Retrieve a List of Successful and Failed Logins within a Given Timeframe

Knowledge Articles
1

Overview

This article details how to retrieve a list of successful and failed logins within a given timeframe.

Applies To

  • Reports
  • Successful / Failed Logins

Solution

Retrieve a list of successful and failed logins using the “type” and “date” fields.

  • The example below will retrieve all successful and failed logins between 24th June 12pm UTC and 25th June 8am UTC:
    (type:s OR type:f) AND date:[2024-06-24T12:00:00.000Z TO 2024-06-25T08:00:00.000Z]

If wanting to export this data in bulk, use the management API to query the data.

  • Here is an example using the last query that includes both successful and failed logins within the timeframe:
    curl -H "Authorization: Bearer $TOKEN" 'https://${DOMAIN}/api/v2/logs?q=(type%3As%20OR%20type%3Af)%20AND%20date%3A%5B2024-06-24T12%3A00%3A00.000Z%20TO%202024-06-25T08%3A00%3A00.000Z%5D

Where $DOMAIN is the Auth0 tenant domain (e.g., “https://tenant.region.auth0.com”) and $TOKEN is the management API token.

The above request will return logs with each entry as an object in a JSON array. Then, a tool like “jq” can be used to further filter and format the data as desired.

Related References

  • Find more details on the search logs endpoint here.
  • More details on the log query syntax are here.