GetEvent parity mapping

Supported in:

This guide details the request and response mapping specifications and property parity analysis for migrating from the legacy Backstory Search API (GetEvent) to the modern Chronicle API (GetEvent).

Protocol and mapping overview

Feature Legacy API (GetEvent) Modern Chronicle API (GetEvent)
HTTP method GET GET
Permissions Partner token or legacy API keys chronicle.googleapis.com/events.get

Request payload field-by-field parity

The modern Chronicle API GetEventRequest targets resources using Google Cloud canonical resource paths with Base64 encoding rules.

Legacy field (GetEventRequest) Modern field (GetEventRequest) Field type Parity and migration notes
name name (in HTTP path) bytes $\rightarrow$ string Google Cloud scoping, type, and encoding shift: Legacy accepted a 256-bit raw byte string prefix (bytes name). The modern API takes a standard canonical Google Cloud string resource path: projects/{project}/locations/{location}/instances/{instance}/events/{event_id}, where {event_id} must be URL-encoded Base64 (matching the unencoded binary in udm.metadata.id).

Response payload field-by-field parity

Both endpoints return the retrieved Event representation containing parsed UDM data.

Legacy field (Event message) Modern field (Event message) Field type Parity and migration notes
name name string Parity mapped and format shift: Legacy returned the raw string event ID. The modern API encapsulates this inside canonical resource names: projects/{project}/locations/{location}/instances/{instance}/events/{event_id}, where {event_id} is URL-encoded Base64.
udm udm backstory.UDM Parity mapped: Identical structured representation of Unified Data Model (UDM) telemetry event properties.

Key differences

  • Service decoupling:
    • Legacy event retrieval was housed under the general-purpose SearchService alongside searches and log queries.
    • Modern Chronicle API decouples event operations into a dedicated EventService resource hierarchy.
  • Google Cloud project scoping and Base64 encoding:
    • Scoped natively under parent project instance folder bindings.
    • Rather than transmitting raw 256-bit binary byte identifiers, the modern API requires that event identifiers in resource paths be URL-encoded Base64 strings.
  • IAM permissions:
    • Request validation maps to standard Cloud IAM permission validation check (chronicle.googleapis.com/events.get).