--- title: "Search actions" method: GET path: "/search/actions" --- # Search actions `GET /search/actions` Returns a paginated list of actions within the requested time window. The response is scoped to the tenant identified by the access token — there is no `tenantId` parameter on this endpoint, and cross-tenant reads are not possible. ## Query parameters - `start_time` integer, required - `end_time` integer, required - `skip` integer - `take` integer - `sort_field` 'id' | 'issued_at' | 'risk_score' | 'threats' | 'was_consumed_by_api' | 'recommendation.type' | 'recommendation.result' | 'recommendation.challenge_type' | 'context.action_id' | 'context.action_type' | 'context.action_performed_at' | 'context.application_id' | 'context.client_id' | 'context.correlation_id' | 'context.device_fingerprint' | 'context.device_id' | 'context.device_timestamp' | 'context.user_id' | 'context.ip' | 'context.ip_country' | 'context.ip_location_city' | 'context.ip_asn_name' | 'context.ip_location_timezone' | 'context.os_name' | 'context.os_version' | 'context.browser_name' | 'context.browser_version' | 'context.user_agent' | 'context.device_timezone' | 'risk_signals.device.tampered' | 'risk_signals.device.emulated' | 'risk_signals.device.spoofed' | 'risk_signals.device.true_useragent' | 'risk_signals.device.summer_timezone_offset' | 'risk_signals.device.winter_timezone_offset' | 'risk_signals.device.device_power_state' | 'risk_signals.network.vpn' | 'risk_signals.network.tor' | 'risk_signals.network.proxy' | 'risk_signals.network.anonymizer' | 'risk_signals.behavior.typing_velocity' | 'risk_signals.behavior.movement_velocity' | 'risk_signals.behavior.no_user_interaction' | 'risk_signals.history.ip_action_rate_60_sec' | 'risk_signals.history.user_action_rate_60_sec' | 'risk_signals.history.device_action_rate_60_sec' | 'risk_signals.history.ip_user_count_last_hour' | 'risk_signals.history.ip_device_count_last_hour' | 'risk_signals.history.linking_device_to_users_count' | 'risk_signals.history.linking_user_to_device_count' | 'assignee_id' | 'labeler_id' | 'fraud_ring_id' | 'label.type' | 'label.subject_value' | 'label.source' | 'label.use_case' | 'label.sub_category' | 'label.attack_method' | 'preview_rule.rule_name' | 'preview_rule.recommendation' — Field name to sort by. Must be one of the listed values. - `order` 'ASC' | 'DESC' - `filters` Filters — Filter expression. Exactly one of `and`, `or`, or a single `{ field, operator, value }` condition must be present. One level deep — nested groups are not supported. - `and` FilterCondition[] — All conditions in this group must match. - `field` 'id' | 'risk_score' | 'reasons' | 'threats' | 'was_consumed_by_api' | 'recommendation.type' | 'recommendation.result' | 'recommendation.challenge_type' | 'context.action_id' | 'context.action_type' | 'context.application_id' | 'context.client_id' | 'context.correlation_id' | 'context.device_fingerprint' | 'context.device_public_key' | 'context.device_id' | 'context.user_id' | 'context.claimed_user_id' | 'context.ip' | 'context.ip_country' | 'context.ip_location_city' | 'context.ip_asn_id' | 'context.ip_asn_name' | 'context.ip_domain' | 'context.ip_location_region' | 'context.ip_location_timezone' | 'context.ip_organization_type' | 'context.os_name' | 'context.browser_name' | 'context.user_agent' | 'context.device_timezone' | 'risk_signals.device.model' | 'risk_signals.device.screen_height' | 'risk_signals.device.screen_width' | 'risk_signals.device.screen_color_depth' | 'risk_signals.device.screen_pixel_depth' | 'risk_signals.device.screen_avail_width' | 'risk_signals.device.screen_avail_height' | 'risk_signals.device.tampered' | 