Identity & Access Security API Documentation

POSThttps://www.brainiac.software/api/v1/identity-security/authentication-pattern-analyze$0.04 USDC

Analyze authentication patterns

Identify abnormal authentication patterns from caller-supplied logs using local time-window correlation. VPN/proxy/shared-network labels reduce confidence. Never proof of compromise from a single login.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`events`	No	array; Array
`accounts`	No	array; Array
`policies`	No	array; Array
`asOf`	No	string
`authWindowMinutes`	No	number
`mfaWindowMinutes`	No	number
`mfaPushThreshold`	No	number
`sharingWindowHours`	No	number
`dormantDays`	No	number
`maxTravelKmh`	No	number
`serviceBaselineWindowHours`	No	number

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "authWindowMinutes": 60,
  "events": [
    {
      "id": "E1",
      "at": "2026-11-04T20:00:00.000Z",
      "userId": "u1",
      "outcome": "failure",
      "ip": "203.0.113.1",
      "geoCountry": "US",
      "source": "Caller-supplied IdP export"
    },
    {
      "id": "E2",
      "at": "2026-11-04T20:01:00.000Z",
      "userId": "u1",
      "outcome": "failure",
      "ip": "203.0.113.2",
      "geoCountry": "US",
      "source": "Caller-supplied IdP export"
    },
    {
      "id": "E3",
      "at": "2026-11-04T20:02:00.000Z",
      "userId": "u1",
      "outcome": "failure",
      "ip": "198.51.100.3",
      "geoCountry": "DE",
      "source": "Caller-supplied IdP export"
    },
    {
      "id": "E4",
      "at": "2026-11-04T20:03:00.000Z",
      "userId": "u1",
      "outcome": "failure",
      "ip": "192.0.2.4",
      "geoCountry": "FR",
      "deviceId": "d2",
      "source": "Caller-supplied IdP export"
    },
    {
      "id": "E5",
      "at": "2026-11-04T20:04:00.000Z",
      "userId": "u1",
      "outcome": "failure",
      "ip": "203.0.113.5",
      "geoCountry": "BR",
      "deviceId": "d3",
      "source": "Caller-supplied IdP export"
    },
    {
      "id": "E6",
      "at": "2026-11-04T20:05:00.000Z",
      "userId": "u1",
      "outcome": "success",
      "ip": "203.0.113.5",
      "geoCountry": "BR",
      "deviceId": "d3",
      "source": "Caller-supplied IdP export"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 1,
  "windowMinutes": 60,
  "items": [
    {
      "id": "auth-pattern-u1-E1",
      "detector": "authentication-pattern-analyze",
      "title": "Abnormal authentication pattern",
      "observedFacts": [
        "5 failures within 60 minutes.",
        "Failures followed by at least one success in the same window.",
        "5 distinct source IPs in the window.",
        "4 distinct countries in the window."
      ],
      "inferredThreat": "Burst failures, fail-then-success, or high IP/device diversity can indicate credential stuffing or account probing.",
      "confidence": "high",
      "relatedEventIds": [
        "E1",
        "E2",
        "E3",
        "E4",
        "E5",
        "E6"
      ],
      "firstAt": "2026-11-04T20:00:00.000Z",
      "lastAt": "2026-11-04T20:05:00.000Z",
      "reasons": [
        "burst_failures",
        "fail_then_success",
        "many_source_ips",
        "many_countries"
      ],
      "mitigatingFactors": [],
      "evidence": [
        {
          "eventId": "E1",
          "at": "2026-11-04T20:00:00.000Z",
          "fact": "authentication outcome=failure ip=203.0.113.1 geo=US",
          "inference": "Pattern based on caller-supplied auth fields only.",
          "confidence": "medium"
        },
        {
          "eventId": "E2",
          "at": "2026-11-04T20:01:00.000Z",
          "fact": "authentication outcome=failure ip=203.0.113.2 geo=US",
          "inference": "Pattern based on caller-supplied auth fields only.",
          "confidence": "medium"
        },
        {
          "eventId": "E3",
          "at": "2026-11-04T20:02:00.000Z",
          "fact": "authentication outcome=failure ip=198.51.100.3 geo=DE",
          "inference": "Pattern based on caller-supplied auth fields only.",
          "confidence": "medium"
        },
        {
          "eventId": "E4",
          "at": "2026-11-04T20:03:00.000Z",
          "fact": "authentication outcome=failure ip=192.0.2.4 geo=FR",
          "inference": "Pattern based on caller-supplied auth fields only.",
          "confidence": "medium"
        },
        {
          "eventId": "E5",
          "at": "2026-11-04T20:04:00.000Z",
          "fact": "authentication outcome=failure ip=203.0.113.5 geo=BR",
          "inference": "Pattern based on caller-supplied auth fields only.",
          "confidence": "medium"
        },
        {
          "eventId": "E6",
          "at": "2026-11-04T20:05:00.000Z",
          "fact": "authentication outcome=success ip=203.0.113.5 geo=BR",
          "inference": "Pattern based on caller-supplied auth fields only.",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied auth events; local correlation only",
      "status": "signal",
      "confirmedCompromise": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "identityProviderConnected": false,
  "oauthUsed": false,
  "networkAccessed": false,
  "confirmedCompromiseClaimed": false,
  "findings": [
    {
      "kind": "conflict",
      "code": "auth_pattern",
      "subject": "u1",
      "detail": "Abnormal auth pattern via burst_failures, fail_then_success, many_source_ips, many_countries (confirmedCompromise=false)."
    }
  ],
  "limitations": [
    "Authentication logs, access events, accounts, and policy exports are copied only from caller-supplied fields. Identity providers are not contacted and OAuth is not used.",
    "Time correlation, geolocation comparison, and behavioural rules run locally over supplied records. Missing values are not invented.",
    "VPN, proxy, shared-network, and legitimate-travel labels reduce confidence when supplied. A single unusual login is never treated as proof of account compromise.",
    "Observed facts are separated from inferred threat hypotheses. Events are not labeled confirmed compromise without sufficient multi-signal evidence.",
    "No paid identity-threat feed is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/identity-security/authentication-pattern-analyze" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "authWindowMinutes": 60,
  "events": [
    {
      "id": "E1",
      "at": "2026-11-04T20:00:00.000Z",
      "userId": "u1",
      "outcome": "failure",
      "ip": "203.0.113.1",
      "geoCountry": "US",
      "source": "Caller-supplied IdP export"
    },
    {
      "id": "E2",
      "at": "2026-11-04T20:01:00.000Z",
      "userId": "u1",
      "outcome": "failure",
      "ip": "203.0.113.2",
      "geoCountry": "US",
      "source": "Caller-supplied IdP export"
    },
    {
      "id": "E3",
      "at": "2026-11-04T20:02:00.000Z",
      "userId": "u1",
      "outcome": "failure",
      "ip": "198.51.100.3",
      "geoCountry": "DE",
      "source": "Caller-supplied IdP export"
    },
    {
      "id": "E4",
      "at": "2026-11-04T20:03:00.000Z",
      "userId": "u1",
      "outcome": "failure",
      "ip": "192.0.2.4",
      "geoCountry": "FR",
      "deviceId": "d2",
      "source": "Caller-supplied IdP export"
    },
    {
      "id": "E5",
      "at": "2026-11-04T20:04:00.000Z",
      "userId": "u1",
      "outcome": "failure",
      "ip": "203.0.113.5",
      "geoCountry": "BR",
      "deviceId": "d3",
      "source": "Caller-supplied IdP export"
    },
    {
      "id": "E6",
      "at": "2026-11-04T20:05:00.000Z",
      "userId": "u1",
      "outcome": "success",
      "ip": "203.0.113.5",
      "geoCountry": "BR",
      "deviceId": "d3",
      "source": "Caller-supplied IdP export"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/identity-security/impossible-travel-detect$0.05 USDC

