PingOne Platform APIs

Create Risk Predictor (Traffic anomaly)

 

POST {{apiPath}}/environments/{{envID}}/riskPredictors

This request creates a traffic anomaly predictor.

The rules array contains a single rule - tracking of unique users on a single device, the only rule that can currently be included in traffic anomaly predictors.

The threshold object is used to specify the number of users that will be considered Medium risk and the number of users that will be considered High risk.

The interval object is used to define the timeframe for tracking unique users on a device.

Prerequisites

Request Model

Refer to Risk Predictors for the complete data models.

Base data model

Property Type Required?

compactName

String

Required

default

Object

Required

default.result.level

String

Required

default.result.type

String

Required

name

String

Required

rules

Array

Optional

rules[].enabled

Boolean

Required

rules[].interval

Object

Required

rules[].interval.unit

String

Required

`rules[].interval.quantity `

Integer

Required

rules[].threshold

Object

Required

rules[].threshold.medium

Integer

Required

rules[].threshold.high

Integer

Required

rules[].type

String

Required

type

String

Required

Headers

Authorization      Bearer {{accessToken}}

Content-Type      application/json

Body

raw ( application/json )

{
    "name": "Traffic anomaly predictor created with API",
    "compactName": "trafficAnomalyCreatedFromAPI",
    "type": "TRAFFIC_ANOMALY",
    "default": {
        "result": {
            "level": "medium",
            "type": "VALUE"
        }
    },
    "rules": [
        {
            "type": "UNIQUES_USERS_PER_DEVICE",
            "threshold": {
                "medium": 3,
                "high": 6
            },
            "interval": {
                "unit": "DAY",
                "quantity": 7
            },
            "enabled": true
        }
    ]
}

Example Request

  • cURL

  • C#

  • Go

  • HTTP

  • Java

  • jQuery

  • NodeJS

  • Python

  • PHP

  • Ruby

  • Swift

curl --location --globoff '{{apiPath}}/environments/{{envID}}/riskPredictors' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer {{accessToken}}' \
--data '{
    "name": "Traffic anomaly predictor created with API",
    "compactName": "trafficAnomalyCreatedFromAPI",
    "type": "TRAFFIC_ANOMALY",
    "default": {
        "result": {
            "level": "medium",
            "type": "VALUE"
        }
    },
    "rules": [
        {
            "type": "UNIQUES_USERS_PER_DEVICE",
            "threshold": {
                "medium": 3,
                "high": 6
            },
            "interval": {
                "unit": "DAY",
                "quantity": 7
            },
            "enabled": true
        }
    ]
}'
var options = new RestClientOptions("{{apiPath}}/environments/{{envID}}/riskPredictors")
{
  MaxTimeout = -1,
};
var client = new RestClient(options);
var request = new RestRequest("", Method.Post);
request.AddHeader("Content-Type", "application/json");
request.AddHeader("Authorization", "Bearer {{accessToken}}");
var body = @"{" + "\n" +
@"    ""name"": ""Traffic anomaly predictor created with API""," + "\n" +
@"    ""compactName"": ""trafficAnomalyCreatedFromAPI""," + "\n" +
@"    ""type"": ""TRAFFIC_ANOMALY""," + "\n" +
@"    ""default"": {" + "\n" +
@"        ""result"": {" + "\n" +
@"            ""level"": ""medium""," + "\n" +
@"            ""type"": ""VALUE""" + "\n" +
@"        }" + "\n" +
@"    }," + "\n" +
@"    ""rules"": [" + "\n" +
@"        {" + "\n" +
@"            ""type"": ""UNIQUES_USERS_PER_DEVICE""," + "\n" +
@"            ""threshold"": {" + "\n" +
@"                ""medium"": 3," + "\n" +
@"                ""high"": 6" + "\n" +
@"            }," + "\n" +
@"            ""interval"": {" + "\n" +
@"                ""unit"": ""DAY""," + "\n" +
@"                ""quantity"": 7" + "\n" +
@"            }," + "\n" +
@"            ""enabled"": true" + "\n" +
@"        }" + "\n" +
@"    ]" + "\n" +
@"}";
request.AddStringBody(body, DataFormat.Json);
RestResponse response = await client.ExecuteAsync(request);
Console.WriteLine(response.Content);
package main

