Get New Log Entries main.eventlog.tail

If you are developing integrations for Bitrix24 using AI tools (Codex, Claude Code, Cursor), connect to the MCP server so that the assistant can utilize the official REST documentation.

Scope: main

Who can execute the method: administrator

The method main.eventlog.tail returns new log entries that appeared after the specified cursor reference point, considering the filter.

Method Parameters

Required parameters are marked with *

Name `type`	Description
select `array`	List of fields to return in the response. Available fields: `id` — log entry identifier `timestampX` — date and time of the event `severity` — importance level of the event `auditTypeId` — event type `moduleId` — module identifier `itemId` — object identifier `remoteAddr` — IP address `userAgent` — request User-Agent `requestUri` — request URI `siteId` — site identifier `userId` — user identifier `guestId` — guest identifier `description` — event description
filter `array`	Conditions for filtering records in the format: `["field", "operator", value]` `["field", value]`, default operator `=` Available fields are similar to those in `select`. More about filtering in REST 3.0
cursor `object`	Reference point for retrieving new records: `field` — sorting field, default `id` `order` — sorting direction `ASC` or `DESC`, default `ASC` `value` — starting value, default `0` `limit` — record limit, default `50`

Code Examples

How to Use Examples in Documentation

The new API call differs by adding the /api/ parameter in the request:

https://{installation_address}/rest/api/{user_id}/{webhook_token}/main.eventlog.tail

cURL (Webhook)

cURL (OAuth)

PHP

BX24.js

PHP CRest

curl -X POST \
        -H "Content-Type: application/json" \
        -H "Accept: application/json" \
        -d '{"select":["id","timestampX","severity","auditTypeId","moduleId","itemId","userId","description"],"filter":[],"cursor":{"field":"id","value":446313,"order":"ASC"}}' \
        https://**put_your_bitrix24_address**/rest/api/**put_your_user_id_here**/**put_your_webhook_here**/main.eventlog.tail

curl -X POST \
        -H "Content-Type: application/json" \
        -H "Accept: application/json" \
        -d '{"select":["id","timestampX","severity","auditTypeId","moduleId","itemId","userId","description"],"filter":[],"cursor":{"field":"id","value":446313,"order":"ASC"},"auth":"**put_access_token_here**"}' \
        https://**put_your_bitrix24_address**/rest/api/main.eventlog.tail

The SDK does not yet support the /rest/api/ address in calls. Use direct HTTP requests, such as via curl or fetch.

try
        {
            const response = await $b24.callMethod(
                'main.eventlog.tail',
                {
                    select: [
                        'id',
                        'timestampX',
                        'severity',
                        'auditTypeId',
                        'moduleId',
                        'itemId',
                        'userId',
                        'description'
                    ],
                    filter: [],
                    cursor: {
                        field: 'id',
                        value: 446313,
                        order: 'ASC'
                    }
                }
            );
        
            const result = response.getData().result;
            console.log('Event log tail:', result);
        }
        catch( error )
        {
            console.error('Error:', error);
        }

The SDK does not yet support the /rest/api/ address in calls. Use direct HTTP requests, such as via curl or fetch.

try {
            $response = $b24Service
                ->core
                ->call(
                    'main.eventlog.tail',
                    [
                        'select' => [
                            'id',
                            'timestampX',
                            'severity',
                            'auditTypeId',
                            'moduleId',
                            'itemId',
                            'userId',
                            'description'
                        ],
                        'filter' => [],
                        'cursor' => [
                            'field' => 'id',
                            'value' => 446313,
                            'order' => 'ASC'
                        ]
                    ]
                );
        
            $result = $response
                ->getResponseData()
                ->getResult();
        
            echo 'Success: ' . print_r($result, true);
        
        } catch (Throwable $e) {
            error_log($e->getMessage());
            echo 'Error: ' . $e->getMessage();
        }

The SDK does not yet support the /rest/api/ address in calls. Use direct HTTP requests, such as via curl or fetch.

