---
title: "Get an identity risk event by object_id."
method: GET
path: "/identityrisk/events/{objectId}"
tags: ["Identity Risk"]
---

# Get an identity risk event by object_id.

`GET /identityrisk/events/{objectId}`

## Request

- Base URL: `https://console.jumpcloud.com/api/v2`
- URL: `https://console.jumpcloud.com/api/v2/identityrisk/events/{objectId}`
- Auth: API key in header `x-api-key`
- TypeScript: <https://skmtc.dev/jumpcloud/apis/jumpcloud-api-2/docs/identityrisk/events/:objectId/get.ts> (a function with typed inputs; its response is checked against the schema)

This endpoint allows you to get an identity risk event using its id.

**Example request:**
```
GET /api/v2/identityrisk/events/{object_id}
```

## Path parameters

- `objectId` string, byte, required

## Response `200`

A successful response.

- JumpcloudIdentityRiskRiskEvent
  - `applicationDisplayName` string
  - `applicationName` string
  - `city` string
  - `clientIp` string: client_ip is the client IP from the Directory Insights login event for the latest occurrence.
  - `countryCode` string
  - `createdAt` string, date-time, nullable
  - `description` string: description is a human readable description of the risk event. not populated when a list of risk events is retrieved.
  - `diEvent` object: di_event is the full Directory Insights event for the latest occurrence (JSON-compatible). Populated when a specific risk event is retrieved via GetRiskEvent.
  - `firstOccurrenceAt` string, date-time, nullable
  - `identityDisplayName` string
  - `identityIdentifier` string
  - `identityObjectId` string, byte
  - `identityType` 'IDENTITY_TYPE_UNSPECIFIED' | 'IDENTITY_TYPE_ADMIN' | 'IDENTITY_TYPE_USER'
  - `lastOccurrenceAt` string, date-time, nullable
  - `level` 'RISK_LEVEL_NONE' | 'RISK_LEVEL_LOW' | 'RISK_LEVEL_MEDIUM' | 'RISK_LEVEL_HIGH' | 'RISK_LEVEL_CRITICAL'
  - `location` string: location is "city, country code" format.
  - `loginResource` 'TARGET_RESOURCE_TYPE_UNSPECIFIED' | 'TARGET_RESOURCE_TYPE_USER_PORTAL' | 'TARGET_RESOURCE_TYPE_ADMIN_PORTAL' | 'TARGET_RESOURCE_TYPE_APPLICATION' | 'TARGET_RESOURCE_TYPE_DEVICE': TargetResourceType is the type of resource targeted by the event (e.g. Device for login_attempt).
  - `loginStatus` boolean
  - `mfaMethod` string: mfa_method is the MFA method enum name (mfa_method_type), derived from auth_context.auth_methods keys. Supported values: MFA_METHOD_JUMPCLOUD_GO, MFA_METHOD_JUMPCLOUD_GO_UV, MFA_METHOD_WEBAUTHN, MFA_METHOD_PUSH, MFA_METHOD_JC_PROTECT_PUSH, MFA_METHOD_DUO, MFA_METHOD_TOTP, MFA_METHOD_SMS. Returns MFA_METHOD_UNSPECIFIED when no matching key is found.
  - `mfaStatus` boolean
  - `objectId` string, byte
  - `occurrenceCount` integer
  - `regionName` string
  - `resolutionNotes` string
