Events and Analytics API

Use events and analytics endpoints to power dashboards, export investigations, and prove what the API is blocking.

Endpoints

GET /events
GET /events?query=req_123
GET /events.csv
GET /analytics/summary

An active workspace API key is required. These workspace reads are unmetered and available with Free; they never expose another workspace’s records. See Authorization.

Events

GET /events returns investigation events for assessments, rules, webhooks, protected link activity, and other account-scoped security actions when available.

Use query to search by request ID, email, domain, IP, rule, or other indexed fields supported by your account.

CSV Export

GET /events.csv

CSV exports are intended for investigations, compliance evidence, and offline analysis.

Summary Analytics

GET /analytics/summary

Summary analytics return aggregate counts and trends for risk levels, decisions, top signals, and endpoint usage when available.

Lookup History and Saved Reports

GET /lookups/history is an unmetered workspace read using an API key. It returns safe summaries rather than raw lookup payloads, with created_at and captured expires_at. Free has no lookup history; paid history windows follow the current plan and captured expiry.

Saved fraud reports use the separate Hanko session routes POST /api/account/reports and GET /api/account/reports on requestguard.com. Creating a report requires Suite or Lookups and consumes one shared lookup unit. Reading workspace reports is unmetered. New reports capture their expires_at from the current lookup history window; expired reports are hidden and later deleted. Existing legacy reports with no captured expiry remain available. Report creation does not change event or analytics retention.