Office
A suite of Microsoft productivity software that supports common business tasks, including word processing, email, presentations, and data management and analysis.
1,651 questions
Strange behavior when using REST APIs? (Office 365 Management APIs)
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(38.4, 30%, 13%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
andrei
45
Reputation points
I'm trying to build a tool which collects audit events from O365.
I'm using this Office365 Management APIs documentation https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-reference#activity-api-operations and Python requests package.
It works great but sometimes the request made to those audit URLs (for example, https://manage.office.com/api/v1.0/<tenant-id>/activity/feed/subscriptions/content?contentType=DLP.All&startTime=2023-08-07T18:34:10&endTime=2023-08-07T18:36:10) hangs. So I set a timeout of 60 seconds and, if timeout occurs, wait, let's say 15 seconds, and retry the request. Do it for, let's say, 3 times, and abort if none of the attempts is successful.
Now, it seems like working a little better. Sometimes I catch a timeout (sometimes even 503 Server Error: Service Unavailable) but after one or two retries to an URL like https://manage.office.com/api/v1.0/<tenant-id>/activity/feed/subscriptions/content?contentType=DLP.All&startTime=2023-08-07T18:34:10&endTime=2023-08-07T18:36:10 it succeed. Other times, there is no success even after 3 retries, for example on this URL: https://manage.office.com/api/v1.0/<tenant-id>/activity/feed/subscriptions/content?contentType=Audit.AzureActiveDirectory&startTime=2023-08-07T21:24:11&endTime=2023-08-07T21:27:28
Is this expected behavior when working directly with REST APIs? In my past experience when I was working with clouds and using dedicated python libraries I didn't encounter something similar. Perhaps those libraries handle those cases (like I explained above) behind the interface?
Thank you!!
Office
{count} votes
-
andrei 45 Reputation points
2023-09-18T09:10:10.66+00:00 Me again:
I have a theory. Can it be because, for the endTime parameter I was using the current time? Thus, some events are not yet processed by the office platform and so there are not available to be retrieved, resulting in the above behavior?
Can somebody direct me to a documentation where I can find what is the delay from the time the event happened on the platform to the time the event can now be collected?
LATER EDIT:
this assumption was false, the List Available Content API filter events by the time they are available to be collected, NOT by the time the event happened on the platform https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-reference#list-available-content
-
andrei 45 Reputation points
2023-09-18T14:47:46.78+00:00 update for my previous comment: the timeout exception is still there, even if I only request events which occur more than 90 minutes, as per this documentation: https://learn.microsoft.com/en-us/purview/audit-log-search
"Most auditing data is available within 60-90 minutes but it may take up to 24 hours after an event occurs for the corresponding audit log entry to be displayed in the search results."
Sign in to comment
Sign in to answer