# List your sign-in activity

> The users.sign_ins.list operation: GET /api/v1/users/me/sign_ins in the REST API and the users_sign_ins_list tool in the MCP server.

Lists the security events of your account, newest first: sign-ins (`auth.signed_in`, with the method), fresh
sign-ins before a sensitive action (`auth.reauthenticated`), sign-outs, sign-ins that were refused
(`auth.sign_in_refused`, with the reason: a disabled account, too many sign-in codes, …), Google or Microsoft
accounts added as a way to sign in (`auth.identity_linked`), the security emails sent to you about a sign-in from
a network, country or browser your account hadn't used in 90 days or an added sign-in method (`auth.notice_sent`,
with `new_sign_in` or `identity_linked` as the reason) and changes to your account such as ending your other
sessions. Each shows the country, the network (the client address shortened to /24 or /48) and the browser. If
you see a sign-in that wasn't you, end your other sessions (`users.sessions.revoke`) and tell your
organization's owner and Ownrecord support.

**Who can call it:** the signed-in user, for their own account.

## At a glance

- **REST:** `GET /api/v1/users/me/sign_ins`
- **MCP tool:** `users_sign_ins_list`
- **Operation ID:** `users.sign_ins.list`
- **Scope:** Platform
- **Permission:** `account:read`
- **Risk tier:** `read`
- **Dry run:** Not supported
- **Idempotency:** Not needed (read only)
- **Modes:** Test and live
- **Authentication:** API key with the `account:read` scope
- **Since:** M13

## Request

### Query parameters

| Field   | Type               | Required | Description                   |
| ------- | ------------------ | -------- | ----------------------------- |
| `limit` | integer (1 to 100) | No       | How many events, at most 100. |

## Response

`200 OK` with a JSON object:

| Field              | Type                            | Description                                                                                                                                                                                                                                                                     |
| ------------------ | ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `object`           | `"list"`                        |                                                                                                                                                                                                                                                                                 |
| `data`             | array of object                 |                                                                                                                                                                                                                                                                                 |
| `data[].object`    | `"security_event"`              |                                                                                                                                                                                                                                                                                 |
| `data[].id`        | `aud_…` ID                      |                                                                                                                                                                                                                                                                                 |
| `data[].at`        | date-time                       |                                                                                                                                                                                                                                                                                 |
| `data[].action`    | string                          | `auth.signed_in`, `auth.reauthenticated`, `auth.sign_in_refused`, `auth.signed_out`, `auth.identity_linked` (a Google or Microsoft account added), `auth.notice_sent` (a security email sent to you), or the operation that changed the account (e.g. `users.sessions.revoke`). |
| `data[].by`        | one of `you`, `staff`, `system` | Who did it: you, Ownrecord staff, or the platform.                                                                                                                                                                                                                              |
| `data[].method`    | string or null                  | How you signed in: `email` (a code sent by email), `google`, `microsoft-entra-id`, or `dev`.                                                                                                                                                                                    |
| `data[].reason`    | string or null                  | Why a sign-in was refused (an error code), how a session ended, or what a security email was about (`new_sign_in`, `identity_linked`).                                                                                                                                          |
| `data[].country`   | string or null                  |                                                                                                                                                                                                                                                                                 |
| `data[].network`   | string or null                  | The client address shortened to its network (/24 for IPv4, /48 for IPv6).                                                                                                                                                                                                       |
| `data[].userAgent` | string or null                  |                                                                                                                                                                                                                                                                                 |

## Examples

### A sign-in and a refused one

```http
GET /api/v1/users/me/sign_ins?limit=50
Authorization: Bearer or_test_…
```

Response (`200`):

```json
{
  "object": "list",
  "data": [
    {
      "object": "security_event",
      "id": "aud_01m4tx5nj8emwbyf7y9vcf47xe",
      "at": "2026-10-30T08:15:00.000Z",
      "action": "auth.signed_in",
      "by": "you",
      "method": "google",
      "reason": null,
      "country": "HR",
      "network": "203.0.113.0",
      "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 15_5) AppleWebKit/605.1.15 Version/18.5 Safari/605.1.15"
    },
    {
      "object": "security_event",
      "id": "aud_01m4tx5nj8emwbyf7y9vcf47xf",
      "at": "2026-10-29T17:02:00.000Z",
      "action": "auth.sign_in_refused",
      "by": "system",
      "method": "email",
      "reason": "sign_in_link_rate_limited",
      "country": "DE",
      "network": "198.51.100.0",
      "userAgent": null
    }
  ]
}
```

## Errors

| Code                                                                                   | HTTP status | When                               | What to do                                                                      |
| -------------------------------------------------------------------------------------- | ----------- | ---------------------------------- | ------------------------------------------------------------------------------- |
| [`validation_failed`](https://ownrecord.io/docs/reference/errors.md#validation_failed) | 400         | `limit` is out of range.           | Fix the fields listed in `details.issues` and send the request again.           |
| [`permission_denied`](https://ownrecord.io/docs/reference/errors.md#permission_denied) | 403         | The caller isn't a signed-in user. | Ask an organization owner or admin for a role or scope that allows this action. |

It can also return these [common errors](https://ownrecord.io/docs/reference.md#common-errors): [`api_version_unsupported`](https://ownrecord.io/docs/reference/errors.md#api_version_unsupported), [`authentication_required`](https://ownrecord.io/docs/reference/errors.md#authentication_required), [`api_key_invalid`](https://ownrecord.io/docs/reference/errors.md#api_key_invalid), [`resource_not_found`](https://ownrecord.io/docs/reference/errors.md#resource_not_found), [`dry_run_not_supported`](https://ownrecord.io/docs/reference/errors.md#dry_run_not_supported), [`rate_limited`](https://ownrecord.io/docs/reference/errors.md#rate_limited), [`internal_error`](https://ownrecord.io/docs/reference/errors.md#internal_error).