The Account Activity API consists of a set of endpoints that allow you to create and manage user subscriptions to receive real-time account activities for all of your subscribed accounts through a single connection. 

There are two authentication methods available with the Account Activity API (OAuth 1.0a and OAuth 2.0 Bearer Token). The authentication method that you should use will depend on which endpoint you are using.

For those endpoints that require OAuth 1.0a user context authentication, you will need to provide the following credentials to authenticate the request: 

• Consumer Keys (API Key and Secret)
• Access Tokens (Access Token and Secret)

In the case of the following three endpoints, you perform write actions within the context of your application (no X users are involved). Therefore, the Access Tokens you need to provide are the ones belonging to your developer App. These can be generated directly from within the developer portal, under the “Keys and tokens” tab for your App.  

• POST account_activity/webhooks: Register a new webhook URL for the given application context
• PUT account_activity/webhooks/:webhook_id: Trigger a challenge response check (CRC) for a given webhook's URL
• DELETE account_activity/webhooks/:webhook_id: Delete a webhook

On the other hand, in the case of the following three endpoints, you are making a request that allows your application to access protected data on behalf of a X user (for example, Direct Messages). You must therefore provide the Access Tokens that belong to the subscribing user in question. The required Access tokens can be obtained using the 3-legged OAuth flow (see OAuth 1.0a: how to obtain a user’s Access Tokens). These endpoints have been marked with an asterisk in the above table (*).

• POST account_activity/webhooks/:webhook_id/subscriptions/all: Subscribe the application to a user’s account events
• GET account_activity/webhooks/:webhook_id/subscriptions/all: Check if a webhook configuration is subscribed to a user’s events
• DELETE account_activity/webhooks/:webhook_id/subscriptions/all: Deactivate a subscription for the provided user context and application [DEPRECATED]

A list of all endpoints available with the Account Activity API, including associated description and example cURL requests with authentication implementation examples, can be found in the API reference documentation.

For additional information, check out XDev’s sample web app and helper scripts to get started with the Enterprise Account Activity API.