Get security metrics
const url = 'http://localhost:8000/clusters/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/insights/security?realm=customer-portal';
const options = {
method: 'GET',
headers: {'API-Version': '2026-06-01.beta', 'API-Key': '<API-Key>'}
};
try {
const response = await fetch(url, options);
const data = await response.json();
console.log(data);
} catch (error) {
console.error(error);
}curl --request GET \
--url 'http://localhost:8000/clusters/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/insights/security?realm=customer-portal' \
--header 'API-Key: <API-Key>' \
--header 'API-Version: 2026-06-01.beta'Returns failed login and brute-force attempt time series, along with ranked lists of IP addresses and user accounts with the most failures in the requested window.
When neither start_time nor end_time is provided the window covers the last 24 hours.
Required scope: clusters:insights:read
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”Query Parameters
Section titled “Query Parameters”Keycloak realm name (not ID). Must start with a letter; allows letters, digits, and hyphens.
Example
customer-portalRestrict metrics to a specific realm.
Inclusive start time (ISO 8601). Defaults to 24 hours ago when omitted.
Inclusive end time (ISO 8601). Defaults to the current time when omitted.
Header Parameters
Section titled “Header Parameters”Responses
Section titled “Responses”The request has succeeded.
Authentication security metrics over the requested time window.
object
object
object
object
object
IP addresses ranked by failed login count within the window.
An IP address with notable authentication failure activity.
object
Number of failed login attempts from this IP in the time window.
ISO 3166-1 alpha-2 country code resolved from the IP, when available.
User accounts ranked by failed login count within the window.
Authentication failure statistics for a single user account.
object
Aggregate Keycloak security event time series.
object
object
Example
{
"suspicious_ips": [
{
"country": "US"
}
]
}The server could not understand the request due to invalid syntax.
RFC 9457 Problem Details object.
object
Example generated
{
"type": "https://example.com",
"title": "example",
"status": 1,
"detail": "example",
"instance": "https://example.com"
}Access is unauthorized.
RFC 9457 Problem Details object.
object
Example generated
{
"type": "https://example.com",
"title": "example",
"status": 1,
"detail": "example",
"instance": "https://example.com"
}Access is forbidden.
RFC 9457 Problem Details object.
object
Example generated
{
"type": "https://example.com",
"title": "example",
"status": 1,
"detail": "example",
"instance": "https://example.com"
}The server cannot find the requested resource.
RFC 9457 Problem Details object.
object
Example generated
{
"type": "https://example.com",
"title": "example",
"status": 1,
"detail": "example",
"instance": "https://example.com"
}Client error
object
object
Example generated
{
"type": "https://example.com",
"title": "example",
"status": 1,
"detail": "example",
"instance": "https://example.com",
"errors": [
{
"field": "example",
"detail": "example",
"code": "example",
"value": "example"
}
]
}Client error
RFC 9457 Problem Details object.
object
Example generated
{
"type": "https://example.com",
"title": "example",
"status": 1,
"detail": "example",
"instance": "https://example.com"
}Headers
Section titled “Headers”Server error
RFC 9457 Problem Details object.
object
Example generated
{
"type": "https://example.com",
"title": "example",
"status": 1,
"detail": "example",
"instance": "https://example.com"
}Server error
RFC 9457 Problem Details object.
object
Example generated
{
"type": "https://example.com",
"title": "example",
"status": 1,
"detail": "example",
"instance": "https://example.com"
}