{"openapi":"3.1.0","info":{"title":"Identity & Access Security API","version":"1.0.0","description":"Analyze abnormal authentication patterns, impossible travel, session-hijacking signals, MFA fatigue, account sharing, access-policy conflicts, dormant-account risk, and service-account anomalies—using caller-supplied auth logs, access events, and policy exports with local time/geo/behavioural rules only. Paid with x402 exact USDC on Base. No account is required.","contact":{"email":"support@brainiac.software"},"x-guidance":"BRAINIAC.software is a pay-per-call API for software agents. No account or API key is required.\nPayment uses the x402 protocol with exact USDC on Base (chain id 8453). Each POST operation has a fixed USD price.\nHow to call an operation:\n1. POST a JSON body matching the operation's requestBody schema to the operation path. Include an Idempotency-Key header (64 hex characters, 32 random bytes).\n2. If you have not paid, the server responds 402 with payment requirements in the body. Pay the exact amount to the payTo address on Base.\n3. Retry the identical request with the same Idempotency-Key and add a payment-signature header containing the x402 payment payload. On success (200) the operation result is returned.\n4. Reuse the same Idempotency-Key only for retries of the same operation and request body; it will not be charged twice.\nAll outputs are compliance prechecks, drafts, or data lookups for human review. They are not official determinations, legal advice, identity confirmation, or certified filings. Verify time-sensitive or official data with the cited source before acting."},"servers":[{"url":"https://www.brainiac.software"}],"paths":{"/api/v1/identity-security/authentication-pattern-analyze":{"post":{"operationId":"analyze_authentication_patterns","summary":"Analyze authentication patterns","description":"Identify abnormal authentication patterns from caller-supplied logs using local time-window correlation. VPN/proxy/shared-network labels reduce confidence. Never proof of compromise from a single login.","tags":["identity-security"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false},"files":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false}},"events":{"maxItems":20000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"at":{"type":"string","maxLength":40},"userId":{"type":"string","maxLength":120},"username":{"type":"string","maxLength":120},"accountType":{"type":"string","enum":["user","service","unknown"]},"eventType":{"type":"string","maxLength":120},"outcome":{"type":"string","enum":["success","failure","challenge","unknown"]},"ip":{"type":"string","maxLength":80},"geoCountry":{"type":"string","maxLength":80},"geoCity":{"type":"string","maxLength":120},"latitude":{"type":"number","minimum":-90,"maximum":90},"longitude":{"type":"number","minimum":-180,"maximum":180},"asn":{"type":"string","maxLength":80},"isVpn":{"type":"boolean"},"isProxy":{"type":"boolean"},"isSharedNetwork":{"type":"boolean"},"deviceId":{"type":"string","maxLength":120},"previousDeviceId":{"type":"string","maxLength":120},"sessionId":{"type":"string","maxLength":160},"previousSessionId":{"type":"string","maxLength":160},"userAgent":{"type":"string","maxLength":500},"previousUserAgent":{"type":"string","maxLength":500},"mfaMethod":{"type":"string","maxLength":80},"mfaResult":{"type":"string","enum":["approved","denied","timeout","push_sent","unknown"]},"application":{"type":"string","maxLength":160},"resource":{"type":"string","maxLength":300},"action":{"type":"string","maxLength":120},"labels":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"accounts":{"maxItems":20000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"userId":{"type":"string","maxLength":120},"username":{"type":"string","maxLength":120},"accountType":{"type":"string","enum":["user","service","unknown"]},"createdAt":{"type":"string","maxLength":40},"lastLoginAt":{"type":"string","maxLength":40},"lastActivityAt":{"type":"string","maxLength":40},"isPrivileged":{"type":"boolean"},"isDisabled":{"type":"boolean"},"owner":{"type":"string","maxLength":160},"labels":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"policies":{"maxItems":20000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"principal":{"type":"string","maxLength":200},"resource":{"type":"string","maxLength":300},"action":{"type":"string","maxLength":120},"effect":{"type":"string","enum":["allow","deny"]},"priority":{"type":"number","minimum":-1000000,"maximum":1000000},"conditions":{"type":"string","maxLength":2000},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"asOf":{"type":"string","maxLength":40},"authWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"mfaWindowMinutes":{"type":"number","minimum":1,"maximum":1440},"mfaPushThreshold":{"type":"number","minimum":2,"maximum":1000},"sharingWindowHours":{"type":"number","minimum":1,"maximum":720},"dormantDays":{"type":"number","minimum":1,"maximum":3650},"maxTravelKmh":{"type":"number","minimum":50,"maximum":2000},"serviceBaselineWindowHours":{"type":"number","minimum":1,"maximum":2160}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","authWindowMinutes":60,"events":[{"id":"E1","at":"2026-11-04T20:00:00.000Z","userId":"u1","outcome":"failure","ip":"203.0.113.1","geoCountry":"US","source":"Caller-supplied IdP export"},{"id":"E2","at":"2026-11-04T20:01:00.000Z","userId":"u1","outcome":"failure","ip":"203.0.113.2","geoCountry":"US","source":"Caller-supplied IdP export"},{"id":"E3","at":"2026-11-04T20:02:00.000Z","userId":"u1","outcome":"failure","ip":"198.51.100.3","geoCountry":"DE","source":"Caller-supplied IdP export"},{"id":"E4","at":"2026-11-04T20:03:00.000Z","userId":"u1","outcome":"failure","ip":"192.0.2.4","geoCountry":"FR","deviceId":"d2","source":"Caller-supplied IdP export"},{"id":"E5","at":"2026-11-04T20:04:00.000Z","userId":"u1","outcome":"failure","ip":"203.0.113.5","geoCountry":"BR","deviceId":"d3","source":"Caller-supplied IdP export"},{"id":"E6","at":"2026-11-04T20:05:00.000Z","userId":"u1","outcome":"success","ip":"203.0.113.5","geoCountry":"BR","deviceId":"d3","source":"Caller-supplied IdP export"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"itemCount":{"type":"number"},"windowMinutes":{"type":"number"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confidence":{"type":"string"},"relatedEventIds":{"type":"array","items":{"type":"string"}},"firstAt":{"type":"string"},"lastAt":{"type":"string"},"reasons":{"type":"array","items":{"type":"string"}},"mitigatingFactors":{"type":"array","items":{}},"evidence":{"type":"array","items":{"type":"object","properties":{"eventId":{"type":"string"},"at":{"type":"string"},"fact":{"type":"string"},"inference":{"type":"string"},"confidence":{"type":"string"}},"additionalProperties":true}},"source":{"type":"string"},"status":{"type":"string"},"confirmedCompromise":{"type":"boolean"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"identityProviderConnected":{"type":"boolean"},"oauthUsed":{"type":"boolean"},"networkAccessed":{"type":"boolean"},"confirmedCompromiseClaimed":{"type":"boolean"},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"detected","itemCount":1,"windowMinutes":60,"items":[{"id":"auth-pattern-u1-E1","detector":"authentication-pattern-analyze","title":"Abnormal authentication pattern","observedFacts":["5 failures within 60 minutes.","Failures followed by at least one success in the same window.","5 distinct source IPs in the window.","4 distinct countries in the window."],"inferredThreat":"Burst failures, fail-then-success, or high IP/device diversity can indicate credential stuffing or account probing.","confidence":"high","relatedEventIds":["E1","E2","E3","E4","E5","E6"],"firstAt":"2026-11-04T20:00:00.000Z","lastAt":"2026-11-04T20:05:00.000Z","reasons":["burst_failures","fail_then_success","many_source_ips","many_countries"],"mitigatingFactors":[],"evidence":[{"eventId":"E1","at":"2026-11-04T20:00:00.000Z","fact":"authentication