Skip to content
Authrim

Get authentication timeline

GET
/api/admin/stats/timeline
Code sample: Shell / cURL 
curl --request GET \
  --url 'https://auth.example.com/api/admin/stats/timeline?from=2026-04-15T12%3A00%3A00Z&to=2026-04-15T12%3A00%3A00Z&interval=hour&tz=UTC' \
  --header 'Authorization: Bearer <token>'

Returns time-bucketed authentication success, failure, and MFA usage counts. Retained whole-row archives are included in supported log queries. A bounded query that cannot read its required rows returns log_query_incomplete instead of partial statistics or an empty success.

Authorizations

Section titled “Authorizations ”

Parameters

Section titled “ Parameters ”

Query Parameters

Section titled “Query Parameters ”
from
required
string format: date-time

Inclusive start of the statistics period.

to
required
string format: date-time

Inclusive end of the statistics period.

client_id
string

Optional client ID filter.

interval
string
default: day
Allowed values: hour day week

Timeline bucket size.

tz
string
default: UTC

Timezone label returned in the response.

Responses

Section titled “ Responses ”

200

Section titled “200 ”

Time-bucketed authentication statistics for the requested period.

Media type application/json
object
data
Array<object>
object
ts
string
success
integer
failed
integer
mfa_used
integer
key
additional properties
interval
string
tz
string
period
object
from
string format: date-time
to
string format: date-time
key
additional properties
key
additional properties
Example 
{
  "data": [
    {
      "ts": "2026-06-01T00:00:00.000Z",
      "success": 120,
      "failed": 3,
      "mfa_used": 44
    },
    {
      "ts": "2026-06-01T01:00:00.000Z",
      "success": 133,
      "failed": 4,
      "mfa_used": 40
    }
  ],
  "interval": "hour",
  "tz": "UTC",
  "period": {
    "from": "2026-06-01T00:00:00.000Z",
    "to": "2026-06-02T00:00:00.000Z"
  }
}

Headers

Section titled “Headers ”
X-Authrim-Log-Consistency
string
Allowed values: snapshot eventual local_hot_only

Snapshot for the remote scheduled view; eventual when Pipeline visibility can lag ingestion; local_hot_only for local scheduled staging without a remote Catalog.

X-Authrim-Log-Pending-Deliveries
integer

Tenant deliveries not yet confirmed visible. Omitted for self-service subjects. Zero does not guarantee immediate Pipeline visibility.

X-Authrim-Log-Complete
boolean

True only for a complete bounded snapshot query. Pipeline responses remain false; incomplete reads return 503.

400

Section titled “400 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

401

Section titled “401 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

403

Section titled “403 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

503

Section titled “503 ”

The retained log query is incomplete. No partial entries or statistics are returned as a successful result. Narrow the period or retry.

Media type application/json
object
error
required
string
Allowed value: log_query_incomplete
error_description
required
string
complete
required
boolean
key
additional properties
Example 
{
  "error": "log_query_incomplete",
  "complete": false
}