  - `resolutionState` 'RISK_RESOLUTION_STATE_UNSPECIFIED' | 'RISK_RESOLUTION_STATE_SAFE' | 'RISK_RESOLUTION_STATE_UNSAFE'
  - `resolutionStatus` 'RISK_RESOLUTION_STATUS_UNSPECIFIED' | 'RISK_RESOLUTION_STATUS_OPEN' | 'RISK_RESOLUTION_STATUS_RESOLVED' | 'RISK_RESOLUTION_STATUS_MFA_RESOLVED' | 'RISK_RESOLUTION_STATUS_DISMISSED'
  - `resolvedAt` string, date-time, nullable
  - `resolvedBy` string, byte, nullable
  - `resolvedByEmail` string
  - `riskFactorTypes` JumpcloudIdentityRiskRiskFactorType[]: risk_factor_types is a list of risk factor types that contributed to this risk event. populated when a list of risk events is retrieved. Risk factor types are the codes of the risk factors.
  - `riskFactors` JumpcloudIdentityRiskRiskFactor[]: risk_factors is a list of risk factors that contributed to this risk event. populated when a specific risk event is retrieved.
    - `description` string
    - `metadata` object
    - `severity` 'RISK_FACTOR_SEVERITY_UNSPECIFIED' | 'RISK_FACTOR_SEVERITY_LOW' | 'RISK_FACTOR_SEVERITY_MEDIUM' | 'RISK_FACTOR_SEVERITY_HIGH' | 'RISK_FACTOR_SEVERITY_CRITICAL'
    - `type` 'RISK_FACTOR_TYPE_UNSPECIFIED' | 'RISK_FACTOR_TYPE_NEW_DEVICE_LOGIN' | 'RISK_FACTOR_TYPE_UNUSUAL_GEOLOCATION' | 'RISK_FACTOR_TYPE_UNUSUAL_LOGIN_TIME' | 'RISK_FACTOR_TYPE_UNUSUAL_USER_AGENT' | 'RISK_FACTOR_TYPE_IMPOSSIBLE_TRAVEL' | 'RISK_FACTOR_TYPE_DORMANT_ACCOUNT_LOGIN' | 'RISK_FACTOR_TYPE_NEW_ASN' | 'RISK_FACTOR_TYPE_EXCESSIVE_FAILED_LOGIN_ATTEMPTS' | 'RISK_FACTOR_TYPE_HIGH_VOLUME_LOGIN_ATTEMPTS' | 'RISK_FACTOR_TYPE_UNUSUAL_APPLICATION_LOGIN' | 'RISK_FACTOR_TYPE_UNUSUAL_BROWSER_ID' | 'RISK_FACTOR_TYPE_BROWSER_ENVIRONMENT_MISMATCH' | 'RISK_FACTOR_TYPE_NHI_SECURITY_CONTROL_CHANGED' | 'RISK_FACTOR_TYPE_NHI_SENSITIVE_ACTIVITY_NEW_NETWORK' | 'RISK_FACTOR_TYPE_NHI_UNFAMILIAR_SENSITIVE_ACTIVITY' | 'RISK_FACTOR_TYPE_NHI_SENSITIVE_ACTIVITY_NEW_CREDENTIAL' | 'RISK_FACTOR_TYPE_NHI_RESUMED_AFTER_INACTIVITY' | 'RISK_FACTOR_TYPE_NHI_UNUSUAL_SENSITIVE_SEQUENCE' | 'RISK_FACTOR_TYPE_NHI_UNUSUAL_ACTIVITY_VOLUME': RiskFactorType identifies the kind of risk factor contributing to the score.
    - `weight` integer
  - `riskPolicyId` string, byte, nullable: risk_policy_id is the applied identity risk policy object_id at scoring time.
  - `riskPolicyName` string: risk_policy_name is the display name of the policy referenced by risk_policy_id (when present).
  - `score` integer
  - `sourceEventObjectId` string, byte: Source DI context for the last occurrence of this risk event (flattened).
  - `sourceEventTimestamp` string, date-time, nullable
  - `sourceEventType` string
  - `updatedAt` string, date-time, nullable

---

[API](https://skmtc.dev/jumpcloud/apis/jumpcloud-api-2.md) - [All operations](https://skmtc.dev/jumpcloud/apis/jumpcloud-api-2/llms.txt) - [OpenAPI document](https://skmtc.dev/jumpcloud/apis/jumpcloud-api-2/revisions/3f09fe63caaa?raw)