Identity Query Filters
Copy for LLM
Copy page as Markdown for LLMs
View as Markdown
Open this page as Markdown
Open in ChatGPT
Get insights from ChatGPT
Open in Claude
Get insights from Claude

This document provides details on the filters supported by each provider for each API operation. Filters can be used to restrict the results of an API operation, such as filtering by a specific field or value.

They are used in conjunction with the filter query parameter in the API request.

Google Workspace filters for `query_audit_log`

Field	Operators	Supported Values
class_uid	eq	string
src_endpoint.ip	eq	string
time	gte, lte	datetime
type_uid	eq	string
user.email_addr	eq, ne, gt, gte, lt, lte	string

Microsoft Entra ID filters for `query_audit_log`

Field	Operators	Supported Values
actor.user.uid	eq, in, like	string
class_uid	eq, in	number
message	eq, in, like	string
src_endpoint.ip	eq, in, like	string
status_id	eq	number
time	gte, lte	datetime
type_uid	eq, in	number
user.name	eq, in, like	string
user.uid	eq, in, like	string

Okta Identity filters for `query_audit_log`

Field	Operators	Supported Values
actor.user.email_addr	eq, ne, in, not_in, like, not_like	string
actor.user.uid	eq, ne, in, not_in, like, not_like	string
class_uid	eq	string
message	eq, ne, in, not_in, like, not_like	string
src_endpoint.ip	eq	string
status_id	eq	string
time	gte, lte	datetime
type_uid	eq	string
user.email_addr	eq, ne, in, not_in, like, not_like	string
user.uid	eq, ne, in, not_in, like, not_like	string

PingOne Cloud Platform filters for `query_audit_log`

Field	Operators	Supported Values
actor.user.uid	eq, in	string
class_uid	eq, in	string
name	eq, in	string
time	lte, gte	datetime
type_uid	eq, in	string
user.uid	eq, in	string

Google Workspace filters for `query_groups`

Field	Operators	Supported Values

Microsoft Entra ID filters for `query_groups`

Field	Operators	Supported Values
entity.group.desc	eq, ne, in, not_in, like, not_like	string
entity.group.name	eq, ne, in, not_in, like, not_like	string
entity.group.type	eq, ne, in, not_in, like, not_like	string
entity.group.uid	eq, ne, in, not_in, like, not_like	string
entity.uid	eq, ne, in, not_in, like, not_like	string
time	eq, gt, gte, lt, lte, ne	datetime

Okta Identity filters for `query_groups`

Field	Operators	Supported Values
entity.group.desc	eq, ne, in, not_in, like	string
entity.group.name	eq, ne, in, not_in, like	string
entity.group.uid	eq, ne, in, not_in, like	string
entity.uid	eq, ne, in, not_in, like	string
entity.user.type	eq, ne, in, not_in, like	string
time	eq, gt, gte, lt, lte	datetime

PingOne Cloud Platform filters for `query_groups`

Field	Operators	Supported Values
entity.group.name	eq, in	string
entity.group.uid	eq, in	string
entity.uid	eq, in	string

Google Workspace filters for `query_users`

Field	Operators	Supported Values
entity.uid	eq, in	string
entity.user.email_addr	eq, in	string
entity.user.full_name	eq, in	string
entity.user.ldap_person.cost_center	eq, in	string
entity.user.ldap_person.employee_uid	eq, in	string
entity.user.ldap_person.given_name	eq, in	string
entity.user.ldap_person.job_title	eq, in	string
entity.user.ldap_person.surname	eq, in	string
entity.user.name	eq, in	string
entity.user.org.name	eq, in	string
entity.user.org.ou_name	eq, in	string
entity.user.uid	eq, in	string
entity.user.uid_alt	eq, in	string

