Skip to main content
POST
Record velocity event
Records an action for a subject and updates rolling window counters across four time windows (1 m, 5 m, 1 h, 24 h). A weighted velocity score is computed from the updated counts. When the score reaches 60 or above, a risk signal with signal_type: "velocity" is automatically ingested into the risk signal pipeline. See the velocity and anomaly scoring guide for the full workflow, scoring model, and integration patterns.

Scoring weights

Request

string
required
Identifier of the subject performing the action (user ID, device ID, IP address, or any entity reference).
string
required
The type of action being recorded (e.g. login.failed, api.request, transaction.create).
string
Source IP address associated with this action.

Response

string
The subject that was recorded.
string
The action type that was recorded.
object
Current action counts per rolling window: 1m, 5m, 1h, 24h.
integer
Weighted velocity score (0–100). Scores at or above 60 trigger automatic signal ingestion.
boolean
true if a risk signal was auto-ingested because the velocity score reached 60 or above.
string
UUID of the auto-ingested risk signal (only present when signal_ingested is true).

Authorizations

X-API-Key
string
header
required

API key for machine-to-machine authentication

Body

application/json
subject_id
string
required
action
string
required

Action type being tracked

metadata
object

Response

Velocity event recorded

event_id
string
current_count
integer
window
string