curl --location 'https://your-cloud-id.threataware.com/public-api/v1/users?limit=10' \
--header 'Accept: application/json' \
--header 'X-ThreatAware-ApiKey: your-api-key-here'
import requests
API_KEY = "your-api-key-here"
CLOUD_ID = "sandbox"
BASE_URL = f"https://{CLOUD_ID}.threataware.com/public-api/v1"
headers = {
"Accept": "application/json",
"X-ThreatAware-ApiKey": API_KEY
}
response = requests.get(f"{BASE_URL}/users", headers=headers, params={"limit": 10})
users = response.json()
print(f"Retrieved {len(users['data'])} of {users['total']} total users")
const axios = require('axios');
const API_KEY = 'your-api-key-here';
const CLOUD_ID = 'sandbox';
const BASE_URL = `https://${CLOUD_ID}.threataware.com/public-api/v1`;
const headers = {
'Accept': 'application/json',
'X-ThreatAware-ApiKey': API_KEY
};
axios.get(`${BASE_URL}/users`, {
headers,
params: { limit: 10 }
})
.then(response => {
console.log(`Retrieved ${response.data.data.length} users`);
});
$ApiKey = "your-api-key-here"
$CloudId = "sandbox"
$BaseUrl = "https://$CloudId.threataware.com/public-api/v1"
$Headers = @{
"Accept" = "application/json"
"X-ThreatAware-ApiKey" = $ApiKey
}
$Response = Invoke-RestMethod -Uri "$BaseUrl/users?limit=10" -Headers $Headers -Method Get
Write-Host "Retrieved $($Response.data.Count) of $($Response.total) total users"
{
"offset": 0,
"limit": 1,
"total": 100,
"data": [
{
"name": "Douglas Campbell",
"email": "douglas.campbell@company.com",
"jobTitle": "Data Protection Officer",
"department": "Compliance",
"tags": [],
"lastActivity": "0001-01-01T00:00:00.0000000",
"lastSuccessLogin": {
"lastLoginTime": "2022-10-08T16:54:03.0000000",
"lastLoginLocation": {
"ip": "203.0.113.42",
"countryCode": "gb",
"country": "United Kingdom",
"city": "London"
}
},
"lastFailedLogin": {
"lastLoginTime": "2022-10-07T04:58:20.0000000",
"lastLoginLocation": {
"ip": "203.0.113.99",
"countryCode": "za",
"country": "South Africa",
"city": "Standerton"
}
},
"recentDevices": [
{
"itemId": "aceeb28b-95dd-41d9-8880-cd2f33ca965b",
"name": "LAPTOP-001",
"multiple": false,
"isInactive": false
}
]
}
],
"success": true,
"statusCode": 200,
"message": "Successfully retrieved users."
}
Core Endpoints
Get Users
Retrieve all user data that has been collected from your integrations
GET
/
public-api
/
v1
/
users
curl --location 'https://your-cloud-id.threataware.com/public-api/v1/users?limit=10' \
--header 'Accept: application/json' \
--header 'X-ThreatAware-ApiKey: your-api-key-here'
import requests
API_KEY = "your-api-key-here"
CLOUD_ID = "sandbox"
BASE_URL = f"https://{CLOUD_ID}.threataware.com/public-api/v1"
headers = {
"Accept": "application/json",
"X-ThreatAware-ApiKey": API_KEY
}
response = requests.get(f"{BASE_URL}/users", headers=headers, params={"limit": 10})
users = response.json()
print(f"Retrieved {len(users['data'])} of {users['total']} total users")
const axios = require('axios');
const API_KEY = 'your-api-key-here';
const CLOUD_ID = 'sandbox';
const BASE_URL = `https://${CLOUD_ID}.threataware.com/public-api/v1`;
const headers = {
'Accept': 'application/json',
'X-ThreatAware-ApiKey': API_KEY
};
axios.get(`${BASE_URL}/users`, {
headers,
params: { limit: 10 }
})
.then(response => {
console.log(`Retrieved ${response.data.data.length} users`);
});
$ApiKey = "your-api-key-here"
$CloudId = "sandbox"
$BaseUrl = "https://$CloudId.threataware.com/public-api/v1"
$Headers = @{
"Accept" = "application/json"
"X-ThreatAware-ApiKey" = $ApiKey
}
$Response = Invoke-RestMethod -Uri "$BaseUrl/users?limit=10" -Headers $Headers -Method Get
Write-Host "Retrieved $($Response.data.Count) of $($Response.total) total users"
{
"offset": 0,
"limit": 1,
"total": 100,
"data": [
{
"name": "Douglas Campbell",
"email": "douglas.campbell@company.com",
"jobTitle": "Data Protection Officer",
"department": "Compliance",
"tags": [],
"lastActivity": "0001-01-01T00:00:00.0000000",
"lastSuccessLogin": {
"lastLoginTime": "2022-10-08T16:54:03.0000000",
"lastLoginLocation": {
"ip": "203.0.113.42",
"countryCode": "gb",
"country": "United Kingdom",
"city": "London"
}
},
"lastFailedLogin": {
"lastLoginTime": "2022-10-07T04:58:20.0000000",
"lastLoginLocation": {
"ip": "203.0.113.99",
"countryCode": "za",
"country": "South Africa",
"city": "Standerton"
}
},
"recentDevices": [
{
"itemId": "aceeb28b-95dd-41d9-8880-cd2f33ca965b",
"name": "LAPTOP-001",
"multiple": false,
"isInactive": false
}
]
}
],
"success": true,
"statusCode": 200,
"message": "Successfully retrieved users."
