Request parameters

Use these parameters in requests.

Parameter	Description	Parameter type	Data type	Required	Default
`Authorization`	Trellix IAM-based access token. The token must include one of these combinations of scopes. `epo.admin` — Allow users to access threat events and Trellix DLP Endpoint incidents. `epo.evt.r` — Allow users to access threat events only. `dp.im.r` — Allow users to access Trellix DLP Endpoint incidents only. Note You must have the assigned role — Data Loss Prevention: View incident reports to fetch the token with scope `dp.im.r`. `epo.evt.r dp.im.r` — Allow user to access threat events and Trellix DLP Endpoint incidents.	Header	String	True	N/A
`type`	The type of events. `threats` — Returns threat events only. `incidents` — Returns Trellix DLP Endpoint incidents only. `all` — Returns threat events and Trellix DLP Endpoint incidents.
`since`	The date and time of the earliest events to return with the response.	Query	Date	False	1970-01-01T00:00:00.000Z
`until`	The date and time of the latest events to return with the response.	Query	Date	False	Current date and time when query is executed.
`sort`	Ordering of events, sorted by date and time. Values can be `desc` or `asc`.	Query	String	False	desc
`limit`	The maximum number of events to be returned in the response must be an integer value between 1 and 1000. Note In some cases, the requested number of events may be reduced to prevent time-out issues.	Query	Number	False	100
`after`	A link returned in the HTTP header (rel=next), providing the cursor that points to the end of the page of data that has been returned. Used to get the next results, if available. Treat the after cursor as an opaque value as its contents are subject to change without notice.	Query	String	False	N/A