Get security metrics

Returns failed login and brute-force attempt time series, along with ranked lists of IP addresses and user accounts with the most failures in the requested window.

When neither start_time nor end_time is provided the window covers the last 24 hours.

Required scope: clusters:insights:read

get/clusters/{cluster_id}/insights/security

Request

Base URL: http://localhost:8000
URL: http://localhost:8000/clusters/{cluster_id}/insights/security
Auth: API key in header API-Key

Path parameters

cluster_idstring uuid required

Query parameters

realmstring

Keycloak realm name (not ID). Must start with a letter; allows letters, digits, and hyphens.

Example:customer-portal

Restrict metrics to a specific realm.

start_timestring date-time

Inclusive start time (ISO 8601). Defaults to 24 hours ago when omitted.

end_timestring date-time

Inclusive end time (ISO 8601). Defaults to the current time when omitted.

Headers

API-Version'2026-06-01.beta' required

Response

The request has succeeded.

Example response

{
  "suspicious_ips": [
    {
      "country": "US"
    }
  ]
}

Changes

No recorded changes to this operation across all 1 revision of this API.