> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Compare an identity detection's login against user and team authentication baselines



## OpenAPI

````yaml https://api.wirespeed.co/v1/openapi.json get /v1/detection/{id}/identity-baseline
openapi: 3.0.0
info:
  title: Wirespeed API
  description: The public Wirespeed API. v1 is the first stable contract.
  version: '1.0'
  contact: {}
servers:
  - url: https://api.wirespeed.co
security: []
tags: []
paths:
  /v1/detection/{id}/identity-baseline:
    get:
      tags:
        - Detection
      summary: >-
        Compare an identity detection's login against user and team
        authentication baselines
      operationId: DetectionController_getIdentityBaseline
      parameters:
        - name: id
          required: true
          in: path
          description: Detection ID
          schema:
            type: string
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DetectionIdentityBaselineDto'
        '404':
          description: ''
        '422':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HttpError'
      security:
        - bearer: []
components:
  schemas:
    DetectionIdentityBaselineDto:
      type: object
      properties:
        available:
          type: boolean
          description: False when no comparison could be produced; see unavailableReason
        unavailableReason:
          type: string
          enum:
            - NOT_IDENTITY
            - NO_AUTH_EVENT
            - BASELINE_NOT_READY
          nullable: true
        observedAt:
          type: string
          nullable: true
          description: Timestamp of the authentication event that was compared
        datapoints:
          type: array
          items:
            $ref: '#/components/schemas/IdentityBaselineDatapointDto'
      required:
        - available
        - observedAt
        - datapoints
    HttpError:
      type: object
      properties:
        message:
          type: string
        statusCode:
          type: number
      required:
        - message
        - statusCode
    IdentityBaselineDatapointDto:
      type: object
      properties:
        kind:
          type: string
          enum:
            - LOGIN_TIME
            - LOGIN_LOCATION
            - ASN
            - USER_AGENT
        scope:
          type: string
          enum:
            - USER
            - TEAM
        withinBaseline:
          type: boolean
          description: >-
            True when the observed value has prior successful logins in the
            baseline
        priorLogins:
          type: number
          description: Baseline logins recorded for the observed value
        rank:
          type: number
          nullable: true
          description: >-
            Rank of the observed value by login volume; null when never seen
            before
        observed:
          $ref: '#/components/schemas/IdentityBaselineObservedDto'
        distribution:
          type: array
          items:
            $ref: '#/components/schemas/IdentityBaselineBucketDto'
      required:
        - kind
        - scope
        - withinBaseline
        - priorLogins
        - rank
        - observed
        - distribution
    IdentityBaselineObservedDto:
      type: object
      properties:
        subjectEmail:
          type: string
          nullable: true
          description: Mailbox the authentication event was attributed to
        hour:
          type: number
          nullable: true
          description: Hour of day (0-23, UTC) the login occurred
        city:
          type: string
          nullable: true
        region:
          type: string
          nullable: true
        country:
          type: string
          nullable: true
        lat:
          type: number
          nullable: true
        lon:
          type: number
          nullable: true
        asnNumber:
          type: number
          nullable: true
        asnName:
          type: string
          nullable: true
        userAgent:
          type: string
          nullable: true
        osName:
          type: string
          nullable: true
        browserName:
          type: string
          nullable: true
      required:
        - subjectEmail
        - hour
        - city
        - region
        - country
        - lat
        - lon
        - asnNumber
        - asnName
        - userAgent
        - osName
        - browserName
    IdentityBaselineBucketDto:
      type: object
      properties:
        id:
          type: string
          description: Stable identity for this bucket within its datapoint
        label:
          type: string
          nullable: true
        hour:
          type: number
          nullable: true
        city:
          type: string
          nullable: true
        region:
          type: string
          nullable: true
        country:
          type: string
          nullable: true
        lat:
          type: number
          nullable: true
        lon:
          type: number
          nullable: true
        priorLogins:
          type: number
          description: Successful and failed logins in the baseline window
        successRate:
          type: number
          description: Share of logins that succeeded, 0-100
        rank:
          type: number
          nullable: true
          description: Position by login volume within the baseline, 1 being most used
        isObserved:
          type: boolean
          description: Whether this bucket is the value observed on the detection
      required:
        - id
        - label
        - hour
        - city
        - region
        - country
        - lat
        - lon
        - priorLogins
        - successRate
        - rank
        - isObserved
  securitySchemes:
    bearer:
      scheme: bearer
      bearerFormat: API key
      type: http
      description: >-
        Team API key sent as a Bearer token. Create a key in Wirespeed under
        Settings → Team. See
        https://docs.wirespeed.co/api-reference/authentication.

````