outcome=failure ip=203.0.113.1 geo=US","inference":"Pattern based on caller-supplied auth fields only.","confidence":"medium"},{"eventId":"E2","at":"2026-11-04T20:01:00.000Z","fact":"authentication outcome=failure ip=203.0.113.2 geo=US","inference":"Pattern based on caller-supplied auth fields only.","confidence":"medium"},{"eventId":"E3","at":"2026-11-04T20:02:00.000Z","fact":"authentication outcome=failure ip=198.51.100.3 geo=DE","inference":"Pattern based on caller-supplied auth fields only.","confidence":"medium"},{"eventId":"E4","at":"2026-11-04T20:03:00.000Z","fact":"authentication outcome=failure ip=192.0.2.4 geo=FR","inference":"Pattern based on caller-supplied auth fields only.","confidence":"medium"},{"eventId":"E5","at":"2026-11-04T20:04:00.000Z","fact":"authentication outcome=failure ip=203.0.113.5 geo=BR","inference":"Pattern based on caller-supplied auth fields only.","confidence":"medium"},{"eventId":"E6","at":"2026-11-04T20:05:00.000Z","fact":"authentication outcome=success ip=203.0.113.5 geo=BR","inference":"Pattern based on caller-supplied auth fields only.","confidence":"medium"}],"source":"Caller-supplied auth events; local correlation only","status":"signal","confirmedCompromise":false}],"paidProviderUsed":false,"apiKeyRequired":false,"identityProviderConnected":false,"oauthUsed":false,"networkAccessed":false,"confirmedCompromiseClaimed":false,"findings":[{"kind":"conflict","code":"auth_pattern","subject":"u1","detail":"Abnormal auth pattern via burst_failures, fail_then_success, many_source_ips, many_countries (confirmedCompromise=false)."}],"limitations":["Authentication logs, access events, accounts, and policy exports are copied only from caller-supplied fields. Identity providers are not contacted and OAuth is not used.","Time correlation, geolocation comparison, and behavioural rules run locally over supplied records. Missing values are not invented.","VPN, proxy, shared-network, and legitimate-travel labels reduce confidence when supplied. A single unusual login is never treated as proof of account compromise.","Observed facts are separated from inferred threat hypotheses. Events are not labeled confirmed compromise without sufficient multi-signal evidence.","No paid identity-threat feed is used and no API key is required."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.04"},"protocols":[{"x402":{}}]}}},"/api/v1/identity-security/impossible-travel-detect":{"post":{"operationId":"detect_impossible_travel","summary":"Detect impossible travel","description":"Detect geographically inconsistent logins from supplied timestamps and locations. Accounts for VPN/proxy/shared networks and legitimate-travel labels; a single unusual pair is not proof of compromise.","tags":["identity-security"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false},"files":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false}},"events":{"maxItems":20000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"at":{"type":"string","maxLength":40},"userId":{"type":"string","maxLength":120},"username":{"type":"string","maxLength":120},"accountType":{"type":"string","enum":["user","service","unknown"]},"eventType":{"type":"string","maxLength":120},"outcome":{"type":"string","enum":["success","failure","challenge","unknown"]},"ip":{"type":"string","maxLength":80},"geoCountry":{"type":"string","maxLength":80},"geoCity":{"type":"string","maxLength":120},"latitude":{"type":"number","minimum":-90,"maximum":90},"longitude":{"type":"number","minimum":-180,"maximum":180},"asn":{"type":"string","maxLength":80},"isVpn":{"type":"boolean"},"isProxy":{"type":"boolean"},"isSharedNetwork":{"type":"boolean"},"deviceId":{"type":"string","maxLength":120},"previousDeviceId":{"type":"string","maxLength":120},"sessionId":{"type":"string","maxLength":160},"previousSessionId":{"type":"string","maxLength":160},"userAgent":{"type":"string","maxLength":500},"previousUserAgent":{"type":"string","maxLength":500},"mfaMethod":{"type":"string","maxLength":80},"mfaResult":{"type":"string","enum":["approved","denied","timeout","push_sent","unknown"]},"application":{"type":"string","maxLength":160},"resource":{"type":"string","maxLength":300},"action":{"type":"string","maxLength":120},"labels":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"accounts":{"maxItems":20000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"userId":{"type":"string","maxLength":120},"username":{"type":"string","maxLength":120},"accountType":{"type":"string","enum":["user","service","unknown"]},"createdAt":{"type":"string","maxLength":40},"lastLoginAt":{"type":"string","maxLength":40},"lastActivityAt":{"type":"string","maxLength":40},"isPrivileged":{"type":"boolean"},"isDisabled":{"type":"boolean"},"owner":{"type":"string","maxLength":160},"labels":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"policies":{"maxItems":20000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"principal":{"type":"string","maxLength":200},"resource":{"type":"string","maxLength":300},"action":{"type":"string","maxLength":120},"effect":{"type":"string","enum":["allow","deny"]},"priority":{"type":"number","minimum":-1000000,"maximum":1000000},"conditions":{"type":"string","maxLength":2000},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"asOf":{"type":"string","maxLength":40},"authWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"mfaWindowMinutes":{"type":"number","minimum":1,"maximum":1440},"mfaPushThreshold":{"type":"number","minimum":2,"maximum":1000},"sharingWindowHours":{"type":"number","minimum":1,"maximum":720},"dormantDays":{"type":"number","minimum":1,"maximum":3650},"maxTravelKmh":{"type":"number","minimum":50,"maximum":2000},"serviceBaselineWindowHours":{"type":"number","minimum":1,"maximum":2160}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","maxTravelKmh":900,"events":[{"id":"E1","at":"2026-11-04T12:00:00.000Z","userId":"u2","outcome":"success","geoCountry":"US","geoCity":"New York","latitude":40.71,"longitude":-74.01,"source":"Caller-supplied"},{"id":"E2","at":"2026-11-04T13:00:00.000Z","userId":"u2","outcome":"success","geoCountry":"JP","geoCity":"Tokyo","latitude":35.68,"longitude":139.69,"isVpn":false,"source":"Caller-supplied"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"itemCount":{"type":"number"},"maxTravelKmh":{"type":"number"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"status":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confidence":{"type":"string"},"relatedEventIds":{"type":"array","items":{"type":"string"}},"firstAt":{"type":"string"},"lastAt":{"type":"string"},"reasons":{"type":"array","items":{"type":"string"}},"mitigatingFactors":{"type":"array","items":{}},"evidence":{"type":"array","items":{"type":"object","properties":{"eventId":{"type":"string"},"at":{"type":"string"},"fact":{"type":"string"},"confidence":{"type":"string"}},"additionalProperties":true}},"source":{"type":"string"},"confirmedCompromise":{"type":"boolean"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"identityProviderConnected":{"type":"boolean"},"oauthUsed":{"type":"boolean"},"networkAccessed":{"type":"boolean"},"confirmedCompromiseClaimed":{"type":"boolean"},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"detected","itemCount":1,"maxTravelKmh":900,"items":[{"id":"impossible-travel-u2-E1-E2","detector":"impossible-travel-detect","title":"Geographically inconsistent logins","status":"signal","observedFacts":["Distance 10850 km over 1 hours between 2026-11-04T12:00:00.000Z and 2026-11-04T13:00:00.000Z.","Implied speed ≈ 10850 km/h (threshold 900 km/h)."],"inferredThreat":"Locations may be inconsistent with travel time; VPN/proxy/shared networks and legitimate travel can explain many cases.","confidence":"medium","relatedEventIds":["E1","E2"],"firstAt":"2026-11-04T12:00:00.000Z","lastAt":"2026-11-04T13:00:00.000Z","reasons":["speed_exceeds_threshold","extreme_speed"],"mitigatingFactors":[],"evidence":[{"eventId":"E1","at":"2026-11-04T12:00:00.000Z","fact":"geo=New York; ip=n/a","confidence":"high"},{"eventId":"E2","at":"2026-11-04T13:00:00.000Z","fact":"geo=Tokyo; ip=n/a","inference":"Geographically inconsistent relative to elapsed time.","confidence":"high"}],"source":"Caller-supplied locations/timestamps; local haversine/time rules","confirmedCompromise":false}],"paidProviderUsed":false,"apiKeyRequired":false,"identityProviderConnected":false,"oauthUsed":false,"networkAccessed":false,"confirmedCompromiseClaimed":false,"findings":[{"kind":"conflict","code":"impossible_travel","subject":"u2","detail":"Possible impossible travel via speed_exceeds_threshold, extreme_speed (confirmedCompromise=false; single pair is not proof)."