---
title: "List identity risk events"
method: GET
path: "/identityrisk/events"
tags: ["Identity Risk"]
---

# List identity risk events

`GET /identityrisk/events`

## Request

- Base URL: `https://console.jumpcloud.com/api/v2`
- URL: `https://console.jumpcloud.com/api/v2/identityrisk/events`
- Auth: API key in header `x-api-key`
- TypeScript: <https://skmtc.dev/jumpcloud/apis/jumpcloud-api-2/docs/identityrisk/events/get.ts> (a function with typed inputs; its response is checked against the schema)

This endpoint lists all identity risk events for an organization.

**Example request:**
```
GET /api/v2/identityrisk/events?filter=level:eq:RISK_LEVEL_MEDIUM&limit=10&skip=0&sort=-lastOccurrenceAt
```

**Example request with multiple filters:**
```
GET /api/v2/identityrisk/events?filter=level:eq:RISK_LEVEL_MEDIUM&filter=resolutionStatus:eq:RISK_RESOLUTION_STATUS_OPEN&limit=25&skip=0
```

## Query parameters

- `filter` string[]
- `fields` string[]
- `skip` string, int64
- `sort` string[]
- `limit` string, int64
- `searchTerm` string

## Response `200`

A successful response.

- JumpcloudIdentityRiskListRiskEventsResponse
  - `riskEvents` JumpcloudIdentityRiskRiskEvent[]
    - `applicationDisplayName` string
    - `applicationName` string
    - `city` string
    - `clientIp` string: client_ip is the client IP from the Directory Insights login event for the latest occurrence.
    - `countryCode` string
    - `createdAt` string, date-time, nullable
    - `description` string: description is a human readable description of the risk event. not populated when a list of risk events is retrieved.
    - `diEvent` object: di_event is the full Directory Insights event for the latest occurrence (JSON-compatible). Populated when a specific risk event is retrieved via GetRiskEvent.
    - `firstOccurrenceAt` string, date-time, nullable
    - `identityDisplayName` string
    - `identityIdentifier` string
    - `identityObjectId` string, byte
    - `identityType` 'IDENTITY_TYPE_UNSPECIFIED' | 'IDENTITY_TYPE_ADMIN' | 'IDENTITY_TYPE_USER'
    - `lastOccurrenceAt` string, date-time, nullable
    - `level` 'RISK_LEVEL_NONE' | 'RISK_LEVEL_LOW' | 'RISK_LEVEL_MEDIUM' | 'RISK_LEVEL_HIGH' | 'RISK_LEVEL_CRITICAL'
    - `location` string: location is "city, country code" format.
    - `loginResource` 'TARGET_RESOURCE_TYPE_UNSPECIFIED' | 'TARGET_RESOURCE_TYPE_USER_PORTAL' | 'TARGET_RESOURCE_TYPE_ADMIN_PORTAL' | 'TARGET_RESOURCE_TYPE_APPLICATION' | 'TARGET_RESOURCE_TYPE_DEVICE': TargetResourceType is the type of resource targeted by the event (e.g. Device for login_attempt).
    - `loginStatus` boolean
    - `mfaMethod` string: mfa_method is the MFA method enum name (mfa_method_type), derived from auth_context.auth_methods keys. Supported values: MFA_METHOD_JUMPCLOUD_GO, MFA_METHOD_JUMPCLOUD_GO_UV, MFA_METHOD_WEBAUTHN, MFA_METHOD_PUSH, MFA_METHOD_JC_PROTECT_PUSH, MFA_METHOD_DUO, MFA_METHOD_TOTP, MFA_METHOD_SMS. Returns MFA_METHOD_UNSPECIFIED when no matching key is found.
    - `mfaStatus` boolean
    - `objectId` string, byte
    - `occurrenceCount` integer
