Skip to main content

Directory Insights Events

Ingests JumpCloud Directory Insights events for security monitoring, audit trail analysis, and platform activity tracking.

Sync Type: Incremental

Requirements​

Before configuring this input, you need to:

  1. Verify API Access Permissions

    • Your JumpCloud account might be disabled for API access, to enable it head over to Settings > Administrators.
    • Click on your username and then in Edit Administrator panel on the right side scroll till you see Enable API access checkbox.
    • If disabled, click to enable it.

  2. Create or obtain a JumpCloud Admin API Key

    • Log in to your JumpCloud Admin Portal
    • Navigate to your account name (top right) > API Settings
    • Copy your API Key or create a new one if needed
    • Securely store the API Key

Details​

Monad uses the JumpCloud Directory Insights API to fetch events for audit and security monitoring. The input tracks state using a timestamp cursor for incremental syncing.

How State Management Works​

  • Monad stores the timestamp of the last successfully synced event
  • On subsequent runs, only events occurring after this timestamp are fetched
  • The first sync fetches up to 15 days of historical data (if not otherwise configured)
  • All subsequent syncs are incremental based on the stored timestamp

API Behavior​

  • The API uses cursor-based pagination with the X-Search_after header
  • Events are returned in ascending timestamp order to ensure correct state tracking
  • Each request can return up to 10,000 events (page limit)
  • Pagination continues until fewer than 10,000 events are returned in a page

Limitations​

  • JumpCloud does not publish a specific hard rate limit for the Directory Insights API
  • Monad applies a conservative limit of 10 requests per second (RPS) to avoid throttling
  • Historical data is available for up to 15 days in the past
  • The API returns events in UTC timezone

Configuration​

Settings​

SettingTypeRequiredDescription
Backfill Start TimestringNoThe date to start fetching data from. If not specified, no past records will be fetched.
ServicesarrayNoFilter events by specific services. Defaults to all services if not specified. Valid values: alert, all, directory, ldap, mdm, notifications, object_storage, password_manager, radius, reports, saas_app_management, software, sso, systems, access_management, asset_management, workflows.

Secrets​

SecretTypeRequiredDescription
API KeystringYesJumpCloud Admin API Key. Found in the Admin Portal under your account name > API Settings.

Rate Limits​

JumpCloud does not publish specific rate limits for the Directory Insights API. Monad applies a conservative rate limit to ensure reliable operation:

LimitValueNotes
Requests per second10 RPSConservative limit to avoid throttling
Results per request10,000 eventsMaximum page size supported by the API
Historical data15 days maximumAPI only returns events from the last 15 days

API Headers: x-api-key, Content-Type: application/json

Source: JumpCloud Directory Insights API Documentation

Troubleshooting​

Authentication Errors​

If you receive authentication failures:

  1. Verify your API Key is correct and has not expired
  2. Check that the API Key is enabled in the JumpCloud Admin Portal
  3. Ensure the API Key has been properly copied without extra whitespace
  4. Confirm your account has access to the Directory Insights API

No Events Returned​

If you're not receiving events:

  1. Verify that the configured services have generated events in the time period
  2. Check that your backfill start time is within the last 15 days
  3. Confirm your account has permissions to access the Directory Insights API
  4. Review your service filter if you've limited it to specific services

Sample Record​

{
  "changes": [
      {
          "field": "mfa",
          "from": "old_value",
          "to": "active"
      }
  ],
  "client_ip": "198.196.253.206",
  "event_type": "mfa_enrolled",
  "id": "6fe0dfe7-06d9-89d1-78c4-a4730db40f60",
  "initiated_by": {
      "email": "alice.williams@example.com",
      "id": "26cbb592-6eef-05e0-b085-a8ad74f4ed52",
      "type": "admin",
      "username": "admin"
  },
  "organization": "2708f8d0-e724-4a64-3bee-5a84b34c93f2",
  "provider": "Okta",
  "resource": {
      "displayName": "HR Users",
      "id": "ffc1dfc1-1c9d-5600-94f2-4cfe9b3743ef",
      "type": "system"
  },
  "service": "sso",
  "success": false,
  "timestamp": "2026-02-17T11:02:33Z",
  "useragent": {
      "browser": "Edge",
      "os": "Android",
      "raw": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36"
  }
}