Detect impossible travel

Detect geographically inconsistent logins from supplied timestamps and locations. Accounts for VPN/proxy/shared networks and legitimate-travel labels; a single unusual pair is not proof of compromise.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`events`	No	array; Array
`accounts`	No	array; Array
`policies`	No	array; Array
`asOf`	No	string
`authWindowMinutes`	No	number
`mfaWindowMinutes`	No	number
`mfaPushThreshold`	No	number
`sharingWindowHours`	No	number
`dormantDays`	No	number
`maxTravelKmh`	No	number
`serviceBaselineWindowHours`	No	number

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "maxTravelKmh": 900,
  "events": [
    {
      "id": "E1",
      "at": "2026-11-04T12:00:00.000Z",
      "userId": "u2",
      "outcome": "success",
      "geoCountry": "US",
      "geoCity": "New York",
      "latitude": 40.71,
      "longitude": -74.01,
      "source": "Caller-supplied"
    },
    {
      "id": "E2",
      "at": "2026-11-04T13:00:00.000Z",
      "userId": "u2",
      "outcome": "success",
      "geoCountry": "JP",
      "geoCity": "Tokyo",
      "latitude": 35.68,
      "longitude": 139.69,
      "isVpn": false,
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 1,
  "maxTravelKmh": 900,
  "items": [
    {
      "id": "impossible-travel-u2-E1-E2",
      "detector": "impossible-travel-detect",
      "title": "Geographically inconsistent logins",
      "status": "signal",
      "observedFacts": [
        "Distance 10850 km over 1 hours between 2026-11-04T12:00:00.000Z and 2026-11-04T13:00:00.000Z.",
        "Implied speed ≈ 10850 km/h (threshold 900 km/h)."
      ],
      "inferredThreat": "Locations may be inconsistent with travel time; VPN/proxy/shared networks and legitimate travel can explain many cases.",
      "confidence": "medium",
      "relatedEventIds": [
        "E1",
        "E2"
      ],
      "firstAt": "2026-11-04T12:00:00.000Z",
      "lastAt": "2026-11-04T13:00:00.000Z",
      "reasons": [
        "speed_exceeds_threshold",
        "extreme_speed"
      ],
      "mitigatingFactors": [],
      "evidence": [
        {
          "eventId": "E1",
          "at": "2026-11-04T12:00:00.000Z",
          "fact": "geo=New York; ip=n/a",
          "confidence": "high"
        },
        {
          "eventId": "E2",
          "at": "2026-11-04T13:00:00.000Z",
          "fact": "geo=Tokyo; ip=n/a",
          "inference": "Geographically inconsistent relative to elapsed time.",
          "confidence": "high"
        }
      ],
      "source": "Caller-supplied locations/timestamps; local haversine/time rules",
      "confirmedCompromise": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "identityProviderConnected": false,
  "oauthUsed": false,
  "networkAccessed": false,
  "confirmedCompromiseClaimed": false,
  "findings": [
    {
      "kind": "conflict",
      "code": "impossible_travel",
      "subject": "u2",
      "detail": "Possible impossible travel via speed_exceeds_threshold, extreme_speed (confirmedCompromise=false; single pair is not proof)."
    }
  ],
  "limitations": [
    "Authentication logs, access events, accounts, and policy exports are copied only from caller-supplied fields. Identity providers are not contacted and OAuth is not used.",
    "Time correlation, geolocation comparison, and behavioural rules run locally over supplied records. Missing values are not invented.",
    "VPN, proxy, shared-network, and legitimate-travel labels reduce confidence when supplied. A single unusual login is never treated as proof of account compromise.",
    "Observed facts are separated from inferred threat hypotheses. Events are not labeled confirmed compromise without sufficient multi-signal evidence.",
    "No paid identity-threat feed is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/identity-security/impossible-travel-detect" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "maxTravelKmh": 900,
  "events": [
    {
      "id": "E1",
      "at": "2026-11-04T12:00:00.000Z",
      "userId": "u2",
      "outcome": "success",
      "geoCountry": "US",
      "geoCity": "New York",
      "latitude": 40.71,
      "longitude": -74.01,
      "source": "Caller-supplied"
    },
    {
      "id": "E2",
      "at": "2026-11-04T13:00:00.000Z",
      "userId": "u2",
      "outcome": "success",
      "geoCountry": "JP",
      "geoCity": "Tokyo",
      "latitude": 35.68,
      "longitude": 139.69,
      "isVpn": false,
      "source": "Caller-supplied"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/identity-security/session-hijacking-signal-detect$0.04 USDC