import (
  "fmt"
  "strings"
  "net/http"
  "io"
)

func main() {

  url := "{{apiPath}}/environments/{{envID}}/riskPredictors"
  method := "POST"

  payload := strings.NewReader(`{
    "name": "Traffic anomaly predictor created with API",
    "compactName": "trafficAnomalyCreatedFromAPI",
    "type": "TRAFFIC_ANOMALY",
    "default": {
        "result": {
            "level": "medium",
            "type": "VALUE"
        }
    },
    "rules": [
        {
            "type": "UNIQUES_USERS_PER_DEVICE",
            "threshold": {
                "medium": 3,
                "high": 6
            },
            "interval": {
                "unit": "DAY",
                "quantity": 7
            },
            "enabled": true
        }
    ]
}`)

  client := &http.Client {
  }
  req, err := http.NewRequest(method, url, payload)

  if err != nil {
    fmt.Println(err)
    return
  }
  req.Header.Add("Content-Type", "application/json")
  req.Header.Add("Authorization", "Bearer {{accessToken}}")

  res, err := client.Do(req)
  if err != nil {
    fmt.Println(err)
    return
  }
  defer res.Body.Close()

  body, err := io.ReadAll(res.Body)
  if err != nil {
    fmt.Println(err)
    return
  }
  fmt.Println(string(body))
}
POST /environments/{{envID}}/riskPredictors HTTP/1.1
Host: {{apiPath}}
Content-Type: application/json
Authorization: Bearer {{accessToken}}

{
    "name": "Traffic anomaly predictor created with API",
    "compactName": "trafficAnomalyCreatedFromAPI",
    "type": "TRAFFIC_ANOMALY",
    "default": {
        "result": {
            "level": "medium",
            "type": "VALUE"
        }
    },
    "rules": [
        {
            "type": "UNIQUES_USERS_PER_DEVICE",
            "threshold": {
                "medium": 3,
                "high": 6
            },
            "interval": {
                "unit": "DAY",
                "quantity": 7
            },
            "enabled": true
        }
    ]
}
OkHttpClient client = new OkHttpClient().newBuilder()
  .build();
MediaType mediaType = MediaType.parse("application/json");
RequestBody body = RequestBody.create(mediaType, "{\n    \"name\": \"Traffic anomaly predictor created with API\",\n    \"compactName\": \"trafficAnomalyCreatedFromAPI\",\n    \"type\": \"TRAFFIC_ANOMALY\",\n    \"default\": {\n        \"result\": {\n            \"level\": \"medium\",\n            \"type\": \"VALUE\"\n        }\n    },\n    \"rules\": [\n        {\n            \"type\": \"UNIQUES_USERS_PER_DEVICE\",\n            \"threshold\": {\n                \"medium\": 3,\n                \"high\": 6\n            },\n            \"interval\": {\n                \"unit\": \"DAY\",\n                \"quantity\": 7\n            },\n            \"enabled\": true\n        }\n    ]\n}");
Request request = new Request.Builder()
  .url("{{apiPath}}/environments/{{envID}}/riskPredictors")
  .method("POST", body)
  .addHeader("Content-Type", "application/json")
  .addHeader("Authorization", "Bearer {{accessToken}}")
  .build();
Response response = client.newCall(request).execute();
var settings = {
  "url": "{{apiPath}}/environments/{{envID}}/riskPredictors",
  "method": "POST",
  "timeout": 0,
  "headers": {
    "Content-Type": "application/json",
    "Authorization": "Bearer {{accessToken}}"
  },
  "data": JSON.stringify({
    "name": "Traffic anomaly predictor created with API",
    "compactName": "trafficAnomalyCreatedFromAPI",
    "type": "TRAFFIC_ANOMALY",
    "default": {
      "result": {
        "level": "medium",
        "type": "VALUE"
      }
    },
    "rules": [
      {
        "type": "UNIQUES_USERS_PER_DEVICE",
        "threshold": {
          "medium": 3,
          "high": 6
        },
        "interval": {
          "unit": "DAY",
          "quantity": 7
        },
        "enabled": true
      }
    ]
  }),
};

