List login events

POST

/login-events

Query and filter login events

Relations:

employee (Person): The person who performed the login

Request

Authorization

Bearer Token

Provide your bearer token in the

Authorization

header when making requests to protected resources.

Example:

Authorization: Bearer ********************

Body Params application/json

Examples

Responses

🟢200OK

application/json

Successful operation

Body

🟠400Bad Request

🟠401Unauthorized

🟠403Forbidden

Request Example

Shell

JavaScript

Java

Swift

curl --location --request POST '/login-events' \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data-raw '{
    "distinct_count": "string",
    "include_total_count": true,
    "limit": 10,
    "offset": 0,
    "query": "name='\''WINPC-4291'\'' AND status IN ('\''active'\'', '\''pending'\'')",
    "sort": "name desc, id"
}'

Response Example

{
    "distinct_values": [
        {
            "count": 0,
            "value": null
        }
    ],
    "pagination": {
        "count": 0,
        "total_count": 1000
    },
    "items": [
        {
            "allowlisted": true,
            "authentication_details": [
                {
                    "authentication_method": "Password",
                    "authentication_method_detail": "Password in the cloud",
                    "authentication_step_result_detail": "MFA requirement satisfied by claim in the token",
                    "succeeded": true
                }
            ],
            "challenge_method_kinds": [
                "security_key",
                "password"
            ],
            "client_app": "Browser",
            "conditional_access_status": "failure",
            "device_id": "device-123456",
            "employee_email": "john.doe@example.com",
            "employee_name": "John Doe",
            "external_id": "login_success/user@example.com/2025-01-15T14:30:00Z",
            "high_prevalence": true,
            "id": "8CA67511-744C-4D74-B26E-7281CF88712F",
            "impossible_travel_detail": {
                "distance_miles": 5823.4,
                "from_city": "San Francisco",
                "from_country": "US",
                "speed_mph": 1250.7,
                "to_city": "Amsterdam",
                "to_country": "NL"
            },
            "ip_address": "192.168.1.100",
            "ip_chain": [
                {
                    "city": "Amsterdam",
                    "country": "NL",
                    "ip": "203.0.113.45",
                    "source": "proxy",
                    "version": "V4"
                }
            ],
            "is_allowed_vpn": true,
            "is_foreign_country": false,
            "is_impossible_travel": false,
            "is_new_ip_network": false,
            "is_off_hours": false,
            "is_proxy_login": false,
            "is_service_account": false,
            "is_suspicious_client": false,
            "location_city": "San Francisco",
            "location_country": "USA",
            "location_state": "CA",
            "login_audit_kind": "failed_login",
            "login_time": "2025-01-15T14:30:00Z",
            "network_context": {
                "as_number": 14061,
                "as_org": "DigitalOcean, LLC",
                "domain": "digitalocean.com",
                "isp": "Comcast Cable"
            },
            "proxy_detail": {
                "kind": "vpn",
                "source": "NordVPN"
            },
            "risk_factors": [
                {
                    "magnitude": 40,
                    "type": "sensitive_file"
                }
            ],
            "risk_level": "high",
            "risk_score": 25.5,
            "sign_on_mode": "auto_login",
            "source": "unspecified",
            "token_protection": "bound",
            "user_agent": {
                "browser": "Chrome",
                "os": "Mac OS X",
                "raw": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36"
            },
            "vpn_operators": [
                "GLOBAL_PROTECT_CLOUD_VPN"
            ]
        }
    ]
}

Modified at 2026-03-31 19:28:57

Get API key information

Get a login event by ID