Get ATO profile

Retrieve the current account takeover risk profile for a subject, including failed login count, risk level, and known devices.

Returns the ATO risk profile for the specified subject. The profile tracks failed login velocity in a rolling one-hour window and records known IP addresses and devices. Use this endpoint to check the current risk posture of a user without triggering a new evaluation.

See the account takeover detection guide for the full workflow.

Path parameters

subject_id · string · required

The subject identifier to look up (user ID, email, or external ID).

Response

subject_id · string

The subject identifier.

subject_type · string

Type of subject (user).

risk_level · string

Current ATO risk level: normal | elevated | high | critical

failed_login_count · integer

Number of failed logins in the current one-hour window.

known_ips · array

List of IP addresses previously seen for this subject.

known_devices · array

List of device identifiers previously seen for this subject.

updated_at · string

ISO 8601 timestamp of the last profile update.