Cloud Administration Add/Remove High-Risk User API

Use the Cloud Administration Add/Remove High-Risk User List API to add or remove one or more users from a high-risk user list. You can determine authentication and access requirements for users who are identified as high risk. These might be users whose accounts have been compromised, or for whom a third-party security information and event management (SIEM) solution, such as NetWitness, has detected suspicious activity. For more information, see Determining Access Requirements for High-Risk Users in Cloud Access Service.

Note:  This API is licensed. See ID Plus Subscription Plans.

For information about managing access to this API, see Accessing the Cloud Administration APIs.

Authentication

Clients calling this API must authenticate themselves by including a JSON Web Token in a request. For instructions on using this token, see Authentication for the Cloud Administration REST APIs.

Software Developer Kit

You can download the API Software Developer Kit (SDK) from Cloud Administration REST API Download.

Request Requirements

Use the following information to add or remove one or more users from the high-risk user list.

Note:  The high-risk user list supports user emails. The sAMAccountName attribute is not supported.

Example Request Body

The following example displays a request.

PUT /AdminInterface/restapi/v1/users/highrisk

Accept: application/json

Authorization: Bearer <JWT token>

Request Body Parameters

The following table describes the request body parameters.

User Identification

The request can identify users as described in the following table. Make sure the appropriate identity source attributes are configured as described in Add, Delete, and Test the Connection for an Identity Source in Cloud Access Service and Directory Server Attributes Synchronized for Authentication.

When the Cloud Access Service (CAS) receives a list of users, it first searches for users' email addresses. If it cannot find a user's email address, it searches for the user's Primary Username or UID, and finally for the Alternate Username. Searching by Primary Username or Alternate Username can result in multiple conflicting matches. When searching by Primary Username, CAS selects the user with the latest creation entry. When searching by Alternate Username, no user is selected and the API responds with an HTTP failed status code.

Example Request Body

The following example displays a request body.

{ "action": "add",

"users": [

"user.one@mycompany.com",

"user.two@mycompany.com",

"user.three@mycompany.com"

]

}

Response

The following table lists the response scenarios.

Multi-Status Objects Response

When a partial success occurs, each failed user is listed in the response, along with the status code.

Example Partial Success Response Body

The following example displays a partial success response body.

{

"users": [

{

"id": "user.one@company.com",

"statusCode": 404,

"error": "User not found"

},

{

"id": "user.two@company.com",

"statusCode": 409,

"error": "Multiple users were found for the user identifier"

}

]

}

Response Property Descriptions

The following table describes properties used in the response.