}],"limitations":["Authentication logs, access events, accounts, and policy exports are copied only from caller-supplied fields. Identity providers are not contacted and OAuth is not used.","Time correlation, geolocation comparison, and behavioural rules run locally over supplied records. Missing values are not invented.","VPN, proxy, shared-network, and legitimate-travel labels reduce confidence when supplied. A single unusual login is never treated as proof of account compromise.","Observed facts are separated from inferred threat hypotheses. Events are not labeled confirmed compromise without sufficient multi-signal evidence.","No paid identity-threat feed is used and no API key is required."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.05"},"protocols":[{"x402":{}}]}}},"/api/v1/identity-security/session-hijacking-signal-detect":{"post":{"operationId":"detect_session_hijacking_signals","summary":"Detect session-hijacking signals","description":"Identify suspicious session changes and reuse patterns from caller-supplied session, device, IP, and user-agent fields. Indicators only—not confirmed hijacking.","tags":["identity-security"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false},"files":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false}},"events":{"maxItems":20000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"at":{"type":"string","maxLength":40},"userId":{"type":"string","maxLength":120},"username":{"type":"string","maxLength":120},"accountType":{"type":"string","enum":["user","service","unknown"]},"eventType":{"type":"string","maxLength":120},"outcome":{"type":"string","enum":["success","failure","challenge","unknown"]},"ip":{"type":"string","maxLength":80},"geoCountry":{"type":"string","maxLength":80},"geoCity":{"type":"string","maxLength":120},"latitude":{"type":"number","minimum":-90,"maximum":90},"longitude":{"type":"number","minimum":-180,"maximum":180},"asn":{"type":"string","maxLength":80},"isVpn":{"type":"boolean"},"isProxy":{"type":"boolean"},"isSharedNetwork":{"type":"boolean"},"deviceId":{"type":"string","maxLength":120},"previousDeviceId":{"type":"string","maxLength":120},"sessionId":{"type":"string","maxLength":160},"previousSessionId":{"type":"string","maxLength":160},"userAgent":{"type":"string","maxLength":500},"previousUserAgent":{"type":"string","maxLength":500},"mfaMethod":{"type":"string","maxLength":80},"mfaResult":{"type":"string","enum":["approved","denied","timeout","push_sent","unknown"]},"application":{"type":"string","maxLength":160},"resource":{"type":"string","maxLength":300},"action":{"type":"string","maxLength":120},"labels":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"accounts":{"maxItems":20000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"userId":{"type":"string","maxLength":120},"username":{"type":"string","maxLength":120},"accountType":{"type":"string","enum":["user","service","unknown"]},"createdAt":{"type":"string","maxLength":40},"lastLoginAt":{"type":"string","maxLength":40},"lastActivityAt":{"type":"string","maxLength":40},"isPrivileged":{"type":"boolean"},"isDisabled":{"type":"boolean"},"owner":{"type":"string","maxLength":160},"labels":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"policies":{"maxItems":20000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"principal":{"type":"string","maxLength":200},"resource":{"type":"string","maxLength":300},"action":{"type":"string","maxLength":120},"effect":{"type":"string","enum":["allow","deny"]},"priority":{"type":"number","minimum":-1000000,"maximum":1000000},"conditions":{"type":"string","maxLength":2000},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"asOf":{"type":"string","maxLength":40},"authWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"mfaWindowMinutes":{"type":"number","minimum":1,"maximum":1440},"mfaPushThreshold":{"type":"number","minimum":2,"maximum":1000},"sharingWindowHours":{"type":"number","minimum":1,"maximum":720},"dormantDays":{"type":"number","minimum":1,"maximum":3650},"maxTravelKmh":{"type":"number","minimum":50,"maximum":2000},"serviceBaselineWindowHours":{"type":"number","minimum":1,"maximum":2160}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","events":[{"id":"E1","at":"2026-11-04T19:00:00.000Z","userId":"u3","outcome":"success","sessionId":"S1","ip":"203.0.113.10","deviceId":"laptop-1","userAgent":"Chrome/120","source":"Caller-supplied"},{"id":"E2","at":"2026-11-04T19:20:00.000Z","userId":"u3","outcome":"success","sessionId":"S1","ip":"198.51.100.55","deviceId":"phone-9","previousDeviceId":"laptop-1","userAgent":"MobileSafari/17","source":"Caller-supplied"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"itemCount":{"type":"number"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confidence":{"type":"string"},"relatedEventIds":{"type":"array","items":{"type":"string"}},"firstAt":{"type":"string"},"lastAt":{"type":"string"},"reasons":{"type":"array","items":{"type":"string"}},"mitigatingFactors":{"type":"array","items":{}},"evidence":{"type":"array","items":{"type":"object","properties":{"eventId":{"type":"string"},"at":{"type":"string"},"fact":{"type":"string"},"inference":{"type":"string"},"confidence":{"type":"string"}},"additionalProperties":true}},"source":{"type":"string"},"status":{"type":"string"},"confirmedCompromise":{"type":"boolean"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"identityProviderConnected":{"type":"boolean"},"oauthUsed":{"type":"boolean"},"networkAccessed":{"type":"boolean"},"confirmedCompromiseClaimed":{"type":"boolean"},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"detected","itemCount":1,"items":[{"id":"session-hijack-s1","detector":"session-hijacking-signal-detect","title":"Suspicious session change/reuse","observedFacts":["Session S1 has 2 related event(s).","Session reused across IPs: 203.0.113.10, 198.51.100.55.","Session reused across devices: laptop-1, phone-9.","User-Agent changed within the same session id.","Event E2 changed device from laptop-1 to phone-9."],"inferredThreat":"Session identifiers appearing across IPs/devices/users can indicate hijacking or shared clients.","confidence":"high","relatedEventIds":["E1","E2"],"firstAt":"2026-11-04T19:00:00.000Z","lastAt":"2026-11-04T19:20:00.000Z","reasons":["session_ip_change","session_device_change","session_ua_change","device_swap_on_session"],"mitigatingFactors":[],"evidence":[{"eventId":"E1","at":"2026-11-04T19:00:00.000Z","fact":"session=S1; ip=203.0.113.10; device=laptop-1","inference":"Session change/reuse indicators are not proof of hijacking alone.","confidence":"medium"},{"eventId":"E2","at":"2026-11-04T19:20:00.000Z","fact":"session=S1; ip=198.51.100.55; device=phone-9","inference":"Session change/reuse indicators are not proof of hijacking alone.","confidence":"medium"}],"source":"Caller-supplied session fields; local rules only","status":"signal","confirmedCompromise":false}],"paidProviderUsed":false,"apiKeyRequired":false,"identityProviderConnected":false,"oauthUsed":false,"networkAccessed":false,"confirmedCompromiseClaimed":false,"findings":[{"kind":"conflict","code":"session_hijack_signal","subject":"S1","detail":"Session signals: session_ip_change, session_device_change, session_ua_change, device_swap_on_session (confirmedCompromise=false)."