RiskEvents

Anomalous-login / risk-detection signals (impossible travel, new device, credential stuffing) — one severity-filterable, cursor-paginated stream for the admin risk dashboard (SSO-2143).

Base URL: https://api.stg.thoryn.org

Operations

Method	Path	Summary	Scopes
GET	/api/v1/security/risk-events	Risk Events List	tenant:audit.read

Operation details

GET /api/v1/security/risk-events

Risk Events List

• Operation ID: riskEventsList
• Required scopes: tenant:audit.read

Parameters:

Name	In	Required	Type	Description
signalType	query	no	string
subjectId	query	no	string
riskLevel	query	no	string
from	query	no	string
to	query	no	string
cursor	query	no	string
limit	query	no	integer

Responses:

Status	Description	Body
200	OK	object
401	Unauthorized — bearer token missing, expired, signed by an untrusted issuer, or missing the tnt tenant claim.	Problem (problem+json)
403	Forbidden — token lacks a required tenant:* scope, or the tnt claim does not match the tenant addressed by the request path.	Problem (problem+json)