Skip to main content
GET
/
v1
/
failed-attacks
Get failed attacks
curl --request GET \
  --url https://api.petrasecurity.com/v1/failed-attacks \
  --header 'Authorization: Bearer <token>'
{
  "dateRange": {
    "startDate": "2025-01-05T00:00:00.000Z",
    "endDate": "2025-02-25T00:00:00.000Z"
  },
  "tenant": {
    "petraTenantId": "ZZk90t",
    "name": "Acme Corp.",
    "microsoftTenantId": "a1b2c3d4-5e6f-7890-abcd-ef1234567890"
  },
  "totalCount": 50471,
  "byCountry": [
    {
      "name": "United States",
      "countryCode": "US",
      "count": 11501
    },
    {
      "name": "China",
      "countryCode": "CN",
      "count": 11349
    },
    {
      "name": "South Korea",
      "countryCode": "KR",
      "count": 5184
    }
  ],
  "byDay": [
    {
      "date": "2025-01-05T00:00:00.000Z",
      "byType": [
        {
          "attackType": "LEGACY_AUTH",
          "count": 11
        }
      ]
    },
    {
      "date": "2025-01-06T00:00:00.000Z",
      "byType": [
        {
          "attackType": "LEGACY_AUTH",
          "count": 66
        },
        {
          "attackType": "PASSWORD_SPRAY",
          "count": 30
        }
      ]
    },
    {
      "date": "2025-01-07T00:00:00.000Z",
      "byType": [
        {
          "attackType": "LEGACY_AUTH",
          "count": 97
        },
        {
          "attackType": "PASSWORD_SPRAY",
          "count": 42
        }
      ]
    }
  ],
  "topTargetedUsers": [
    {
      "userPrincipalName": "pink.jones@acmecorp.com",
      "fullName": "Pink Jones",
      "jobTitle": "Sales Representative",
      "count": 4463,
      "attackOriginCountries": [
        {
          "name": "India",
          "countryCode": "IN"
        },
        {
          "name": "United Arab Emirates",
          "countryCode": "AE"
        },
        {
          "name": "Portugal",
          "countryCode": "PT"
        }
      ]
    },
    {
      "userPrincipalName": "solon.doyle@acmecorp.com",
      "fullName": "Solon Doyle",
      "jobTitle": "Network Engineer",
      "count": 2519,
      "attackOriginCountries": [
        {
          "name": "China",
          "countryCode": "CN"
        },
        {
          "name": "Russia",
          "countryCode": "RU"
        },
        {
          "name": "South Korea",
          "countryCode": "KR"
        }
      ]
    },
    {
      "userPrincipalName": "annabel.ankunding@acmecorp.com",
      "fullName": "Annabel Ankunding",
      "jobTitle": "Sales Manager",
      "count": 2466,
      "attackOriginCountries": [
        {
          "name": "France",
          "countryCode": "FR"
        },
        {
          "name": "Germany",
          "countryCode": "DE"
        },
        {
          "name": "Spain",
          "countryCode": "ES"
        }
      ]
    }
  ]
}
For common API errors, see API Troubleshooting.
This route is limited to 1 request per minute.
You can find a tenant’s Petra ID in the URL when viewing a tenant in the dashboard (e.g. app.petrasecurity.com/tenant/<tenantId>). You can also pass a Microsoft tenant ID and the endpoint will resolve it automatically.

Authorizations

Authorization
string
header
required

Bearer token authentication. Include your API key in the Authorization header as 'Bearer YOUR_API_KEY'

Query Parameters

tenantId
string
required

The tenant to generate the report for. Accepts either a Petra tenant ID or a Microsoft tenant ID. You can find a tenant's Petra ID in the URL when viewing a tenant in the dashboard (e.g. app.petrasecurity.com/tenant/). You can also pass a Microsoft tenant ID and the endpoint will resolve it automatically.

startDate
string<date-time>

Start of the reporting window. Accepts ISO 8601 date or date-time (e.g. 2026-03-01 or 2026-03-01T00:00:00Z). Defaults to 30 days before endDate.

endDate
string<date-time>

End of the reporting window. Accepts ISO 8601 date or date-time. Defaults to now.

Response

Successful response

dateRange
object
tenant
object

The tenant this report covers

totalCount
integer

Total number of failed attacks in the window

byCountry
object[]

Failed attacks grouped by origin country

byDay
object[]

Daily breakdown of failed attacks grouped by attack type

topTargetedUsers
object[]

Users most targeted by failed attacks