}],"limitations":["Authentication logs, access events, accounts, and policy exports are copied only from caller-supplied fields. Identity providers are not contacted and OAuth is not used.","Time correlation, geolocation comparison, and behavioural rules run locally over supplied records. Missing values are not invented.","VPN, proxy, shared-network, and legitimate-travel labels reduce confidence when supplied. A single unusual login is never treated as proof of account compromise.","Observed facts are separated from inferred threat hypotheses. Events are not labeled confirmed compromise without sufficient multi-signal evidence.","No paid identity-threat feed is used and no API key is required."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.04"},"protocols":[{"x402":{}}]}}},"/api/v1/identity-security/mfa-fatigue-detect":{"post":{"operationId":"detect_mfa_fatigue","summary":"Detect MFA fatigue","description":"Detect repeated MFA push/challenge patterns from caller-supplied MFA events that may indicate an MFA fatigue attack. Not confirmation of account takeover.","tags":["identity-security"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false},"files":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false}},"events":{"maxItems":20000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"at":{"type":"string","maxLength":40},"userId":{"type":"string","maxLength":120},"username":{"type":"string","maxLength":120},"accountType":{"type":"string","enum":["user","service","unknown"]},"eventType":{"type":"string","maxLength":120},"outcome":{"type":"string","enum":["success","failure","challenge","unknown"]},"ip":{"type":"string","maxLength":80},"geoCountry":{"type":"string","maxLength":80},"geoCity":{"type":"string","maxLength":120},"latitude":{"type":"number","minimum":-90,"maximum":90},"longitude":{"type":"number","minimum":-180,"maximum":180},"asn":{"type":"string","maxLength":80},"isVpn":{"type":"boolean"},"isProxy":{"type":"boolean"},"isSharedNetwork":{"type":"boolean"},"deviceId":{"type":"string","maxLength":120},"previousDeviceId":{"type":"string","maxLength":120},"sessionId":{"type":"string","maxLength":160},"previousSessionId":{"type":"string","maxLength":160},"userAgent":{"type":"string","maxLength":500},"previousUserAgent":{"type":"string","maxLength":500},"mfaMethod":{"type":"string","maxLength":80},"mfaResult":{"type":"string","enum":["approved","denied","timeout","push_sent","unknown"]},"application":{"type":"string","maxLength":160},"resource":{"type":"string","maxLength":300},"action":{"type":"string","maxLength":120},"labels":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"accounts":{"maxItems":20000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"userId":{"type":"string","maxLength":120},"username":{"type":"string","maxLength":120},"accountType":{"type":"string","enum":["user","service","unknown"]},"createdAt":{"type":"string","maxLength":40},"lastLoginAt":{"type":"string","maxLength":40},"lastActivityAt":{"type":"string","maxLength":40},"isPrivileged":{"type":"boolean"},"isDisabled":{"type":"boolean"},"owner":{"type":"string","maxLength":160},"labels":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"policies":{"maxItems":20000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"principal":{"type":"string","maxLength":200},"resource":{"type":"string","maxLength":300},"action":{"type":"string","maxLength":120},"effect":{"type":"string","enum":["allow","deny"]},"priority":{"type":"number","minimum":-1000000,"maximum":1000000},"conditions":{"type":"string","maxLength":2000},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"asOf":{"type":"string","maxLength":40},"authWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"mfaWindowMinutes":{"type":"number","minimum":1,"maximum":1440},"mfaPushThreshold":{"type":"number","minimum":2,"maximum":1000},"sharingWindowHours":{"type":"number","minimum":1,"maximum":720},"dormantDays":{"type":"number","minimum":1,"maximum":3650},"maxTravelKmh":{"type":"number","minimum":50,"maximum":2000},"serviceBaselineWindowHours":{"type":"number","minimum":1,"maximum":2160}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","mfaWindowMinutes":10,"mfaPushThreshold":5,"events":[{"id":"E1","at":"2026-11-04T20:50:00.000Z","userId":"u4","eventType":"mfa_push","mfaResult":"push_sent","outcome":"challenge","source":"Caller-supplied"},{"id":"E2","at":"2026-11-04T20:51:00.000Z","userId":"u4","eventType":"mfa_push","mfaResult":"denied","outcome":"challenge","source":"Caller-supplied"},{"id":"E3","at":"2026-11-04T20:52:00.000Z","userId":"u4","eventType":"mfa_push","mfaResult":"timeout","outcome":"challenge","source":"Caller-supplied"},{"id":"E4","at":"2026-11-04T20:53:00.000Z","userId":"u4","eventType":"mfa_push","mfaResult":"push_sent","outcome":"challenge","source":"Caller-supplied"},{"id":"E5","at":"2026-11-04T20:54:00.000Z","userId":"u4","eventType":"mfa_push","mfaResult":"push_sent","outcome":"challenge","source":"Caller-supplied"},{"id":"E6","at":"2026-11-04T20:55:00.000Z","userId":"u4","eventType":"mfa_push","mfaResult":"approved","outcome":"success","source":"Caller-supplied"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"itemCount":{"type":"number"},"windowMinutes":{"type":"number"},"pushThreshold":{"type":"number"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confidence":{"type":"string"},"relatedEventIds":{"type":"array","items":{"type":"string"}},"firstAt":{"type":"string"},"lastAt":{"type":"string"},"reasons":{"type":"array","items":{"type":"string"}},"mitigatingFactors":{"type":"array","items":{}},"evidence":{"type":"array","items":{"type":"object","properties":{"eventId":{"type":"string"},"at":{"type":"string"},"fact":{"type":"string"},"inference":{"type":"string"},"confidence":{"type":"string"}},"additionalProperties":true}},"source":{"type":"string"},"status":{"type":"string"},"confirmedCompromise":{"type":"boolean"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"identityProviderConnected":{"type":"boolean"},"oauthUsed":{"type":"boolean"},"networkAccessed":{"type":"boolean"},"confirmedCompromiseClaimed":{"type":"boolean"},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"detected","itemCount":1,"windowMinutes":10,"pushThreshold":5,"items":[{"id":"mfa-fatigue-u4-E1","detector":"mfa-fatigue-detect","title":"Possible MFA fatigue pattern","observedFacts":["5 MFA challenge/push/deny/timeout events within 10 minutes (threshold 5).","1 MFA approval/success event(s) occurred in the same window."],"inferredThreat":"Repeated MFA pushes may pressure a user into approving a malicious login.","confidence":"high","relatedEventIds":["E1","E2","E3","E4","E5","E6"],"firstAt":"2026-11-04T20:50:00.000Z","lastAt":"2026-11-04T20:55:00.000Z","reasons":["repeated_mfa_prompts","prompt_then_approval"],"mitigatingFactors":[],"evidence":[{"eventId":"E1","at":"2026-11-04T20:50:00.000Z","fact":"mfaResult=push_sent; outcome=challenge; method=n/a","inference":"Repeated MFA prompts can indicate MFA fatigue; not confirmed compromise by themselves.","confidence":"medium"},{"eventId":"E2","at":"2026-11-04T20:51:00.000Z","fact":"mfaResult=denied; outcome=challenge; method=n/a","inference":"Repeated MFA prompts can indicate MFA fatigue; not confirmed compromise by themselves.","confidence":"medium"},{"eventId":"E3","at":"2026-11-04T20:52:00.000Z","fact":"mfaResult=timeout; outcome=challenge; method=n/a","inference":"Repeated MFA prompts can indicate MFA fatigue; not confirmed compromise by themselves.","confidence":"medium"},{"eventId":"E4","at":"2026-11-04T20:53:00.000Z","fact":"mfaResult=push_sent; outcome=challenge; method=n/a","inference":"Repeated MFA prompts can indicate MFA fatigue; not confirmed compromise by themselves.","confidence":"medium"},{"eventId":"E5","at":"2026-11-04T20:54:00.000Z","fact":"mfaResult=push_sent; outcome=challenge; method=n/a","inference":"Repeated MFA prompts can indicate MFA fatigue; not confirmed compromise by themselves.","confidence":"medium"},{"eventId":"E6","at":"2026-11-04T20:55:00.000Z","fact":"mfaResult=approved; outcome=success; method=n/a","inference":"Repeated MFA prompts can indicate MFA fatigue; not confirmed compromise by themselves.","confidence":"medium"}],"source":"Caller-supplied MFA events; local time-window rules","status":"signal","confirmedCompromise":false}],"paidProviderUsed":false,"apiKeyRequired":false,"identityProviderConnected":false,"oauthUsed":false,"networkAccessed":false,"confirmedCompromiseClaimed":false,"findings":[{"kind":"conflict","code":"mfa_fatigue","subject":"u4","detail":"MFA fatigue indicators: repeated_mfa_prompts, prompt_then_approval (confirmedCompromise=false)."