# Identity Query Filters

This document provides details on the filters supported by each provider for each API operation. Filters can be used to restrict the results of an API operation, such as filtering by a specific field or value.

They are used in conjunction with the `filter` query parameter in the API request.

### Google Workspace filters for `query_audit_log`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| class_uid | eq | string |
| src_endpoint.ip | eq | string |
| time | gte, lte | datetime |
| type_uid | eq | string |
| user.email_addr | eq, ne, gt, gte, lt, lte | string |


### Microsoft Entra ID filters for `query_audit_log`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| actor.user.uid | eq, in, like | string |
| class_uid | eq, in | number |
| message | eq, in, like | string |
| src_endpoint.ip | eq, in, like | string |
| status_id | eq | number |
| time | gte, lte | datetime |
| type_uid | eq, in | number |
| user.name | eq, in, like | string |
| user.uid | eq, in, like | string |


### Okta Identity filters for `query_audit_log`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| actor.user.email_addr | eq, ne, in, not_in, like, not_like | string |
| actor.user.uid | eq, ne, in, not_in, like, not_like | string |
| class_uid | eq | string |
| message | eq, ne, in, not_in, like, not_like | string |
| src_endpoint.ip | eq | string |
| status_id | eq | string |
| time | gte, lte | datetime |
| type_uid | eq | string |
| user.email_addr | eq, ne, in, not_in, like, not_like | string |
| user.uid | eq, ne, in, not_in, like, not_like | string |


### PingOne Cloud Platform filters for `query_audit_log`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| actor.user.uid | eq, in | string |
| class_uid | eq, in | string |
| name | eq, in | string |
| time | lte, gte | datetime |
| type_uid | eq, in | string |
| user.uid | eq, in | string |


### Google Workspace filters for `query_groups`

| Field | Operators | Supported Values |
|  --- | --- | --- |


### Microsoft Entra ID filters for `query_groups`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| entity.group.desc | eq, ne, in, not_in, like, not_like | string |
| entity.group.name | eq, ne, in, not_in, like, not_like | string |
| entity.group.type | eq, ne, in, not_in, like, not_like | string |
| entity.group.uid | eq, ne, in, not_in, like, not_like | string |
| entity.uid | eq, ne, in, not_in, like, not_like | string |
| time | eq, gt, gte, lt, lte, ne | datetime |


### Okta Identity filters for `query_groups`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| entity.group.desc | eq, ne, in, not_in, like | string |
| entity.group.name | eq, ne, in, not_in, like | string |
| entity.group.uid | eq, ne, in, not_in, like | string |
| entity.uid | eq, ne, in, not_in, like | string |
| entity.user.type | eq, ne, in, not_in, like | string |
| time | eq, gt, gte, lt, lte | datetime |


### PingOne Cloud Platform filters for `query_groups`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| entity.group.name | eq, in | string |
| entity.group.uid | eq, in | string |
| entity.uid | eq, in | string |


### Google Workspace filters for `query_users`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| entity.uid | eq, in | string |
| entity.user.email_addr | eq, in | string |
| entity.user.full_name | eq, in | string |
| entity.user.ldap_person.cost_center | eq, in | string |
| entity.user.ldap_person.employee_uid | eq, in | string |
| entity.user.ldap_person.given_name | eq, in | string |
| entity.user.ldap_person.job_title | eq, in | string |
| entity.user.ldap_person.surname | eq, in | string |
| entity.user.name | eq, in | string |
| entity.user.org.name | eq, in | string |
| entity.user.org.ou_name | eq, in | string |
| entity.user.uid | eq, in | string |
| entity.user.uid_alt | eq, in | string |


### Microsoft Entra ID filters for `query_users`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| email_addrs | eq, ne, in, not_in, like, not_like | string |
| entity.uid | eq, ne, in, not_in, like, not_like | string |
| entity.user.email_addr | eq, ne, in, not_in, like, not_like | string |
| entity.user.full_name | eq, ne, in, not_in, like, not_like | string |
| entity.user.ldap_person.cost_center | eq, ne, in, not_in, like, not_like | string |
| entity.user.ldap_person.created_time | eq, gt, gte, lt, lte, ne | datetime |
| entity.user.ldap_person.deleted_time | eq, gt, gte, lt, lte, ne | datetime |
| entity.user.ldap_person.employee_uid | eq, ne, in, not_in, like, not_like | string |
| entity.user.ldap_person.given_name | eq, ne, in, not_in, like, not_like | string |
| entity.user.ldap_person.job_title | eq, ne, in, not_in, like, not_like | string |
| entity.user.ldap_person.last_login_time | eq, gt, gte, lt, lte, ne | datetime |
| entity.user.ldap_person.surname | eq, ne, in, not_in, like, not_like | string |
| entity.user.name | eq, ne, in, not_in, like, not_like | string |
| entity.user.org.name | eq, ne, in, not_in, like, not_like | string |
| entity.user.org.ou_name | eq, ne, in, not_in, like, not_like | string |
| entity.user.uid | eq, ne, in, not_in, like, not_like | string |
| entity.user.uid_alt | eq, ne, in, not_in, like, not_like | string |
| entity.user.user_status_id | eq, in | number |
| time | eq, gt, gte, lt, lte, ne | datetime |


### Okta Identity filters for `query_users`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| entity.uid | eq, ne, in, not_in, like | string |
| entity.user.email_addr | eq, ne, in, not_in, like | string |
| entity.user.full_name | eq, ne, in, not_in, like | string |
| entity.user.ldap_person.cost_center | eq, ne, in, not_in, like | string |
| entity.user.ldap_person.created_time | eq, gt, gte, lt, lte | datetime |
| entity.user.ldap_person.employee_uid | eq, ne, in, not_in, like | string |
| entity.user.ldap_person.given_name | eq, ne, in, not_in, like | string |
| entity.user.ldap_person.job_title | eq, ne, in, not_in, like | string |
| entity.user.ldap_person.manager.full_name | eq, ne, in, not_in, like | string |
| entity.user.ldap_person.modified_time | eq, gt, gte, lt, lte | datetime |
| entity.user.ldap_person.surname | eq, ne, in, not_in, like | string |
| entity.user.name | eq, ne, in, not_in, like | string |
| entity.user.org.name | eq, ne, in, not_in, like | string |
| entity.user.org.ou_name | eq, ne, in, not_in, like | string |
| entity.user.uid | eq, ne, in, not_in, like | string |
| entity.user.uid_alt | eq, ne, in, not_in, like | string |
| entity.user.user_status_id | eq, in | string |
| time | eq, gt, gte, lt, lte | datetime |


### PingOne Cloud Platform filters for `query_users`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| entity.uid | eq, in, like | string |
| entity.user.email_addr | eq, in, like | string |
| entity.user.full_name | eq, in, like | string |
| entity.user.ldap_person.cost_center | eq, in, like | string |
| entity.user.ldap_person.created_time | eq | datetime |
| entity.user.ldap_person.employee_uid | eq, in, like | string |
| entity.user.ldap_person.given_name | eq, in, like | string |
| entity.user.ldap_person.job_title | eq, in, like | string |
| entity.user.ldap_person.modified_time | eq | datetime |
| entity.user.ldap_person.surname | eq, in, like | string |
| entity.user.name | eq, in, like | string |
| entity.user.uid | eq, in, like | string |
| entity.user.uid_alt | eq, in, like | string |
| time | eq | datetime |