'risk_signals.device.emulated' | 'risk_signals.device.spoofed' | 'risk_signals.device.mobile_network_code' | 'risk_signals.device.device_name' | 'risk_signals.device.summer_timezone_offset' | 'risk_signals.device.winter_timezone_offset' | 'risk_signals.device.device_power_state' | 'risk_signals.device.tz_mismatch' | 'risk_signals.device.device_timezone_offset' | 'risk_signals.network.vpn' | 'risk_signals.network.tor' | 'risk_signals.network.proxy' | 'risk_signals.network.anonymizer' | 'risk_signals.behavior.typing_velocity' | 'risk_signals.behavior.movement_velocity' | 'risk_signals.behavior.input_method' | 'risk_signals.behavior.no_user_interaction' | 'risk_signals.behavior.straight_line_ratio' | 'risk_signals.behavior.right_angels_ratio' | 'risk_signals.behavior.minor_angels_ratio' | 'risk_signals.behavior.movement_latency' | 'risk_signals.behavior.corner_click' | 'risk_signals.history.linking_device_to_users_count' | 'risk_signals.history.linking_user_to_device_count' | 'transaction_data.amount' | 'transaction_data.currency' | 'transaction_data.type' | 'transaction_data.method' | 'transaction_data.channelId' | 'transaction_data.reason' | 'transaction_data.transactionDate' | 'transaction_data.payee.name' | 'transaction_data.payee.accountNumber' | 'transaction_data.payee.accountId' | 'transaction_data.payee.accountCountryCode' | 'transaction_data.payee.bankIdentifier' | 'transaction_data.payee.branchIdentifier' | 'transaction_data.payee.card.holderName' | 'transaction_data.payee.card.bin' | 'transaction_data.payee.card.last4' | 'transaction_data.payer.name' | 'transaction_data.payer.accountNumber' | 'transaction_data.payer.accountId' | 'transaction_data.payer.accountCountryCode' | 'transaction_data.payer.bankIdentifier' | 'transaction_data.payer.branchIdentifier' | 'transaction_data.payer.customerTier' | 'transaction_data.payer.card.holderName' | 'transaction_data.payer.card.bin' | 'transaction_data.payer.card.last4' | 'transaction_data.payer.billingInfo.name' | 'transaction_data.payer.billingInfo.addressLine1' | 'transaction_data.payer.billingInfo.addressLine2' | 'transaction_data.payer.billingInfo.city' | 'transaction_data.payer.billingInfo.state' | 'transaction_data.payer.billingInfo.zipPostalCode' | 'transaction_data.payer.billingInfo.country' | 'transaction_data.payer.billingInfo.email' | 'transaction_data.payer.billingInfo.phone' | 'transaction_data.purchase.totalItems' | 'transaction_data.purchase.shippingInfo.name' | 'transaction_data.purchase.shippingInfo.addressLine1' | 'transaction_data.purchase.shippingInfo.addressLine2' | 'transaction_data.purchase.shippingInfo.city' | 'transaction_data.purchase.shippingInfo.state' | 'transaction_data.purchase.shippingInfo.zipPostalCode' | 'transaction_data.purchase.shippingInfo.country' | 'transaction_data.purchase.shippingInfo.email' | 'transaction_data.purchase.shippingInfo.phone' | 'transaction_data.avs.code' | 'transaction_data.avs.provider' | 'transaction_data.avs.matchLevel' | 'assignee_id' | 'labeler_id' | 'fraud_ring_id' | 'campaign_id' | 'list_id' | 'label.type' | 'label.subject_value' | 'label.source' | 'label.use_case' | 'label.sub_category' | 'label.attack_method' | 'preview_rule.rule_name' | 'preview_rule.recommendation', required — Field path to filter on. Must be one of the listed values. - `operator` 'eq' | 'neq' | 'lt' | 'gt' | 'between' | 'in' | 'nin', required — Comparison operator. The valid `value` shape depends on the operator chosen — see `filter_value`. - `value` union, required — Value to compare against. Shape depends on the operator: - `eq` / `neq` — string, number, or boolean - `lt` / `gt` — number - `between` — `[number, number]` tuple - `in` / `nin` — array of string, number, or boolean - string - number - boolean - union[] - union - string - number - boolean - `or` FilterCondition[] — At least one condition in this group must match. - `field` 'id' | 'risk_score' | 'reasons' | 'threats' | 'was_consumed_by_api' | 'recommendation.type' | 'recommendation.result' | 'recommendation.challenge_type' | 'context.action_id' | 'context.action_type' | 'context.application_id' | 'context.client_id' | 'context.correlation_id' | 'context.device_fingerprint' | 'context.device_public_key' | 'context.device_id' | 'context.user_id' | 'context.claimed_user_id' | 'context.ip' | 'context.ip_country' | 'context.ip_location_city' | 'context.ip_asn_id' | 'context.ip_asn_name' | 'context.ip_domain' | 'context.ip_location_region' | 'context.ip_location_timezone' | 'context.ip_organization_type' | 'context.os_name' | 'context.browser_name' | 'context.user_agent' | 'context.device_timezone' | 'risk_signals.device.model' | 'risk_signals.device.screen_height' | 'risk_signals.device.screen_width' | 'risk_signals.device.screen_color_depth' | 'risk_signals.device.screen_pixel_depth' | 'risk_signals.device.screen_avail_width' | 'risk_signals.device.screen_avail_height' | 'risk_signals.device.tampered' | 'risk_signals.device.emulated' | 'risk_signals.device.spoofed' | 'risk_signals.device.mobile_network_code' | 'risk_signals.device.device_name' | 'risk_signals.device.summer_timezone_offset' | 'risk_signals.device.winter_timezone_offset' | 'risk_signals.device.device_power_state' | 'risk_signals.device.tz_mismatch' | 'risk_signals.device.device_timezone_offset' | 'risk_signals.network.vpn' | 'risk_signals.network.tor' | 'risk_signals.network.proxy' | 'risk_signals.network.anonymizer' | 'risk_signals.behavior.typing_velocity' | 'risk_signals.behavior.movement_velocity' | 'risk_signals.behavior.input_method' | 'risk_signals.behavior.no_user_interaction' | 'risk_signals.behavior.straight_line_ratio' | 'risk_signals.behavior.right_angels_ratio' | 'risk_signals.behavior.minor_angels_ratio' | 'risk_signals.behavior.movement_latency' | 'risk_signals.behavior.corner_click' | 'risk_signals.history.linking_device_to_users_count' | 'risk_signals.history.linking_user_to_device_count' | 'transaction_data.amount' | 'transaction_data.currency' | 'transaction_data.type' | 'transaction_data.method' | 'transaction_data.channelId' | 'transaction_data.reason' | 'transaction_data.transactionDate' | 'transaction_data.payee.name' | 'transaction_data.payee.accountNumber' | 'transaction_data.payee.accountId' | 'transaction_data.payee.accountCountryCode' | 'transaction_data.payee.bankIdentifier' | 'transaction_data.payee.branchIdentifier' | 'transaction_data.payee.card.holderName' | 'transaction_data.payee.card.bin' | 'transaction_data.payee.card.last4' | 'transaction_data.payer.name' | 'transaction_data.payer.accountNumber' | 'transaction_data.payer.accountId' | 'transaction_data.payer.accountCountryCode' | 'transaction_data.payer.bankIdentifier' | 'transaction_data.payer.branchIdentifier' | 'transaction_data.payer.customerTier' | 'transaction_data.payer.card.holderName' | 'transaction_data.payer.card.bin' | 'transaction_data.payer.card.last4' | 'transaction_data.payer.billingInfo.name' | 'transaction_data.payer.billingInfo.addressLine1' | 'transaction_data.payer.billingInfo.addressLine2' | 'transaction_data.payer.billingInfo.city' | 'transaction_data.payer.billingInfo.state' | 'transaction_data.payer.billingInfo.zipPostalCode' | 'transaction_data.payer.billingInfo.country' | 'transaction_data.payer.billingInfo.email' | 'transaction_data.payer.billingInfo.phone' | 