---
title: "List unusual activities"
method: GET
path: "/v2/organizations/{organization_id}/insights/unusual_activities"
tags: ["unusual_activities"]
---

# List unusual activities

`GET /v2/organizations/{organization_id}/insights/unusual_activities`

## Request

- Base URL: `https://api.hubstaff.com`
- URL: `https://api.hubstaff.com/v2/organizations/{organization_id}/insights/unusual_activities`
- Auth: OAuth 2
  - Authorization code: `https://account.hubstaff.com/authorizations/new`
  - Token URL: `https://account.hubstaff.com/access_tokens` scopes: `hubstaff:read`, `hubstaff:write`

Returns a collection of unusual activities (anomalous behavior patterns) for the given organization.

Results can be filtered by user_ids[], time_slot[start]/[stop], confidence_level, and unusual_activity_type.

Note: Unusual activities can be removed automatically by the system (e.g. after silent app member merging).

screenshot_ids lists only the screenshots the caller may see, as on the Screenshots page.
top_apps_in_use, top_urls_visited and suspicious_apps are empty when the caller may not see the
member's screenshots or the member hides their apps and URLs.

## Path parameters

- `organization_id` integer, required

## Query parameters

- `page_start_id` integer
- `page_limit` integer
- `time_slot[start]` string, date-time, required
- `time_slot[stop]` string, date-time, required
- `user_ids` integer[]
- `include` string[]
- `include_secondary_activities` boolean
- `confidence_level` 'high' | 'medium' | 'low'
- `unusual_activity_type` 'consistent_persistent_activity' | 'consistent_variable_activity' | 'unusual_high_mouse_activity' | 'unusual_high_keyboard_activity' | 'long_period_of_single_mouse_activity' | 'long_period_of_single_keyboard_activity' | 'breakless_work' | 'sustained_high_focus_time' | 'automation_like_activity' | 'suspicious_activity'

## Response `200`

A list of unusual activity

- object
  - `unusual_activities` UnusualActivity[]
    - `id` integer, required: Unusual activity ID
    - `user_id` integer, required: User ID
    - `type` string, required: Unusual activity type
    - `keyboard_active_seconds` integer, required: Keyboard active seconds
    - `mouse_active_seconds` integer, required: Mouse active seconds
    - `time_tracked_seconds` integer, required: Time tracked seconds
    - `overall_active_seconds` integer, required: Overall active seconds
    - `url` string, required: Permalink to the unusual activity page in the Web UI
    - `date` string, date, required: Organization date
    - `confidence_level` string, required: Confidence level of the unusual activity
    - `top_apps_in_use` object, required: Top apps in this period of time, empty when hidden
    - `top_urls_visited` string[], required: Top URLs in this period of time, empty when hidden
    - `screenshot_ids` integer[], required: IDs of the screenshots the caller may see
    - `suspicious_apps` string[], required: Suspicious apps, empty when hidden
    - `starts_at` unknown, required
    - `ends_at` unknown, required
    - `created_at` string, date-time, required: When the record was created
    - `updated_at` string, date-time, required: When the record was last updated

## Other responses

- `400`: Invalid parameters
- `401`: Unauthorized
- `403`: API access is only for organizations on an active plan
- `404`: Could not find record
- `429`: Rate limit exceeded

## Changes

- **2026-11-06** `c6b90e4e4bdc`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/hubstaff/apis/hubstaff-v2-api/changes/v2/organizations/:organization_id/insights/unusual_activities/get.md)

---

[API](https://skmtc.dev/hubstaff/apis/hubstaff-v2-api.md) - [All operations](https://skmtc.dev/hubstaff/apis/hubstaff-v2-api/llms.txt) - [OpenAPI document](https://skmtc.dev/hubstaff/apis/hubstaff-v2-api/revisions/c6b90e4e4bdc?raw)