$.ajax(settings).done(function (response) {
  console.log(response);
});
var request = require('request');
var options = {
  'method': 'POST',
  'url': '{{apiPath}}/environments/{{envID}}/riskPredictors',
  'headers': {
    'Content-Type': 'application/json',
    'Authorization': 'Bearer {{accessToken}}'
  },
  body: JSON.stringify({
    "name": "Traffic anomaly predictor created with API",
    "compactName": "trafficAnomalyCreatedFromAPI",
    "type": "TRAFFIC_ANOMALY",
    "default": {
      "result": {
        "level": "medium",
        "type": "VALUE"
      }
    },
    "rules": [
      {
        "type": "UNIQUES_USERS_PER_DEVICE",
        "threshold": {
          "medium": 3,
          "high": 6
        },
        "interval": {
          "unit": "DAY",
          "quantity": 7
        },
        "enabled": true
      }
    ]
  })

};
request(options, function (error, response) {
  if (error) throw new Error(error);
  console.log(response.body);
});
import requests
import json

url = "{{apiPath}}/environments/{{envID}}/riskPredictors"

payload = json.dumps({
  "name": "Traffic anomaly predictor created with API",
  "compactName": "trafficAnomalyCreatedFromAPI",
  "type": "TRAFFIC_ANOMALY",
  "default": {
    "result": {
      "level": "medium",
      "type": "VALUE"
    }
  },
  "rules": [
    {
      "type": "UNIQUES_USERS_PER_DEVICE",
      "threshold": {
        "medium": 3,
        "high": 6
      },
      "interval": {
        "unit": "DAY",
        "quantity": 7
      },
      "enabled": True
    }
  ]
})
headers = {
  'Content-Type': 'application/json',
  'Authorization': 'Bearer {{accessToken}}'
}

response = requests.request("POST", url, headers=headers, data=payload)

print(response.text)
<?php
require_once 'HTTP/Request2.php';
$request = new HTTP_Request2();
$request->setUrl('{{apiPath}}/environments/{{envID}}/riskPredictors');
$request->setMethod(HTTP_Request2::METHOD_POST);
$request->setConfig(array(
  'follow_redirects' => TRUE
));
$request->setHeader(array(
  'Content-Type' => 'application/json',
  'Authorization' => 'Bearer {{accessToken}}'
));
$request->setBody('{\n    "name": "Traffic anomaly predictor created with API",\n    "compactName": "trafficAnomalyCreatedFromAPI",\n    "type": "TRAFFIC_ANOMALY",\n    "default": {\n        "result": {\n            "level": "medium",\n            "type": "VALUE"\n        }\n    },\n    "rules": [\n        {\n            "type": "UNIQUES_USERS_PER_DEVICE",\n            "threshold": {\n                "medium": 3,\n                "high": 6\n            },\n            "interval": {\n                "unit": "DAY",\n                "quantity": 7\n            },\n            "enabled": true\n        }\n    ]\n}');
try {
  $response = $request->send();
  if ($response->getStatus() == 200) {
    echo $response->getBody();
  }
  else {
    echo 'Unexpected HTTP status: ' . $response->getStatus() . ' ' .
    $response->getReasonPhrase();
  }
}
catch(HTTP_Request2_Exception $e) {
  echo 'Error: ' . $e->getMessage();
}
require "uri"
require "json"
require "net/http"

