--- title: Create Risk Predictor (Traffic anomaly) description: This request creates a traffic anomaly predictor. component: pingone-api page_id: pingone-api:protect:risk-predictors/create_risk_predictor_traffic_anomaly canonical_url: https://developer.pingidentity.com/pingone-api/protect/risk-predictors/create_risk_predictor_traffic_anomaly.html section_ids: prerequisites: Prerequisites headers: Headers body: Body example-request: Example Request example-response: Example Response --- # Create Risk Predictor (Traffic anomaly) ## ```none POST {{apiPath}}/v1/environments/{{envID}}/riskPredictors ``` This request creates a traffic anomaly predictor. The `rules` array contains a single rule - tracking of unique users on a single device, the only rule that can currently be included in traffic anomaly predictors. The `threshold` object is used to specify the number of users that will be considered Medium risk and the number of users that will be considered High risk. The `interval` object is used to define the timeframe for tracking unique users on a device. ### Prerequisites * Refer to [Risk Predictors](#risk-predictors) for important overview information. > **Collapse: Request Model** > > Refer to [Risk Predictors](#risk-predictors) for the complete data models. > > **Base data model** > > | Property | Type | Required? | > | ------------------------------- | ------- | --------- | > | `compactName` | String | Required | > | `default` | Object | Required | > | `default.result.level` | String | Required | > | `default.result.type` | String | Required | > | `name` | String | Required | > | `rules` | Array | Optional | > | `rules[].enabled` | Boolean | Required | > | `rules[].interval` | Object | Required | > | `rules[].interval.unit` | String | Required | > | \`rules\[].interval.quantity \` | Integer | Required | > | `rules[].threshold` | Object | Required | > | `rules[].threshold.medium` | Integer | Required | > | `rules[].threshold.high` | Integer | Required | > | `rules[].type` | String | Required | > | `type` | String | Required | ### Headers Authorization      Bearer {{accessToken}} Content-Type      application/json ### Body raw ( application/json ) ```json { "name": "Traffic anomaly predictor created with API", "compactName": "trafficAnomalyCreatedFromAPI", "type": "TRAFFIC_ANOMALY", "default": { "result": { "level": "medium", "type": "VALUE" } }, "rules": [ { "type": "UNIQUES_USERS_PER_DEVICE", "threshold": { "medium": 3, "high": 6 }, "interval": { "unit": "DAY", "quantity": 7 }, "enabled": true } ] } ``` ## ### Example Request * cURL * C# * Go * HTTP * Java * jQuery * NodeJS * Python * PHP * Ruby * Swift ```shell curl --location --globoff '{{apiPath}}/v1/environments/{{envID}}/riskPredictors' \ --header 'Content-Type: application/json' \ --header 'Authorization: Bearer {{accessToken}}' \ --data '{ "name": "Traffic anomaly predictor created with API", "compactName": "trafficAnomalyCreatedFromAPI", "type": "TRAFFIC_ANOMALY", "default": { "result": { "level": "medium", "type": "VALUE" } }, "rules": [ { "type": "UNIQUES_USERS_PER_DEVICE", "threshold": { "medium": 3, "high": 6 }, "interval": { "unit": "DAY", "quantity": 7 }, "enabled": true } ] }' ``` ```csharp var options = new RestClientOptions("{{apiPath}}/v1/environments/{{envID}}/riskPredictors") { MaxTimeout = -1, }; var client = new RestClient(options); var request = new RestRequest("", Method.Post); request.AddHeader("Content-Type", "application/json"); request.AddHeader("Authorization", "Bearer {{accessToken}}"); var body = @"{" + "\n" + @" ""name"": ""Traffic anomaly predictor created with API""," + "\n" + @" ""compactName"": ""trafficAnomalyCreatedFromAPI""," + "\n" + @" ""type"": ""TRAFFIC_ANOMALY""," + "\n" + @" ""default"": {" + "\n" + @" ""result"": {" + "\n" + @" ""level"": ""medium""," + "\n" + @" ""type"": ""VALUE""" + "\n" + @" }" + "\n" + @" }," + "\n" + @" ""rules"": [" + "\n" + @" {" + "\n" + @" ""type"": ""UNIQUES_USERS_PER_DEVICE""," + "\n" + @" ""threshold"": {" + "\n" + @" ""medium"": 3," + "\n" + @" ""high"": 6" + "\n" + @" }," + "\n" + @" ""interval"": {" + "\n" + @" ""unit"": ""DAY""," + "\n" + @" ""quantity"": 7" + "\n" + @" }," + "\n" + @" ""enabled"": true" + "\n" + @" }" + "\n" + @" ]" + "\n" + @"}"; request.AddStringBody(body, DataFormat.Json); RestResponse