}],"limitations":["Authentication logs, access events, accounts, and policy exports are copied only from caller-supplied fields. Identity providers are not contacted and OAuth is not used.","Time correlation, geolocation comparison, and behavioural rules run locally over supplied records. Missing values are not invented.","VPN, proxy, shared-network, and legitimate-travel labels reduce confidence when supplied. A single unusual login is never treated as proof of account compromise.","Observed facts are separated from inferred threat hypotheses. Events are not labeled confirmed compromise without sufficient multi-signal evidence.","No paid identity-threat feed is used and no API key is required."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.04"},"protocols":[{"x402":{}}]}}},"/api/v1/identity-security/account-sharing-detect":{"post":{"operationId":"detect_account_sharing","summary":"Detect account sharing","description":"Identify suspicious account-sharing patterns from multi-device, multi-location, and near-simultaneous authentications. Shared-network context is treated as a mitigating factor.","tags":["identity-security"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false},"files":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false}},"events":{"maxItems":20000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"at":{"type":"string","maxLength":40},"userId":{"type":"string","maxLength":120},"username":{"type":"string","maxLength":120},"accountType":{"type":"string","enum":["user","service","unknown"]},"eventType":{"type":"string","maxLength":120},"outcome":{"type":"string","enum":["success","failure","challenge","unknown"]},"ip":{"type":"string","maxLength":80},"geoCountry":{"type":"string","maxLength":80},"geoCity":{"type":"string","maxLength":120},"latitude":{"type":"number","minimum":-90,"maximum":90},"longitude":{"type":"number","minimum":-180,"maximum":180},"asn":{"type":"string","maxLength":80},"isVpn":{"type":"boolean"},"isProxy":{"type":"boolean"},"isSharedNetwork":{"type":"boolean"},"deviceId":{"type":"string","maxLength":120},"previousDeviceId":{"type":"string","maxLength":120},"sessionId":{"type":"string","maxLength":160},"previousSessionId":{"type":"string","maxLength":160},"userAgent":{"type":"string","maxLength":500},"previousUserAgent":{"type":"string","maxLength":500},"mfaMethod":{"type":"string","maxLength":80},"mfaResult":{"type":"string","enum":["approved","denied","timeout","push_sent","unknown"]},"application":{"type":"string","maxLength":160},"resource":{"type":"string","maxLength":300},"action":{"type":"string","maxLength":120},"labels":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"accounts":{"maxItems":20000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"userId":{"type":"string","maxLength":120},"username":{"type":"string","maxLength":120},"accountType":{"type":"string","enum":["user","service","unknown"]},"createdAt":{"type":"string","maxLength":40},"lastLoginAt":{"type":"string","maxLength":40},"lastActivityAt":{"type":"string","maxLength":40},"isPrivileged":{"type":"boolean"},"isDisabled":{"type":"boolean"},"owner":{"type":"string","maxLength":160},"labels":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"policies":{"maxItems":20000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"principal":{"type":"string","maxLength":200},"resource":{"type":"string","maxLength":300},"action":{"type":"string","maxLength":120},"effect":{"type":"string","enum":["allow","deny"]},"priority":{"type":"number","minimum":-1000000,"maximum":1000000},"conditions":{"type":"string","maxLength":2000},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"asOf":{"type":"string","maxLength":40},"authWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"mfaWindowMinutes":{"type":"number","minimum":1,"maximum":1440},"mfaPushThreshold":{"type":"number","minimum":2,"maximum":1000},"sharingWindowHours":{"type":"number","minimum":1,"maximum":720},"dormantDays":{"type":"number","minimum":1,"maximum":3650},"maxTravelKmh":{"type":"number","minimum":50,"maximum":2000},"serviceBaselineWindowHours":{"type":"number","minimum":1,"maximum":2160}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","sharingWindowHours":24,"events":[{"id":"E1","at":"2026-11-04T10:00:00.000Z","userId":"u5","outcome":"success","deviceId":"d1","geoCity":"Austin","geoCountry":"US","userAgent":"Chrome/120","source":"Caller-supplied"},{"id":"E2","at":"2026-11-04T10:05:00.000Z","userId":"u5","outcome":"success","deviceId":"d2","geoCity":"Dallas","geoCountry":"US","userAgent":"Firefox/121","source":"Caller-supplied"},{"id":"E3","at":"2026-11-04T18:00:00.000Z","userId":"u5","outcome":"success","deviceId":"d3","geoCity":"Chicago","geoCountry":"US","userAgent":"Edge/120","source":"Caller-supplied"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"itemCount":{"type":"number"},"windowHours":{"type":"number"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confidence":{"type":"string"},"relatedEventIds":{"type":"array","items":{"type":"string"}},"firstAt":{"type":"string"},"lastAt":{"type":"string"},"reasons":{"type":"array","items":{"type":"string"}},"mitigatingFactors":{"type":"array","items":{}},"evidence":{"type":"array","items":{"type":"object","properties":{"eventId":{"type":"string"},"at":{"type":"string"},"fact":{"type":"string"},"inference":{"type":"string"},"confidence":{"type":"string"}},"additionalProperties":true}},"source":{"type":"string"},"status":{"type":"string"},"confirmedCompromise":{"type":"boolean"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"identityProviderConnected":{"type":"boolean"},"oauthUsed":{"type":"boolean"},"networkAccessed":{"type":"boolean"},"confirmedCompromiseClaimed":{"type":"boolean"},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"detected","itemCount":1,"windowHours":24,"items":[{"id":"account-sharing-u5","detector":"account-sharing-detect","title":"Suspicious account-sharing pattern","observedFacts":["3 devices used by the same account within 24 hours.","Distinct devices authenticated within 15 minutes of each other.","Account active from 3 locations and 3 devices."],"inferredThreat":"Multiple devices/locations for one account may indicate credential sharing.","confidence":"high","relatedEventIds":["E1","E2","E3"],"firstAt":"2026-11-04T10:00:00.000Z","lastAt":"2026-11-04T18:00:00.000Z","reasons":["many_devices_same_account","near_simultaneous_distinct_devices","multi_location_multi_device"],"mitigatingFactors":[],"evidence":[{"eventId":"E1","at":"2026-11-04T10:00:00.000Z","fact":"device=d1; geo=Austin; ua=Chrome/120","inference":"Concurrent/diverse device use can indicate sharing or roaming; not proof of compromise.","confidence":"medium"},{"eventId":"E2","at":"2026-11-04T10:05:00.000Z","fact":"device=d2; geo=Dallas; ua=Firefox/121","inference":"Concurrent/diverse device use can indicate sharing or roaming; not proof of compromise.","confidence":"medium"},{"eventId":"E3","at":"2026-11-04T18:00:00.000Z","fact":"device=d3; geo=Chicago; ua=Edge/120","inference":"Concurrent/diverse device use can indicate sharing or roaming; not proof of compromise.","confidence":"medium"}],"source":"Caller-supplied auth events; local behavioural rules","status":"signal","confirmedCompromise":false}],"paidProviderUsed":false,"apiKeyRequired":false,"identityProviderConnected":false,"oauthUsed":false,"networkAccessed":false,"confirmedCompromiseClaimed":false,"findings":[{"kind":"conflict","code":"account_sharing","subject":"u5","detail":"Account-sharing indicators: many_devices_same_account, near_simultaneous_distinct_devices, multi_location_multi_device (confirmedCompromise=false)."