Query Users Blocked by Brute Force Protection Using the Auth0 Management API

Users blocked by brute force protection do not possess the blocked: true attribute, preventing administrators from filtering users with this attribute. To identify users blocked by brute force, query the Get a user's blocks endpoint for each user individually or configure a log stream to track specific block and unblock events.

• Auth0
• Management API
• Brute Force Protection

What methods exist to query users that brute force protection restricts?

Accounts that brute force protection restricts do not have the blocked: true attribute, making it impossible to include these users using a standard filter. Two methods exist to identify these users.

The Management API Identifies Restricted Users Through Individual Queries

Query the Get a user's blocks endpoint for each user individually to retrieve block status details. Review the following JSON response example returned by the endpoint.

{"blocked_for":[{"identifier":"user.email@domain.com","connection":"Username-Password-Authentication","ip":"1.2.3.4"}]}

NOTE: This method requires a separate request for each user and requires significant time for a large number of users.

A log Stream Tracks Restricted Users Through Event Monitoring

Configure a log stream with a third-party service to track specific events and maintain a record of restricted users. Track brute force protection blocks and unblocks by monitoring the following events in the log stream.

• Filter for limit_wc events to record restricted users.
• Check for ublkdu events to remove users from the record once Auth0 releases the block.

NOTE: This approach involves additional complexity and infrastructure.