that UTC day (00:00:00Z). For these four types, from and to filter on that synthetic bucket timestamp and ignore the timestamps of individual activity. A bucket the window selects covers the complete UTC day, capped at the response’s stable asOf anchor if that day is still in progress. As a result, a from after midnight excludes that UTC day, while a to after midnight includes it, and that day’s total can contain activity later than to. Use midnight UTC boundaries when you split a usage export into adjacent windows.

Every daily usage row is marked mutable: true, because late session or telemetry updates can revise an aggregate even for an earlier start day. Within one cursor chain, the fixed asOf anchor keeps a row’s ID and value the same whichever partial-day filter you choose. Scheduled syncs should re-read a short overlap window and upsert by event ID. The other activity types are immutable, individual occurrences.

Event shape and privacy

Each record identifies the event and gives its public type, occurrence time, stable user ID, aggregation mode, and a reviewed data object. The data object accepts only documented fields, such as course, scenario, curriculum, chapter, question, filename, snapshot name, count, or duration.

Raw Logger payloads are never returned. This keeps unrelated internal values, including private paths, window titles, VM IDs, and voucher IDs, from leaking when an event schema changes internally.

If an old event has malformed or unrecognized payload data, the page still returns successfully:

{
  "payloadStatus": "unavailable",
  "data": null
}

Keep the event itself and treat its optional details as unavailable. Don’t fail a whole sync because one legacy event lacks a usable payload.