Record velocity event
Velocity Scoring
Record velocity action
Record a subject action and evaluate it against velocity-based anomaly scoring. Auto-ingests a risk signal when the velocity score reaches 60 or above.
POST
Record velocity event
Records an action for a subject and updates rolling window counters across four time windows (1 m, 5 m, 1 h, 24 h). A weighted velocity score is computed from the updated counts. When the score reaches 60 or above, a risk signal with
signal_type: "velocity" is automatically ingested into the risk signal pipeline.
See the velocity and anomaly scoring guide for the full workflow, scoring model, and integration patterns.
Scoring weights
Request
string
required
Identifier of the subject performing the action (user ID, device ID, IP address, or any entity reference).
string
required
The type of action being recorded (e.g.
login.failed, api.request, transaction.create).string
Source IP address associated with this action.
Response
string
The subject that was recorded.
string
The action type that was recorded.
object
Current action counts per rolling window:
1m, 5m, 1h, 24h.integer
Weighted velocity score (0–100). Scores at or above 60 trigger automatic signal ingestion.
boolean
true if a risk signal was auto-ingested because the velocity score reached 60 or above.string
UUID of the auto-ingested risk signal (only present when
signal_ingested is true).
