Skip to main content
GET
Get failed attacks
For common API errors, see API Troubleshooting.
This route is limited to 1 request per minute.
You can find a tenant’s Petra ID in the URL when viewing a tenant in the dashboard (e.g. app.petrasecurity.com/tenant/<tenantId>). You can also pass a Microsoft tenant ID and the endpoint will resolve it automatically.

Authorizations

Authorization
string
header
required

Bearer token authentication. Include your API key in the Authorization header as 'Bearer YOUR_API_KEY'

Query Parameters

tenantId
string
required

The tenant to generate the report for. Accepts either a Petra tenant ID or a Microsoft tenant ID. You can find a tenant's Petra ID in the URL when viewing a tenant in the dashboard (e.g. app.petrasecurity.com/tenant/). You can also pass a Microsoft tenant ID and the endpoint will resolve it automatically.

startDate
string<date-time>

Start of the reporting window. Accepts ISO 8601 date or date-time (e.g. 2026-03-01 or 2026-03-01T00:00:00Z). Defaults to 30 days before endDate.

endDate
string<date-time>

End of the reporting window. Accepts ISO 8601 date or date-time. Defaults to now.

Response

Successful response

dateRange
object
tenant
object

The tenant this report covers

totalCount
integer

Total number of failed attacks in the window

byCountry
object[]

Failed attacks grouped by origin country

byDay
object[]

Daily breakdown of failed attacks grouped by attack type

topTargetedUsers
object[]

Users most targeted by failed attacks