# Security feature: Add failed login data to /report/activities

**URL:** <https://devforum.zoom.us/t/security-feature-add-failed-login-data-to-report-activities/18803>\
**Category:** Feature Requests\
**Created:** [May 23, 2020, 12:10am UTC](https://devforum.zoom.us/t/security-feature-add-failed-login-data-to-report-activities/18803 "2020-05-23T00:10:41Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dmirizzi](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/dmirizzi/32/5364_2.png) [@dmirizzi](https://devforum.zoom.us/u/dmirizzi)\
**Post date:** [May 23, 2020, 12:10am UTC](https://devforum.zoom.us/t/security-feature-add-failed-login-data-to-report-activities/18803/1 "2020-05-23T00:10:41Z")

</div>

# TLDR

It would be nice to get logs of clients attempting and failing to access Zoom in my managed domain. I would use that information to lock suspicious accounts and report compromise. I would also like more information available from the authorization logs.

## My Problem:

We currently monitor who logs in and out of our managed domain via [https://marketplace.zoom.us/docs/api-reference/zoom-api/reports/reportsigninsignoutactivities](https://marketplace.zoom.us/docs/api-reference/zoom-api/reports/reportsigninsignoutactivities) . It would be a nice feature to know where failed logins are coming from as well as client and IP information.

## Suggestions

I have 2 suggestions:

1. Add another reporting endpoint that aggregates failed logins ie. /reports/failedsigninaggs or /reports/failedsignins. This would be nice however computing aggregates is difficult depending on your backend, so it may not be advantageous.
2. _PREFERRED_ add a new type to /report/activities ([https://marketplace.zoom.us/docs/api-reference/zoom-api/reports/reportsigninsignoutactivities](https://marketplace.zoom.us/docs/api-reference/zoom-api/reports/reportsigninsignoutactivities)) like “Sign in failed” and include as much client information as possible, most importantly the data\_center and client version.

Preferred event data returned could look something like this:

```auto
{
            "email": "sfkjsldfhjdsf@dskjflhdsf.com",
            "time": "2019-09-15T20:56:09Z",
            "type": "Sign in failed",
            "ip_address": "38.99.100.6",
            "client_type": "Browser",
            "device": "WIN",
           "data_center": "SC",
           "connection_type": "P2P",
           "pc_name": "dojo's pc",
           "domain": "Dojo-workspace",
           "mac_addr": " 00:0a:95:9d:68:16",
           "version": "-"
}

```

if aggregating over the last day something like this:

```auto
{
            "email": "sfkjsldfhjdsf@dskjflhdsf.com",
            "ip_address": "38.99.100.6",
            "client_type": "Browser",
            "version": "-",
            "count": 9000
        }

```

Thanks Zoom Great Product!

---

<div class="post-metadata">

**Author:** ![dmirizzi](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/dmirizzi/32/5364_2.png) [@dmirizzi](https://devforum.zoom.us/u/dmirizzi)\
**Post date:** [September 24, 2020, 8:38pm UTC](https://devforum.zoom.us/t/security-feature-add-failed-login-data-to-report-activities/18803/2 "2020-09-24T20:38:53Z")

</div>

bump

> **Summary**
>
> This text will be hidden