BX24.callMethod(
            'main.eventlog.tail',
            {
                select: [
                    'id',
                    'timestampX',
                    'severity',
                    'auditTypeId',
                    'moduleId',
                    'itemId',
                    'userId',
                    'description'
                ],
                filter: [],
                cursor: {
                    field: 'id',
                    value: 446313,
                    order: 'ASC'
                }
            },
            function(result){
                console.info(result.data());
                console.log(result);
            }
        );

The SDK does not yet support the /rest/api/ address in calls. Use direct HTTP requests, such as via curl or fetch.

require_once('crest.php');
        
        $result = CRest::call(
            'main.eventlog.tail',
            [
                'select' => [
                    'id',
                    'timestampX',
                    'severity',
                    'auditTypeId',
                    'moduleId',
                    'itemId',
                    'userId',
                    'description'
                ],
                'filter' => [],
                'cursor' => [
                    'field' => 'id',
                    'value' => 446313,
                    'order' => 'ASC'
                ]
            ]
        );
        
        echo '<PRE>';
        print_r($result);
        echo '</PRE>';

Response Handling

HTTP Status: 200

{
            "result": {
                "items": [
                    {
                        "id": 446315,
                        "timestampX": "2026-01-30T14:05:38+02:00",
                        "severity": "SECURITY",
                        "auditTypeId": "USER_AUTHORIZE",
                        "moduleId": "main",
                        "itemId": "1463",
                        "userId": 1463,
                        "description": "{\"userId\":1463,\"applicationId\":\"mobile\",\"applicationPasswordId\":977,\"requestId\":\"1649cc2c8540e12c1f3aeb1e670c13f8\\\"-\\\"0\",\"method\":\"appPassword\"}"
                    },
                    // ....
                    {
                        "id": 446325,
                        "timestampX": "2026-01-30T15:03:02+02:00",
                        "severity": "SECURITY",
                        "auditTypeId": "USER_AUTHORIZE",
                        "moduleId": "rest",
                        "itemId": "971",
                        "userId": 971,
                        "description": "{\"userId\":971,\"method\":\"rest\",\"applicationType\":\"apauth\",\"applicationId\":383,\"timePeriod\":\"2026-01-30 15\"}"
                    }
                ]
            },
            "time": {
                "start": 1769774582,
                "finish": 1769774583.014603,
                "duration": 1.0146028995513916,
                "processing": 0,
                "date_start": "2026-01-30T15:03:02+02:00",
                "date_finish": "2026-01-30T15:03:03+02:00",
                "operating_reset_at": 1769775183,
                "operating": 0
            }
        }

Returned Data

Name `type`	Description
result `object`	Object with response data
items `array`	Array of log entry objects
items[] `object`	Log entry object
id `integer`	Log entry identifier
timestampX `datetime`	Date and time of the event
severity `string`	Importance level of the event
auditTypeId `string`	Event type
moduleId `string`	Module identifier
itemId `string`	Object identifier
remoteAddr `string`	IP address
userAgent `string`	Request User-Agent
requestUri `string`	Request URI
siteId `string`	Site identifier
userId `integer`	User identifier
guestId `integer`	Guest identifier
description `string`	Event description
time `time`	Information about the request execution time

Error Handling

HTTP Status: 400

{
            "error": {
                "code": "BITRIX_REST_V3_EXCEPTION_INVALIDFILTEREXCEPTION",
                "message": "Unable to recognize filter expression `Cursor field id cannot be used at filter.`"
            }
        }

Name `type`	Description
error.code `string`	String error code. Use it to identify the type of exception
error.message `string`	Text description of the error
error.validation `array`	Array with error details. Present only in data validation errors `BITRIX_REST_V3_EXCEPTION_VALIDATION_REQUESTVALIDATIONEXCEPTION`
error.validation[].field `string`	Name of the field where the validation error occurred
error.validation[].message `string`	Description of the error related to the specified field

