> Source: [sk181906](https://support.checkpoint.com/results/sk/sk181906)

# sk181906 - How to see the API usage on a Management Server?

| Property | Value |
|----------|-------|
| Solution ID | sk181906 |
| Date Created | 2024-01-21 |
| Last Modified | 2025-05-19 |
| Technical Level | General |
| Products | Security Management Server, Multi-Domain Security Management Server |
| Versions | R82, R81.20, R81.20, R82 |
| OS | Gaia |

## Solution

### Background

You can perform various action on a Check Point Management Server with the Management REST API commands (see the [Management API Reference](https://sc1.checkpoint.com/documents/latest/APIs/index.html#introduction)).

You can extract data from the API logs to get the API usage information (API calls, timestamp, duration, payload, and so on).

This feature is available in:

* [Check Point Quantum R82](https://support.checkpoint.com/results/sk/sk181127)
* [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 101

<br />

### Procedure

1. Connect to the command line on the Security Management Server / Multi-Domain Security Management Server.

2. Log in to the Expert mode.

3. On a Multi-Domain Security Management Server, go to the context of the applicable Domain Management Server:

   `mdsenv <IP Address or Name of Domain Management Server>`
4. Run the script with the applicable parameters:

   `$FWDIR/scripts/api_log_to_json.py <parameters>`

<br />

### Syntax

|------------------------------------------------------------------------------------------------|
| `$FWDIR/scripts/api_log_to_json.py {-h | -v}`                                                  |
| `$FWDIR/scripts/api_log_to_json.py [-o <output file>] [<API log files> [<API log files> ...]]` |

**CLI Parameters**

|---------------------------------------------|---------------------------------------------------------------------------------------------------------------------------|
| Parameter                                   | Description                                                                                                               |
| `-h` `--help`                               | Shows the short built-in help.                                                                                            |
| `-v` `--verbose-help`                       | Shows the verbose built-in help.                                                                                          |
| `-o <output file>` `--output <output file>` | Specifies the path to the output file. If not specified, the script shows the output on the screen.                       |
| `<API log files>`                           | Specifies the list of paths to API log files. If not specified, the script analyzes all *$MDS_FWDIR/log/api.elg\** files. |

<br />

### Output

The output structure is a list of JSON objects with the fields described below.

The JSON objects are sorted in the order of "`inbound_timestamp`" and then in the order of "`id`".

|----------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Field                | Description                                                                                                                                                                                                                         |
| `command`            | Name of the API command.                                                                                                                                                                                                            |
| `id`                 | Numeric ID of the API request. Requests and responses from the Check Point API log are combined into a single object. Each time you stop and start Check Point services (or reboot) on the Management Server, the ID starts from 1. |
| `x_chkp_sid`         | UUID that all commands from the session share (not a Session UUID).                                                                                                                                                                 |
| `inbound_timestamp`  | Timestamp of the API request. Format: *yyyy-mm-dd hh:mm:ss.sss*                                                                                                                                                                     |
| `outbound_timestamp` | Timestamp of the API response. Format: *yyyy-mm-dd hh:mm:ss.sss*                                                                                                                                                                    |
| `duration`           | Duration of the API call - time between receiving the API request and sending the API response. Format: *hh:mm:ss.sss*                                                                                                              |
| `inbound_payload`    | API request data in the JSON format.                                                                                                                                                                                                |
| `outbound_payload`   | API response data in the JSON format.                                                                                                                                                                                               |

Example for the API "*show-object*":
>
> ```
> [
>     {
>       "id": 316,
>       "x_chkp_sid": "8095012a-4ec3-deab-90f5-ab54a7d36127",
>       "command": "show-object",
>       "inbound_timestamp": "2023-08-21 18:57:22.062",
>       "outbound_timestamp": "2023-08-21 18:57:22.074",
>       "duration": "0:00:00.012",
>       "inbound_payload": {
>         "uid": "4376ea6c-387b-4360-8086-f4c7ffc51b71"
>       },
>       "outbound_payload": {
>         "object": {
>           "uid": "4376ea6c-387b-4360-8086-f4c7ffc51b71",
>           "name": "host-192.168.3.4",
>           "type": "host",
>           "domain": {
>             "uid": "41e821a0-3720-11e3-aa6e-0800200c9fde",
>             "name": "SMC User",
>             "domain-type": "domain"
>           },
>           "icon": "Objects/host",
>           "color": "black",
>           "ipv4-address": "192.168.3.4"
>         }
>       }
>     },
>     ... ... ...
> ]
> ```

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content