Microsoft Entra ID filters for `query_users`

Field	Operators	Supported Values
email_addrs	eq, ne, in, not_in, like, not_like	string
entity.uid	eq, ne, in, not_in, like, not_like	string
entity.user.email_addr	eq, ne, in, not_in, like, not_like	string
entity.user.full_name	eq, ne, in, not_in, like, not_like	string
entity.user.ldap_person.cost_center	eq, ne, in, not_in, like, not_like	string
entity.user.ldap_person.created_time	eq, gt, gte, lt, lte, ne	datetime
entity.user.ldap_person.deleted_time	eq, gt, gte, lt, lte, ne	datetime
entity.user.ldap_person.employee_uid	eq, ne, in, not_in, like, not_like	string
entity.user.ldap_person.given_name	eq, ne, in, not_in, like, not_like	string
entity.user.ldap_person.job_title	eq, ne, in, not_in, like, not_like	string
entity.user.ldap_person.last_login_time	eq, gt, gte, lt, lte, ne	datetime
entity.user.ldap_person.surname	eq, ne, in, not_in, like, not_like	string
entity.user.name	eq, ne, in, not_in, like, not_like	string
entity.user.org.name	eq, ne, in, not_in, like, not_like	string
entity.user.org.ou_name	eq, ne, in, not_in, like, not_like	string
entity.user.uid	eq, ne, in, not_in, like, not_like	string
entity.user.uid_alt	eq, ne, in, not_in, like, not_like	string
entity.user.user_status_id	eq, in	number
time	eq, gt, gte, lt, lte, ne	datetime

Okta Identity filters for `query_users`

Field	Operators	Supported Values
entity.uid	eq, ne, in, not_in, like	string
entity.user.email_addr	eq, ne, in, not_in, like	string
entity.user.full_name	eq, ne, in, not_in, like	string
entity.user.ldap_person.cost_center	eq, ne, in, not_in, like	string
entity.user.ldap_person.created_time	eq, gt, gte, lt, lte	datetime
entity.user.ldap_person.employee_uid	eq, ne, in, not_in, like	string
entity.user.ldap_person.given_name	eq, ne, in, not_in, like	string
entity.user.ldap_person.job_title	eq, ne, in, not_in, like	string
entity.user.ldap_person.manager.full_name	eq, ne, in, not_in, like	string
entity.user.ldap_person.modified_time	eq, gt, gte, lt, lte	datetime
entity.user.ldap_person.surname	eq, ne, in, not_in, like	string
entity.user.name	eq, ne, in, not_in, like	string
entity.user.org.name	eq, ne, in, not_in, like	string
entity.user.org.ou_name	eq, ne, in, not_in, like	string
entity.user.uid	eq, ne, in, not_in, like	string
entity.user.uid_alt	eq, ne, in, not_in, like	string
entity.user.user_status_id	eq, in	string
time	eq, gt, gte, lt, lte	datetime

PingOne Cloud Platform filters for `query_users`

Field	Operators	Supported Values
entity.uid	eq, in, like	string
entity.user.email_addr	eq, in, like	string
entity.user.full_name	eq, in, like	string
entity.user.ldap_person.cost_center	eq, in, like	string
entity.user.ldap_person.created_time	eq	datetime
entity.user.ldap_person.employee_uid	eq, in, like	string
entity.user.ldap_person.given_name	eq, in, like	string
entity.user.ldap_person.job_title	eq, in, like	string
entity.user.ldap_person.modified_time	eq	datetime
entity.user.ldap_person.surname	eq, in, like	string
entity.user.name	eq, in, like	string
entity.user.uid	eq, in, like	string
entity.user.uid_alt	eq, in, like	string
time	eq	datetime

Identity Query FiltersCopyCopy for LLMCopy page as Markdown for LLMsView as MarkdownOpen this page as MarkdownOpen in ChatGPTGet insights from ChatGPTOpen in ClaudeGet insights from Claude

Google Workspace filters for query_audit_log

Microsoft Entra ID filters for query_audit_log

Okta Identity filters for query_audit_log

PingOne Cloud Platform filters for query_audit_log

Google Workspace filters for query_groups

Microsoft Entra ID filters for query_groups

Okta Identity filters for query_groups

PingOne Cloud Platform filters for query_groups

Google Workspace filters for query_users

Microsoft Entra ID filters for query_users

Okta Identity filters for query_users

PingOne Cloud Platform filters for query_users

Was this helpful?