Suspicious IP Throttling Behavior When Creating Users Using Auth0 Management API Versus Authentication API
Last Updated:
Overview
Suspicious IP Throttling in Attack Protection only functions on the Authentication API. Creating a user via the Management API does not trigger Suspicious IP Throttling. While both the Authentication API and the Management API offer endpoints to create users, only the Authentication API enforces throttling protections.
Applies To
- Auth0
- Authentication API
- Management API
- Attack Protection
- Suspicious IP Throttling
Solution
Why does creating a user via the Management API bypass Suspicious IP Throttling?
Auth0 provides endpoints to create a user in both the Authentication API (POST /dbconnection/signup) and the Management API (POST /api/v2/users). However, Suspicious IP Throttling in Attack Protection evaluates traffic exclusively on the Authentication API. Therefore, creating a user via the Management API bypasses Suspicious IP Throttling.