response = await client.ExecuteAsync(request); Console.WriteLine(response.Content); ``` ```golang package main import ( "fmt" "strings" "net/http" "io" ) func main() { url := "{{apiPath}}/v1/environments/{{envID}}/riskPredictors" method := "POST" payload := strings.NewReader(`{ "name": "Traffic anomaly predictor created with API", "compactName": "trafficAnomalyCreatedFromAPI", "type": "TRAFFIC_ANOMALY", "default": { "result": { "level": "medium", "type": "VALUE" } }, "rules": [ { "type": "UNIQUES_USERS_PER_DEVICE", "threshold": { "medium": 3, "high": 6 }, "interval": { "unit": "DAY", "quantity": 7 }, "enabled": true } ] }`) client := &http.Client { } req, err := http.NewRequest(method, url, payload) if err != nil { fmt.Println(err) return } req.Header.Add("Content-Type", "application/json") req.Header.Add("Authorization", "Bearer {{accessToken}}") res, err := client.Do(req) if err != nil { fmt.Println(err) return } defer res.Body.Close() body, err := io.ReadAll(res.Body) if err != nil { fmt.Println(err) return } fmt.Println(string(body)) } ``` ```http POST /v1/environments/{{envID}}/riskPredictors HTTP/1.1 Host: {{apiPath}} Content-Type: application/json Authorization: Bearer {{accessToken}} { "name": "Traffic anomaly predictor created with API", "compactName": "trafficAnomalyCreatedFromAPI", "type": "TRAFFIC_ANOMALY", "default": { "result": { "level": "medium", "type": "VALUE" } }, "rules": [ { "type": "UNIQUES_USERS_PER_DEVICE", "threshold": { "medium": 3, "high": 6 }, "interval": { "unit": "DAY", "quantity": 7 }, "enabled": true } ] } ``` ```java OkHttpClient client = new OkHttpClient().newBuilder() .build(); MediaType mediaType = MediaType.parse("application/json"); RequestBody body = RequestBody.create(mediaType, "{\n \"name\": \"Traffic anomaly predictor created with API\",\n \"compactName\": \"trafficAnomalyCreatedFromAPI\",\n \"type\": \"TRAFFIC_ANOMALY\",\n \"default\": {\n \"result\": {\n \"level\": \"medium\",\n \"type\": \"VALUE\"\n }\n },\n \"rules\": [\n {\n \"type\": \"UNIQUES_USERS_PER_DEVICE\",\n \"threshold\": {\n \"medium\": 3,\n \"high\": 6\n },\n \"interval\": {\n \"unit\": \"DAY\",\n \"quantity\": 7\n },\n \"enabled\": true\n }\n ]\n}"); Request request = new Request.Builder() .url("{{apiPath}}/v1/environments/{{envID}}/riskPredictors") .method("POST", body) .addHeader("Content-Type", "application/json") .addHeader("Authorization", "Bearer {{accessToken}}") .build(); Response response = client.newCall(request).execute(); ``` ```javascript var settings = { "url": "{{apiPath}}/v1/environments/{{envID}}/riskPredictors", "method": "POST", "timeout": 0, "headers": { "Content-Type": "application/json", "Authorization": "Bearer {{accessToken}}" }, "data": JSON.stringify({ "name": "Traffic anomaly predictor created with API", "compactName": "trafficAnomalyCreatedFromAPI", "type": "TRAFFIC_ANOMALY", "default": { "result": { "level": "medium", "type": "VALUE" } }, "rules": [ { "type": "UNIQUES_USERS_PER_DEVICE", "threshold": { "medium": 3, "high": 6 }, "interval": { "unit": "DAY", "quantity": 7 }, "enabled": true } ] }), }; $.ajax(settings).done(function (response) { console.log(response); }); ``` ```javascript var request = require('request'); var options = { 'method': 'POST', 'url': '{{apiPath}}/v1/environments/{{envID}}/riskPredictors', 'headers': { 'Content-Type': 'application/json', 'Authorization': 'Bearer {{accessToken}}' }, body: JSON.stringify({ "name": "Traffic anomaly predictor created with API", "compactName": "trafficAnomalyCreatedFromAPI", "type": "TRAFFIC_ANOMALY", "default": { "result": { "level": "medium", "type": "VALUE" } }, "rules": [ { "type": "UNIQUES_USERS_PER_DEVICE", "threshold": { "medium": 3, "high": 6 }, "interval": { "unit": "DAY", "quantity": 7 }, "enabled": true } ] }) }; request(options, function (error, response) { if (error) throw new Error(error); console.log(response.body); }); ``` ```python import requests import json url = "{{apiPath}}/v1/environments/{{envID}}/riskPredictors" payload = json.dumps({ "name": "Traffic anomaly predictor created with API", "compactName": "trafficAnomalyCreatedFromAPI", "type": "TRAFFIC_ANOMALY", "default": { "result": { "level": "medium", "type": "VALUE" } }, "rules": [ { "type": "UNIQUES_USERS_PER_DEVICE", "threshold": { "medium": 