Inquiry on /team_log/get_events Endpoint Behavior with Empty Events List and has_more True

rweckey

I am reaching out regarding an issue we are encountering when calling the /team_log/get_events endpoint. Occasionally, we receive a response where the events list is empty, but has_more is returned as True. Our company is attempting to integrate and analyze Dropbox logs using our SIEM product, Exabeam. Unfortunately, this issue is preventing a successful integration.

We had previously inquired about this matter and were informed that there are no plans for a correction. I would like to know if this behavior is considered part of the intended design or if it is recognized as a bug. 

Could you please inform us if there are any plans for addressing this issue? Additionally, are there any known causes for the empty list being returned despite has_more indicating more entries are available?

We appreciate your assistance in understanding and resolving this matter, as it is critical for our ongoing efforts to securely and effectively utilize Dropbox in conjunction with Exabeam.

Thank you for your time and support.

Best regards,

Greg-DB

Thanks for the feedback! I'll pass this along to the team.

 

There isn't a specified minimum size of the GetTeamEventsResult.events list returned by /2/team_log/get_events[/continue] so it is possible and expected to get an empty list in some cases. Due to some technical details, this can occur, though I don't have more specific information to share on what scenarios might cause that. I also am not aware of plans to change that or the endpoint specification.

 

That being the case, regardless of the size of the GetTeamEventsResult.events list, apps should always check the returned GetTeamEventsResult.has_more value and call back to /2/team_log/get_events/continue if it is true.