---
title: OAuth2 Token Forensics REST API
description: The OAuth2 Token Forensics REST API provides information like total number of requests for a token and the number of attacks identified using the token.
component: pingintelligence
version: 5.1
page_id: pingintelligence:abs_ai_engine:pingintelligence_oath2_token_forensics_rest_api
canonical_url: https://docs.pingidentity.com/pingintelligence/5.1/abs_ai_engine/pingintelligence_oath2_token_forensics_rest_api.html
revdate: April 3, 2024
---

# OAuth2 Token Forensics REST API

The OAuth2 Token Forensics REST API provides information like total number of requests for a token and the number of attacks identified using the token.

**Method**: GET

**URL**: `/v4/abs?later_date=<>T<hh:mm>&earlier_date=<>T<hh:mm>&token=<oauth2_token>`

|                | **Header** | **Value**  |
| -------------- | ---------- | ---------- |
| **Access Key** | `x-abs-ak` | `<string>` |
| **Secret Key** | `x-abs-sk` | `<string>` |

**Sample response**

```json
{
 "company": "ping identity",
 "name": "api_abs_token",
 "description": "This report contains a summary and detailed information on
  metrics, attacks and anomalies for the specified token across all APIs.",
 "earlier_date": "Tue Feb 13 18:00:00:000 2018",
 "later_date": "Sun Feb 18 18:00:00:000 2018",
 "summary": {
 "total_requests": 6556,
 "total_attacks": 2,
 "total_anomalies": 0
 },
 "details": {
 "metrics": {
 "token": "token1",
 "total_requests": 6556,
 "ip_list": [
 {
 "ip": "127.0.0.1",
 "total_requests": 6556,
 "devices": {
 "UNKNOWN": 6556
 },
 "methods": {
 "DELETE": 472,
 "POST": 140,
 "GET": 1944,
 "PUT": 4000
 },
 "urls": {
 "/atm_app_oauth/delete200": 218,
 "/atm_app_oauth/get200": 850,
 "/atm_app_oauth/post400": 8,
 "/atm_app_oauth/post200": 62,
 "/atm_app_oauth/put400": 62,
 "/atm_app_oauth/get400": 122,
 "/atm_app_oauth/put200": 1938,
 "/atm_app_oauth/delete400": 18,
 "/2_atm_app_oauth/put200": 1938,
 "/2_atm_app_oauth/post200": 62,
 "/2_atm_app_oauth/delete200": 218,
 "/2_atm_app_oauth/delete400": 18,
 "/2_atm_app_oauth/put400": 62,
 "/2_atm_app_oauth/post400": 8,
 "/2_atm_app_oauth/get400": 122,
 "/2_atm_app_oauth/get200": 850
 },
 "apis": {
 "atm_app_oauth": 3278,
 "2_atm_app_oauth": 3278
 }
 }
 ]
 },
 "attack_types": {
 "API Memory Attack Type 1": [
 "atm_app_oauth",
 "2_atm_app_oauth"
 ],
 "Data Poisoning Attack": [
 "atm_app_oauth",
 "2_atm_app_oauth"
 ]
 },
 "anomaly_types": {}
 }
}
```