Get ATO profile
Account Takeover
Get ATO profile
Retrieve the current account takeover risk profile for a subject, including failed login count, risk level, and known devices.
GET
Get ATO profile
Returns the ATO risk profile for the specified subject. The profile tracks failed login velocity in a rolling one-hour window and records known IP addresses and devices. Use this endpoint to check the current risk posture of a user without triggering a new evaluation.
See the account takeover detection guide for the full workflow.
Path parameters
string
required
The subject identifier to look up (user ID, email, or external ID).
Response
string
The subject identifier.
string
Type of subject (
user).string
Current ATO risk level:
normal | elevated | high | criticalinteger
Number of failed logins in the current one-hour window.
array
List of IP addresses previously seen for this subject.
array
List of device identifiers previously seen for this subject.
string
ISO 8601 timestamp of the last profile update.

