Identity Query Filters

This document provides details on the filters supported by each provider for each API operation. Filters can be used to restrict the results of an API operation, such as filtering by a specific field or value.

They are used in conjunction with the filter query parameter in the API request.

Google Workspace filters for `query_audit_log`

Field	Operators	Supported Values
src_endpoint.ip	eq	string
time	gte, lte	datetime
user.email_addr	eq, ne, gt, gte, lt, lte	string

Microsoft Entra ID filters for `query_audit_log`

Field	Operators	Supported Values
actor.user.uid	eq, in, like	string
class_id	eq, in	integer
message	eq, in, like	string
status_id	eq	integer
time	gte, lte	datetime
type_id	eq, in	integer
user.name	eq, in, like	string
user.uid	eq, in, like	string

Okta filters for `query_audit_log`

Field	Operators	Supported Values
actor.user.email_addr	eq, ne, in, not_in, like, not_like	string
actor.user.uid	eq, ne, in, not_in, like, not_like	string
class_uid	eq	string
message	eq, ne, in, not_in, like, not_like	string
status_id	eq	string
type_uid	eq	string
user.email_addr	eq, ne, in, not_in, like, not_like	string
user.uid	eq, ne, in, not_in, like, not_like	string

PingOne Identity filters for `query_audit_log`

Field	Operators	Supported Values
actor.user.uid	eq, in	string
class_uid	eq, in	string
name	eq, in	string
time	lte, gte	datetime
type_uid	eq, in	string
user.uid	eq, in	string

Google Workspace filters for `query_groups`

Field	Operators	Supported Values

Microsoft Entra ID filters for `query_groups`

Field	Operators	Supported Values
entity.group.desc	eq, ne, in, not_in, like, not_like	string
entity.group.name	eq, ne, in, not_in, like, not_like	string
entity.group.type	eq, ne, in, not_in, like, not_like	string
entity.group.uid	eq, ne, in, not_in, like, not_like	string
entity.uid	eq, ne, in, not_in, like, not_like	string
time	eq, gt, gte, lt, lte, ne	datetime

Okta filters for `query_groups`

Field	Operators	Supported Values
entity.group.desc	eq, ne, in, not_in, like	string
entity.group.name	eq, ne, in, not_in, like	string
entity.group.uid	eq, ne, in, not_in, like	string
entity.uid	eq, ne, in, not_in, like	string
entity.user.type	eq, ne, in, not_in, like	string
time	eq, gt, gte, lt, lte	date

PingOne Identity filters for `query_groups`

Field	Operators	Supported Values
entity.group.name	eq, in	string
entity.group.uid	eq, in	string
entity.uid	eq, in	string

Google Workspace filters for `query_users`

Field	Operators	Supported Values
entity.uid	eq, in	string
entity.user.email_addr	eq, in	string
entity.user.full_name	eq, in	string
entity.user.ldap_person.cost_center	eq, in	string
entity.user.ldap_person.employee_uid	eq, in	string
entity.user.ldap_person.given_name	eq, in	string
entity.user.ldap_person.job_title	eq, in	string
entity.user.ldap_person.surname	eq, in	string
entity.user.name	eq, in	string
entity.user.org.name	eq, in	string
entity.user.org.ou_name	eq, in	string
entity.user.uid	eq, in	string
entity.user.uid_alt	eq, in	string

Microsoft Entra ID filters for `query_users`

Field	Operators	Supported Values
email_addrs	eq, ne, in, not_in, like, not_like	string
entity.uid	eq, ne, in, not_in, like, not_like	string
entity.user.email_addr	eq, ne, in, not_in, like, not_like	string
entity.user.full_name	eq, ne, in, not_in, like, not_like	string
entity.user.ldap_person.cost_center	eq, ne, in, not_in, like, not_like	string
entity.user.ldap_person.created_time	eq, gt, gte, lt, lte, ne	datetime
entity.user.ldap_person.deleted_time	eq, gt, gte, lt, lte, ne	datetime
entity.user.ldap_person.employee_uid	eq, ne, in, not_in, like, not_like	string
entity.user.ldap_person.given_name	eq, ne, in, not_in, like, not_like	string
entity.user.ldap_person.job_title	eq, ne, in, not_in, like, not_like	string
entity.user.ldap_person.last_login_time	eq, gt, gte, lt, lte, ne	datetime
entity.user.ldap_person.surname	eq, ne, in, not_in, like, not_like	string
entity.user.name	eq, ne, in, not_in, like, not_like	string
entity.user.org.name	eq, ne, in, not_in, like, not_like	string
entity.user.org.ou_name	eq, ne, in, not_in, like, not_like	string
entity.user.uid	eq, ne, in, not_in, like, not_like	string
entity.user.uid_alt	eq, ne, in, not_in, like, not_like	string
entity.user.user_status_id	eq, in	integer
time	eq, gt, gte, lt, lte, ne	datetime

Okta filters for `query_users`

Field	Operators	Supported Values
entity.uid	eq, ne, in, not_in, like	string
entity.user.email_addr	eq, ne, in, not_in, like	string
entity.user.full_name	eq, ne, in, not_in, like	string
entity.user.ldap_person.cost_center	eq, ne, in, not_in, like	string
entity.user.ldap_person.created_time	eq, gt, gte, lt, lte	datetime
entity.user.ldap_person.employee_uid	eq, ne, in, not_in, like	string
entity.user.ldap_person.given_name	eq, ne, in, not_in, like	string
entity.user.ldap_person.job_title	eq, ne, in, not_in, like	string
entity.user.ldap_person.manager.full_name	eq, ne, in, not_in, like	string
entity.user.ldap_person.modified_time	eq, gt, gte, lt, lte	datetime
entity.user.ldap_person.surname	eq, ne, in, not_in, like	string
entity.user.name	eq, ne, in, not_in, like	string
entity.user.org.name	eq, ne, in, not_in, like	string
entity.user.org.ou_name	eq, ne, in, not_in, like	string
entity.user.uid	eq, ne, in, not_in, like	string
entity.user.uid_alt	eq, ne, in, not_in, like	string
entity.user.user_status_id	eq, in	string
time	eq, gt, gte, lt, lte	datetime

PingOne Identity filters for `query_users`

Field	Operators	Supported Values
entity.uid	eq, in, like	string
entity.user.email_addr	eq, in, like	string
entity.user.full_name	eq, in, like	string
entity.user.ldap_person.cost_center	eq, in, like	string
entity.user.ldap_person.created_time	eq	datetime
entity.user.ldap_person.employee_uid	eq, in, like	string
entity.user.ldap_person.given_name	eq, in, like	string
entity.user.ldap_person.job_title	eq, in, like	string
entity.user.ldap_person.modified_time	eq	datetime
entity.user.ldap_person.surname	eq, in, like	string
entity.user.name	eq, in, like	string
entity.user.uid	eq, in, like	string
entity.user.uid_alt	eq, in, like	string
time	eq	datetime

Identity Query Filters

Google Workspace filters for query_audit_log

Microsoft Entra ID filters for query_audit_log

Okta filters for query_audit_log

PingOne Identity filters for query_audit_log

Google Workspace filters for query_groups

Microsoft Entra ID filters for query_groups

Okta filters for query_groups

PingOne Identity filters for query_groups

Google Workspace filters for query_users

Microsoft Entra ID filters for query_users

Okta filters for query_users

PingOne Identity filters for query_users

Was this helpful?