url = URI("{{apiPath}}/environments/{{envID}}/riskPredictors")

http = Net::HTTP.new(url.host, url.port);
request = Net::HTTP::Post.new(url)
request["Content-Type"] = "application/json"
request["Authorization"] = "Bearer {{accessToken}}"
request.body = JSON.dump({
  "name": "Traffic anomaly predictor created with API",
  "compactName": "trafficAnomalyCreatedFromAPI",
  "type": "TRAFFIC_ANOMALY",
  "default": {
    "result": {
      "level": "medium",
      "type": "VALUE"
    }
  },
  "rules": [
    {
      "type": "UNIQUES_USERS_PER_DEVICE",
      "threshold": {
        "medium": 3,
        "high": 6
      },
      "interval": {
        "unit": "DAY",
        "quantity": 7
      },
      "enabled": true
    }
  ]
})

response = http.request(request)
puts response.read_body
let parameters = "{\n    \"name\": \"Traffic anomaly predictor created with API\",\n    \"compactName\": \"trafficAnomalyCreatedFromAPI\",\n    \"type\": \"TRAFFIC_ANOMALY\",\n    \"default\": {\n        \"result\": {\n            \"level\": \"medium\",\n            \"type\": \"VALUE\"\n        }\n    },\n    \"rules\": [\n        {\n            \"type\": \"UNIQUES_USERS_PER_DEVICE\",\n            \"threshold\": {\n                \"medium\": 3,\n                \"high\": 6\n            },\n            \"interval\": {\n                \"unit\": \"DAY\",\n                \"quantity\": 7\n            },\n            \"enabled\": true\n        }\n    ]\n}"
let postData = parameters.data(using: .utf8)

var request = URLRequest(url: URL(string: "{{apiPath}}/environments/{{envID}}/riskPredictors")!,timeoutInterval: Double.infinity)
request.addValue("application/json", forHTTPHeaderField: "Content-Type")
request.addValue("Bearer {{accessToken}}", forHTTPHeaderField: "Authorization")

request.httpMethod = "POST"
request.httpBody = postData

let task = URLSession.shared.dataTask(with: request) { data, response, error in
  guard let data = data else {
    print(String(describing: error))
    return
  }
  print(String(data: data, encoding: .utf8)!)
}

task.resume()

Example Response

201 Created

{
    "_links": {
        "self": {
            "href": "https://api.pingone.eu/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6/riskPredictors/fe36c631-6520-431b-a586-e680277a9f85"
        },
        "environment": {
            "href": "https://api.pingone.eu/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6"
        }
    },
    "id": "fe36c631-6520-431b-a586-e680277a9f85",
    "environment": {
        "id": "abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6"
    },
    "createdAt": "2024-08-06T15:22:09.536Z",
    "createdBy": "USER_DEFINED",
    "updatedAt": "2024-08-06T15:22:09.536Z",
    "name": "Traffic anomaly predictor created with API",
    "compactName": "trafficAnomalyCreatedFromAPI",
    "licensed": true,
    "rules": [
        {
            "type": "UNIQUES_USERS_PER_DEVICE",
            "threshold": {
                "medium": 3,
                "high": 6
            },
            "interval": {
                "unit": "DAY",
                "quantity": 7
            },
            "enabled": true
        }
    ],
    "type": "TRAFFIC_ANOMALY",
    "condition": {
        "scores": [
            {
                "name": "HIGH",
                "value": "HIGH"
            },
            {
                "name": "MEDIUM",
                "value": "MEDIUM"
            },
            {
                "name": "LOW",
                "value": "LOW"
            }
        ]
    },
    "deletable": true,
    "tooltip": "predictor.tooltip.traffic.anomaly",
    "default": {
        "weight": 5,
        "score": 80,
        "result": {
            "level": "MEDIUM",
            "type": "VALUE"
        },
        "evaluated": false
    }
}