--- title: Get recently updated entity context description: Get the entities with the most recent updates in the Cloud SIEM entity context store. breadcrumbs: Docs > API > Get recently updated entity context --- > For the complete documentation index, see [llms.txt](https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/llms.txt). # Get recently updated entity context ## v2 (latest) {% alert level="warning" %} **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help.md). {% /alert %} | Datadog site | API endpoint | | ----------------- | -------------------------------------------------------------------------------------------- | | app.datadoghq.com | GET https://api.datadoghq.com/api/v2/security_monitoring/entity_context/recently_updated | | us3.datadoghq.com | GET https://api.us3.datadoghq.com/api/v2/security_monitoring/entity_context/recently_updated | | us5.datadoghq.com | GET https://api.us5.datadoghq.com/api/v2/security_monitoring/entity_context/recently_updated | | app.datadoghq.eu | GET https://api.datadoghq.eu/api/v2/security_monitoring/entity_context/recently_updated | | ap1.datadoghq.com | GET https://api.ap1.datadoghq.com/api/v2/security_monitoring/entity_context/recently_updated | | ap2.datadoghq.com | GET https://api.ap2.datadoghq.com/api/v2/security_monitoring/entity_context/recently_updated | | uk1.datadoghq.com | GET https://api.uk1.datadoghq.com/api/v2/security_monitoring/entity_context/recently_updated | | app.ddog-gov.com | GET https://api.ddog-gov.com/api/v2/security_monitoring/entity_context/recently_updated | | us2.ddog-gov.com | GET https://api.us2.ddog-gov.com/api/v2/security_monitoring/entity_context/recently_updated | ### Overview Get the entities with the most recent updates in the Cloud SIEM entity context store. Entities are ranked by the time of their most recent revision in the requested time range, and the top `limit` entities are returned in that order. This endpoint is not paginated. This endpoint requires the `siem_entities_read` permission. OAuth apps require the `siem_entities_read` authorization [scope](https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/api/latest/scopes.md#security-monitoring) to access this endpoint. ### Arguments #### Query Strings | Field | Type | Description | | ----------- | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | query | string | A free-text query (for example, an email address or principal ID) used to filter the entities returned. | | entity_type | enum | The type of entity to retrieve. Only `siem_entity_identity` is currently supported. Defaults to `siem_entity_identity`. Allowed enum values: `siem_entity_identity`. Default: `siem_entity_identity`. | | from | string | The start of the time range to query, as an RFC3339 timestamp or a relative time (for example, `now-7d`). Defaults to `now-7d`. Default: `now-7d`. | | to | string | The end of the time range to query, as an RFC3339 timestamp or a relative time (for example, `now`). Defaults to `now`. Entities are ranked by their most recent revision within `[from, to]`. Default: `now`. | | limit | integer | The number of entities to return. Must be between 1 and 100. Default: `50`. | | revisions | enum | Which revisions to return for each entity: `latest` returns only the latest revision of each entity as of `to`, and `all` returns every revision in the requested time range. Allowed enum values: `latest`, `all`. Default: `latest`. | ### Response {% tabs %} {% tab label="200" %} OK {% tabs %} {% tab label="Model" %} Response from the recently updated entities endpoint, containing the entities with the most recent updates in the requested time range, ordered from most to least recently updated. | Parent field | Field | Type | Description | | ------------ | -------------------------- | --------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | data [*required*] | [object] | The list of entities with the most recent updates, ordered from most to least recently updated. | | data | attributes [*required*] | object | The attributes of an entity context entry, grouping all the historical revisions of the entity. | | attributes | revisions [*required*] | [object] | The historical revisions of the entity, ordered chronologically. | | revisions | attributes [*required*] | object | The set of attributes recorded for the entity at this revision. The keys depend on the kind of entity. | | revisions | first_seen_at [*required*] | date-time | The first time the entity was observed at this revision. | | revisions | last_seen_at [*required*] | date-time | The last time the entity was observed at this revision. | | data | id [*required*] | string | The unique identifier of the entity. | | data | type [*required*] | string | The type of the entity. Reflects the underlying entity kind from the entity context store (for example, `siem_entity_identity` for identities). Defaults to `entity` when the kind is unknown. Default: `entity`. | {% /tab %} {% tab label="Example" %} ```json { "data": [ { "attributes": { "revisions": [ { "attributes": { "accounts": [ "linked-account-123" ], "display_name": "Test User", "email": "user@example.com", "principal_id": "user@example.com" }, "first_seen_at": "2026-04-01T00:00:00Z", "last_seen_at": "2026-05-01T00:00:00Z" } ] }, "id": "user@example.com", "type": "siem_entity_identity" } ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% tab label="400" %} Bad Request {% tabs %} {% tab label="Model" %} API error response. | Field | Type | Description | | ------------------- | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab label="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% tab label="403" %} Not Authorized {% tabs %} {% tab label="Model" %} API error response. | Field | Type | Description | | ------------------- | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab label="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% tab label="429" %} Too many requests {% tabs %} {% tab label="Model" %} API error response. | Field | Type | Description | | ------------------- | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab label="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% /tabs %} ### Code Example {% tabs %} {% tab label="Curl" %} ```bash # Set your Datadog site and credentials export DD_SITE="datadoghq.com" # Or us3.datadoghq.com, us5.datadoghq.com, datadoghq.eu, ap1.datadoghq.com, ap2.datadoghq.com, uk1.datadoghq.com, ddog-gov.com, us2.ddog-gov.com # Use a Personal Access Token or Service Access Token export DD_BEARER_TOKEN="" curl -X GET "https://api.