}],"limitations":["Authentication logs, access events, accounts, and policy exports are copied only from caller-supplied fields. Identity providers are not contacted and OAuth is not used.","Time correlation, geolocation comparison, and behavioural rules run locally over supplied records. Missing values are not invented.","VPN, proxy, shared-network, and legitimate-travel labels reduce confidence when supplied. A single unusual login is never treated as proof of account compromise.","Observed facts are separated from inferred threat hypotheses. Events are not labeled confirmed compromise without sufficient multi-signal evidence.","No paid identity-threat feed is used and no API key is required."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.04"},"protocols":[{"x402":{}}]}}},"/api/v1/identity-security/access-policy-conflict-detect":{"post":{"operationId":"detect_access_policy_conflicts","summary":"Detect access-policy conflicts","description":"Detect conflicting allow/deny access rules from caller-supplied policy exports for the same principal, resource, and action.","tags":["identity-security"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false},"files":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false}},"events":{"maxItems":20000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"at":{"type":"string","maxLength":40},"userId":{"type":"string","maxLength":120},"username":{"type":"string","maxLength":120},"accountType":{"type":"string","enum":["user","service","unknown"]},"eventType":{"type":"string","maxLength":120},"outcome":{"type":"string","enum":["success","failure","challenge","unknown"]},"ip":{"type":"string","maxLength":80},"geoCountry":{"type":"string","maxLength":80},"geoCity":{"type":"string","maxLength":120},"latitude":{"type":"number","minimum":-90,"maximum":90},"longitude":{"type":"number","minimum":-180,"maximum":180},"asn":{"type":"string","maxLength":80},"isVpn":{"type":"boolean"},"isProxy":{"type":"boolean"},"isSharedNetwork":{"type":"boolean"},"deviceId":{"type":"string","maxLength":120},"previousDeviceId":{"type":"string","maxLength":120},"sessionId":{"type":"string","maxLength":160},"previousSessionId":{"type":"string","maxLength":160},"userAgent":{"type":"string","maxLength":500},"previousUserAgent":{"type":"string","maxLength":500},"mfaMethod":{"type":"string","maxLength":80},"mfaResult":{"type":"string","enum":["approved","denied","timeout","push_sent","unknown"]},"application":{"type":"string","maxLength":160},"resource":{"type":"string","maxLength":300},"action":{"type":"string","maxLength":120},"labels":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"accounts":{"maxItems":20000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"userId":{"type":"string","maxLength":120},"username":{"type":"string","maxLength":120},"accountType":{"type":"string","enum":["user","service","unknown"]},"createdAt":{"type":"string","maxLength":40},"lastLoginAt":{"type":"string","maxLength":40},"lastActivityAt":{"type":"string","maxLength":40},"isPrivileged":{"type":"boolean"},"isDisabled":{"type":"boolean"},"owner":{"type":"string","maxLength":160},"labels":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"policies":{"maxItems":20000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"principal":{"type":"string","maxLength":200},"resource":{"type":"string","maxLength":300},"action":{"type":"string","maxLength":120},"effect":{"type":"string","enum":["allow","deny"]},"priority":{"type":"number","minimum":-1000000,"maximum":1000000},"conditions":{"type":"string","maxLength":2000},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"asOf":{"type":"string","maxLength":40},"authWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"mfaWindowMinutes":{"type":"number","minimum":1,"maximum":1440},"mfaPushThreshold":{"type":"number","minimum":2,"maximum":1000},"sharingWindowHours":{"type":"number","minimum":1,"maximum":720},"dormantDays":{"type":"number","minimum":1,"maximum":3650},"maxTravelKmh":{"type":"number","minimum":50,"maximum":2000},"serviceBaselineWindowHours":{"type":"number","minimum":1,"maximum":2160}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","policies":[{"id":"P1","principal":"role:finance","resource":"app:payroll","action":"read","effect":"allow","priority":100,"source":"Caller-supplied IAM export"},{"id":"P2","principal":"role:finance","resource":"app:payroll","action":"read","effect":"deny","priority":100,"source":"Caller-supplied IAM export"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"itemCount":{"type":"number"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confidence":{"type":"string"},"relatedEventIds":{"type":"array","items":{"type":"string"}},"firstAt":{"type":"string"},"lastAt":{"type":"string"},"reasons":{"type":"array","items":{"type":"string"}},"mitigatingFactors":{"type":"array","items":{}},"evidence":{"type":"array","items":{"type":"object","properties":{"eventId":{"type":"string"},"at":{"type":"string"},"fact":{"type":"string"},"confidence":{"type":"string"}},"additionalProperties":true}},"source":{"type":"string"},"status":{"type":"string"},"confirmedCompromise":{"type":"boolean"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"identityProviderConnected":{"type":"boolean"},"oauthUsed":{"type":"boolean"},"networkAccessed":{"type":"boolean"},"confirmedCompromiseClaimed":{"type":"boolean"},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"detected","itemCount":1,"items":[{"id":"policy-conflict-P1-P2","detector":"access-policy-conflict-detect","title":"Conflicting access policy rules","observedFacts":["Rules P1 (allow) and P2 (deny) target the same principal/resource/action.","Conflicting effects share priority 100."],"inferredThreat":"Conflicting allow/deny rules can create unintended access or deny outcomes.","confidence":"high","relatedEventIds":["P1","P2"],"firstAt":"2026-11-04T21:00:00.000Z","lastAt":"2026-11-04T21:00:00.000Z","reasons":["allow_deny_conflict","equal_priority_conflict"],"mitigatingFactors":[],"evidence":[{"eventId":"P1","at":"2026-11-04T21:00:00.000Z","fact":"allow role:finance read app:payroll priority=100","confidence":"high"},{"eventId":"P2","at":"2026-11-04T21:00:00.000Z","fact":"deny role:finance read app:payroll priority=100","inference":"Conflict derived from caller-supplied policy export only.","confidence":"high"}],"source":"Caller-supplied policy export; local comparison only","status":"signal","confirmedCompromise":false}],"paidProviderUsed":false,"apiKeyRequired":false,"identityProviderConnected":false,"oauthUsed":false,"networkAccessed":false,"confirmedCompromiseClaimed":false,"findings":[{"kind":"conflict","code":"policy_conflict","subject":"P1:P2","detail":"Policy conflict via allow_deny_conflict, equal_priority_conflict."}],"limitations":["Authentication logs, access events, accounts, and policy exports are copied only from caller-supplied fields. Identity providers are not contacted and OAuth is not used.","Time correlation, geolocation comparison, and behavioural rules run locally over supplied records. Missing values are not invented.","VPN, proxy, shared-network, and legitimate-travel labels reduce confidence when supplied. A single unusual login is never treated as proof of account compromise.","Observed facts are separated from inferred threat hypotheses. Events are not labeled confirmed compromise without sufficient multi-signal evidence.","No paid identity-threat feed is used and no API key is required."