'transaction_data.purchase.totalItems' | 'transaction_data.purchase.shippingInfo.name' | 'transaction_data.purchase.shippingInfo.addressLine1' | 'transaction_data.purchase.shippingInfo.addressLine2' | 'transaction_data.purchase.shippingInfo.city' | 'transaction_data.purchase.shippingInfo.state' | 'transaction_data.purchase.shippingInfo.zipPostalCode' | 'transaction_data.purchase.shippingInfo.country' | 'transaction_data.purchase.shippingInfo.email' | 'transaction_data.purchase.shippingInfo.phone' | 'transaction_data.avs.code' | 'transaction_data.avs.provider' | 'transaction_data.avs.matchLevel' | 'assignee_id' | 'labeler_id' | 'fraud_ring_id' | 'campaign_id' | 'list_id' | 'label.type' | 'label.subject_value' | 'label.source' | 'label.use_case' | 'label.sub_category' | 'label.attack_method' | 'preview_rule.rule_name' | 'preview_rule.recommendation', required — Field path to filter on. Must be one of the listed values. - `operator` 'eq' | 'neq' | 'lt' | 'gt' | 'between' | 'in' | 'nin', required — Comparison operator. The valid `value` shape depends on the operator chosen — see `filter_value`. - `value` union, required — Value to compare against. Shape depends on the operator: - `eq` / `neq` — string, number, or boolean - `lt` / `gt` — number - `between` — `[number, number]` tuple - `in` / `nin` — array of string, number, or boolean - string - number - boolean - union[] - union - string - number - boolean - `field` 'id' | 'risk_score' | 'reasons' | 'threats' | 'was_consumed_by_api' | 'recommendation.type' | 'recommendation.result' | 'recommendation.challenge_type' | 'context.action_id' | 'context.action_type' | 'context.application_id' | 'context.client_id' | 'context.correlation_id' | 'context.device_fingerprint' | 'context.device_public_key' | 'context.device_id' | 'context.user_id' | 'context.claimed_user_id' | 'context.ip' | 'context.ip_country' | 'context.ip_location_city' | 'context.ip_asn_id' | 'context.ip_asn_name' | 'context.ip_domain' | 'context.ip_location_region' | 'context.ip_location_timezone' | 'context.ip_organization_type' | 'context.os_name' | 'context.browser_name' | 'context.user_agent' | 'context.device_timezone' | 'risk_signals.device.model' | 'risk_signals.device.screen_height' | 'risk_signals.device.screen_width' | 'risk_signals.device.screen_color_depth' | 'risk_signals.device.screen_pixel_depth' | 'risk_signals.device.screen_avail_width' | 'risk_signals.device.screen_avail_height' | 'risk_signals.device.tampered' | 'risk_signals.device.emulated' | 'risk_signals.device.spoofed' | 'risk_signals.device.mobile_network_code' | 'risk_signals.device.device_name' | 'risk_signals.device.summer_timezone_offset' | 'risk_signals.device.winter_timezone_offset' | 'risk_signals.device.device_power_state' | 'risk_signals.device.tz_mismatch' | 'risk_signals.device.device_timezone_offset' | 'risk_signals.network.vpn' | 'risk_signals.network.tor' | 'risk_signals.network.proxy' | 'risk_signals.network.anonymizer' | 'risk_signals.behavior.typing_velocity' | 'risk_signals.behavior.movement_velocity' | 'risk_signals.behavior.input_method' | 'risk_signals.behavior.no_user_interaction' | 'risk_signals.behavior.straight_line_ratio' | 'risk_signals.behavior.right_angels_ratio' | 'risk_signals.behavior.minor_angels_ratio' | 'risk_signals.behavior.movement_latency' | 'risk_signals.behavior.corner_click' | 'risk_signals.history.linking_device_to_users_count' | 'risk_signals.history.linking_user_to_device_count' | 'transaction_data.amount' | 'transaction_data.currency' | 'transaction_data.type' | 'transaction_data.method' | 'transaction_data.channelId' | 'transaction_data.reason' | 'transaction_data.transactionDate' | 