    - `regionName` string
    - `resolutionNotes` string
    - `resolutionState` 'RISK_RESOLUTION_STATE_UNSPECIFIED' | 'RISK_RESOLUTION_STATE_SAFE' | 'RISK_RESOLUTION_STATE_UNSAFE'
    - `resolutionStatus` 'RISK_RESOLUTION_STATUS_UNSPECIFIED' | 'RISK_RESOLUTION_STATUS_OPEN' | 'RISK_RESOLUTION_STATUS_RESOLVED' | 'RISK_RESOLUTION_STATUS_MFA_RESOLVED' | 'RISK_RESOLUTION_STATUS_DISMISSED'
    - `resolvedAt` string, date-time, nullable
    - `resolvedBy` string, byte, nullable
    - `resolvedByEmail` string
    - `riskFactorTypes` JumpcloudIdentityRiskRiskFactorType[]: risk_factor_types is a list of risk factor types that contributed to this risk event. populated when a list of risk events is retrieved. Risk factor types are the codes of the risk factors.
    - `riskFactors` JumpcloudIdentityRiskRiskFactor[]: risk_factors is a list of risk factors that contributed to this risk event. populated when a specific risk event is retrieved.
      - `description` string
      - `metadata` object
      - `severity` 'RISK_FACTOR_SEVERITY_UNSPECIFIED' | 'RISK_FACTOR_SEVERITY_LOW' | 'RISK_FACTOR_SEVERITY_MEDIUM' | 'RISK_FACTOR_SEVERITY_HIGH' | 'RISK_FACTOR_SEVERITY_CRITICAL'
      - `type` 'RISK_FACTOR_TYPE_UNSPECIFIED' | 'RISK_FACTOR_TYPE_NEW_DEVICE_LOGIN' | 'RISK_FACTOR_TYPE_UNUSUAL_GEOLOCATION' | 'RISK_FACTOR_TYPE_UNUSUAL_LOGIN_TIME' | 'RISK_FACTOR_TYPE_UNUSUAL_USER_AGENT' | 'RISK_FACTOR_TYPE_IMPOSSIBLE_TRAVEL' | 'RISK_FACTOR_TYPE_DORMANT_ACCOUNT_LOGIN' | 'RISK_FACTOR_TYPE_NEW_ASN' | 'RISK_FACTOR_TYPE_EXCESSIVE_FAILED_LOGIN_ATTEMPTS' | 'RISK_FACTOR_TYPE_HIGH_VOLUME_LOGIN_ATTEMPTS' | 'RISK_FACTOR_TYPE_UNUSUAL_APPLICATION_LOGIN' | 'RISK_FACTOR_TYPE_UNUSUAL_BROWSER_ID' | 'RISK_FACTOR_TYPE_BROWSER_ENVIRONMENT_MISMATCH' | 'RISK_FACTOR_TYPE_NHI_SECURITY_CONTROL_CHANGED' | 'RISK_FACTOR_TYPE_NHI_SENSITIVE_ACTIVITY_NEW_NETWORK' | 'RISK_FACTOR_TYPE_NHI_UNFAMILIAR_SENSITIVE_ACTIVITY' | 'RISK_FACTOR_TYPE_NHI_SENSITIVE_ACTIVITY_NEW_CREDENTIAL' | 'RISK_FACTOR_TYPE_NHI_RESUMED_AFTER_INACTIVITY' | 'RISK_FACTOR_TYPE_NHI_UNUSUAL_SENSITIVE_SEQUENCE' | 'RISK_FACTOR_TYPE_NHI_UNUSUAL_ACTIVITY_VOLUME': RiskFactorType identifies the kind of risk factor contributing to the score.
      - `weight` integer
    - `riskPolicyId` string, byte, nullable: risk_policy_id is the applied identity risk policy object_id at scoring time.
    - `riskPolicyName` string: risk_policy_name is the display name of the policy referenced by risk_policy_id (when present).
    - `score` integer
    - `sourceEventObjectId` string, byte: Source DI context for the last occurrence of this risk event (flattened).
    - `sourceEventTimestamp` string, date-time, nullable
    - `sourceEventType` string
    - `updatedAt` string, date-time, nullable
  - `totalCount` integer: total_count is the total number of risk events matching the query (before pagination).

---

[API](https://skmtc.dev/jumpcloud/apis/jumpcloud-api-2.md) - [All operations](https://skmtc.dev/jumpcloud/apis/jumpcloud-api-2/llms.txt) - [OpenAPI document](https://skmtc.dev/jumpcloud/apis/jumpcloud-api-2/revisions/3f09fe63caaa?raw)