Client Login History
Audit trail of authentication attempts (success and failure) by an RBAC client. Distinct from /sessions — that endpoint shows successful sessions; this one shows every attempt, including failures, useful for spotting brute-force attempts or anomalous login locations.
Records are kept per the platform's retention policy (typically 90 days for failure events, longer for successes).
Path parameters
id string (uuid) Req
Endpoint UUID.
client_id int64 Req
Client ID.
Query parameters
limit int
Max records to return. Must be a positive integer; otherwise the default of
50 is used.Response (200 OK)
A bare JSON array of login-history objects (not wrapped in an envelope), most recent first.
[].id int64
Login-history record ID.
[].endpoint_id, client_id int64
Owning endpoint and client.
[].created_at datetime
When the attempt occurred.
[].success boolean
true = authentication succeeded; false = wrong credentials, expired token, etc.[].auth_method string
Method attempted:
username_password, token, oauth, or session.[].oauth_provider string?
Provider type for OAuth attempts (e.g.
google). Omitted otherwise.[].ip_address string
Source IP of the attempt.
[].user_agent string?
User-Agent of the attempt. Omitted if empty.
[].failure_reason string?
Free-text reason set on failed attempts. Omitted on success.
Errors
401 Unauthorized
Missing auth.
404 Not Found
Endpoint doesn't exist or doesn't belong to the calling account.
Request
curl "https://api.ngris.com/v1/endpoints/<uuid>/rbac/clients/11/login-history" \
-H "X-API-KEY: <your_api_key>"
Python — surface failures
from ngris import Ngris
client = Ngris(api_key="<your_api_key>")
hist = client._get_raw(
"/endpoints/<endpoint_uuid>/rbac/clients/11/login-history?limit=100"
)
fails = [e for e in hist if not e["success"]]
print(f"{len(fails)} failed attempts in window")
for e in fails[:5]:
print(f" {e['created_at']} {e['ip_address']} {e.get('failure_reason')}")
Response — 200 OK
[
{
"id": 901,
"endpoint_id": 184,
"client_id": 11,
"created_at": "2026-04-29T13:45:00Z",
"success": true,
"auth_method": "oauth",
"oauth_provider": "google",
"ip_address": "203.0.113.42",
"user_agent": "Mozilla/5.0 ..."
},
{
"id": 900,
"endpoint_id": 184,
"client_id": 11,
"created_at": "2026-04-29T13:44:30Z",
"success": false,
"auth_method": "username_password",
"ip_address": "198.51.100.7",
"user_agent": "curl/8.0",
"failure_reason": "wrong_password"
}
]