Search actions

Returns a paginated list of actions within the requested time window. The response is scoped to the tenant identified by the access token — there is no tenantId parameter on this endpoint, and cross-tenant reads are not possible.

get/search/actions

Query parameters

start_timeinteger required

Example:1779600000000

Start of the time window, Unix epoch time in milliseconds.

end_timeinteger required

Example:1779686400000

End of the time window, Unix epoch time in milliseconds.

skipinteger

Pagination offset. Maximum 10000.

takeinteger

Page size. Maximum 400.

sort_field'id' | 'issued_at' | 'risk_score' | 'threats' | 'was_consumed_by_api' | 'recommendation.type' | 'recommendation.result' | 'recommendation.challenge_type' | 'context.action_id' | 'context.action_type' | 'context.action_performed_at' | 'context.application_id' | 'context.client_id' | 'context.correlation_id' | 'context.device_fingerprint' | 'context.device_id' | 'context.device_timestamp' | 'context.user_id' | 'context.ip' | 'context.ip_country' | 'context.ip_location_city' | 'context.ip_asn_name' | 'context.ip_location_timezone' | 'context.os_name' | 'context.os_version' | 'context.browser_name' | 'context.browser_version' | 'context.user_agent' | 'context.device_timezone' | 'risk_signals.device.tampered' | 'risk_signals.device.emulated' | 'risk_signals.device.spoofed' | 'risk_signals.device.true_useragent' | 'risk_signals.device.summer_timezone_offset' | 'risk_signals.device.winter_timezone_offset' | 'risk_signals.device.device_power_state' | 'risk_signals.network.vpn' | 'risk_signals.network.tor' | 'risk_signals.network.proxy' | 'risk_signals.network.anonymizer' | 'risk_signals.behavior.typing_velocity' | 'risk_signals.behavior.movement_velocity' | 'risk_signals.behavior.no_user_interaction' | 'risk_signals.history.ip_action_rate_60_sec' | 'risk_signals.history.user_action_rate_60_sec' | 'risk_signals.history.device_action_rate_60_sec' | 'risk_signals.history.ip_user_count_last_hour' | 'risk_signals.history.ip_device_count_last_hour' | 'risk_signals.history.linking_device_to_users_count' | 'risk_signals.history.linking_user_to_device_count' | 'assignee_id' | 'labeler_id' | 'fraud_ring_id' | 'label.type' | 'label.subject_value' | 'label.source' | 'label.use_case' | 'label.sub_category' | 'label.attack_method' | 'preview_rule.rule_name' | 'preview_rule.recommendation'

Field name to sort by. Must be one of the listed values.

Field to sort by. Defaults to issued_at.

order'ASC' | 'DESC'

Sort direction. Defaults to DESC.

