Look up a user's sign-in activity

For platform staff: a user's account (ID, address, platform role, whether it's disabled), its active console sessions and its recent security events (sign-ins, fresh sign-ins, refused sign-ins, sign-outs and account changes), as the user sees them on their account page. Use it to investigate a suspected account takeover; end the sessions by disabling the user.

Who can call it: platform staff with read access to the platform console.

At a glance

REST: POST /api/v1/platform/users/sign_ins
MCP tool: platform_users_sign_ins_list
Operation ID: platform.users.sign_ins.list
Scope: Platform
Permission: platform:read
Risk tier: read
Dry run: Not supported
Idempotency: Idempotency-Key required
Modes: Test and live
Authentication: API key with the platform:read scope
Since: M13

Request

Body

A JSON object (Content-Type: application/json):

Field	Type	Required	Description
`email`	string	No	The user's email address.
`user`	`usr_…` ID	No	Or the user's ID (`usr_…`).
`limit`	integer (1 to 100)	No

Response

200 OK with a JSON object:

Field	Type	Description
`object`	`"user_security"`
`user`	object
`user.id`	`usr_…` ID
`user.email`	string
`user.platformRole`	string or null
`user.disabled`	boolean
`user.lastLoginAt`	date-time or null
`sessions`	array of object
`sessions[].object`	`"session"`
`sessions[].id`	`ses_…` ID
`sessions[].createdAt`	date-time	When the session was created (the sign-in).
`sessions[].lastAuthenticatedAt`	date-time	When you last proved who you are on this session (sign-in or a fresh sign-in).
`sessions[].idleExpiresAt`	date-time	When it ends without activity (2 hours after the last request, moved forward by activity).
`sessions[].expiresAt`	date-time	When it ends at the latest (12 hours after the sign-in).
`sessions[].country`	string or null	The country of the sign-in request, when known.
`sessions[].userAgent`	string or null	The browser that signed in.
`events`	array of object
`events[].object`	`"security_event"`
`events[].id`	`aud_…` ID
`events[].at`	date-time
`events[].action`	string	`auth.signed_in`, `auth.reauthenticated`, `auth.sign_in_refused`, `auth.signed_out`, `auth.identity_linked` (a Google or Microsoft account added), `auth.notice_sent` (a security email sent to you), or the operation that changed the account (e.g. `users.sessions.revoke`).
`events[].by`	one of `you`, `staff`, `system`	Who did it: you, Ownrecord staff, or the platform.
`events[].method`	string or null	How you signed in: `email` (a sign-in link), `google`, `microsoft-entra-id`, or `dev`.
`events[].reason`	string or null	Why a sign-in was refused (an error code), how a session ended, or what a security email was about (`new_sign_in`, `identity_linked`).
`events[].country`	string or null
`events[].network`	string or null	The client address shortened to its network (/24 for IPv4, /48 for IPv6).
`events[].userAgent`	string or null

Examples

By address

HTTP

POST /api/v1/platform/users/sign_ins
Authorization: Bearer or_test_…
Idempotency-Key: 3f1c9a52-7d0e-4b8f-9a61-0c2d5e8b7f14
Content-Type: application/json

{
  "email": "ana@acme.example",
  "limit": 50
}

Response (200):

JSON

{
  "object": "user_security",
  "user": {
    "id": "usr_01m4tx5nj8emwbyf7y9vcf47xa",
    "email": "ana@acme.example",
    "platformRole": null,
    "disabled": false,
    "lastLoginAt": "2026-10-30T08:15:00.000Z"
  },
  "sessions": [
    {
      "object": "session",
      "id": "ses_01m4tx5nj8emwbyf7y9vcf47xc",
      "createdAt": "2026-10-30T08:15:00.000Z",
      "lastAuthenticatedAt": "2026-10-30T08:15:00.000Z",
      "idleExpiresAt": "2026-10-30T10:15:00.000Z",
      "expiresAt": "2026-10-30T20:15:00.000Z",
      "country": "HR",
      "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 15_5) AppleWebKit/605.1.15 Version/18.5 Safari/605.1.15"
    }
  ],
  "events": [
    {
      "object": "security_event",
      "id": "aud_01m4tx5nj8emwbyf7y9vcf47xe",
      "at": "2026-10-30T08:15:00.000Z",
      "action": "auth.signed_in",
      "by": "you",
      "method": "google",
      "reason": null,
      "country": "HR",
      "network": "203.0.113.0",
      "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 15_5) AppleWebKit/605.1.15 Version/18.5 Safari/605.1.15"
    },
    {
      "object": "security_event",
      "id": "aud_01m4tx5nj8emwbyf7y9vcf47xf",
      "at": "2026-10-29T17:02:00.000Z",
      "action": "auth.sign_in_refused",
      "by": "system",
      "method": "email",
      "reason": "sign_in_link_rate_limited",
      "country": "DE",
      "network": "198.51.100.0",
      "userAgent": null
    }
  ]
}

Errors

Code	HTTP status	When	What to do
`validation_failed`	400	Neither or both of `email` and `user` were passed.	Fix the fields listed in `details.issues` and send the request again.
`resource_not_found`	404	No user has this address or ID.	Check the ID and that your credentials are scoped to the right organization, entity, brand and mode.
`permission_denied`	403	You aren't platform staff with read access to the platform console.	Ask an organization owner or admin for a role or scope that allows this action.

It can also return these common errors: api_version_unsupported, invalid_json, unsupported_media_type, authentication_required, api_key_invalid, idempotency_key_required, dry_run_not_supported, rate_limited, internal_error.

At a glance#

Request#

Body#

Response#

Examples#

By address#

Errors#