Possible Error Codes

Access Errors

Error Code: BITRIX_REST_V3_EXCEPTION_ACCESSDENIEDEXCEPTION

Field	Error Description	How to Fix
`-`	Access denied	No administrator rights or missing scope main

Filtering Errors

Error Code: BITRIX_REST_V3_EXCEPTION_INVALIDFILTEREXCEPTION

Field	Error Description	How to Fix
`filter`	Unable to recognize filter expression `#FILTER#`	Remove the field specified in `cursor.field` from `filter`

Pagination Errors

Error Code: BITRIX_REST_V3_EXCEPTION_INVALIDPAGINATIONEXCEPTION

Field	Error Description	How to Fix
`cursor.limit`	Unable to recognize pagination parameter `#PAGE#`	Provide a numeric `limit` greater than `0`

Statuses and System Error Codes

HTTP Status: 20x, 40x, 50x

The errors described below may occur when calling any method.

Status	Code Error Message	Description
`500`	`INTERNAL_SERVER_ERROR` Internal server error	An internal server error has occurred. Please contact the server administrator or Bitrix24 technical support
`500`	`ERROR_UNEXPECTED_ANSWER` Server returned an unexpected response	An internal server error has occurred. Please contact the server administrator or Bitrix24 technical support
`503`	`QUERY_LIMIT_EXCEEDED` Too many requests	The request intensity limit has been exceeded
`405`	`ERROR_BATCH_METHOD_NOT_ALLOWED` Method is not allowed for batch usage	The current method is not permitted for calls using batch
`400`	`ERROR_BATCH_LENGTH_EXCEEDED` Max batch length exceeded	The maximum length of parameters passed to the batch method has been exceeded
`401`	`NO_AUTH_FOUND` Wrong authorization data	Invalid access token or webhook code
`400`	`INVALID_REQUEST` Https required	The HTTPS protocol is required for method calls
`503`	`OVERLOAD_LIMIT` REST API is blocked due to overload	The REST API is blocked due to overload. This is a manual individual block; please contact Bitrix24 technical support to lift it
`403`	`ACCESS_DENIED` REST API is available only on commercial plans	The REST API is only available on commercial plans
`403`	`INVALID_CREDENTIALS` Invalid request credentials	The user associated with the access token or webhook used to call the method lacks the necessary permissions
`404`	`ERROR_MANIFEST_IS_NOT_AVAILABLE` Manifest is not available	The manifest is not available
`403`	`insufficient_scope` The request requires higher privileges than provided by the webhook token	The request requires higher privileges than those provided by the webhook token
`401`	`expired_token` The access token provided has expired	The provided access token has expired
`403`	`user_access_error` The user does not have access to the application	The user does not have access to the application. This means that the application is installed, but the portal administrator has restricted access to this application to specific users only
`500`	`PORTAL_DELETED` Portal was deleted	The public part of the site is closed. To open the public part of the site on an on-premise installation, disable the "Temporary closure of the public part of the site" option. Path to the setting: Desktop > Settings > Product Settings > Module Settings > Main Module > Temporary closure of the public part of the site

Continue Learning

Retrieve a Specific Event Log Entry

Retrieve Event Log Fields

Get New Log Entries main.eventlog.tail

Method ParametersMethod Parameters

Code ExamplesCode Examples

Response HandlingResponse Handling

Returned DataReturned Data

Error HandlingError Handling

Possible Error CodesPossible Error Codes

Access ErrorsAccess Errors

Filtering ErrorsFiltering Errors

Pagination ErrorsPagination Errors

Statuses and System Error CodesStatuses and System Error Codes

Continue LearningContinue Learning

Method Parameters

Code Examples

Response Handling

Returned Data

Error Handling

Possible Error Codes

Access Errors

Filtering Errors

Pagination Errors

Statuses and System Error Codes

Continue Learning