Detect session-hijacking signals

Identify suspicious session changes and reuse patterns from caller-supplied session, device, IP, and user-agent fields. Indicators only—not confirmed hijacking.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`events`	No	array; Array
`accounts`	No	array; Array
`policies`	No	array; Array
`asOf`	No	string
`authWindowMinutes`	No	number
`mfaWindowMinutes`	No	number
`mfaPushThreshold`	No	number
`sharingWindowHours`	No	number
`dormantDays`	No	number
`maxTravelKmh`	No	number
`serviceBaselineWindowHours`	No	number

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "events": [
    {
      "id": "E1",
      "at": "2026-11-04T19:00:00.000Z",
      "userId": "u3",
      "outcome": "success",
      "sessionId": "S1",
      "ip": "203.0.113.10",
      "deviceId": "laptop-1",
      "userAgent": "Chrome/120",
      "source": "Caller-supplied"
    },
    {
      "id": "E2",
      "at": "2026-11-04T19:20:00.000Z",
      "userId": "u3",
      "outcome": "success",
      "sessionId": "S1",
      "ip": "198.51.100.55",
      "deviceId": "phone-9",
      "previousDeviceId": "laptop-1",
      "userAgent": "MobileSafari/17",
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 1,
  "items": [
    {
      "id": "session-hijack-s1",
      "detector": "session-hijacking-signal-detect",
      "title": "Suspicious session change/reuse",
      "observedFacts": [
        "Session S1 has 2 related event(s).",
        "Session reused across IPs: 203.0.113.10, 198.51.100.55.",
        "Session reused across devices: laptop-1, phone-9.",
        "User-Agent changed within the same session id.",
        "Event E2 changed device from laptop-1 to phone-9."
      ],
      "inferredThreat": "Session identifiers appearing across IPs/devices/users can indicate hijacking or shared clients.",
      "confidence": "high",
      "relatedEventIds": [
        "E1",
        "E2"
      ],
      "firstAt": "2026-11-04T19:00:00.000Z",
      "lastAt": "2026-11-04T19:20:00.000Z",
      "reasons": [
        "session_ip_change",
        "session_device_change",
        "session_ua_change",
        "device_swap_on_session"
      ],
      "mitigatingFactors": [],
      "evidence": [
        {
          "eventId": "E1",
          "at": "2026-11-04T19:00:00.000Z",
          "fact": "session=S1; ip=203.0.113.10; device=laptop-1",
          "inference": "Session change/reuse indicators are not proof of hijacking alone.",
          "confidence": "medium"
        },
        {
          "eventId": "E2",
          "at": "2026-11-04T19:20:00.000Z",
          "fact": "session=S1; ip=198.51.100.55; device=phone-9",
          "inference": "Session change/reuse indicators are not proof of hijacking alone.",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied session fields; local rules only",
      "status": "signal",
      "confirmedCompromise": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "identityProviderConnected": false,
  "oauthUsed": false,
  "networkAccessed": false,
  "confirmedCompromiseClaimed": false,
  "findings": [
    {
      "kind": "conflict",
      "code": "session_hijack_signal",
      "subject": "S1",
      "detail": "Session signals: session_ip_change, session_device_change, session_ua_change, device_swap_on_session (confirmedCompromise=false)."
    }
  ],
  "limitations": [
    "Authentication logs, access events, accounts, and policy exports are copied only from caller-supplied fields. Identity providers are not contacted and OAuth is not used.",
    "Time correlation, geolocation comparison, and behavioural rules run locally over supplied records. Missing values are not invented.",
    "VPN, proxy, shared-network, and legitimate-travel labels reduce confidence when supplied. A single unusual login is never treated as proof of account compromise.",
    "Observed facts are separated from inferred threat hypotheses. Events are not labeled confirmed compromise without sufficient multi-signal evidence.",
    "No paid identity-threat feed is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/identity-security/session-hijacking-signal-detect" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "events": [
    {
      "id": "E1",
      "at": "2026-11-04T19:00:00.000Z",
      "userId": "u3",
      "outcome": "success",
      "sessionId": "S1",
      "ip": "203.0.113.10",
      "deviceId": "laptop-1",
      "userAgent": "Chrome/120",
      "source": "Caller-supplied"
    },
    {
      "id": "E2",
      "at": "2026-11-04T19:20:00.000Z",
      "userId": "u3",
      "outcome": "success",
      "sessionId": "S1",
      "ip": "198.51.100.55",
      "deviceId": "phone-9",
      "previousDeviceId": "laptop-1",
      "userAgent": "MobileSafari/17",
      "source": "Caller-supplied"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/identity-security/mfa-fatigue-detect$0.04 USDC