'transaction_data.payee.name' | 'transaction_data.payee.accountNumber' | 'transaction_data.payee.accountId' | 'transaction_data.payee.accountCountryCode' | 'transaction_data.payee.bankIdentifier' | 'transaction_data.payee.branchIdentifier' | 'transaction_data.payee.card.holderName' | 'transaction_data.payee.card.bin' | 'transaction_data.payee.card.last4' | 'transaction_data.payer.name' | 'transaction_data.payer.accountNumber' | 'transaction_data.payer.accountId' | 'transaction_data.payer.accountCountryCode' | 'transaction_data.payer.bankIdentifier' | 'transaction_data.payer.branchIdentifier' | 'transaction_data.payer.customerTier' | 'transaction_data.payer.card.holderName' | 'transaction_data.payer.card.bin' | 'transaction_data.payer.card.last4' | 'transaction_data.payer.billingInfo.name' | 'transaction_data.payer.billingInfo.addressLine1' | 'transaction_data.payer.billingInfo.addressLine2' | 'transaction_data.payer.billingInfo.city' | 'transaction_data.payer.billingInfo.state' | 'transaction_data.payer.billingInfo.zipPostalCode' | 'transaction_data.payer.billingInfo.country' | 'transaction_data.payer.billingInfo.email' | 'transaction_data.payer.billingInfo.phone' | 'transaction_data.purchase.totalItems' | 'transaction_data.purchase.shippingInfo.name' | 'transaction_data.purchase.shippingInfo.addressLine1' | 'transaction_data.purchase.shippingInfo.addressLine2' | 'transaction_data.purchase.shippingInfo.city' | 'transaction_data.purchase.shippingInfo.state' | 'transaction_data.purchase.shippingInfo.zipPostalCode' | 'transaction_data.purchase.shippingInfo.country' | 'transaction_data.purchase.shippingInfo.email' | 'transaction_data.purchase.shippingInfo.phone' | 'transaction_data.avs.code' | 'transaction_data.avs.provider' | 'transaction_data.avs.matchLevel' | 'assignee_id' | 'labeler_id' | 'fraud_ring_id' | 'campaign_id' | 'list_id' | 'label.type' | 'label.subject_value' | 'label.source' | 'label.use_case' | 'label.sub_category' | 'label.attack_method' | 'preview_rule.rule_name' | 'preview_rule.recommendation' — Field path to filter on. Must be one of the listed values. - `operator` 'eq' | 'neq' | 'lt' | 'gt' | 'between' | 'in' | 'nin' — Comparison operator. The valid `value` shape depends on the operator chosen — see `filter_value`. - `value` union — Value to compare against. Shape depends on the operator: - `eq` / `neq` — string, number, or boolean - `lt` / `gt` — number - `between` — `[number, number]` tuple - `in` / `nin` — array of string, number, or boolean - string - number - boolean - union[] - union - string - number - boolean - `fields` Field[] ## Response `200` Paginated list of actions for the requested window. - PaginatedActionsResponse - `items` ActionItem[], required — Page of actions matching the query. — unresolved $ref - `count` integer, required — Number of items in this page. - `skipped` integer, required — Echo of the requested `skip` offset. ## Other responses - `400` — Bad request. Returned when a query parameter fails validation — for example, `take` outside `[1, 400]`, `skip` outside `[0, 10000]`, `start_time`/`end_time` missing or non-numeric, an unknown `sort_field`/`field`/`filter_field`/`filter_operator`, or a malformed `filters` JSON expression. - `401` — Invalid authentication. - `403` — Invalid authorization. - `429` — Rate limit reached. Requests are throttled per tenant at 20 per 60 seconds. - `500` — Internal error. --- [API](https://skmtc.dev/transmitsecurity/apis/search-actions.md) · [All operations](https://skmtc.dev/transmitsecurity/apis/search-actions/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/transmitsecurity/search-actions/revisions/00a7a1a5d3cb/schema)