Get failed attacks
curl --request GET \
--url https://api.petrasecurity.com/v1/failed-attacks \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.petrasecurity.com/v1/failed-attacks"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.petrasecurity.com/v1/failed-attacks', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.petrasecurity.com/v1/failed-attacks",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.petrasecurity.com/v1/failed-attacks"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.petrasecurity.com/v1/failed-attacks")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.petrasecurity.com/v1/failed-attacks")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"dateRange": {
"startDate": "2025-01-05T00:00:00.000Z",
"endDate": "2025-02-25T00:00:00.000Z"
},
"tenant": {
"petraTenantId": "ZZk90t",
"name": "Acme Corp.",
"microsoftTenantId": "a1b2c3d4-5e6f-7890-abcd-ef1234567890"
},
"totalCount": 50471,
"byCountry": [
{
"name": "United States",
"countryCode": "US",
"count": 11501
},
{
"name": "China",
"countryCode": "CN",
"count": 11349
},
{
"name": "South Korea",
"countryCode": "KR",
"count": 5184
}
],
"byDay": [
{
"date": "2025-01-05T00:00:00.000Z",
"byType": [
{
"attackType": "LEGACY_AUTH",
"count": 11
}
]
},
{
"date": "2025-01-06T00:00:00.000Z",
"byType": [
{
"attackType": "LEGACY_AUTH",
"count": 66
},
{
"attackType": "PASSWORD_SPRAY",
"count": 30
}
]
},
{
"date": "2025-01-07T00:00:00.000Z",
"byType": [
{
"attackType": "LEGACY_AUTH",
"count": 97
},
{
"attackType": "PASSWORD_SPRAY",
"count": 42
}
]
}
],
"topTargetedUsers": [
{
"userPrincipalName": "pink.jones@acmecorp.com",
"fullName": "Pink Jones",
"jobTitle": "Sales Representative",
"count": 4463,
"attackOriginCountries": [
{
"name": "India",
"countryCode": "IN"
},
{
"name": "United Arab Emirates",
"countryCode": "AE"
},
{
"name": "Portugal",
"countryCode": "PT"
}
]
},
{
"userPrincipalName": "solon.doyle@acmecorp.com",
"fullName": "Solon Doyle",
"jobTitle": "Network Engineer",
"count": 2519,
"attackOriginCountries": [
{
"name": "China",
"countryCode": "CN"
},
{
"name": "Russia",
"countryCode": "RU"
},
{
"name": "South Korea",
"countryCode": "KR"
}
]
},
{
"userPrincipalName": "annabel.ankunding@acmecorp.com",
"fullName": "Annabel Ankunding",
"jobTitle": "Sales Manager",
"count": 2466,
"attackOriginCountries": [
{
"name": "France",
"countryCode": "FR"
},
{
"name": "Germany",
"countryCode": "DE"
},
{
"name": "Spain",
"countryCode": "ES"
}
]
}
]
}{
"error": {
"code": "UNAUTHORIZED",
"message": "Invalid API key",
"details": "The provided API key is invalid or has been revoked"
}
}{
"error": {
"code": "UNAUTHORIZED",
"message": "Invalid API key",
"details": "The provided API key is invalid or has been revoked"
}
}{
"error": {
"code": "UNAUTHORIZED",
"message": "Invalid API key",
"details": "The provided API key is invalid or has been revoked"
}
}{
"error": {
"code": "UNAUTHORIZED",
"message": "Invalid API key",
"details": "The provided API key is invalid or has been revoked"
}
}{
"error": {
"code": "UNAUTHORIZED",
"message": "Invalid API key",
"details": "The provided API key is invalid or has been revoked"
}
}Endpoints
Get Failed Attacks
Retrieve failed-attack data for a specific tenant. Returns attack counts by country, daily attack breakdowns by type, and the most targeted users for the requested date range.