Detect MFA fatigue

Detect repeated MFA push/challenge patterns from caller-supplied MFA events that may indicate an MFA fatigue attack. Not confirmation of account takeover.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`events`	No	array; Array
`accounts`	No	array; Array
`policies`	No	array; Array
`asOf`	No	string
`authWindowMinutes`	No	number
`mfaWindowMinutes`	No	number
`mfaPushThreshold`	No	number
`sharingWindowHours`	No	number
`dormantDays`	No	number
`maxTravelKmh`	No	number
`serviceBaselineWindowHours`	No	number

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "mfaWindowMinutes": 10,
  "mfaPushThreshold": 5,
  "events": [
    {
      "id": "E1",
      "at": "2026-11-04T20:50:00.000Z",
      "userId": "u4",
      "eventType": "mfa_push",
      "mfaResult": "push_sent",
      "outcome": "challenge",
      "source": "Caller-supplied"
    },
    {
      "id": "E2",
      "at": "2026-11-04T20:51:00.000Z",
      "userId": "u4",
      "eventType": "mfa_push",
      "mfaResult": "denied",
      "outcome": "challenge",
      "source": "Caller-supplied"
    },
    {
      "id": "E3",
      "at": "2026-11-04T20:52:00.000Z",
      "userId": "u4",
      "eventType": "mfa_push",
      "mfaResult": "timeout",
      "outcome": "challenge",
      "source": "Caller-supplied"
    },
    {
      "id": "E4",
      "at": "2026-11-04T20:53:00.000Z",
      "userId": "u4",
      "eventType": "mfa_push",
      "mfaResult": "push_sent",
      "outcome": "challenge",
      "source": "Caller-supplied"
    },
    {
      "id": "E5",
      "at": "2026-11-04T20:54:00.000Z",
      "userId": "u4",
      "eventType": "mfa_push",
      "mfaResult": "push_sent",
      "outcome": "challenge",
      "source": "Caller-supplied"
    },
    {
      "id": "E6",
      "at": "2026-11-04T20:55:00.000Z",
      "userId": "u4",
      "eventType": "mfa_push",
      "mfaResult": "approved",
      "outcome": "success",
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 1,
  "windowMinutes": 10,
  "pushThreshold": 5,
  "items": [
    {
      "id": "mfa-fatigue-u4-E1",
      "detector": "mfa-fatigue-detect",
      "title": "Possible MFA fatigue pattern",
      "observedFacts": [
        "5 MFA challenge/push/deny/timeout events within 10 minutes (threshold 5).",
        "1 MFA approval/success event(s) occurred in the same window."
      ],
      "inferredThreat": "Repeated MFA pushes may pressure a user into approving a malicious login.",
      "confidence": "high",
      "relatedEventIds": [
        "E1",
        "E2",
        "E3",
        "E4",
        "E5",
        "E6"
      ],
      "firstAt": "2026-11-04T20:50:00.000Z",
      "lastAt": "2026-11-04T20:55:00.000Z",
      "reasons": [
        "repeated_mfa_prompts",
        "prompt_then_approval"
      ],
      "mitigatingFactors": [],
      "evidence": [
        {
          "eventId": "E1",
          "at": "2026-11-04T20:50:00.000Z",
          "fact": "mfaResult=push_sent; outcome=challenge; method=n/a",
          "inference": "Repeated MFA prompts can indicate MFA fatigue; not confirmed compromise by themselves.",
          "confidence": "medium"
        },
        {
          "eventId": "E2",
          "at": "2026-11-04T20:51:00.000Z",
          "fact": "mfaResult=denied; outcome=challenge; method=n/a",
          "inference": "Repeated MFA prompts can indicate MFA fatigue; not confirmed compromise by themselves.",
          "confidence": "medium"
        },
        {
          "eventId": "E3",
          "at": "2026-11-04T20:52:00.000Z",
          "fact": "mfaResult=timeout; outcome=challenge; method=n/a",
          "inference": "Repeated MFA prompts can indicate MFA fatigue; not confirmed compromise by themselves.",
          "confidence": "medium"
        },
        {
          "eventId": "E4",
          "at": "2026-11-04T20:53:00.000Z",
          "fact": "mfaResult=push_sent; outcome=challenge; method=n/a",
          "inference": "Repeated MFA prompts can indicate MFA fatigue; not confirmed compromise by themselves.",
          "confidence": "medium"
        },
        {
          "eventId": "E5",
          "at": "2026-11-04T20:54:00.000Z",
          "fact": "mfaResult=push_sent; outcome=challenge; method=n/a",
          "inference": "Repeated MFA prompts can indicate MFA fatigue; not confirmed compromise by themselves.",
          "confidence": "medium"
        },
        {
          "eventId": "E6",
          "at": "2026-11-04T20:55:00.000Z",
          "fact": "mfaResult=approved; outcome=success; method=n/a",
          "inference": "Repeated MFA prompts can indicate MFA fatigue; not confirmed compromise by themselves.",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied MFA events; local time-window rules",
      "status": "signal",
      "confirmedCompromise": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "identityProviderConnected": false,
  "oauthUsed": false,
  "networkAccessed": false,
  "confirmedCompromiseClaimed": false,
  "findings": [
    {
      "kind": "conflict",
      "code": "mfa_fatigue",
      "subject": "u4",
      "detail": "MFA fatigue indicators: repeated_mfa_prompts, prompt_then_approval (confirmedCompromise=false)."
    }
  ],
  "limitations": [
    "Authentication logs, access events, accounts, and policy exports are copied only from caller-supplied fields. Identity providers are not contacted and OAuth is not used.",
    "Time correlation, geolocation comparison, and behavioural rules run locally over supplied records. Missing values are not invented.",
    "VPN, proxy, shared-network, and legitimate-travel labels reduce confidence when supplied. A single unusual login is never treated as proof of account compromise.",
    "Observed facts are separated from inferred threat hypotheses. Events are not labeled confirmed compromise without sufficient multi-signal evidence.",
    "No paid identity-threat feed is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/identity-security/mfa-fatigue-detect" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "mfaWindowMinutes": 10,
  "mfaPushThreshold": 5,
  "events": [
    {
      "id": "E1",
      "at": "2026-11-04T20:50:00.000Z",
      "userId": "u4",
      "eventType": "mfa_push",
      "mfaResult": "push_sent",
      "outcome": "challenge",
      "source": "Caller-supplied"
    },
    {
      "id": "E2",
      "at": "2026-11-04T20:51:00.000Z",
      "userId": "u4",
      "eventType": "mfa_push",
      "mfaResult": "denied",
      "outcome": "challenge",
      "source": "Caller-supplied"
    },
    {
      "id": "E3",
      "at": "2026-11-04T20:52:00.000Z",
      "userId": "u4",
      "eventType": "mfa_push",
      "mfaResult": "timeout",
      "outcome": "challenge",
      "source": "Caller-supplied"
    },
    {
      "id": "E4",
      "at": "2026-11-04T20:53:00.000Z",
      "userId": "u4",
      "eventType": "mfa_push",
      "mfaResult": "push_sent",
      "outcome": "challenge",
      "source": "Caller-supplied"
    },
    {
      "id": "E5",
      "at": "2026-11-04T20:54:00.000Z",
      "userId": "u4",
      "eventType": "mfa_push",
      "mfaResult": "push_sent",
      "outcome": "challenge",
      "source": "Caller-supplied"
    },
    {
      "id": "E6",
      "at": "2026-11-04T20:55:00.000Z",
      "userId": "u4",
      "eventType": "mfa_push",
      "mfaResult": "approved",
      "outcome": "success",
      "source": "Caller-supplied"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/identity-security/account-sharing-detect$0.04 USDC

