Identity & Access Security API
Analyze abnormal authentication patterns, impossible travel, session-hijacking signals, MFA fatigue, account sharing, access-policy conflicts, dormant-account risk, and service-account anomalies—using caller-supplied auth logs, access events, and policy exports with local time/geo/behavioural rules only.
Identify abnormal authentication patterns from caller-supplied logs using local time-window correlation. VPN/proxy/shared-network labels reduce confidence. Never proof of compromise from a single login.
Detect geographically inconsistent logins from supplied timestamps and locations. Accounts for VPN/proxy/shared networks and legitimate-travel labels; a single unusual pair is not proof of compromise.
Identify suspicious session changes and reuse patterns from caller-supplied session, device, IP, and user-agent fields. Indicators only—not confirmed hijacking.
Detect repeated MFA push/challenge patterns from caller-supplied MFA events that may indicate an MFA fatigue attack. Not confirmation of account takeover.
Identify suspicious account-sharing patterns from multi-device, multi-location, and near-simultaneous authentications. Shared-network context is treated as a mitigating factor.
Detect conflicting allow/deny access rules from caller-supplied policy exports for the same principal, resource, and action.
Identify risks from inactive but enabled accounts using caller-supplied account inventory and optional recent auth events. Hygiene signal only—not confirmed compromise.
Analyze unusual service-account activity such as interactive logins, off-hours use, and high application/IP diversity from caller-supplied events.