---
title: Token Forensics REST API
description: "Description: Token forensics API provides forensics information for a token during a specified period. Information provided includes attack types, metrics, and anomaly details."
component: pingintelligence
version: 5.1
page_id: pingintelligence:abs_ai_engine:pingintelligence_token_forensics_rest_api
canonical_url: https://docs.pingidentity.com/pingintelligence/5.1/abs_ai_engine/pingintelligence_token_forensics_rest_api.html
revdate: April 3, 2024
---

# Token Forensics REST API

**Description**: Token forensics API provides forensics information for a token during a specified period. Information provided includes attack types, metrics, and anomaly details.

**Method**: GET

**URL**: `/v4/abs?later_date=<>T<hh:mm>&earlier_date=<>T<hh:mm> &token=<oauth2_token>`

|                |            |            |
| -------------- | ---------- | ---------- |
|                | **Header** | **Value**  |
| **Access Key** | `x-abs-ak` | `<string>` |
| **Secret Key** | `x-abs-sk` | `<string>` |

**Sample Response**

```json
{
    "company": "ping identity",
    "name": "api_abs_token",
    "description": "This report contains a summary and detailed information on metrics, attacks and anomalies for the specified token across all APIs.",
    "earlier_date": "Wed May 22 12:00:00:000 2019",
    "later_date": "Fri Jun 28 12:00:00:000 2019",
    "summary": {
        "total_requests": 10,
        "total_attacks": 0,
        "total_anomalies": 0
    },
    "details": {
        "metrics": {
            "token": "t3nkCZIR",
            "total_requests": 10,
            "ip_list": [
                {
                    "ip": "127.0.0.28",
                    "total_requests": 5,
                    "devices": {
                        "LINUX": 5
                    },
                    "methods": {
                        "POST": 5
                    },
                    "urls": {
                        "/atm_app_oauth": 5
                    },
                    "apis": {
                        "atm_app_oauth": 5
                    }
                },
                {
                    "ip": "127.0.0.1",
                    "total_requests": 5,
                    "devices": {
                        "LINUX": 5
                    },
                    "methods": {
                        "POST": 5
                    },
                    "urls": {
                        "/atm_app_oauth": 5
                    },
                    "apis": {
                        "atm_app_oauth": 5
                    }
                }
            ]
        },
        "attack_types": {},
        "anomaly_types": {}
    }
}
```