Detect account sharing

Identify suspicious account-sharing patterns from multi-device, multi-location, and near-simultaneous authentications. Shared-network context is treated as a mitigating factor.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`events`	No	array; Array
`accounts`	No	array; Array
`policies`	No	array; Array
`asOf`	No	string
`authWindowMinutes`	No	number
`mfaWindowMinutes`	No	number
`mfaPushThreshold`	No	number
`sharingWindowHours`	No	number
`dormantDays`	No	number
`maxTravelKmh`	No	number
`serviceBaselineWindowHours`	No	number

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "sharingWindowHours": 24,
  "events": [
    {
      "id": "E1",
      "at": "2026-11-04T10:00:00.000Z",
      "userId": "u5",
      "outcome": "success",
      "deviceId": "d1",
      "geoCity": "Austin",
      "geoCountry": "US",
      "userAgent": "Chrome/120",
      "source": "Caller-supplied"
    },
    {
      "id": "E2",
      "at": "2026-11-04T10:05:00.000Z",
      "userId": "u5",
      "outcome": "success",
      "deviceId": "d2",
      "geoCity": "Dallas",
      "geoCountry": "US",
      "userAgent": "Firefox/121",
      "source": "Caller-supplied"
    },
    {
      "id": "E3",
      "at": "2026-11-04T18:00:00.000Z",
      "userId": "u5",
      "outcome": "success",
      "deviceId": "d3",
      "geoCity": "Chicago",
      "geoCountry": "US",
      "userAgent": "Edge/120",
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 1,
  "windowHours": 24,
  "items": [
    {
      "id": "account-sharing-u5",
      "detector": "account-sharing-detect",
      "title": "Suspicious account-sharing pattern",
      "observedFacts": [
        "3 devices used by the same account within 24 hours.",
        "Distinct devices authenticated within 15 minutes of each other.",
        "Account active from 3 locations and 3 devices."
      ],
      "inferredThreat": "Multiple devices/locations for one account may indicate credential sharing.",
      "confidence": "high",
      "relatedEventIds": [
        "E1",
        "E2",
        "E3"
      ],
      "firstAt": "2026-11-04T10:00:00.000Z",
      "lastAt": "2026-11-04T18:00:00.000Z",
      "reasons": [
        "many_devices_same_account",
        "near_simultaneous_distinct_devices",
        "multi_location_multi_device"
      ],
      "mitigatingFactors": [],
      "evidence": [
        {
          "eventId": "E1",
          "at": "2026-11-04T10:00:00.000Z",
          "fact": "device=d1; geo=Austin; ua=Chrome/120",
          "inference": "Concurrent/diverse device use can indicate sharing or roaming; not proof of compromise.",
          "confidence": "medium"
        },
        {
          "eventId": "E2",
          "at": "2026-11-04T10:05:00.000Z",
          "fact": "device=d2; geo=Dallas; ua=Firefox/121",
          "inference": "Concurrent/diverse device use can indicate sharing or roaming; not proof of compromise.",
          "confidence": "medium"
        },
        {
          "eventId": "E3",
          "at": "2026-11-04T18:00:00.000Z",
          "fact": "device=d3; geo=Chicago; ua=Edge/120",
          "inference": "Concurrent/diverse device use can indicate sharing or roaming; not proof of compromise.",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied auth events; local behavioural rules",
      "status": "signal",
      "confirmedCompromise": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "identityProviderConnected": false,
  "oauthUsed": false,
  "networkAccessed": false,
  "confirmedCompromiseClaimed": false,
  "findings": [
    {
      "kind": "conflict",
      "code": "account_sharing",
      "subject": "u5",
      "detail": "Account-sharing indicators: many_devices_same_account, near_simultaneous_distinct_devices, multi_location_multi_device (confirmedCompromise=false)."
    }
  ],
  "limitations": [
    "Authentication logs, access events, accounts, and policy exports are copied only from caller-supplied fields. Identity providers are not contacted and OAuth is not used.",
    "Time correlation, geolocation comparison, and behavioural rules run locally over supplied records. Missing values are not invented.",
    "VPN, proxy, shared-network, and legitimate-travel labels reduce confidence when supplied. A single unusual login is never treated as proof of account compromise.",
    "Observed facts are separated from inferred threat hypotheses. Events are not labeled confirmed compromise without sufficient multi-signal evidence.",
    "No paid identity-threat feed is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/identity-security/account-sharing-detect" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "sharingWindowHours": 24,
  "events": [
    {
      "id": "E1",
      "at": "2026-11-04T10:00:00.000Z",
      "userId": "u5",
      "outcome": "success",
      "deviceId": "d1",
      "geoCity": "Austin",
      "geoCountry": "US",
      "userAgent": "Chrome/120",
      "source": "Caller-supplied"
    },
    {
      "id": "E2",
      "at": "2026-11-04T10:05:00.000Z",
      "userId": "u5",
      "outcome": "success",
      "deviceId": "d2",
      "geoCity": "Dallas",
      "geoCountry": "US",
      "userAgent": "Firefox/121",
      "source": "Caller-supplied"
    },
    {
      "id": "E3",
      "at": "2026-11-04T18:00:00.000Z",
      "userId": "u5",
      "outcome": "success",
      "deviceId": "d3",
      "geoCity": "Chicago",
      "geoCountry": "US",
      "userAgent": "Edge/120",
      "source": "Caller-supplied"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/identity-security/access-policy-conflict-detect$0.03 USDC

