---
title: "Get security signals across all organizations"
method: GET
path: "/v1/admin/security"
tags: ["Admin"]
---

# Get security signals across all organizations

`GET /v1/admin/security`

## Request

- Base URL: `https://api.openworklabs.com`
- URL: `https://api.openworklabs.com/v1/admin/security`
- Auth: one of:
  - API key in header `x-api-key`
  - HTTP bearer

Returns threshold-based findings for the last `days` days: sign-up bursts, unverified and disposable sign-ups, accounts used from many networks, organization, API key, app registration and invitation bursts, new platform admins, model spend spikes, and bot-like use (automation-tool sign-ins, model use around the clock, free allowance used up on day one). Findings are prompts for review, not verdicts.

## Query parameters

- `days` integer

## Response `200`

Security signals returned.

- AdminSecurityReportResponse
  - `generatedAt` string, date-time, required
  - `range` object, required
    - `days` integer, required
    - `from` string, date-time, required
    - `to` string, date-time, required
  - `findings` AdminSecurityFinding[], required
    - `id` string, required
    - `category` 'access' | 'accounts' | 'automation' | 'credentials' | 'usage', required
    - `severity` 'high' | 'medium' | 'low' | 'clear', required
    - `title` string, required
    - `summary` string, required: What is true now, in one sentence.
    - `rule` string, required: The threshold that decides the severity.
    - `why` string, required
    - `review` string, required: What a reviewer should check next.
    - `value` integer, required
    - `unit` 'count' | 'micro_usd', required
    - `entities` object[], required
      - `id` string, required
      - `label` string, required
      - `detail` string, nullable, required
      - `value` integer, required
      - `severity` 'high' | 'medium' | 'low' | 'clear', required
      - `target` union, required
        - object
          - `type` 'user', required
          - `userId` string, required
        - object
          - `type` 'organization', required
          - `organizationId` string, required
    - `entityCount` integer, required: Matching entities, including any past the listed ones.

## Other responses

- `400`: The query parameters were invalid.
- `401`: The caller must be authenticated.
- `403`: The authenticated user is not an admin.

## Changes

- **2026-10-24** `96985dbeccd1`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/openworklabs/apis/den-api/changes/v1/admin/security/get.md)

---

[API](https://skmtc.dev/openworklabs/apis/den-api.md) - [All operations](https://skmtc.dev/openworklabs/apis/den-api/llms.txt) - [OpenAPI document](https://skmtc.dev/openworklabs/apis/den-api/revisions/8170cf4a92ca?raw)