}
Overview
The Users endpoint aggregates user account information from all connected directory services and identity providers (Active Directory, Azure AD, Google Workspace, etc.).Parameters
string
default:"all"
Filter users based on their current state
number
default:"0"
Set the start position of the data returned by the API
number
default:"0"
Limit each request by the provided number. Leave blank or as 0 to return all data available
Authentication
string
required
Your ThreatAware API key
string
default:"application/json"
Response format
Response
number
The starting position of this result set
number
The number of results returned
number
Total number of users available
boolean
Whether the request was successful
number
HTTP status code
string
Status message
array
Show User Object
Show User Object
string
Full name of the user
string
Email address
string
Job title
string
Department
array
Tags assigned to this user
string
Last activity timestamp (ISO 8601)
object
object
Details of last failed login attempt
array
List of devices recently used by this user
curl --location 'https://your-cloud-id.threataware.com/public-api/v1/users?limit=10' \
--header 'Accept: application/json' \
--header 'X-ThreatAware-ApiKey: your-api-key-here'
import requests
API_KEY = "your-api-key-here"
CLOUD_ID = "sandbox"
BASE_URL = f"https://{CLOUD_ID}.threataware.com/public-api/v1"
headers = {
"Accept": "application/json",
"X-ThreatAware-ApiKey": API_KEY
}
response = requests.get(f"{BASE_URL}/users", headers=headers, params={"limit": 10})
users = response.json()
print(f"Retrieved {len(users['data'])} of {users['total']} total users")
const axios = require('axios');
const API_KEY = 'your-api-key-here';
const CLOUD_ID = 'sandbox';
const BASE_URL = `https://${CLOUD_ID}.threataware.com/public-api/v1`;
const headers = {
'Accept': 'application/json',
'X-ThreatAware-ApiKey': API_KEY
};
axios.get(`${BASE_URL}/users`, {
headers,
params: { limit: 10 }
})
.then(response => {
console.log(`Retrieved ${response.data.data.length} users`);
});
$ApiKey = "your-api-key-here"
$CloudId = "sandbox"
$BaseUrl = "https://$CloudId.threataware.com/public-api/v1"
$Headers = @{
"Accept" = "application/json"
"X-ThreatAware-ApiKey" = $ApiKey
}
$Response = Invoke-RestMethod -Uri "$BaseUrl/users?limit=10" -Headers $Headers -Method Get
Write-Host "Retrieved $($Response.data.Count) of $($Response.total) total users"
{
"offset": 0,
"limit": 1,
"total": 100,
"data": [
{
"name": "Douglas Campbell",
"email": "douglas.campbell@company.com",
"jobTitle": "Data Protection Officer",
"department": "Compliance",
"tags": [],
"lastActivity": "0001-01-01T00:00:00.0000000",
"lastSuccessLogin": {
"lastLoginTime": "2022-10-08T16:54:03.0000000",
"lastLoginLocation": {
"ip": "203.0.113.42",
"countryCode": "gb",
"country": "United Kingdom",
"city": "London"
}
},
"lastFailedLogin": {
"lastLoginTime": "2022-10-07T04:58:20.0000000",
"lastLoginLocation": {
"ip": "203.0.113.99",
"countryCode": "za",
"country": "South Africa",
"city": "Standerton"
}
},
"recentDevices": [
{
"itemId": "aceeb28b-95dd-41d9-8880-cd2f33ca965b",
"name": "LAPTOP-001",
"multiple": false,
"isInactive": false
}
]
}
],
"success": true,
"statusCode": 200,
"message": "Successfully retrieved users."
}
Use Cases
User Access Auditing
Track which users have accessed which systems and from where
MFA Coverage Reporting
Identify users without MFA enabled across identity providers
Offboarding Validation
Verify user account deactivation across all connected systems
Geographic Access Analysis
Monitor login patterns and detect unusual geographic access