---
title: "POST /api/support/users/{id}/activity/security-events/"
method: POST
path: "/api/support/users/{id}/activity/security-events/"
tags: ["support"]
---

# POST /api/support/users/{id}/activity/security-events/

`POST /api/support/users/{id}/activity/security-events/`

## Request

- Base URL: `https://app.pixiebrix.com`
- URL: `https://app.pixiebrix.com/api/support/users/{id}/activity/security-events/`
- Auth: none declared

Create test security events for a single user in one of their organizations, for QA and evaluation. The organization must have the activity-tracking flag enabled. An omitted `category`, `severity`, or `action` is chosen at random per event, and each event is tagged `data.test_event`. Events are attributed to the user's primary activity policy and, unless `skip_alerts` is set, queue security alert emails the same way ingested events do. Support staff only.

## Path parameters

- `id` string, required

## Request body

- SupportSecurityEventsCreateRequest
  - `organization_id` string, uuid, required: Organization to create the events in. Must be one the user is an active member of, with activity tracking enabled.
  - `category` 'ai_prompt_dlp' | 'ai_tool_access' | 'clipboard' | 'site_access' | 'file_upload' | 'form_dlp' | 'protected_field_edit' | 'prohibited_language' | 'text_pattern_match' | 'element_redaction' | 'address_fraud_match' | 'interaction_match' | 'print' | 'screenshot': Event category. Omit to pick one at random per event.
  - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical': Event severity. Omit to pick one at random per event.
  - `action` 'block' | 'monitor' | 'redact' | 'softBlock' | 'warn': Enforcement action. Omit to pick one at random per event.
  - `destination` string: Optional destination (e.g. an AI tool's domain) stored on each event.
  - `count` integer: Number of events to create.
  - `skip_alerts` boolean: Store the events without queuing security alert emails.

## Response `201`

- SupportSecurityEventsCreateResult
  - `organization_id` string, uuid, required
  - `event_ids` string[], required
  - `alerts_queued` integer, required: Alert emails stored for these events, after throttling.

## Changes

- **2026-09-29** `0f1ab24bf60e`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/pixiebrix/apis/pixiebrix-api/changes/api/support/users/:id/activity/security-events/post.md)

---

[API](https://skmtc.dev/pixiebrix/apis/pixiebrix-api.md) - [All operations](https://skmtc.dev/pixiebrix/apis/pixiebrix-api/llms.txt) - [OpenAPI document](https://skmtc.dev/pixiebrix/apis/pixiebrix-api/revisions/b5614ae64ccc?raw)