Detect access-policy conflicts

Detect conflicting allow/deny access rules from caller-supplied policy exports for the same principal, resource, and action.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`events`	No	array; Array
`accounts`	No	array; Array
`policies`	No	array; Array
`asOf`	No	string
`authWindowMinutes`	No	number
`mfaWindowMinutes`	No	number
`mfaPushThreshold`	No	number
`sharingWindowHours`	No	number
`dormantDays`	No	number
`maxTravelKmh`	No	number
`serviceBaselineWindowHours`	No	number

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "policies": [
    {
      "id": "P1",
      "principal": "role:finance",
      "resource": "app:payroll",
      "action": "read",
      "effect": "allow",
      "priority": 100,
      "source": "Caller-supplied IAM export"
    },
    {
      "id": "P2",
      "principal": "role:finance",
      "resource": "app:payroll",
      "action": "read",
      "effect": "deny",
      "priority": 100,
      "source": "Caller-supplied IAM export"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 1,
  "items": [
    {
      "id": "policy-conflict-P1-P2",
      "detector": "access-policy-conflict-detect",
      "title": "Conflicting access policy rules",
      "observedFacts": [
        "Rules P1 (allow) and P2 (deny) target the same principal/resource/action.",
        "Conflicting effects share priority 100."
      ],
      "inferredThreat": "Conflicting allow/deny rules can create unintended access or deny outcomes.",
      "confidence": "high",
      "relatedEventIds": [
        "P1",
        "P2"
      ],
      "firstAt": "2026-11-04T21:00:00.000Z",
      "lastAt": "2026-11-04T21:00:00.000Z",
      "reasons": [
        "allow_deny_conflict",
        "equal_priority_conflict"
      ],
      "mitigatingFactors": [],
      "evidence": [
        {
          "eventId": "P1",
          "at": "2026-11-04T21:00:00.000Z",
          "fact": "allow role:finance read app:payroll priority=100",
          "confidence": "high"
        },
        {
          "eventId": "P2",
          "at": "2026-11-04T21:00:00.000Z",
          "fact": "deny role:finance read app:payroll priority=100",
          "inference": "Conflict derived from caller-supplied policy export only.",
          "confidence": "high"
        }
      ],
      "source": "Caller-supplied policy export; local comparison only",
      "status": "signal",
      "confirmedCompromise": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "identityProviderConnected": false,
  "oauthUsed": false,
  "networkAccessed": false,
  "confirmedCompromiseClaimed": false,
  "findings": [
    {
      "kind": "conflict",
      "code": "policy_conflict",
      "subject": "P1:P2",
      "detail": "Policy conflict via allow_deny_conflict, equal_priority_conflict."
    }
  ],
  "limitations": [
    "Authentication logs, access events, accounts, and policy exports are copied only from caller-supplied fields. Identity providers are not contacted and OAuth is not used.",
    "Time correlation, geolocation comparison, and behavioural rules run locally over supplied records. Missing values are not invented.",
    "VPN, proxy, shared-network, and legitimate-travel labels reduce confidence when supplied. A single unusual login is never treated as proof of account compromise.",
    "Observed facts are separated from inferred threat hypotheses. Events are not labeled confirmed compromise without sufficient multi-signal evidence.",
    "No paid identity-threat feed is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/identity-security/access-policy-conflict-detect" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "policies": [
    {
      "id": "P1",
      "principal": "role:finance",
      "resource": "app:payroll",
      "action": "read",
      "effect": "allow",
      "priority": 100,
      "source": "Caller-supplied IAM export"
    },
    {
      "id": "P2",
      "principal": "role:finance",
      "resource": "app:payroll",
      "action": "read",
      "effect": "deny",
      "priority": 100,
      "source": "Caller-supplied IAM export"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/identity-security/dormant-account-risk-detect$0.03 USDC

