Skip to main content
GET
/
v1
/
failed-attacks
Get failed attacks
curl --request GET \
  --url https://api.petrasecurity.com/v1/failed-attacks \
  --header 'Authorization: Bearer <token>'
{
  "dateRange": {
    "startDate": "2025-01-05T00:00:00.000Z",
    "endDate": "2025-02-25T00:00:00.000Z"
  },
  "tenant": {
    "petraTenantId": "ZZk90t",
    "name": "Acme Corp.",
    "microsoftTenantId": "a1b2c3d4-5e6f-7890-abcd-ef1234567890"
  },
  "totalCount": 50471,
  "byCountry": [
    {
      "name": "United States",
      "countryCode": "US",
      "count": 11501
    },
    {
      "name": "China",
      "countryCode": "CN",
      "count": 11349
    },
    {
      "name": "South Korea",
      "countryCode": "KR",
      "count": 5184
    }
  ],
  "byDay": [
    {
      "date": "2025-01-05T00:00:00.000Z",
      "byType": [
        {
          "attackType": "LEGACY_AUTH",
          "count": 11
        }
      ]
    },
    {
      "date": "2025-01-06T00:00:00.000Z",
      "byType": [
        {
          "attackType": "LEGACY_AUTH",
          "count": 66
        },
        {
          "attackType": "PASSWORD_SPRAY",
          "count": 30
        }
      ]
    },
    {
      "date": "2025-01-07T00:00:00.000Z",
      "byType": [
        {
          "attackType": "LEGACY_AUTH",
          "count": 97
        },
        {
          "attackType": "PASSWORD_SPRAY",
          "count": 42
        }
      ]
    }
  ],
  "topTargetedUsers": [
    {
      "userPrincipalName": "pink.jones@acmecorp.com",
      "fullName": "Pink Jones",
      "jobTitle": "Sales Representative",
      "count": 4463,
      "attackOriginCountries": [
        {
          "name": "India",
          "countryCode": "IN"
        },
        {
          "name": "United Arab Emirates",
          "countryCode": "AE"
        },
        {
          "name": "Portugal",
          "countryCode": "PT"
        }
      ]
    },
    {
      "userPrincipalName": "solon.doyle@acmecorp.com",
      "fullName": "Solon Doyle",
      "jobTitle": "Network Engineer",
      "count": 2519,
      "attackOriginCountries": [
        {
          "name": "China",
          "countryCode": "CN"
        },
        {
          "name": "Russia",
          "countryCode": "RU"
        },
        {
          "name": "South Korea",
          "countryCode": "KR"
        }
      ]
    },
    {
      "userPrincipalName": "annabel.ankunding@acmecorp.com",
      "fullName": "Annabel Ankunding",
      "jobTitle": "Sales Manager",
      "count": 2466,
      "attackOriginCountries": [
        {
          "name": "France",
          "countryCode": "FR"
        },
        {
          "name": "Germany",
          "countryCode": "DE"
        },
        {
          "name": "Spain",
          "countryCode": "ES"
        }
      ]
    }
  ]
}

Documentation Index

Fetch the complete documentation index at: https://docs.petrasecurity.com/docs/llms.txt

Use this file to discover all available pages before exploring further.

For common API errors, see API Troubleshooting.
This route is limited to 10 requests per minute.
You can find a tenant’s Petra ID in the URL when viewing a tenant in the dashboard (e.g. app.petrasecurity.com/tenant/<tenantId>). You can also pass a Microsoft tenant ID and the endpoint will resolve it automatically.

Authorizations

Authorization
string
header
required

Bearer token authentication. Include your API key in the Authorization header as 'Bearer YOUR_API_KEY'

Query Parameters

tenantId
string
required

The tenant to generate the report for. Accepts either a Petra tenant ID or a Microsoft tenant ID. You can find a tenant's Petra ID in the URL when viewing a tenant in the dashboard (e.g. app.petrasecurity.com/tenant/). You can also pass a Microsoft tenant ID and the endpoint will resolve it automatically.

startDate
string<date-time>

Start of the reporting window. Accepts ISO 8601 date or date-time (e.g. 2026-03-01 or 2026-03-01T00:00:00Z). Defaults to 30 days before endDate.

endDate
string<date-time>

End of the reporting window. Accepts ISO 8601 date or date-time. Defaults to now.

Response

Successful response

dateRange
object
tenant
object

The tenant this report covers

totalCount
integer

Total number of failed attacks in the window

byCountry
object[]

Failed attacks grouped by origin country

byDay
object[]

Daily breakdown of failed attacks grouped by attack type

topTargetedUsers
object[]

Users most targeted by failed attacks