JUjumpcloud
Identity Risk

Resolve an identity risk event.

This endpoint allows you to resolve an identity risk event using its id.

Example request:

PATCH /api/v2/identityrisk/events/{object_id}/resolve
Content-Type: application/json

{
  "resolution_status": "RISK_RESOLUTION_STATUS_RESOLVED",
  "resolution_state": "RISK_RESOLUTION_STATE_SAFE",
  "resolution_notes": "Verified with the user — login was legitimate."
}
patch/api/v2/identityrisk/events/{objectId}/resolve

Request

Path parameters

objectIdstring byte required

object_id is the bson Object id of the risk event.

Request body

resolutionNotesstring
resolutionState'RISK_RESOLUTION_STATE_UNSPECIFIED' | 'RISK_RESOLUTION_STATE_SAFE' | 'RISK_RESOLUTION_STATE_UNSAFE'
resolutionStatus'RISK_RESOLUTION_STATUS_UNSPECIFIED' | 'RISK_RESOLUTION_STATUS_OPEN' | 'RISK_RESOLUTION_STATUS_RESOLVED' | 'RISK_RESOLUTION_STATUS_MFA_RESOLVED' | 'RISK_RESOLUTION_STATUS_DISMISSED'

Response

A successful response.

applicationDisplayNamestring
applicationNamestring
citystring
clientIpstring

client_ip is the client IP from the Directory Insights login event for the latest occurrence.

countryCodestring
createdAtstring date-time nullable
descriptionstring

description is a human readable description of the risk event. not populated when a list of risk events is retrieved.

diEventobject

di_event is the full Directory Insights event for the latest occurrence (JSON-compatible). Populated when a specific risk event is retrieved via GetRiskEvent.

firstOccurrenceAtstring date-time nullable
identityDisplayNamestring
identityIdentifierstring
identityObjectIdstring byte
identityType'IDENTITY_TYPE_UNSPECIFIED' | 'IDENTITY_TYPE_ADMIN' | 'IDENTITY_TYPE_USER'
lastOccurrenceAtstring date-time nullable
level'RISK_LEVEL_NONE' | 'RISK_LEVEL_LOW' | 'RISK_LEVEL_MEDIUM' | 'RISK_LEVEL_HIGH' | 'RISK_LEVEL_CRITICAL'
locationstring

location is "city, country code" format.

loginResource'TARGET_RESOURCE_TYPE_UNSPECIFIED' | 'TARGET_RESOURCE_TYPE_USER_PORTAL' | 'TARGET_RESOURCE_TYPE_ADMIN_PORTAL' | 'TARGET_RESOURCE_TYPE_APPLICATION' | 'TARGET_RESOURCE_TYPE_DEVICE'

TargetResourceType is the type of resource targeted by the event (e.g. Device for login_attempt).

loginStatusboolean
mfaMethodstring

mfa_method is the MFA method enum name (mfa_method_type), derived from auth_context.auth_methods keys. Supported values: MFA_METHOD_JUMPCLOUD_GO, MFA_METHOD_JUMPCLOUD_GO_UV, MFA_METHOD_WEBAUTHN, MFA_METHOD_PUSH, MFA_METHOD_JC_PROTECT_PUSH, MFA_METHOD_DUO, MFA_METHOD_TOTP, MFA_METHOD_SMS. Returns MFA_METHOD_UNSPECIFIED when no matching key is found.

mfaStatusboolean
objectIdstring byte
occurrenceCountinteger
regionNamestring
resolutionNotesstring
resolutionState'RISK_RESOLUTION_STATE_UNSPECIFIED' | 'RISK_RESOLUTION_STATE_SAFE' | 'RISK_RESOLUTION_STATE_UNSAFE'
resolutionStatus'RISK_RESOLUTION_STATUS_UNSPECIFIED' | 'RISK_RESOLUTION_STATUS_OPEN' | 'RISK_RESOLUTION_STATUS_RESOLVED' | 'RISK_RESOLUTION_STATUS_MFA_RESOLVED' | 'RISK_RESOLUTION_STATUS_DISMISSED'
resolvedAtstring date-time nullable
resolvedBystring byte nullable
resolvedByEmailstring
riskFactorTypesJumpcloudIdentityRiskRiskFactorType[]

risk_factor_types is a list of risk factor types that contributed to this risk event. populated when a list of risk events is retrieved. Risk factor types are the codes of the risk factors.

riskPolicyIdstring byte nullable

risk_policy_id is the applied identity risk policy object_id at scoring time.

riskPolicyNamestring

risk_policy_name is the display name of the policy referenced by risk_policy_id (when present).

scoreinteger
sourceEventObjectIdstring byte

Source DI context for the last occurrence of this risk event (flattened).

sourceEventTimestampstring date-time nullable
sourceEventTypestring
updatedAtstring date-time nullable

Changes

No recorded changes to this operation across all 1 revision of this API.