field'id' | 'risk_score' | 'reasons' | 'threats' | 'was_consumed_by_api' | 'recommendation.type' | 'recommendation.result' | 'recommendation.challenge_type' | 'context.action_id' | 'context.action_type' | 'context.application_id' | 'context.client_id' | 'context.correlation_id' | 'context.device_fingerprint' | 'context.device_public_key' | 'context.device_id' | 'context.user_id' | 'context.claimed_user_id' | 'context.ip' | 'context.ip_country' | 'context.ip_location_city' | 'context.ip_asn_id' | 'context.ip_asn_name' | 'context.ip_domain' | 'context.ip_location_region' | 'context.ip_location_timezone' | 'context.ip_organization_type' | 'context.os_name' | 'context.browser_name' | 'context.user_agent' | 'context.device_timezone' | 'risk_signals.device.model' | 'risk_signals.device.screen_height' | 'risk_signals.device.screen_width' | 'risk_signals.device.screen_color_depth' | 'risk_signals.device.screen_pixel_depth' | 'risk_signals.device.screen_avail_width' | 'risk_signals.device.screen_avail_height' | 'risk_signals.device.tampered' | 'risk_signals.device.emulated' | 'risk_signals.device.spoofed' | 'risk_signals.device.mobile_network_code' | 'risk_signals.device.device_name' | 'risk_signals.device.summer_timezone_offset' | 'risk_signals.device.winter_timezone_offset' | 'risk_signals.device.device_power_state' | 'risk_signals.device.tz_mismatch' | 'risk_signals.device.device_timezone_offset' | 'risk_signals.network.vpn' | 'risk_signals.network.tor' | 'risk_signals.network.proxy' | 'risk_signals.network.anonymizer' | 'risk_signals.behavior.typing_velocity' | 'risk_signals.behavior.movement_velocity' | 'risk_signals.behavior.input_method' | 'risk_signals.behavior.no_user_interaction' | 'risk_signals.behavior.straight_line_ratio' | 'risk_signals.behavior.right_angels_ratio' | 'risk_signals.behavior.minor_angels_ratio' | 'risk_signals.behavior.movement_latency' | 'risk_signals.behavior.corner_click' | 'risk_signals.history.linking_device_to_users_count' | 'risk_signals.history.linking_user_to_device_count' | 'transaction_data.amount' | 'transaction_data.currency' | 'transaction_data.type' | 'transaction_data.method' | 'transaction_data.channelId' | 'transaction_data.reason' | 'transaction_data.transactionDate' | 'transaction_data.payee.name' | 'transaction_data.payee.accountNumber' | 'transaction_data.payee.accountId' | 'transaction_data.payee.accountCountryCode' | 'transaction_data.payee.bankIdentifier' | 'transaction_data.payee.branchIdentifier' | 'transaction_data.payee.card.holderName' | 'transaction_data.payee.card.bin' | 'transaction_data.payee.card.last4' | 'transaction_data.payer.name' | 'transaction_data.payer.accountNumber' | 'transaction_data.payer.accountId' | 'transaction_data.payer.accountCountryCode' | 'transaction_data.payer.bankIdentifier' | 'transaction_data.payer.branchIdentifier' | 'transaction_data.payer.customerTier' | 'transaction_data.payer.card.holderName' | 'transaction_data.payer.card.bin' | 'transaction_data.payer.card.last4' | 'transaction_data.payer.billingInfo.name' | 'transaction_data.payer.billingInfo.addressLine1' | 'transaction_data.payer.billingInfo.addressLine2' | 'transaction_data.payer.billingInfo.city' | 'transaction_data.payer.billingInfo.state' | 'transaction_data.payer.billingInfo.zipPostalCode' | 'transaction_data.payer.billingInfo.country' | 'transaction_data.payer.billingInfo.email' | 'transaction_data.payer.billingInfo.phone' | 'transaction_data.purchase.totalItems' | 'transaction_data.purchase.shippingInfo.name' | 'transaction_data.purchase.shippingInfo.addressLine1' | 'transaction_data.purchase.shippingInfo.addressLine2' | 'transaction_data.purchase.shippingInfo.city' | 'transaction_data.purchase.shippingInfo.state' | 'transaction_data.purchase.shippingInfo.zipPostalCode' | 'transaction_data.purchase.shippingInfo.country' | 'transaction_data.purchase.shippingInfo.email' | 'transaction_data.purchase.shippingInfo.phone' | 'transaction_data.avs.code' | 'transaction_data.avs.provider' | 'transaction_data.avs.matchLevel' | 'assignee_id' | 'labeler_id' | 'fraud_ring_id' | 'campaign_id' | 'list_id' | 'label.type' | 'label.subject_value' | 'label.source' | 'label.use_case' | 'label.sub_category' | 'label.attack_method' | 'preview_rule.rule_name' | 'preview_rule.recommendation'

Field path to filter on. Must be one of the listed values.

operator'eq' | 'neq' | 'lt' | 'gt' | 'between' | 'in' | 'nin'

Comparison operator. The valid value shape depends on the operator chosen — see filter_value.

URL-encoded JSON describing the filter expression. One of: a single { field, operator, value } condition, an { and: [conditions...] } group, or an { or: [conditions...] } group. One level deep.

{
  "and": [
    {
      "operator": "eq"
    }
  ],
  "or": [
    {
      "operator": "eq"
    }
  ],
  "operator": "eq"
}

fieldsField[]

URL-encoded JSON array of field names to include in each item. When omitted, only id, issued_at, context.action_id, and context.action_performed_at are populated with real data; all other fields contain empty or zero default values. Specify the fields required by your integration to populate them with meaningful data.

Response

Paginated list of actions for the requested window.

itemsActionItem[] required— unresolved $ref

Page of actions matching the query.

countinteger required

Number of items in this page.

skippedinteger required

Echo of the requested skip offset.

Changes