Request History

The Request History page provides a detailed log of API requests processed by GEM, including commands, macros, model changes, and admin-only operations. Each entry records who made the request, the result (granted or denied), and the denial reason if applicable.

Overview

Request History tracks:

• Commands and Macros: Zone commands and macro executions
• Model Changes: Inserts, updates, deletes, and sorts
• Admin-Only Operations: Script execution, backups, encryption keys, SSL, user management, and other sensitive operations
• Denied Requests: All denied API calls with the reason for denial

Open Request History

Date Range Selection

Controls at the top of the page set the time range and grouping:

Control	Description
Start Date	Beginning of the date range
End Date	End of the date range
Group By	Timeline chart grouping: Hour, Day, or Week
Quick Select	Shortcut buttons: 1D, 7D, 30D, 90D
Load	Fetches records for the selected range
Export CSV	Downloads every record in the selected range (not just the 2,000 loaded into the page), honoring the active Type/Result/User filters
Refresh	Reloads data with current settings
Create Report	Carries the current date range and filters into a reusable Request Activity report

Quick-select buttons load immediately.

note

The page loads the most recent 2,000 records within the selected date range. For high-traffic systems, narrow the date range for complete coverage — or use Export CSV, which is not subject to the 2,000-record page limit.

Summary Cards

Four cards display aggregate statistics for the loaded data:

Card	Description
Total Requests	Total number of logged requests
Granted	Count of requests that were allowed
Denied	Count of denied requests. Click the card to filter the table to denied requests only.
Unique Types	Number of distinct request types in the loaded data

Request Timeline Chart

A stacked bar chart showing request volume over time:

• Blue bars: Granted requests
• Red bars: Denied requests
• X-Axis: Time buckets (based on Group By setting)
• Y-Axis: Request count

Use the Group By selector to change between hourly, daily, or weekly views.

Top Requests

A table below the timeline lists the 10 most frequently executed requests in the loaded data, with columns for name, type badge, and execution count. Useful for quickly spotting the busiest zones, macros, or API endpoints.

Filters

The filter bar above the request table provides seven filter dimensions:

Filter	Description
Type	Request type (e.g., command, macro, update_model, restart_gem)
Name	Exact request name, such as a command, macro, or endpoint name
Result	granted or denied
Reason	Denial reason (e.g., admin_only, admin_only_pin_session, elevated_role_only, role_denied, unauthorized, invalid_session, invalid_token, remote_disallowed)
User	Username of the authenticated user
Client	Client session ID
IP	Client IP address

A count indicator shows how many records match the current filters out of the total loaded.

Request Log Table

The table displays individual request records:

Column	Description
Timestamp	When the request was made
Type	Request type, color-coded by category
Name	Request name (zone name for commands, macro name for macros)
Result	granted or denied badge
Reason	Denial reason badge (if denied)
User	Username
Client	Client session ID (truncated). Click to open the Clients detail modal for session context.
IP Address	Client IP address
Request	Request payload (truncated, hover for full JSON)

Denied requests are highlighted with a red background for visibility.

The operational table can display raw request JSON for diagnosis. Reusable Request Activity reports deliberately exclude that field because request payloads can contain credentials or tokens.

Sensitive fields are removed from the stored payload before it is written: passwords, PINs, duress PINs, card numbers, password hashes, two-factor codes and alarm-panel access codes (code, new_code, master_code and similar argument names — codes that work at the physical keypad) are replaced wherever they appear. Ordinary values that merely end in "code" (status_code, error_code, country_code, …) are left alone. The encryption key upload goes further — its payload is not recorded at all, and the row reads [payload withheld: key material] instead. Those keys decrypt every secure attribute on the site, so storing them in the same database as the rows they protect would defeat the point of encrypting them. Who made the call, from which client and IP, and whether it was granted are all still recorded.

The bulk attribute set (the Attributes page's change-many-at-once action) is withheld the same way. Field-name redaction cannot help there: the key holding the value is always value, and what makes it sensitive is the name beside it — so rotating a camera, lock or alarm credential through the bulk editor would otherwise have written it in clear text into the same database the attribute encryption exists to protect. The event, user, IP and outcome are recorded as usual; only the payload is dropped.

Pagination

Results are paginated at 50 records per page. Use the Previous/Next buttons at the bottom to navigate.

Denial Reasons

When a request is denied, one of these reasons is recorded:

Reason	Description
admin_only	Non-admin user attempted an admin-only operation
admin_only_pin_session	The user's role is elevated, but they signed in with a PIN, which never carries admin authority. Not a permission problem — signing in with a username and password grants the same request. See Roles → Elevated
elevated_role_only	The function requires an elevated role (site-mode changes). Unlike admin-only functions, an elevated role reaches these through a wildcard grant and keeps them on a PIN session; a non-elevated role needs the function granted by name
role_denied	User's role explicitly denies this API function
unauthorized	User's role does not include this API function
invalid_session	Session expired or invalid
invalid_token	Resource token is invalid or expired
remote_disallowed	Remote access blocked for this user's role
scope_denied	Non-elevated command targeting a zone or device on no UI the user can access. See Roles → UI scope for commands

Logged Request Types

Not all API calls are logged. The following categories are recorded:

Always Logged

• All admin-only operations (backup, restore, restart, scripts, encryption keys, SSL, user management, reports, AI assistant, etc.)
• All denied requests regardless of type

Tracked Operations

• command — Zone commands
• macro — Macro executions
• set_attribute — Attribute changes
• reload — Device/zone reloads
• update_model, insert_model, delete_model, create_model, sort_model — Database changes
• upsert_user — User creation/updates
• enable_disable_target — Enable/disable operations
• set_site_mode, clear_site_mode — Site mode changes
• build_automation_from_config, delete_automation — Automation changes
• save_theme_file, delete_theme_file — Theme changes

REST API

All REST API calls are logged with request_type: rest_api, including /api/token, /api/logout, /api/control/command, /api/control/macro, and /api/data/:entity. Denial reasons specific to the REST API include malformed_body, 2fa_required, 2fa_mismatch, and 2fa_no_email.

Use Cases

Security Auditing

Monitor for unauthorized access attempts:

1. Filter by Result: denied
2. Review denial reasons
3. Look for patterns (repeated denials from same user/IP)
4. Cross-reference with Access Activity for physical access correlation

Troubleshooting

Investigate when something isn't working:

1. Filter by User or Client ID
2. Check if requests are being denied
3. Review denial reason to identify permission issues
4. Adjust Roles if needed

Activity Analysis

Understand system usage patterns:

1. Set date range to desired period
2. Use the timeline chart to identify peak hours
3. Review type breakdown to see which operations are most common
4. Filter by type to drill into specific categories

Scheduled Review

1. Choose the date range and filters that describe the activity to review.
2. Click Create Report.
3. Choose the report columns and preview the result.
4. Save it and add an email schedule.

Related Documentation

• Roles — Role-based access control and API permissions
• Clients — Connected client sessions and device details
• Access Activity — Physical access control events
• Reports — Reusable Request Activity reports and scheduled delivery
• Data Retention — Configure how long request history is kept
• Dashboard — System overview and recent activity widget