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.03"},"protocols":[{"x402":{}}]}}},"/api/v1/identity-security/dormant-account-risk-detect":{"post":{"operationId":"detect_dormant_account_risk","summary":"Detect dormant-account risk","description":"Identify risks from inactive but enabled accounts using caller-supplied account inventory and optional recent auth events. Hygiene signal only—not confirmed compromise.","tags":["identity-security"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false},"files":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false}},"events":{"maxItems":20000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"at":{"type":"string","maxLength":40},"userId":{"type":"string","maxLength":120},"username":{"type":"string","maxLength":120},"accountType":{"type":"string","enum":["user","service","unknown"]},"eventType":{"type":"string","maxLength":120},"outcome":{"type":"string","enum":["success","failure","challenge","unknown"]},"ip":{"type":"string","maxLength":80},"geoCountry":{"type":"string","maxLength":80},"geoCity":{"type":"string","maxLength":120},"latitude":{"type":"number","minimum":-90,"maximum":90},"longitude":{"type":"number","minimum":-180,"maximum":180},"asn":{"type":"string","maxLength":80},"isVpn":{"type":"boolean"},"isProxy":{"type":"boolean"},"isSharedNetwork":{"type":"boolean"},"deviceId":{"type":"string","maxLength":120},"previousDeviceId":{"type":"string","maxLength":120},"sessionId":{"type":"string","maxLength":160},"previousSessionId":{"type":"string","maxLength":160},"userAgent":{"type":"string","maxLength":500},"previousUserAgent":{"type":"string","maxLength":500},"mfaMethod":{"type":"string","maxLength":80},"mfaResult":{"type":"string","enum":["approved","denied","timeout","push_sent","unknown"]},"application":{"type":"string","maxLength":160},"resource":{"type":"string","maxLength":300},"action":{"type":"string","maxLength":120},"labels":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"accounts":{"maxItems":20000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"userId":{"type":"string","maxLength":120},"username":{"type":"string","maxLength":120},"accountType":{"type":"string","enum":["user","service","unknown"]},"createdAt":{"type":"string","maxLength":40},"lastLoginAt":{"type":"string","maxLength":40},"lastActivityAt":{"type":"string","maxLength":40},"isPrivileged":{"type":"boolean"},"isDisabled":{"type":"boolean"},"owner":{"type":"string","maxLength":160},"labels":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"policies":{"maxItems":20000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"principal":{"type":"string","maxLength":200},"resource":{"type":"string","maxLength":300},"action":{"type":"string","maxLength":120},"effect":{"type":"string","enum":["allow","deny"]},"priority":{"type":"number","minimum":-1000000,"maximum":1000000},"conditions":{"type":"string","maxLength":2000},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"asOf":{"type":"string","maxLength":40},"authWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"mfaWindowMinutes":{"type":"number","minimum":1,"maximum":1440},"mfaPushThreshold":{"type":"number","minimum":2,"maximum":1000},"sharingWindowHours":{"type":"number","minimum":1,"maximum":720},"dormantDays":{"type":"number","minimum":1,"maximum":3650},"maxTravelKmh":{"type":"number","minimum":50,"maximum":2000},"serviceBaselineWindowHours":{"type":"number","minimum":1,"maximum":2160}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","dormantDays":90,"accounts":[{"id":"A1","userId":"u6","username":"old.admin","accountType":"user","createdAt":"2024-01-01T00:00:00.000Z","lastLoginAt":"2026-05-01T00:00:00.000Z","lastActivityAt":"2026-05-01T00:00:00.000Z","isPrivileged":true,"isDisabled":false,"source":"Caller-supplied directory export"}],"events":[{"id":"E1","at":"2026-11-03T20:00:00.000Z","userId":"u6","outcome":"success","ip":"203.0.113.80","source":"Caller-supplied"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"itemCount":{"type":"number"},"dormantDays":{"type":"number"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confidence":{"type":"string"},"relatedEventIds":{"type":"array","items":{"type":"string"}},"firstAt":{"type":"string"},"lastAt":{"type":"string"},"reasons":{"type":"array","items":{"type":"string"}},"mitigatingFactors":{"type":"array","items":{}},"evidence":{"type":"array","items":{"type":"object","properties":{"eventId":{"type":"string"},"at":{"type":"string"},"fact":{"type":"string"},"inference":{"type":"string"},"confidence":{"type":"string"}},"additionalProperties":true}},"source":{"type":"string"},"status":{"type":"string"},"confirmedCompromise":{"type":"boolean"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"identityProviderConnected":{"type":"boolean"},"oauthUsed":{"type":"boolean"},"networkAccessed":{"type":"boolean"},"confirmedCompromiseClaimed":{"type":"boolean"},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"detected","itemCount":1,"dormantDays":90,"items":[{"id":"dormant-A1","detector":"dormant-account-risk-detect","title":"Dormant account risk","observedFacts":["Last activity 187 days before asOf (threshold 90).","Account is marked privileged.","Account is not disabled.","Successful authentication occurred after a long idle period."],"inferredThreat":"Inactive but enabled accounts increase takeover and privilege-abuse risk.","confidence":"high","relatedEventIds":["A1","E1"],"firstAt":"2024-01-01T00:00:00.000Z","lastAt":"2026-11-03T20:00:00.000Z","reasons":["inactive_beyond_threshold","privileged_dormant","still_enabled","sudden_reactivation"],"mitigatingFactors":[],"evidence":[{"eventId":"A1","at":"2026-05-01T00:00:00.000Z","fact":"type=user; privileged=true; disabled=false; last=2026-05-01T00:00:00.000Z","inference":"Dormant-account risk is a hygiene signal, not proof of compromise.","confidence":"medium"},{"eventId":"E1","at":"2026-11-03T20:00:00.000Z","fact":"Recent authentication outcome=success","confidence":"medium"}],"source":"Caller-supplied directory export","status":"signal","confirmedCompromise":false}],"paidProviderUsed":false,"apiKeyRequired":false,"identityProviderConnected":false,"oauthUsed":false,"networkAccessed":false,"confirmedCompromiseClaimed":false,"findings":[{"kind":"conflict","code":"dormant_account","subject":"A1","detail":"Dormant-account indicators: inactive_beyond_threshold, privileged_dormant, still_enabled, sudden_reactivation (confirmedCompromise=false)."}],"limitations":["Authentication logs, access events, accounts, and policy exports are copied only from caller-supplied fields. Identity providers are not contacted and OAuth is not used.","Time correlation, geolocation comparison, and behavioural rules run locally over supplied records. Missing values are not invented.","VPN, proxy, shared-network, and legitimate-travel labels reduce confidence when supplied. A single unusual login is never treated as proof of account compromise.","Observed facts are separated from inferred threat hypotheses. Events are not labeled confirmed compromise without sufficient multi-signal evidence.","No paid identity-threat feed is used and no API key is required."