Overview
This article details how to retrieve a list of successful and failed logins within a given timeframe.
Applies To
- Reports
- Successful / Failed Logins
Solution
Retrieve a list of successful and failed logins using the “type” and “date” fields.
- The example below will retrieve all successful and failed logins between 24th June 12pm UTC and 25th June 8am UTC:
-
(type:s OR type:f) AND date:[2024-06-24T12:00:00.000Z TO 2024-06-25T08:00:00.000Z]
If wanting to export this data in bulk, use the management API to query the data.
- Here is an example using the last query that includes both successful and failed logins within the timeframe:
- curl -H "Authorization: Bearer $TOKEN" 'https://${DOMAIN}/api/v2/logs?q=(type%3As%20OR%20type%3Af)%20AND%20date%3A%5B2024-06-24T12%3A00%3A00.000Z%20TO%202024-06-25T08%3A00%3A00.000Z%5D
Where $DOMAIN is the Auth0 tenant domain (e.g., “https://tenant.region.auth0.com”) and $TOKEN is the management API token.
The above request will return logs with each entry as an object in a JSON array. Then, a tool like “jq” can be used to further filter and format the data as desired.