List ATO alerts
Account Takeover
List ATO alerts
List account takeover alerts triggered by the ATO heuristic engine. Alerts are created automatically when a subject crosses a risk threshold.
GET
List ATO alerts
Returns a paginated list of ATO alerts for your tenant. Alerts are created automatically when the ATO evaluation endpoint detects that a subject has crossed a risk threshold. Each alert includes the subject, alert type, risk level at the time of triggering, and a reference to the auto-ingested risk signal.
See the account takeover detection guide for the full workflow.
Query parameters
string
Filter alerts by subject identifier.
integer
Maximum number of alerts to return (default 25, max 100).
string
Cursor for pagination. Use the value from the previous response to fetch the next page.
Response
array
Array of alert objects.
string
UUID of the alert.
string
The subject that triggered the alert.
string
Alert category:
velocity_exceeded or credential_stuffing.string
Risk level when the alert was created:
elevated | high | criticalinteger
Risk score when the alert was created.
string
UUID of the auto-ingested risk signal linked to this alert.
string
ISO 8601 timestamp of when the alert was created.
string
Cursor for the next page of results.
null when there are no more results.
