Litmus Edge 4.4.x - System: Events

Get Events

POST {{edgeUrl}}/events/query

Get Events

Returns a page of historical device events with optional filters by severity, event ID, time window, and free-text. This is the only GraphQL endpoint in System.

Endpoint

POST {{edgeUrl}}/events/query
Content-Type: application/json

Authentication

HTTP Basic Auth. Username is your API token, password is empty. Tokens are managed under System > Access Control > Tokens.

Request body (GraphQL)

query events($filter: HistoryFilter, $offset: Int!, $count: Int!) {
  severityList
  events(filter: $filter, offset: $offset, count: $count) {
    events {
      component eventId severity msg
      time { utc local }
      attrs { name value }
    }
    total
  }
}

Variables

{
  "offset": 0,
  "count": 10,
  "filter": {
    "eventId": {},
    "fromTimestamp": 1673213725331,
    "toTimestamp": 1704749725331
  }
}

Response

200 OK -- application/json

Errors

TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.

Request Body

GraphQL Query

query events($filter: HistoryFilter, $offset: Int!, $count: Int!) {
  severityList
  events(filter: $filter, offset: $offset, count: $count) {
    events {
      component
      eventId
      severity
      msg
      time {
        utc
        local
      }
      attrs {
        name
        value
      }
    }
    total
  }
}

Variables

{
  "offset": 0,
  "count": 10,
  "filter": {
    "eventId": {},
    "fromTimestamp": 1673213725331,
    "toTimestamp": 1704749725331
  }
}

Response

Status: 200 OK

{
    "data": {
        "severityList": [
            "INFO",
            "WARN",
            "ALERT"
        ],
        "events": {
            "events": [],
            "total": 0
        }
    }
}

Purge Events

PUT {{edgeUrl}}/events/mgmt/purge

Purge Events

Deletes the stored event history and returns the number of bytes reclaimed. Pair it with Events Management Stats to see how much the event log is costing before you clear it.

This is destructive and irreversible: purged events are gone, and subsequent Get Events queries return total: 0 for the purged window.

Endpoint

PUT {{edgeUrl}}/events/mgmt/purge
Content-Type: application/json

Authentication

HTTP Basic Auth. Username is your API token, password is empty. Tokens are managed under System > Access Control > Tokens.

Request body

{ "enabled": true }

Response

200 OK -- application/json

{ "freed": 12288 }

Errors

TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.

Request Body

{
    "enabled": true
}

Response

Status: 200 OK

{
    "freed": 12288
}

Events Management Stats

GET {{edgeUrl}}/events/mgmt/stats

Events Management Stats

Returns the on-disk size of the event log in bytes.

Endpoint

GET {{edgeUrl}}/events/mgmt/stats

Authentication

HTTP Basic Auth. Username is your API token, password is empty. Tokens are managed under System > Access Control > Tokens.

Response

{ "size": 36864 }

Errors

TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.

Response

Status: 200 OK

{
    "size": 36864
}

Zerotouch Reports

GET {{edgeUrl}}/dm/zerotouch/reports

Zerotouch Reports

Returns the Zerotouch (zero-touch onboarding) reports recorded on the device. Useful for auditing initial provisioning.

Endpoint

GET {{edgeUrl}}/dm/zerotouch/reports

Authentication

HTTP Basic Auth. Username is your API token, password is empty. Tokens are managed under System > Access Control > Tokens.

Response

200 OK -- application/json. Empty array on devices that were not Zerotouch-provisioned.

Errors

TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.

Get Event Storage State

GET {{edgeUrl}}/events/mgmt/storage

Get Event Storage State

Whether the device stores events. The web UI reads it on the System > Events page and toggles it with PUT /events/mgmt/storage and body {"enabled": <bool>}.

Endpoint

GET {{edgeUrl}}/events/mgmt/storage

Authentication

HTTP Basic Auth. Username is your API token, password is empty. Tokens are managed under System > Access Control > Tokens.

Parameters

None.

Response

200 OK -- application/json.

{ "enabled": true }

Errors

TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.

Response

Status: 200 OK

{
    "enabled": true
}

Subscribe to Events

GET {{edgeUrl}}/events/subscription

Subscribe to Events

Streams system events (device connect / disconnect, service and security events) as they are logged. The Events page uses it for its live view; Get Events queries the stored history.

Endpoint

GET wss://{{edgeHost}}/events/subscription
Sec-WebSocket-Protocol: graphql-transport-ws

WebSocket. Open wss://{{edgeHost}}/events/subscription with a WebSocket client; a plain HTTP GET does not stream. After importing this item, convert it to a Postman WebSocket request.

This is the GraphQL subscription endpoint of the events service (EventsLive.subscribe). Speak graphql-transport-ws: send connection_init, wait for connection_ack, then send a subscribe message carrying the document below. The legacy graphql-ws protocol (start instead of subscribe) is also accepted.

Authentication

HTTP Basic Auth on the WebSocket upgrade request. Username is your API token, password is empty. A token in the query string is not accepted.

An Origin header is not required by this service.

Subscription

subscription eventsLive($historyCount: Int!) {
  subscribe(historyCount: $historyCount) {
    component
    eventId
    severity
    msg
    time {
      utc
      local
    }
    attrs {
      name
      value
    }
  }
}

{"historyCount": 50}

Messages

Each event arrives as a next message whose payload.data.subscribe is an Event. The example response lists the captured text frames, one JSON document per line.

The stream stays open until you send complete or close the socket.

Errors

TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.

Response

Status: 200 OK

{"type":"connection_ack"}
{"payload":{"data":{"subscribe":{"component":"dh","eventId":"device.connected","severity":"info","msg":"Device connected.","time":{"utc":"2026-10-14T18:28:25Z","local":"2026-10-14T11:28:25-07:00"},"attrs":[{"name":"driver","value":"Fanuc CNC Ethernet (Gen1.3)"},{"name":"id","value":"F9DF967C-5981-5F38-B195-0A1BDF961E6F"},{"name":"msg","value":"Device connected."},{"name":"name","value":"CS1_VMC02"},{"name":"uuid","value":"7f897d4f-732d-4484-a1ea-3e8077af76ff"}]}}},"id":"1","type":"next"}