Detect dormant-account risk

Identify risks from inactive but enabled accounts using caller-supplied account inventory and optional recent auth events. Hygiene signal only—not confirmed compromise.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`events`	No	array; Array
`accounts`	No	array; Array
`policies`	No	array; Array
`asOf`	No	string
`authWindowMinutes`	No	number
`mfaWindowMinutes`	No	number
`mfaPushThreshold`	No	number
`sharingWindowHours`	No	number
`dormantDays`	No	number
`maxTravelKmh`	No	number
`serviceBaselineWindowHours`	No	number

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "dormantDays": 90,
  "accounts": [
    {
      "id": "A1",
      "userId": "u6",
      "username": "old.admin",
      "accountType": "user",
      "createdAt": "2024-01-01T00:00:00.000Z",
      "lastLoginAt": "2026-05-01T00:00:00.000Z",
      "lastActivityAt": "2026-05-01T00:00:00.000Z",
      "isPrivileged": true,
      "isDisabled": false,
      "source": "Caller-supplied directory export"
    }
  ],
  "events": [
    {
      "id": "E1",
      "at": "2026-11-03T20:00:00.000Z",
      "userId": "u6",
      "outcome": "success",
      "ip": "203.0.113.80",
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 1,
  "dormantDays": 90,
  "items": [
    {
      "id": "dormant-A1",
      "detector": "dormant-account-risk-detect",
      "title": "Dormant account risk",
      "observedFacts": [
        "Last activity 187 days before asOf (threshold 90).",
        "Account is marked privileged.",
        "Account is not disabled.",
        "Successful authentication occurred after a long idle period."
      ],
      "inferredThreat": "Inactive but enabled accounts increase takeover and privilege-abuse risk.",
      "confidence": "high",
      "relatedEventIds": [
        "A1",
        "E1"
      ],
      "firstAt": "2024-01-01T00:00:00.000Z",
      "lastAt": "2026-11-03T20:00:00.000Z",
      "reasons": [
        "inactive_beyond_threshold",
        "privileged_dormant",
        "still_enabled",
        "sudden_reactivation"
      ],
      "mitigatingFactors": [],
      "evidence": [
        {
          "eventId": "A1",
          "at": "2026-05-01T00:00:00.000Z",
          "fact": "type=user; privileged=true; disabled=false; last=2026-05-01T00:00:00.000Z",
          "inference": "Dormant-account risk is a hygiene signal, not proof of compromise.",
          "confidence": "medium"
        },
        {
          "eventId": "E1",
          "at": "2026-11-03T20:00:00.000Z",
          "fact": "Recent authentication outcome=success",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied directory export",
      "status": "signal",
      "confirmedCompromise": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "identityProviderConnected": false,
  "oauthUsed": false,
  "networkAccessed": false,
  "confirmedCompromiseClaimed": false,
  "findings": [
    {
      "kind": "conflict",
      "code": "dormant_account",
      "subject": "A1",
      "detail": "Dormant-account indicators: inactive_beyond_threshold, privileged_dormant, still_enabled, sudden_reactivation (confirmedCompromise=false)."
    }
  ],
  "limitations": [
    "Authentication logs, access events, accounts, and policy exports are copied only from caller-supplied fields. Identity providers are not contacted and OAuth is not used.",
    "Time correlation, geolocation comparison, and behavioural rules run locally over supplied records. Missing values are not invented.",
    "VPN, proxy, shared-network, and legitimate-travel labels reduce confidence when supplied. A single unusual login is never treated as proof of account compromise.",
    "Observed facts are separated from inferred threat hypotheses. Events are not labeled confirmed compromise without sufficient multi-signal evidence.",
    "No paid identity-threat feed is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/identity-security/dormant-account-risk-detect" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "dormantDays": 90,
  "accounts": [
    {
      "id": "A1",
      "userId": "u6",
      "username": "old.admin",
      "accountType": "user",
      "createdAt": "2024-01-01T00:00:00.000Z",
      "lastLoginAt": "2026-05-01T00:00:00.000Z",
      "lastActivityAt": "2026-05-01T00:00:00.000Z",
      "isPrivileged": true,
      "isDisabled": false,
      "source": "Caller-supplied directory export"
    }
  ],
  "events": [
    {
      "id": "E1",
      "at": "2026-11-03T20:00:00.000Z",
      "userId": "u6",
      "outcome": "success",
      "ip": "203.0.113.80",
      "source": "Caller-supplied"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/identity-security/service-account-anomaly-detect$0.04 USDC

Detect service-account anomalies

Analyze unusual service-account activity such as interactive logins, off-hours use, and high application/IP diversity from caller-supplied events.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`events`	No	array; Array
`accounts`	No	array; Array
`policies`	No	array; Array
`asOf`	No	string
`authWindowMinutes`	No	number
`mfaWindowMinutes`	No	number
`mfaPushThreshold`	No	number
`sharingWindowHours`	No	number
`dormantDays`	No	number
`maxTravelKmh`	No	number
`serviceBaselineWindowHours`	No	number

