Get the attack protection settings

GET /v1/attack-protection · permission attack-protection:read

Returns the environment's attack protection object: brute force, suspicious IP throttling, credential stuffing, bot protection, breached password, sign-up protection, SMS protection and risk policy. Every section has two views: configured is what you wrote, effective is the value in force, with the defaults, the security floor and your plan applied. A section you never wrote has configured: {}. The ETag response header identifies the object's content; send it as If-Match on PUT and PATCH.

Request

This operation takes no path, query or body fields. The environment comes from the credential.

Response

200 OK with the object and the ETag header.

{
  "schema_version": 1,
  "brute_force": {
    "configured": {"max_failures": 10},
    "effective": {"mode": "enforce", "max_failures": 10, "window_minutes": 15, "lock_minutes": 15, "notify_user": true}
  },
  "risk_policy": {
    "configured": {"mode": "enforce"},
    "effective": {"mode": "log", "challenge_threshold": 4, "block_threshold": null, "notify_user_on_new_device": true}
  },
  "bot_protection": {
    "configured": {},
    "effective": {"mode": "risk_based", "provider": "altcha"}
  }
}

The example is shortened: every response carries all eight sections (brute_force, suspicious_ip_throttling, credential_stuffing, bot_protection, breached_password, signup_protection, sms_protection, risk_policy). In the example the plan no longer includes risk enforcement, so the configured enforce is kept but reads as log.

Fields

Field	Type	Range or values	Default	Floor
`brute_force.mode`	string	`log`, `enforce`	`enforce`
`brute_force.max_failures`	integer	5-100	20	at most 100
`brute_force.window_minutes`	integer	5-60	15
`brute_force.lock_minutes`	integer	5-60	15	at least 5
`brute_force.notify_user`	boolean		`true`
`suspicious_ip_throttling.mode`	string	`log`, `enforce`	`enforce`
`suspicious_ip_throttling.login_failures_per_ip_per_day`	integer	10-10000	100
`suspicious_ip_throttling.signups_per_ip_per_hour`	integer	1-20	20	at most 20
`suspicious_ip_throttling.allowlist`	string[]	up to 100 CIDR prefixes; IPv4 no wider than /8, IPv6 no wider than /32	`[]`
`credential_stuffing.mode`	string	`log`, `enforce`	`enforce`
`credential_stuffing.attack_mode_auto`	boolean		`true`
`credential_stuffing.attack_mode_duration_minutes`	integer	15-240	30
`bot_protection.mode`	string	`off`, `risk_based`, `always`	`risk_based`
`bot_protection.provider`	string	`altcha`	`altcha`
`breached_password.on_signup`	string	`block`	`block`	`block`
`breached_password.on_password_change`	string	`block`	`block`	`block`
`breached_password.on_login`	string	`require_reset`, `notify`	`require_reset`
`breached_password.notify_user`	boolean		`true`
`signup_protection.block_disposable_email`	boolean		`true`
`signup_protection.block_email_subaddress`	boolean		`false`
`signup_protection.max_signups_per_device_30d`	integer	1-50	3
`sms_protection.allowed_countries`	string[]	up to 250 ISO 3166-1 alpha-2 codes	`[]` (plan default)
`sms_protection.daily_cap`	integer \| null	1-1000000; `null` is the plan value	`null`
`sms_protection.conversion_breaker`	boolean		`true`	`true`
`risk_policy.mode`	string	`log`, `enforce` (`enforce` needs the Startup plan or higher)	`log`
`risk_policy.challenge_threshold`	integer	3-8	4
`risk_policy.block_threshold`	integer \| null	6-12, greater than `challenge_threshold`; `null` is off	`null`
`risk_policy.notify_user_on_new_device`	boolean		`true`

Errors

HTTP	code	When
401	`unauthenticated`	The credential is missing, invalid or revoked.
403	`insufficient_permissions`	The credential lacks the required permission.
429	`rate_limited`	The rate limit was exceeded; retry after the `Retry-After` period.
503	`service_unavailable`	A dependency is temporarily unavailable; retry after the `Retry-After` period.

Example

curl https://api.eu.keenauth.com/v1/attack-protection \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"