${DD_SITE}/api/v2/security_monitoring/entity_context/recently_updated" \ -H "Accept: application/json" \ -H "Authorization: Bearer ${DD_BEARER_TOKEN}" ``` {% /tab %} {% tab label="Go" %} ```go // Get recently updated entity context returns "OK" response package main import ( "context" "encoding/json" "fmt" "os" "github.com/DataDog/datadog-api-client-go/v2/api/datadog" "github.com/DataDog/datadog-api-client-go/v2/api/datadogV2" ) func main() { ctx := datadog.NewDefaultContext(context.Background()) ctx = context.WithValue(ctx, datadog.ContextAccessToken, os.Getenv("DD_BEARER_TOKEN")) configuration := datadog.NewConfiguration() configuration.SetUnstableOperationEnabled("v2.GetEntityContextRecentlyUpdated", true) apiClient := datadog.NewAPIClient(configuration) api := datadogV2.NewSecurityMonitoringApi(apiClient) resp, r, err := api.GetEntityContextRecentlyUpdated(ctx, *datadogV2.NewGetEntityContextRecentlyUpdatedOptionalParameters()) if err != nil { fmt.Fprintf(os.Stderr, "Error when calling `SecurityMonitoringApi.GetEntityContextRecentlyUpdated`: %v\n", err) fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r) } responseContent, _ := json.MarshalIndent(resp, "", " ") fmt.Fprintf(os.Stdout, "Response from `SecurityMonitoringApi.GetEntityContextRecentlyUpdated`:\n%s\n", responseContent) } ``` #### Instructions First [install the library and its dependencies](https://dnd37xeb23o8n.cloudfront.net/api/latest.md?code-lang=go) and then save the example to `main.go` and run following commands: ```bash DD_SITE="datadoghq.com" DD_BEARER_TOKEN="" go run "main.go" ``` {% /tab %} {% tab label="Java" %} ```java // Get recently updated entity context returns "OK" response import com.datadog.api.client.ApiClient; import com.datadog.api.client.ApiException; import com.datadog.api.client.v2.api.SecurityMonitoringApi; import com.datadog.api.client.v2.model.RecentlyUpdatedEntitiesResponse; public class Example { public static void main(String[] args) { ApiClient defaultClient = ApiClient.getDefaultApiClient(); defaultClient.setAccessToken(System.getenv("DD_BEARER_TOKEN")); defaultClient.setUnstableOperationEnabled("v2.getEntityContextRecentlyUpdated", true); SecurityMonitoringApi apiInstance = new SecurityMonitoringApi(defaultClient); try { RecentlyUpdatedEntitiesResponse result = apiInstance.getEntityContextRecentlyUpdated(); System.out.println(result); } catch (ApiException e) { System.err.println( "Exception when calling SecurityMonitoringApi#getEntityContextRecentlyUpdated"); System.err.println("Status code: " + e.getCode()); System.err.println("Reason: " + e.getResponseBody()); System.err.println("Response headers: " + e.getResponseHeaders()); e.printStackTrace(); } } } ``` #### Instructions First [install the library and its dependencies](https://dnd37xeb23o8n.cloudfront.net/api/latest.md?code-lang=java) and then save the example to `Example.java` and run following commands: ```bash DD_SITE="datadoghq.com" DD_BEARER_TOKEN="" java "Example.java" ``` {% /tab %} {% tab label="Python" %} ```python """ Get recently updated entity context returns "OK" response """ from os import environ from datadog_api_client import ApiClient, Configuration from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi configuration = Configuration() configuration.access_token = environ["DD_BEARER_TOKEN"] configuration.unstable_operations["get_entity_context_recently_updated"] = True with ApiClient(configuration) as api_client: api_instance = SecurityMonitoringApi(api_client) response = api_instance.get_entity_context_recently_updated() print(response) ``` #### Instructions First [install the library and its dependencies](https://dnd37xeb23o8n.cloudfront.net/api/latest.md?code-lang=python) and then save the example to `example.py` and run following commands: ```bash DD_SITE="datadoghq.com" DD_BEARER_TOKEN="" python3 "example.py" ``` {% /tab %} {% tab label="Ruby" %} ```ruby # Get recently updated entity context returns "OK" response require "datadog_api_client" DatadogAPIClient.configure do |config| config.access_token = ENV["DD_BEARER_TOKEN"] config.unstable_operations["v2.get_entity_context_recently_updated".to_sym] = true end api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new p api_instance.get_entity_context_recently_updated() ``` #### Instructions First [install the library and its dependencies](https://dnd37xeb23o8n.cloudfront.net/api/latest.md?code-lang=ruby) and then save the example to `example.rb` and run following commands: ```bash DD_SITE="datadoghq.com" DD_BEARER_TOKEN="" rb "example.rb" ``` {% /tab %} {% tab label="Rust" %} ```rust // Get recently updated entity context returns "OK" response use datadog_api_client::datadog; use datadog_api_client::datadogV2::api_security_monitoring::GetEntityContextRecentlyUpdatedOptionalParams; use datadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI; #[tokio::main] async fn main() { let mut configuration = datadog::Configuration::new(); configuration.set_unstable_operation_enabled("v2.get_entity_context_recently_updated", true); let api = SecurityMonitoringAPI::with_config(configuration); let resp = api .get_entity_context_recently_updated( GetEntityContextRecentlyUpdatedOptionalParams::default(), ) .await; if let Ok(value) = resp { println!("{:#?}", value); } else { println!("{:#?}", resp.unwrap_err()); } } ``` #### Instructions First [install the library and its dependencies](https://dnd37xeb23o8n.cloudfront.net/api/latest.md?code-lang=rust) and then save the example to `src/main.rs` and run following commands: ```bash DD_SITE="datadoghq.com" DD_API_KEY="" DD_APP_KEY="" cargo run ``` {% /tab %} {% /tabs %}