Record velocity event
Velocity Scoring
Record velocity action
Record a subject action and evaluate it against velocity-based anomaly scoring. Auto-ingests a risk signal when the velocity score reaches 60 or above.
POST
Record velocity event
Records an action for a subject and updates rolling window counters across four time windows (1 m, 5 m, 1 h, 24 h). A weighted velocity score is computed from the updated counts. When the score reaches 60 or above, a risk signal with
signal_type: "velocity" is automatically ingested into the risk signal pipeline.
See the velocity and anomaly scoring guide for the full workflow, scoring model, and integration patterns.
Scoring weights
| Window | Weight | Purpose |
|---|---|---|
| 1 minute | 30 | Burst detection |
| 5 minutes | 20 | Sustained short-term abuse |
| 1 hour | 10 | Medium-term patterns |
| 24 hours | 5 | Persistent anomalies |
Request
Identifier of the subject performing the action (user ID, device ID, IP address, or any entity reference).
The type of action being recorded (e.g.
login.failed, api.request, transaction.create).Source IP address associated with this action.
Response
The subject that was recorded.
The action type that was recorded.
Current action counts per rolling window:
1m, 5m, 1h, 24h.Weighted velocity score (0–100). Scores at or above 60 trigger automatic signal ingestion.
true if a risk signal was auto-ingested because the velocity score reached 60 or above.UUID of the auto-ingested risk signal (only present when
signal_ingested is true).