---
title: "Get security metrics"
method: GET
path: "/clusters/{cluster_id}/insights/security"
tags: ["Cluster Insights"]
---

# Get security metrics

`GET /clusters/{cluster_id}/insights/security`

## Request

- Base URL: `http://localhost:8000`
- URL: `http://localhost:8000/clusters/{cluster_id}/insights/security`
- Auth: API key in header `API-Key`

Returns failed login and brute-force attempt time series, along with ranked lists
of IP addresses and user accounts with the most failures in the requested window.

When neither `start_time` nor `end_time` is provided the window covers the last 24 hours.

Required scope: `clusters:insights:read`

## Path parameters

- `cluster_id` string, uuid, required

## Query parameters

- `realm` string: Keycloak realm name (not ID). Must start with a letter; allows letters, digits, and hyphens.
- `start_time` string, date-time
- `end_time` string, date-time

## Headers

- `API-Version` '2026-06-01.beta', required

## Response `200`

The request has succeeded.

- SecurityMetrics: Authentication security metrics over the requested time window.
  - `failed_logins` MetricSeries, required
    - `values` MetricValue[], required
      - `timestamp` string, date-time, required
      - `value` number, double, required
  - `brute_force_attempts` MetricSeries, required
    - `values` MetricValue[], required
      - `timestamp` string, date-time, required
      - `value` number, double, required
  - `suspicious_ips` SuspiciousIP[], required: IP addresses ranked by failed login count within the window.
    - `ip` string, required
    - `failed_logins` integer, required: Number of failed login attempts from this IP in the time window.
    - `last_attempt` string, date-time, required
    - `country` string: ISO 3166-1 alpha-2 country code resolved from the IP, when available.
  - `top_failed_users` UserFailureStat[], required: User accounts ranked by failed login count within the window.
    - `username` string, required
    - `failure_count` integer, required
    - `last_failure` string, date-time, required
  - `security_events` MetricSeries, required
    - `values` MetricValue[], required
      - `timestamp` string, date-time, required
      - `value` number, double, required

## Other responses

- `400`: The server could not understand the request due to invalid syntax.
- `401`: Access is unauthorized.
- `403`: Access is forbidden.
- `404`: The server cannot find the requested resource.
- `422`: Client error
- `429`: Client error
- `500`: Server error
- `501`: Server error

---

[API](https://skmtc.dev/skycloak/apis/skycloak-public-api.md) · [All operations](https://skmtc.dev/skycloak/apis/skycloak-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/skycloak/apis/skycloak-public-api/revisions/33a69e2ce35f?raw)