# Look up a user's sign-in activity > The platform.users.sign_ins.list operation: POST /api/v1/platform/users/sign_ins in the REST API and the platform_users_sign_ins_list tool in the MCP server. For platform staff: a user's account (ID, address, platform role, whether it's disabled), its active console sessions and its recent security events (sign-ins, fresh sign-ins, refused sign-ins, sign-outs and account changes), as the user sees them on their account page. Use it to investigate a suspected account takeover; end the sessions by disabling the user. **Who can call it:** platform staff with read access to the platform console. ## At a glance - **REST:** `POST /api/v1/platform/users/sign_ins` - **MCP tool:** `platform_users_sign_ins_list` - **Operation ID:** `platform.users.sign_ins.list` - **Scope:** Platform - **Permission:** `platform:read` - **Risk tier:** `read` - **Dry run:** Not supported - **Idempotency:** `Idempotency-Key` required - **Modes:** Test and live - **Authentication:** API key with the `platform:read` scope - **Since:** M13 ## Request ### Body A JSON object (`Content-Type: application/json`): | Field | Type | Required | Description | | ------- | ------------------ | -------- | --------------------------- | | `email` | string | No | The user's email address. | | `user` | `usr_…` ID | No | Or the user's ID (`usr_…`). | | `limit` | integer (1 to 100) | No | | ## Response `200 OK` with a JSON object: | Field | Type | Description | | -------------------------------- | ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `object` | `"user_security"` | | | `user` | object | | | `user.id` | `usr_…` ID | | | `user.email` | string | | | `user.platformRole` | string or null | | | `user.disabled` | boolean | | | `user.lastLoginAt` | date-time or null | | | `sessions` | array of object | | | `sessions[].object` | `"session"` | | | `sessions[].id` | `ses_…` ID | | | `sessions[].createdAt` | date-time | When the session was created (the sign-in). | | `sessions[].lastAuthenticatedAt` | date-time | When you last proved who you are on this session (sign-in or a fresh sign-in). | | `sessions[].idleExpiresAt` | date-time | When it ends without activity (2 hours after the last request, moved forward by activity). | | `sessions[].expiresAt` | date-time | When it ends at the latest (12 hours after the sign-in). | | `sessions[].country` | string or null | The country of the sign-in request, when known. | | `sessions[].userAgent` | string or null | The browser that signed in. | | `events` | array of object | | | `events[].object` | `"security_event"` | | | `events[].id` | `aud_…` ID | | | `events[].at` | date-time | | | `events[].action` | string | `auth.signed_in`, `auth.reauthenticated`, `auth.sign_in_refused`, `auth.signed_out`, `auth.identity_linked` (a Google or Microsoft account added), `auth.notice_sent` (a security email sent to you), or the operation that changed the account (e.g. `users.sessions.revoke`). | | `events[].by` | one of `you`, `staff`, `system` | Who did it: you, Ownrecord staff, or the platform. | | `events[].method` | string or null | How you signed in: `email` (a code sent by email), `google`, `microsoft-entra-id`, or `dev`. | | `events[].reason` | string or null | Why a sign-in was refused (an error code), how a session ended, or what a security email was about (`new_sign_in`, `identity_linked`). | | `events[].country` | string or null | | | `events[].network` | string or null | The client address shortened to its network (/24 for IPv4, /48 for IPv6). | | `events[].userAgent` | string or null | | ## Examples ### By address ```http POST /api/v1/platform/users/sign_ins Authorization: Bearer or_test_… Idempotency-Key: 3f1c9a52-7d0e-4b8f-9a61-0c2d5e8b7f14 Content-Type: application/json { "email": "ana@acme.example", "limit": 50 } ``` Response (`200`): ```json { "object": "user_security", "user": { "id": "usr_01m4tx5nj8emwbyf7y9vcf47xa", "email": "ana@acme.example", "platformRole": null, "disabled": false, "lastLoginAt": "2026-10-30T08:15:00.000Z" }, "sessions": [ { "object": "session", "id": "ses_01m4tx5nj8emwbyf7y9vcf47xc", "createdAt": "2026-10-30T08:15:00.000Z", "lastAuthenticatedAt": "2026-10-30T08:15:00.000Z", "idleExpiresAt": "2026-10-30T10:15:00.000Z", "expiresAt": "2026-10-30T20:15:00.000Z", "country": "HR", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 15_5) AppleWebKit/605.1.15 Version/18.5 Safari/605.1.15" } ], "events": [ { "object": "security_event", "id": "aud_01m4tx5nj8emwbyf7y9vcf47xe", "at": "2026-10-30T08:15:00.000Z", "action": "auth.signed_in", "by": "you", "method": "google", "reason": null, "country": "HR", "network": "203.0.113.0", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 15_5) AppleWebKit/605.1.15 Version/18.5 Safari/605.1.15" }, { "object": "security_event", "id": "aud_01m4tx5nj8emwbyf7y9vcf47xf", "at": "2026-10-29T17:02:00.000Z", "action": "auth.sign_in_refused", "by": "system", "method": "email", "reason": "sign_in_link_rate_limited", "country": "DE", "network": "198.51.100.0", "userAgent": null } ] } ``` ## Errors | Code | HTTP status | When | What to do | | ---------------------------------------------------------------------------------------- | ----------- | ------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | | [`validation_failed`](https://ownrecord.io/docs/reference/errors.md#validation_failed) | 400 | Neither or both of `email` and `user` were passed. | Fix the fields listed in `details.issues` and send the request again. | | [`resource_not_found`](https://ownrecord.io/docs/reference/errors.md#resource_not_found) | 404 | No user has this address or ID. | Check the ID and that your credentials are scoped to the right organization, entity, brand and mode. | | [`permission_denied`](https://ownrecord.io/docs/reference/errors.md#permission_denied) | 403 | You aren't platform staff with read access to the platform console. | Ask an organization owner or admin for a role or scope that allows this action. | It can also return these [common errors](https://ownrecord.io/docs/reference.md#common-errors): [`api_version_unsupported`](https://ownrecord.io/docs/reference/errors.md#api_version_unsupported), [`invalid_json`](https://ownrecord.io/docs/reference/errors.md#invalid_json), [`unsupported_media_type`](https://ownrecord.io/docs/reference/errors.md#unsupported_media_type), [`authentication_required`](https://ownrecord.io/docs/reference/errors.md#authentication_required), [`api_key_invalid`](https://ownrecord.io/docs/reference/errors.md#api_key_invalid), [`idempotency_key_required`](https://ownrecord.io/docs/reference/errors.md#idempotency_key_required), [`dry_run_not_supported`](https://ownrecord.io/docs/reference/errors.md#dry_run_not_supported), [`rate_limited`](https://ownrecord.io/docs/reference/errors.md#rate_limited), [`internal_error`](https://ownrecord.io/docs/reference/errors.md#internal_error).