---
title: "Query identity risk detections timeline"
method: POST
path: "/api/v2/identityrisk/factors-timeline"
tags: ["Identity Risk"]
---

# Query identity risk detections timeline

`POST /api/v2/identityrisk/factors-timeline`

## Request

- Base URL: `https://console.jumpcloud.com`
- URL: `https://console.jumpcloud.com/api/v2/identityrisk/factors-timeline`
- Auth: API key in header `x-api-key`
- TypeScript: <https://skmtc.dev/jumpcloud/apis/jumpcloud-console-api/docs/api/v2/identityrisk/factors-timeline/post.ts> (a function with typed inputs; its response is checked against the schema)

This endpoint gets the identity risk detections timeline (counts over time) for an organization.

**Example request:**
```
POST /api/v2/identityrisk/factors-timeline
{
  "interval": "day",
  "start_time": "2024-01-01T00:00:00Z",
  "end_time": "2024-01-31T23:59:59Z"
}
```

**Example request filtered by risk factor:**
```
POST /api/v2/identityrisk/factors-timeline
{
  "interval": "day",
  "start_time": "2024-01-01T00:00:00Z",
  "end_time": "2024-01-31T23:59:59Z",
  "risk_factor_types": ["IMPOSSIBLE_TRAVEL"]
}
```

## Request body

- JumpcloudIdentityRiskGetTimelineRequest
  - `endTime` string
  - `intervalType` string
  - `intervalValue` string
  - `riskFactorTypes` string[]
  - `startTime` string

## Response `200`

A successful response.

- JumpcloudIdentityRiskRiskTimelineResponse: since we are using google.protobuf.Struct for timeline_data. This allows arbitrary JSON structures (like dynamic maps).
  - `timelineData` object

---

[API](https://skmtc.dev/jumpcloud/apis/jumpcloud-console-api.md) - [All operations](https://skmtc.dev/jumpcloud/apis/jumpcloud-console-api/llms.txt) - [OpenAPI document](https://skmtc.dev/jumpcloud/apis/jumpcloud-console-api/revisions/f396d9271b46?raw)