List account lockouts

GET /v1/attack-protection/lockouts · permission attack-protection:read

Lists the environment's open account lockouts, oldest first. Brute force protection locks one sign-in path of a user (for example password or totp) after too many failures; the user's other paths stay open. A lockout that has expired is not listed, because it no longer blocks the path. The list pages forward only and returns no total count. The response holds no IP address and no failure counter key.

Request

Parameter	In	Required	Description
`limit`	query	no	Items per page, 1-100 (default 20).
`after`	query	no	Cursor from `list_metadata.after` of the previous page.

before and order=desc are not supported and return 422.

Response

200 OK.

{
  "data": [
    {
      "id": "lck_01jaz8m5c3f6t9w2y4b7d0g3k6",
      "user_id": "usr_0a1b2c3d4e5f6g7h8j9k0m1n2p",
      "path": "password",
      "locked_at": "2026-10-20T09:00:00Z",
      "expires_at": "2026-10-20T09:15:00Z",
      "failure_count": 20
    }
  ],
  "list_metadata": {"before": null, "after": null}
}

Field	Description
`id`	Lockout id, prefixed `lck_`. The `user.unlocked` event carries the same id.
`user_id`	The locked user.
`path`	The locked sign-in path: `password`, `totp`, `sms_2fa`, `email_2fa`, `otp` or `recovery_code`.
`locked_at`, `expires_at`	When the lockout started and when it lifts by itself.
`failure_count`	Failed attempts in the window that caused the lockout.

Errors

Every error is an application/problem+json body with a stable code.

HTTP	`code`	When
400	`invalid_cursor`	The cursor is malformed or belongs to another list.
422	`validation_failed`	`limit` is out of range, or `before` or a descending `order` was sent.
401	`unauthenticated`	The API key is missing, invalid or revoked.
403	`insufficient_permissions`	The key lacks the `attack-protection:read` permission.
429	`rate_limited`	The rate limit was exceeded; honor `Retry-After`.
503	`service_unavailable`	A dependency is temporarily unavailable; retry later.

Example

curl https://api.eu.keenauth.com/v1/attack-protection/lockouts?limit=50 \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"

CLI: keenauth attack-protection lockouts list --limit 50