GET
/
v1
/
failed-attacks
Get failed attacks
curl --request GET \
--url https://api.petrasecurity.com/v1/failed-attacks \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.petrasecurity.com/v1/failed-attacks"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.petrasecurity.com/v1/failed-attacks', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.petrasecurity.com/v1/failed-attacks",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.petrasecurity.com/v1/failed-attacks"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.petrasecurity.com/v1/failed-attacks")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.petrasecurity.com/v1/failed-attacks")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"dateRange": {
"startDate": "2025-01-05T00:00:00.000Z",
"endDate": "2025-02-25T00:00:00.000Z"
},
"tenant": {
"petraTenantId": "ZZk90t",
"name": "Acme Corp.",
"microsoftTenantId": "a1b2c3d4-5e6f-7890-abcd-ef1234567890"
},
"totalCount": 50471,
"byCountry": [
{
"name": "United States",
"countryCode": "US",
"count": 11501
},
{
"name": "China",
"countryCode": "CN",
"count": 11349
},
{
"name": "South Korea",
"countryCode": "KR",
"count": 5184
}
],
"byDay": [
{
"date": "2025-01-05T00:00:00.000Z",
"byType": [
{
"attackType": "LEGACY_AUTH",
"count": 11
}
]
},
{
"date": "2025-01-06T00:00:00.000Z",
"byType": [
{
"attackType": "LEGACY_AUTH",
"count": 66
},
{
"attackType": "PASSWORD_SPRAY",
"count": 30
}
]
},
{
"date": "2025-01-07T00:00:00.000Z",
"byType": [
{
"attackType": "LEGACY_AUTH",
"count": 97
},
{
"attackType": "PASSWORD_SPRAY",
"count": 42
}
]
}
],
"topTargetedUsers": [
{
"userPrincipalName": "pink.jones@acmecorp.com",
"fullName": "Pink Jones",
"jobTitle": "Sales Representative",
"count": 4463,
"attackOriginCountries": [
{
"name": "India",
"countryCode": "IN"
},
{
"name": "United Arab Emirates",
"countryCode": "AE"
},
{
"name": "Portugal",
"countryCode": "PT"
}
]
},
{
"userPrincipalName": "solon.doyle@acmecorp.com",
"fullName": "Solon Doyle",
"jobTitle": "Network Engineer",
"count": 2519,
"attackOriginCountries": [
{
"name": "China",
"countryCode": "CN"
},
{
"name": "Russia",
"countryCode": "RU"
},
{
"name": "South Korea",
"countryCode": "KR"
}
]
},
{
"userPrincipalName": "annabel.ankunding@acmecorp.com",
"fullName": "Annabel Ankunding",
"jobTitle": "Sales Manager",
"count": 2466,
"attackOriginCountries": [
{
"name": "France",
"countryCode": "FR"
},
{
"name": "Germany",
"countryCode": "DE"
},
{
"name": "Spain",
"countryCode": "ES"
}
]
}
]
}{
"error": {
"code": "UNAUTHORIZED",
"message": "Invalid API key",
"details": "The provided API key is invalid or has been revoked"
}
}{
"error": {
"code": "UNAUTHORIZED",
"message": "Invalid API key",
"details": "The provided API key is invalid or has been revoked"
}
}{
"error": {
"code": "UNAUTHORIZED",
"message": "Invalid API key",
"details": "The provided API key is invalid or has been revoked"
}
}{
"error": {
"code": "UNAUTHORIZED",
"message": "Invalid API key",
"details": "The provided API key is invalid or has been revoked"
}
}{
"error": {
"code": "UNAUTHORIZED",
"message": "Invalid API key",
"details": "The provided API key is invalid or has been revoked"
}
}For common API errors, see API Troubleshooting.
This route is limited to 1 request per minute.
app.petrasecurity.com/tenant/<tenantId>). You can also pass a Microsoft tenant ID and the endpoint will resolve it automatically.Authorizations
Bearer token authentication. Include your API key in the Authorization header as 'Bearer YOUR_API_KEY'
Query Parameters
The tenant to generate the report for. Accepts either a Petra tenant ID or a Microsoft tenant ID. You can find a tenant's Petra ID in the URL when viewing a tenant in the dashboard (e.g. app.petrasecurity.com/tenant/). You can also pass a Microsoft tenant ID and the endpoint will resolve it automatically.
Start of the reporting window. Accepts ISO 8601 date or date-time (e.g. 2026-03-01 or 2026-03-01T00:00:00Z). Defaults to 30 days before endDate.
End of the reporting window. Accepts ISO 8601 date or date-time. Defaults to now.
Response
Successful response
Show child attributes
Show child attributes
The tenant this report covers
Show child attributes
Show child attributes
Total number of failed attacks in the window
Failed attacks grouped by origin country
Show child attributes
Show child attributes
Daily breakdown of failed attacks grouped by attack type
Show child attributes
Show child attributes
Users most targeted by failed attacks
Show child attributes
Show child attributes