---
title: "Get authentication metrics"
method: GET
path: "/clusters/{cluster_id}/insights/authentication"
tags: ["Cluster Insights"]
---

# Get authentication metrics

`GET /clusters/{cluster_id}/insights/authentication`

## Request

- Base URL: `http://localhost:8000`
- URL: `http://localhost:8000/clusters/{cluster_id}/insights/authentication`
- Auth: API key in header `API-Key`

Returns login attempt, success, failure, and token issuance time series,
along with a per-protocol breakdown.

When neither `start_time` nor `end_time` is provided the window covers the last 24 hours.

Required scope: `clusters:insights:read`

## Path parameters

- `cluster_id` string, uuid, required

## Query parameters

- `realm` string: Keycloak realm name (not ID). Must start with a letter; allows letters, digits, and hyphens.
- `start_time` string, date-time
- `end_time` string, date-time

## Headers

- `API-Version` '2026-06-01.beta', required

## Response `200`

The request has succeeded.

- AuthenticationMetrics: Authentication activity time series over the requested time window.
  - `login_attempts` MetricSeries, required
    - `values` MetricValue[], required
      - `timestamp` string, date-time, required
      - `value` number, double, required
  - `login_successes` MetricSeries, required
    - `values` MetricValue[], required
      - `timestamp` string, date-time, required
      - `value` number, double, required
  - `login_failures` MetricSeries, required
    - `values` MetricValue[], required
      - `timestamp` string, date-time, required
      - `value` number, double, required
  - `token_issuances` MetricSeries, required
    - `values` MetricValue[], required
      - `timestamp` string, date-time, required
      - `value` number, double, required
  - `token_validations` MetricSeries, required
    - `values` MetricValue[], required
      - `timestamp` string, date-time, required
      - `value` number, double, required
  - `password_validations` MetricSeries, required
    - `values` MetricValue[], required
      - `timestamp` string, date-time, required
      - `value` number, double, required
  - `by_protocol` ProtocolStat[], required
    - `protocol` string, required
    - `count` integer, required
    - `rate` number, double, required: Fraction of total login events for this protocol (0–1).

## Other responses

- `400`: The server could not understand the request due to invalid syntax.
- `401`: Access is unauthorized.
- `403`: Access is forbidden.
- `404`: The server cannot find the requested resource.
- `422`: Client error
- `429`: Client error
- `500`: Server error
- `501`: Server error

---

[API](https://skmtc.dev/skycloak/apis/skycloak-public-api.md) · [All operations](https://skmtc.dev/skycloak/apis/skycloak-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/skycloak/apis/skycloak-public-api/revisions/33a69e2ce35f?raw)