Search all events for user login failures
GET {{HOST}}/admin/v1/AuditEvents?filter=eventId eq "sso.authentication.failure"
This example demonstrates how to search all events for user login failures filtering by the sso.authentication.failure
eventId.
Request Params
| Key | Datatype | Required | Description |
|---|---|---|---|
filter | string |
HEADERS
| Key | Datatype | Required | Description |
|---|---|---|---|
Authorization | string | ||
Content-Type | string |
RESPONSES
status: OK
{"schemas":["urn:ietf:params:scim:api:messages:2.0:ListResponse"],"totalResults":2,"Resources":[{"idcsCreatedBy":{"type":"User","display":"username@example.com","value":"IDCS","$ref":"https://tenant-base-url/admin/v1/Users/IDCS"},"actorName":"username@example.com","id":"ecaae86c21fc4df69cfaa80448fc9478","ssoLocalIp":"172.xx.x.xx","actorDisplayName":"username@example.com","ssoRp":"idcscloudgate","meta":{"created":"2018-05-09T21:55:54.900Z","lastModified":"2018-05-09T21:55:54.900Z","resourceType":"AuditEvent","location":"https://tenant-base-url/admin/v1/AuditEvents/ecaae86c21fc4df69cfaa80448fc9478"},"rId":"0:1:1:3:11","actorId":"IDCS","ssoApplicationHostId":"tenant-base-url:1111","ssoIdentityProvider":"localIDP","timestamp":"2018-05-09T21:55:54.890Z","idcsLastModifiedBy":{"value":"IDCS","display":"username@example.com","type":"User","$ref":"https://tenant-base-url/admin/v1/Users/IDCS"},"quotaCount":0,"ecId":"^V1zy0n0000000000","clientIp":"10.xxx.xxx.x","ssoComments":"Authentication failure You entered an incorrect user name or password.","eventId":"sso.authentication.failure","ssoAuthnLevel":0,"ssoUserAgent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36","reasonValue":"SSO-1001","actorType":"User","ssoProtectedResource":"https://tenant-base-url/ui/v1/adminconsole","serviceName":"SSO","message":"Authentication failure You entered an incorrect user name or password.","schemas":["urn:ietf:params:scim:schemas:oracle:idcs:AuditEvent"]},{"idcsCreatedBy":{"type":"User","display":"username@example.com","value":"IDCS","$ref":"https://tenant-base-url/admin/v1/Users/IDCS"},"actorName":"username@example.com","id":"1f1979c3791f442f92ddbd98d1485045","ssoLocalIp":"172.xx.x.xx","actorDisplayName":"username@example.com","ssoRp":"PCTrustedApp","meta":{"created":"2018-05-11T16:47:22.691Z","lastModified":"2018-05-11T16:47:22.691Z","resourceType":"AuditEvent","location":"https://tenant-base-url/admin/v1/AuditEvents/1f1979c3791f442f92ddbd98d1485045"},"rId":"0:1:1","actorId":"IDCS","ssoIdentityProvider":"localIDP","timestamp":"2018-05-11T16:47:22.688Z","idcsLastModifiedBy":{"value":"IDCS","display":"username@example.com","type":"User","$ref":"https://tenant-base-url/admin/v1/Users/IDCS"},"quotaCount":0,"ssoPolicyObligations":"effect:ALLOW,authenticationFactor:IDP,allowUserToSkip2FAEnrolment:false,2FAFrequency:SESSION,reAuthenticate:false,trustedDevice2FAFrequency:","ecId":"iigF90d0000000000","clientIp":"10.xxx.xxx.xx","ssoComments":"Authentication failure You entered an incorrect user name or password.","eventId":"sso.authentication.failure","ssoAuthnLevel":0,"ssoUserAgent":"PostmanRuntime/7.1.1","reasonValue":"SSO-1001","actorType":"User","serviceName":"SSO","message":"Authentication failure You entered an incorrect user name or password.","schemas":["urn:ietf:params:scim:schemas:oracle:idcs:AuditEvent"]}],"startIndex":1,"itemsPerPage":50}