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "events": [
    {
      "id": "E1",
      "at": "2026-11-04T02:10:00.000Z",
      "userId": "svc-backup",
      "username": "svc-backup",
      "accountType": "service",
      "eventType": "interactive_login",
      "outcome": "success",
      "ip": "203.0.113.10",
      "application": "console",
      "userAgent": "Mozilla/5.0",
      "deviceId": "admin-laptop",
      "source": "Caller-supplied"
    },
    {
      "id": "E2",
      "at": "2026-11-04T03:00:00.000Z",
      "userId": "svc-backup",
      "accountType": "service",
      "eventType": "authentication",
      "outcome": "success",
      "ip": "198.51.100.20",
      "application": "s3",
      "source": "Caller-supplied"
    },
    {
      "id": "E3",
      "at": "2026-11-04T03:30:00.000Z",
      "userId": "svc-backup",
      "accountType": "service",
      "eventType": "authentication",
      "outcome": "failure",
      "ip": "192.0.2.30",
      "application": "github",
      "source": "Caller-supplied"
    },
    {
      "id": "E4",
      "at": "2026-11-04T04:00:00.000Z",
      "userId": "svc-backup",
      "accountType": "service",
      "eventType": "authentication",
      "outcome": "success",
      "ip": "203.0.113.40",
      "application": "vpn",
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 1,
  "baselineWindowHours": 168,
  "items": [
    {
      "id": "service-anomaly-svc_backup",
      "detector": "service-account-anomaly-detect",
      "title": "Unusual service account activity",
      "observedFacts": [
        "4 events outside 05:00–22:00 UTC.",
        "1 interactive-style login(s) for a service account.",
        "Service account touched 4 applications/resources.",
        "4 source IPs for service account activity."
      ],
      "inferredThreat": "Service accounts used interactively or across many apps/IPs can indicate misuse or credential theft.",
      "confidence": "high",
      "relatedEventIds": [
        "E1",
        "E2",
        "E3",
        "E4"
      ],
      "firstAt": "2026-11-04T02:10:00.000Z",
      "lastAt": "2026-11-04T04:00:00.000Z",
      "reasons": [
        "off_hours_activity",
        "interactive_service_login",
        "many_applications",
        "many_source_ips",
        "human_client_fingerprint"
      ],
      "mitigatingFactors": [],
      "evidence": [
        {
          "eventId": "E1",
          "at": "2026-11-04T02:10:00.000Z",
          "fact": "interactive_login outcome=success; app=console; ip=203.0.113.10",
          "inference": "Service-account anomaly is behavioural only; not confirmed compromise.",
          "confidence": "medium"
        },
        {
          "eventId": "E2",
          "at": "2026-11-04T03:00:00.000Z",
          "fact": "authentication outcome=success; app=s3; ip=198.51.100.20",
          "inference": "Service-account anomaly is behavioural only; not confirmed compromise.",
          "confidence": "medium"
        },
        {
          "eventId": "E3",
          "at": "2026-11-04T03:30:00.000Z",
          "fact": "authentication outcome=failure; app=github; ip=192.0.2.30",
          "inference": "Service-account anomaly is behavioural only; not confirmed compromise.",
          "confidence": "medium"
        },
        {
          "eventId": "E4",
          "at": "2026-11-04T04:00:00.000Z",
          "fact": "authentication outcome=success; app=vpn; ip=203.0.113.40",
          "inference": "Service-account anomaly is behavioural only; not confirmed compromise.",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied service-account events; local behavioural rules",
      "status": "signal",
      "confirmedCompromise": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "identityProviderConnected": false,
  "oauthUsed": false,
  "networkAccessed": false,
  "confirmedCompromiseClaimed": false,
  "findings": [
    {
      "kind": "conflict",
      "code": "service_account_anomaly",
      "subject": "svc_backup",
      "detail": "Service-account anomalies: off_hours_activity, interactive_service_login, many_applications, many_source_ips, human_client_fingerprint (confirmedCompromise=false)."
    }
  ],
  "limitations": [
    "Authentication logs, access events, accounts, and policy exports are copied only from caller-supplied fields. Identity providers are not contacted and OAuth is not used.",
    "Time correlation, geolocation comparison, and behavioural rules run locally over supplied records. Missing values are not invented.",
    "VPN, proxy, shared-network, and legitimate-travel labels reduce confidence when supplied. A single unusual login is never treated as proof of account compromise.",
    "Observed facts are separated from inferred threat hypotheses. Events are not labeled confirmed compromise without sufficient multi-signal evidence.",
    "No paid identity-threat feed is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/identity-security/service-account-anomaly-detect" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "events": [
    {
      "id": "E1",
      "at": "2026-11-04T02:10:00.000Z",
      "userId": "svc-backup",
      "username": "svc-backup",
      "accountType": "service",
      "eventType": "interactive_login",
      "outcome": "success",
      "ip": "203.0.113.10",
      "application": "console",
      "userAgent": "Mozilla/5.0",
      "deviceId": "admin-laptop",
      "source": "Caller-supplied"
    },
    {
      "id": "E2",
      "at": "2026-11-04T03:00:00.000Z",
      "userId": "svc-backup",
      "accountType": "service",
      "eventType": "authentication",
      "outcome": "success",
      "ip": "198.51.100.20",
      "application": "s3",
      "source": "Caller-supplied"
    },
    {
      "id": "E3",
      "at": "2026-11-04T03:30:00.000Z",
      "userId": "svc-backup",
      "accountType": "service",
      "eventType": "authentication",
      "outcome": "failure",
      "ip": "192.0.2.30",
      "application": "github",
      "source": "Caller-supplied"
    },
    {
      "id": "E4",
      "at": "2026-11-04T04:00:00.000Z",
      "userId": "svc-backup",
      "accountType": "service",
      "eventType": "authentication",
      "outcome": "success",
      "ip": "203.0.113.40",
      "application": "vpn",
      "source": "Caller-supplied"
    }
  ]
}
JSON