Inquiry on /team_log/get_events Endpoint Behavior with Empty Events List and has_more True

[rweckey]

I am reaching out regarding an issue we are encountering when calling the /team_log/get_events endpoint. Occasionally, we receive a response where the events list is empty, but has_more is returned as True. Our company is attempting to integrate and analyze Dropbox logs using our SIEM product, Exabeam. Unfortunately, this issue is preventing a successful integration.

We had previously inquired about this matter and were informed that there are no plans for a correction. I would like to know if this behavior is considered part of the intended design or if it is recognized as a bug. 

Could you please inform us if there are any plans for addressing this issue? Additionally, are there any known causes for the empty list being returned despite has_more indicating more entries are available?

We appreciate your assistance in understanding and resolving this matter, as it is critical for our ongoing efforts to securely and effectively utilize Dropbox in conjunction with Exabeam.

Thank you for your time and support.

Best regards,

[Greg-DB · Accepted solution]

Thanks for the feedback! I'll pass this along to the team.

There isn't a specified minimum size of the GetTeamEventsResult.events list returned by /2/team_log/get_events[/continue] so it is possible and expected to get an empty list in some cases. Due to some technical details, this can occur, though I don't have more specific information to share on what scenarios might cause that. I also am not aware of plans to change that or the endpoint specification.

That being the case, regardless of the size of the GetTeamEventsResult.events list, apps should always check the returned GetTeamEventsResult.has_more value and call back to /2/team_log/get_events/continue if it is true.

[rweckey]

We are attempting to utilize the existing functionality within the product to capture logs, but it seems our only options are to request the developers to modify the code to make decisions based on 'has_more', or to set up a server dedicated to capturing logs and then transferring them.

The developers view this behavior as unexpected, so could you please ensure the documentation reflects that "an empty list can be returned even when has_more=True"?

I will share this thread with the relevant parties.

Thanks.

[Greg-DB]

Thanks for the additional feedback! I'll share this with the team.