Use this procedure to retrieve user activity data as a downloadable report via the iManage Threat Manager API. The API processes the request asynchronously; the initial call returns a job ID, which you use to check status and retrieve results.

Details

Before starting

You must have a valid access token. Refer to Authentication using the iManage Threat Manager API.

Service impact

None.

After completion

Activity report data for the specified users is returned in the requested file format.

Request Summary

Endpoint path

POST https://<tm-host-or-ip-address>/tm-api/async/activity-logs/documents

Headers

"X-Auth-Token": Set value to Access Token string

Request parameters

Parameters

Details

"startdate"

  • Timestamp to specify a date from which to get alerts. The start of the alert day must be after this date to be included.

  • Applied only if "static" is chosen for "daterange_period". "startdate" is inclusive.

  • Example: 1585008000000 [Jan 24, 2026 00:00:00 UTC]

"enddate"

  • Timestamp to specify a date up to which to get alerts [inclusive]. The start of the alert day must be before the end of the day on this date to be included.

  • Applied only if "static" is chosen for "daterange_period". "enddate" is inclusive.

  • Example: 1585008000000 [Jan 24, 2026 00:00:00 UTC]

"timezone"

  • Specifies Timezone to use for obtaining Alerts.

  • Example: "America/Chicago", "GMT", "Asia/Tokyo"

"file_type"

  • Specify a file type of CSV, Excel, and/or PDF. If used, paging isn't used and all alerts are returned in a file of the specified format.

  • Example: "csv", "xlsx”, “pdf"

"users"

  • A list of user IDs whose activity reports will be downloaded.

"captions"

  • Required. Specifies the columns to include in the report.

  • Example: "captions":"[{\"database\":\"ACTIVE\",\"id\":\"description\",\"label\":\"Description\",\"locale\":1033,\"num\":1,\"ss_num\":1,\"type\":\"string\"},{\"database\":\"ACTIVE\",\"id\":\"name\",\"label\":\"Name\",\"locale\":1033,\"num\":2,\"ss_num\":1,\"type\":\"string\"},{\"database\":\"ACTIVE\",\"id\":\"author\",\"label\":\"Author\",\"locale\":1033,\"num\":3,\"ss_num\":1,\"type\":\"users\"},{\"database\":\"ACTIVE\",\"id\":\"operator\",\"label\":\"Operator\",\"locale\":1033,\"num\":4,\"ss_num\":1,\"type\":\"users\"}]"

"job_id"

  • After the initial curl request, you'll receive a job ID.

  • Example: "63bda5ea8a01462cf3d72e80"

“dmsCodes”

  • Optional. Filters the report to specific activity types; if omitted or passed as [], all activity types are included."

  • Example: "dmsCodes":"[\"Document Create Count\",\"Offline Download Count\"]"

Making a curl request and obtaining a job ID

Curl request example:

curl --location --request POST 'http://*IP address goes here*/imcc/tm-api/async/activity-logs/documents' \
--header 'X-Auth-Token: "access token from above step goes here "' \
--header 'Content-Type: application/json' \
--data-raw '
 
{
"dmsCodes": "[]",
"timezone": "America/Chicago",
"users": "[\"SRGSUPPORT\",\"ACASE\",\"AADENMARTIN\"]",
"file_type": "csv",
"startdate": "02/05/2026",
"enddate": "02/25/2026",
"captions": " "
}'

Response with the job ID:

{
"job_id": "63bda5ea8a01462cf3d72e80"
}

Sample GET request to check the status, passing the job ID: 

The request URL is https://<tm-host-or-ip-address>/tm-api/async/status/[job_id] (where [job_id] is the job ID returned, for example 63c6dc531a2787893e5ecea5).

Possible return values, if a job is either in progress, or completed: 

{
"job_id": "63c6dc531a2787893e5ecea5", "status": "in_progress"
}
 
{
"job_id": "63c6dc531a2787893e5ecea5", "status": "completed"
}

When the job completes, make the original curl request but pass the job ID and you'll get the results. 

Sample curl request to get the activity results of a completed job:

curl --location --request POST 'http://imcc/tm-api/async/activity-logs/documents' \
--header 'X-Auth-Token: " "' \
--header 'Content-Type: application/json' \
--data-raw '
{
"dmsCodes": "[]",
"timezone": "America/Chicago",
"users": "[\"SRGSUPPORT\"]",
"file_type": "csv",
"startdate": "02/05/2026",
"enddate": "02/25/2026",
"captions": " ",
"job_id": "63bda4488a01462cf3d72e7e"
}'

Possible sample responses

Sample response with results when a job is complete and successful: 

{
"name": "SRGSUPPORT Documents Activity for 02/05/2026 12:00:00 AM CDT to 02/25/2026 11:59:59 PM CST.csv", "data": "..."
}

Sample response when an invalid user ID is specified: 

{
"job_id": "Async API Call with job_id '63bda4488a01462cf3d72e7e' has different scope parameters. Please rerun Async API Call with new parameters."
}

Sample response when there's no data for a user: 

{
"name": "1231 Documents Activity for 01/19/2026 12:00:00 AM CST to 01/19/2026 11:59:59 PM CST.csv",
"data": "'There are no items in this Report.\r\n"
}