3, "high": 6 }, "interval": { "unit": "DAY", "quantity": 7 }, "enabled": True } ] }) headers = { 'Content-Type': 'application/json', 'Authorization': 'Bearer {{accessToken}}' } response = requests.request("POST", url, headers=headers, data=payload) print(response.text) ``` ```php setUrl('{{apiPath}}/v1/environments/{{envID}}/riskPredictors'); $request->setMethod(HTTP_Request2::METHOD_POST); $request->setConfig(array( 'follow_redirects' => TRUE )); $request->setHeader(array( 'Content-Type' => 'application/json', 'Authorization' => 'Bearer {{accessToken}}' )); $request->setBody('{\n "name": "Traffic anomaly predictor created with API",\n "compactName": "trafficAnomalyCreatedFromAPI",\n "type": "TRAFFIC_ANOMALY",\n "default": {\n "result": {\n "level": "medium",\n "type": "VALUE"\n }\n },\n "rules": [\n {\n "type": "UNIQUES_USERS_PER_DEVICE",\n "threshold": {\n "medium": 3,\n "high": 6\n },\n "interval": {\n "unit": "DAY",\n "quantity": 7\n },\n "enabled": true\n }\n ]\n}'); try { $response = $request->send(); if ($response->getStatus() == 200) { echo $response->getBody(); } else { echo 'Unexpected HTTP status: ' . $response->getStatus() . ' ' . $response->getReasonPhrase(); } } catch(HTTP_Request2_Exception $e) { echo 'Error: ' . $e->getMessage(); } ``` ```ruby require "uri" require "json" require "net/http" url = URI("{{apiPath}}/v1/environments/{{envID}}/riskPredictors") http = Net::HTTP.new(url.host, url.port); request = Net::HTTP::Post.new(url) request["Content-Type"] = "application/json" request["Authorization"] = "Bearer {{accessToken}}" request.body = JSON.dump({ "name": "Traffic anomaly predictor created with API", "compactName": "trafficAnomalyCreatedFromAPI", "type": "TRAFFIC_ANOMALY", "default": { "result": { "level": "medium", "type": "VALUE" } }, "rules": [ { "type": "UNIQUES_USERS_PER_DEVICE", "threshold": { "medium": 3, "high": 6 }, "interval": { "unit": "DAY", "quantity": 7 }, "enabled": true } ] }) response = http.request(request) puts response.read_body ``` ```swift let parameters = "{\n \"name\": \"Traffic anomaly predictor created with API\",\n \"compactName\": \"trafficAnomalyCreatedFromAPI\",\n \"type\": \"TRAFFIC_ANOMALY\",\n \"default\": {\n \"result\": {\n \"level\": \"medium\",\n \"type\": \"VALUE\"\n }\n },\n \"rules\": [\n {\n \"type\": \"UNIQUES_USERS_PER_DEVICE\",\n \"threshold\": {\n \"medium\": 3,\n \"high\": 6\n },\n \"interval\": {\n \"unit\": \"DAY\",\n \"quantity\": 7\n },\n \"enabled\": true\n }\n ]\n}" let postData = parameters.data(using: .utf8) var request = URLRequest(url: URL(string: "{{apiPath}}/v1/environments/{{envID}}/riskPredictors")!,timeoutInterval: Double.infinity) request.addValue("application/json", forHTTPHeaderField: "Content-Type") request.addValue("Bearer {{accessToken}}", forHTTPHeaderField: "Authorization") request.httpMethod = "POST" request.httpBody = postData let task = URLSession.shared.dataTask(with: request) { data, response, error in guard let data = data else { print(String(describing: error)) return } print(String(data: data, encoding: .utf8)!) } task.resume() ``` ### Example Response 201 Created ```json { "_links": { "self": { "href": "https://api.pingone.eu/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6/riskPredictors/fe36c631-6520-431b-a586-e680277a9f85" }, "environment": { "href": "https://api.pingone.eu/v1/environments/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6" } }, "id": "fe36c631-6520-431b-a586-e680277a9f85", "environment": { "id": "abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6" }, "createdAt": "2024-08-06T15:22:09.536Z", "createdBy": "USER_DEFINED", "updatedAt": "2024-08-06T15:22:09.536Z", "name": "Traffic anomaly predictor created with API", "compactName": "trafficAnomalyCreatedFromAPI", "licensed": true, "rules": [ { "type": "UNIQUES_USERS_PER_DEVICE", "threshold": { "medium": 3, "high": 6 }, "interval": { "unit": "DAY", "quantity": 7 }, "enabled": true } ], "type": "TRAFFIC_ANOMALY", "condition": { "scores": [ { "name": "HIGH", "value": "HIGH" }, { "name": "MEDIUM", "value": "MEDIUM" }, { "name": "LOW", "value": "LOW" } ] }, "deletable": true, "tooltip": "predictor.tooltip.traffic.anomaly", "default": { "weight": 5, "score": 80, "result": { "level": "MEDIUM", "type": "VALUE" }, "evaluated": false } } ```