Skip to main content
GET
Get ATO profile
Returns the ATO risk profile for the specified subject. The profile tracks failed login velocity in a rolling one-hour window and records known IP addresses and devices. Use this endpoint to check the current risk posture of a user without triggering a new evaluation. See the account takeover detection guide for the full workflow.

Path parameters

string
required
The subject identifier to look up (user ID, email, or external ID).

Response

string
The subject identifier.
string
Type of subject (user).
string
Current ATO risk level: normal | elevated | high | critical
integer
Number of failed logins in the current one-hour window.
array
List of IP addresses previously seen for this subject.
array
List of device identifiers previously seen for this subject.
string
ISO 8601 timestamp of the last profile update.

Authorizations

X-API-Key
string
header
required

API key for machine-to-machine authentication

Path Parameters

subject_id
string
required

Subject identifier

Response

ATO profile

subject_id
string
risk_level
string
last_login
string
known_devices
integer
alerts
object[]