Event Catalog

GET /api/v1/team/events carries every supported event type through the same cursor-paginated stream. Filter with repeated types parameters and optionally a userId, from, or to.

curl --get --fail-with-body \
  --header "Authorization: Bearer $ROGUE_ARENA_TEAM_API_KEY" \
  --data-urlencode "userId=USER_ID" \
  --data-urlencode "types=userAnsweredQuestion" \
  --data-urlencode "types=userUnlockedChapter" \
  "https://arena.roguelabs.io/api/v1/team/events"

Training and lifecycle events

These require team:events:read:

unlockedCertificateOfCompletion
completedScenario
registeredForCertificationTest
unregisteredForCertificationTest
certificationTestFailed
certificationTestPassed
userDeployedScenario
userRemovedScenario
userStartedResumedScenario
userShutdownScenario
idleUserScenarioShutdown
userUnlockedChapter
userAnsweredQuestion

Sensitive activity events

These require team:activity:read:

sharedScenario
unsharedScenario
acceptedShareInvite
uploadedFile
copiedCutFiles
singleSnapshotCaptured
singleSnapshotReverted
singleSnapshotDeleted
revertedScenarioToSnapshot
acceptedWarp
virtualMachineUsage
vpnUsage
keystrokeActivity
videoWatchTime

The four usage types are daily aggregates rather than raw telemetry. They use deterministic IDs, aggregation: "daily", and safe totals such as durationSeconds or count. A usage session is attributed to the UTC calendar day on which the session started, including when it continues past midnight.

A daily row’s occurredAt is always the start of that UTC day (00:00:00Z). For these four types, from and to select that synthetic bucket timestamp—not individual activity timestamps. A bucket selected by the window covers the complete UTC day, capped at the response’s stable asOf anchor when that day is still in progress. Consequently, from after midnight excludes that UTC day, while to after midnight includes it and its total can contain activity later than to. Use midnight UTC boundaries when dividing a usage export into adjacent windows.

Every daily usage row is marked mutable: true: late session or telemetry updates can revise even an earlier start-day aggregate. Within one cursor chain, the fixed asOf anchor keeps a row’s ID and value independent of the chosen partial-day filter. Scheduled synchronizations should re-read a short overlap window and upsert by event ID. The remaining activity types are immutable individual occurrences.

Event shape and privacy

Each record identifies the event, its public type, occurrence time, stable user ID, aggregation mode, and a reviewed data object. The data object only admits documented fields such as course, scenario, curriculum, chapter, question, filename, snapshot name, count, or duration.

Raw Logger payloads are never returned. That prevents unrelated internal values—including private paths, window titles, VM IDs, and voucher IDs—from leaking when an event schema evolves internally.

If an old event has malformed or unrecognized payload data, the page still succeeds:

{
  "payloadStatus": "unavailable",
  "data": null
}

Consumers should retain the event itself and treat its optional details as unavailable. Do not fail an entire synchronization because one legacy event lacks a usable payload.