Skip to main content
GET
List ATO alerts
Returns a paginated list of ATO alerts for your tenant. Alerts are created automatically when the ATO evaluation endpoint detects that a subject has crossed a risk threshold. Each alert includes the subject, alert type, risk level at the time of triggering, and a reference to the auto-ingested risk signal. See the account takeover detection guide for the full workflow.

Query parameters

string
Filter alerts by subject identifier.
integer
Maximum number of alerts to return (default 25, max 100).
string
Cursor for pagination. Use the value from the previous response to fetch the next page.

Response

array
Array of alert objects.
string
UUID of the alert.
string
The subject that triggered the alert.
string
Alert category: velocity_exceeded or credential_stuffing.
string
Risk level when the alert was created: elevated | high | critical
integer
Risk score when the alert was created.
string
UUID of the auto-ingested risk signal linked to this alert.
string
ISO 8601 timestamp of when the alert was created.
string
Cursor for the next page of results. null when there are no more results.

Authorizations

X-API-Key
string
header
required

API key for machine-to-machine authentication

Query Parameters

limit
integer
default:20
severity
enum<string>
Available options:
low,
medium,
high,
critical

Response

ATO alerts

items
object[]