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.03"},"protocols":[{"x402":{}}]}}},"/api/v1/identity-security/service-account-anomaly-detect":{"post":{"operationId":"detect_service_account_anomalies","summary":"Detect service-account anomalies","description":"Analyze unusual service-account activity such as interactive logins, off-hours use, and high application/IP diversity from caller-supplied events.","tags":["identity-security"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false},"files":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false}},"events":{"maxItems":20000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"at":{"type":"string","maxLength":40},"userId":{"type":"string","maxLength":120},"username":{"type":"string","maxLength":120},"accountType":{"type":"string","enum":["user","service","unknown"]},"eventType":{"type":"string","maxLength":120},"outcome":{"type":"string","enum":["success","failure","challenge","unknown"]},"ip":{"type":"string","maxLength":80},"geoCountry":{"type":"string","maxLength":80},"geoCity":{"type":"string","maxLength":120},"latitude":{"type":"number","minimum":-90,"maximum":90},"longitude":{"type":"number","minimum":-180,"maximum":180},"asn":{"type":"string","maxLength":80},"isVpn":{"type":"boolean"},"isProxy":{"type":"boolean"},"isSharedNetwork":{"type":"boolean"},"deviceId":{"type":"string","maxLength":120},"previousDeviceId":{"type":"string","maxLength":120},"sessionId":{"type":"string","maxLength":160},"previousSessionId":{"type":"string","maxLength":160},"userAgent":{"type":"string","maxLength":500},"previousUserAgent":{"type":"string","maxLength":500},"mfaMethod":{"type":"string","maxLength":80},"mfaResult":{"type":"string","enum":["approved","denied","timeout","push_sent","unknown"]},"application":{"type":"string","maxLength":160},"resource":{"type":"string","maxLength":300},"action":{"type":"string","maxLength":120},"labels":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"accounts":{"maxItems":20000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"userId":{"type":"string","maxLength":120},"username":{"type":"string","maxLength":120},"accountType":{"type":"string","enum":["user","service","unknown"]},"createdAt":{"type":"string","maxLength":40},"lastLoginAt":{"type":"string","maxLength":40},"lastActivityAt":{"type":"string","maxLength":40},"isPrivileged":{"type":"boolean"},"isDisabled":{"type":"boolean"},"owner":{"type":"string","maxLength":160},"labels":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"policies":{"maxItems":20000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"principal":{"type":"string","maxLength":200},"resource":{"type":"string","maxLength":300},"action":{"type":"string","maxLength":120},"effect":{"type":"string","enum":["allow","deny"]},"priority":{"type":"number","minimum":-1000000,"maximum":1000000},"conditions":{"type":"string","maxLength":2000},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"asOf":{"type":"string","maxLength":40},"authWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"mfaWindowMinutes":{"type":"number","minimum":1,"maximum":1440},"mfaPushThreshold":{"type":"number","minimum":2,"maximum":1000},"sharingWindowHours":{"type":"number","minimum":1,"maximum":720},"dormantDays":{"type":"number","minimum":1,"maximum":3650},"maxTravelKmh":{"type":"number","minimum":50,"maximum":2000},"serviceBaselineWindowHours":{"type":"number","minimum":1,"maximum":2160}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","events":[{"id":"E1","at":"2026-11-04T02:10:00.000Z","userId":"svc-backup","username":"svc-backup","accountType":"service","eventType":"interactive_login","outcome":"success","ip":"203.0.113.10","application":"console","userAgent":"Mozilla/5.0","deviceId":"admin-laptop","source":"Caller-supplied"},{"id":"E2","at":"2026-11-04T03:00:00.000Z","userId":"svc-backup","accountType":"service","eventType":"authentication","outcome":"success","ip":"198.51.100.20","application":"s3","source":"Caller-supplied"},{"id":"E3","at":"2026-11-04T03:30:00.000Z","userId":"svc-backup","accountType":"service","eventType":"authentication","outcome":"failure","ip":"192.0.2.30","application":"github","source":"Caller-supplied"},{"id":"E4","at":"2026-11-04T04:00:00.000Z","userId":"svc-backup","accountType":"service","eventType":"authentication","outcome":"success","ip":"203.0.113.40","application":"vpn","source":"Caller-supplied"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"itemCount":{"type":"number"},"baselineWindowHours":{"type":"number"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confidence":{"type":"string"},"relatedEventIds":{"type":"array","items":{"type":"string"}},"firstAt":{"type":"string"},"lastAt":{"type":"string"},"reasons":{"type":"array","items":{"type":"string"}},"mitigatingFactors":{"type":"array","items":{}},"evidence":{"type":"array","items":{"type":"object","properties":{"eventId":{"type":"string"},"at":{"type":"string"},"fact":{"type":"string"},"inference":{"type":"string"},"confidence":{"type":"string"}},"additionalProperties":true}},"source":{"type":"string"},"status":{"type":"string"},"confirmedCompromise":{"type":"boolean"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"identityProviderConnected":{"type":"boolean"},"oauthUsed":{"type":"boolean"},"networkAccessed":{"type":"boolean"},"confirmedCompromiseClaimed":{"type":"boolean"},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"detected","itemCount":1,"baselineWindowHours":168,"items":[{"id":"service-anomaly-svc_backup","detector":"service-account-anomaly-detect","title":"Unusual service account activity","observedFacts":["4 events outside 05:00–22:00 UTC.","1 interactive-style login(s) for a service account.","Service account touched 4 applications/resources.","4 source IPs for service account activity."],"inferredThreat":"Service accounts used interactively or across many apps/IPs can indicate misuse or credential theft.","confidence":"high","relatedEventIds":["E1","E2","E3","E4"],"firstAt":"2026-11-04T02:10:00.000Z","lastAt":"2026-11-04T04:00:00.000Z","reasons":["off_hours_activity","interactive_service_login","many_applications","many_source_ips","human_client_fingerprint"],"mitigatingFactors":[],"evidence":[{"eventId":"E1","at":"2026-11-04T02:10:00.000Z","fact":"interactive_login outcome=success; app=console; ip=203.0.113.10","inference":"Service-account anomaly is behavioural only; not confirmed compromise.","confidence":"medium"},{"eventId":"E2","at":"2026-11-04T03:00:00.000Z","fact":"authentication outcome=success; app=s3; ip=198.51.100.20","inference":"Service-account anomaly is behavioural only; not confirmed compromise.","confidence":"medium"},{"eventId":"E3","at":"2026-11-04T03:30:00.000Z","fact":"authentication outcome=failure; app=github; ip=192.0.2.30","inference":"Service-account anomaly is behavioural only; not confirmed compromise.","confidence":"medium"},{"eventId":"E4","at":"2026-11-04T04:00:00.000Z","fact":"authentication outcome=success; app=vpn; ip=203.0.113.40","inference":"Service-account anomaly is behavioural only; not confirmed compromise.","confidence":"medium"}],"source":"Caller-supplied service-account events; local behavioural rules","status":"signal","confirmedCompromise":false}],"paidProviderUsed":false,"apiKeyRequired":false,"identityProviderConnected":false,"oauthUsed":false,"networkAccessed":false,"confirmedCompromiseClaimed":false,"findings":[{"kind":"conflict","code":"service_account_anomaly","subject":"svc_backup","detail":"Service-account anomalies: off_hours_activity, interactive_service_login, many_applications, many_source_ips, human_client_fingerprint (confirmedCompromise=false)."}],"limitations":["Authentication logs, access events, accounts, and policy exports are copied only from caller-supplied fields. Identity providers are not contacted and OAuth is not used.","Time correlation, geolocation comparison, and behavioural rules run locally over supplied records. Missing values are not invented.","VPN, proxy, shared-network, and legitimate-travel labels reduce confidence when supplied. A single unusual login is never treated as proof of account compromise.","Observed facts are separated from inferred threat hypotheses. Events are not labeled confirmed compromise without sufficient multi-signal evidence.","No paid identity-threat feed is used and no API key is required."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.04"},"protocols":[{"x402":{}}]}}}},"components":{"schemas":{"ApiError":{"type":"object","required":["error"],"properties":{"error":{"type":"object","required":["code","message"],"properties":{"code":{"type":"string"},"message":{"type":"string"},"details":{}}}}}}}}