Cisco duo collector : v1 endpoint will be deprecated on September 30, 2026, so migrated admin API v1 to V2 endpoints

[rakhimundhada15]

Problem Description

Below three API are going to deprecated as per cisco duo document -Duo Admin API | Cisco Duo

1. Offline Enrollment Logs:(/admin/v1/logs/offline_enrollment)
   This v1 endpoint will be deprecated on September 30, 2026. Migrate your use of this logging endpoint to the Activity Logs v2 endpoint before then to avoid service disruption.

2. Telephony Logs:(/admin/v1/logs/telephony)
   This legacy v1 endpoint will be deprecated on September 30, 2026. Migrate your use of this logging endpoint to the Telephony Logs v2 endpoint before then to avoid service disruption.

3. Administrator Logs:( /admin/v1/logs/administrator)
   This v1 endpoint will be deprecated on September 30, 2026. Migrate your use of this logging endpoint to the Activity Logs v2 endpoint before then to avoid service disruption.

4. Administrator, Telephony, and OfflineEnrollment streams were on Duo Admin API v1, which Duo has scheduled for deprecation. v1 used 10-digit second timestamps, different response shapes per endpoint, and offset-based paging — diverging from v2's unified [mintime]/[maxtime] + [metadata.next_offset] model.

5. Duo enforces ~1 request per minute per endpoint. Polling 4 streams every 60s (Administrator + OfflineEnrollment share /admin/v2/logs/activity) caused frequent 42901 throttling.

Solution Description

1. Updated the api endpoint from v1 to v2 and Unified query builder for all streams. Timestamp / typeId paths updated per stream.
2. Response shape handling: Auth uses authlogs with array-form next_offset (joined); Activity / Telephony use items with string next_offset
3. De-duplication on shared activity endpoint: Administrator filters out o2fa_* events, OfflineEnrollment keeps only o2fa_* events.
4. Per-stream cadence: Authentication keeps the 60s baseline; other streams use 900s, with caught-up streams forced to wait 900s to avoid polling a future window.
5. Legacy 10-digit timestamp normalization via a shared  MIN_13_DIGIT_TIMESTAMP = 1e12 guard used in both the query builder and next-state calculation.
6. Updated old test cases and added new ones covering v2 response shapes, timestamp continuity, no-future-poll, per-stream cadence, and no-mutation regression.
7. Documentation refresh: updated README and collector API inventory.

[al-cibot]

CI Service Job Number 1225 Logs - SUCCESS

alps ci job-logs --organization alertlogic --repository paws-collector --job-num 1225 -g

Stages Run:

• PR Test

[scott-jones-AlertLogic]

Great stuff, thanks Rakhi!

[al-cibot]

CI Service Job Number 1230 Logs - SUCCESS

alps ci job-logs --organization alertlogic --repository paws-collector --job-num 1230 -g

Stages Run:

• PR Test

[al-cibot]

CI Service Job Number 1234 Logs - SUCCESS

alps ci job-logs --organization alertlogic --repository paws-collector --job-num 1234 -g

Stages Run:

• PR Test

[rakhimundhada15]

build-collector-ciscoduo

[al-cibot]

CI Service Job Number 1235 Logs - SUCCESS

alps ci job-logs --organization alertlogic --repository paws-collector --job-num 1235 -g

Stages Run:

• build-collector-ciscoduo
• file_packager_52757b