Please be sure you’ve read the docs and API specs before asking for help. Also, please be sure you’ve searched the forum for your answer before you create a new topic.
what is the actual API you are using and parameters being passed. a sample call will help.
I see what you are trying. assuming you are using below v2025 but that does not matter
{{baseUrl}}/historical-identities/:id/events?limit=250&offset=0&count=true
“*” in id parameter will not work. this API is to get events history only for a given identity and cannot use wild card.
to achieve what you are trying, first get the IDs from Idenitites API, pass it to this above API and for call there is a limit of 250 in response so page over complete count returned and move on to the next identity. keep doing that for all.
that said, lets you have an idenitty id retrivied. lets say that is aaabbbccc, you first call will be :
{{baseUrl}}/historical-identities/aaabbbccc/events?limit=250&offset=0&count=true
this will return all first 250 events, along with response header “X-Total-Count” whish will have total count of events for this Identity. lets assume its 550.
then you 2nd call will be :
{{baseUrl}}/historical-identities/aaabbbccc/events?limit=250&offset=250&count=true
3rd will be :
{{baseUrl}}/historical-identities/aaabbbccc/events?limit=250&offset=500&count=true
that bring all events for the identity. then move on to get the next identity. its going to be a long execution depending on number of IDs and how far you want to go back. you want to limit based on from time:
this is your call to get events for a given ID in 2026:
{{baseUrl}}/historical-identities/:id/events?from=2026-01-01T00:00:00.000Z&limit=250&offset=0&count=true
finally. good luck.
But I want to get for at least 10000 identities. To put one after another, it will take a lot of time.
Hello Suyatra. The {id} in that endpoint path needs to be a real identity ID. * isn’t a supported wildcard there, so it won’t return history for all identities.
There is no documented bulk endpoint for pulling all identity event history in one go. The practical way to do it is a small script or SDK loop in two steps.
Step 1 - Page through all identities:
GET /v2025/historical-identities?limit=250&offset=0
Step 2 - For each identity ID from Step 1, page through their events:
GET /v2025/historical-identities/{id}/events?limit=250&offset=0
For both calls, keep increasing offset by 250 until the response comes back with fewer than 250 records. That’s how you know you’ve reached the end.
Both calls need this header:
X-SailPoint-Experimental: true
Your token also needs the idn:identity-history:read scope.
On pagination, count=true is supported on the events call (Step 2) if you want total counts per identity, but it’s not supported on the identities list call (Step 1). So for Step 1 just go by the page size to know when to stop.
One more thing, the Search API with "indices": ["events"] is a different dataset. That gives you tenant-level audit events, not the per-identity access history that the historical-identities endpoint returns.
So there is no API to fetch ALL IDENTITY events? Can you please show or help me with how to do your steps?
I literally did that. using the API you were trying to use.
Yeah, running 10,000 calls one after another would take a while. The API still needs one identity ID per request, and I am not aware of a bulk endpoint for this (though if one exists that I am missing, happy to be corrected).
The practical way to handle this at scale is to run the event calls concurrently instead of sequentially. So you page through the identity list first to collect all the IDs, then instead of calling events for each identity one by one, you process them in parallel. If you are using Python, concurrent.futures.ThreadPoolExecutor makes this pretty straightforward. For PowerShell, ForEach-Object -Parallel does the same thing. Start with maybe 5-10 concurrent workers and write each response directly to a file or database rather than holding everything in memory.
The main thing to be careful about is rate limiting. ISC allows 100 requests per client_id per API version every 10 seconds. If you go over that, you will get a 429 response with a Retry-After header. So having a retry handler that respects that header would keep the script from breaking mid-run.
The SailPoint SDKs (Python, PowerShell, TypeScript) already have built-in methods and pagination helpers for both the identity list and per-identity events calls, so those could save you some boilerplate.
If this is more of a one-time full tenant extract, it might also be worth raising a case with SailPoint Support to see if they have any bulk export options on their end.
your step 1 is interesting. have you tried it?