Platform Analytics

A real-time view of your tenant's API performance and authentication health in one dashboard. The API Analytics tab covers traffic volume, latency percentiles, request breakdowns, and capacity peaks. The Security Analytics tab covers login outcomes, failure reasons, password-reset and MFA activity, and the account-protection guards behind your sign-in flows.

Access: Admin Console → Insights → Platform Analytics. API Analytics: the tab is always present, showing the view described here when the feature is enabled on your tenant, or contact support@loginradius.com if it is disabled. Security Analytics: the tab appears only when the feature is enabled on your tenant, independent of which API Analytics view you have, or contact support@loginradius.com if it is disabled.

---

Dashboards

Platform Analytics is organized into two tabs. Pick API Analytics to investigate slow endpoints, locate the source of errors, and verify peak load against your subscribed RPS. Pick Security Analytics to review authentication health and spot abuse patterns before they reach the helpdesk.

API Analytics

Request volume

The Group requests by dropdown in the Request Volume card re-pivots that chart by the selected attribute. It does not affect the latency graph, Top 5 cards, or RPS chart. All charts total volume as a single line; every other option fans out into one color-matched line per summary card so you can compare buckets side by side.

Request Volume

AllStatus CodeHTTP MethodAPI PathUser AgentIP AddressHost

The default tab — total request volume with no breakdown. Use it as the big-picture starting point before slicing further.

19.68k

Total

19.64k(100%)

All requests

What to watch

• Sudden cliffs in traffic — usually a client disconnect or DNS issue.
• Sharp spikes — typically a marketing push, a client retry storm, or a runaway integration looping on errors.
• Once you spot something, switch to Status Code or API Path to investigate.

Latency graph

Distribution of response latency over time, broken into four percentile bands — P75, P90, P95, P99. Each band is stacked so the gap between typical and worst-case performance is visible at a glance.

Unit

Milliseconds

Percentiles

P75 / P90 / P95 / P99

Scope

Respects filters

P75 LatencyP90 LatencyP95 LatencyP99 Latency

Request volume by source

A grid of cards, each showing the top five contributors for one attribute. Use it to find the loudest IPs, the busiest endpoints, the dominant SDK versions, and the response-code mix in one glance. Bar length is proportional to the largest row in the card.

Breakdown by

IP, Host, Method, Path, Status, UA

Visible rows

Top 5 · Load More extends in-page

CSV download

Top 100 per card

Each card lists the top 5 contributors. Bar length = relative volume; the largest is full width.

The cards at a glance

IP Address

Originating client IPs. A new IP in the top 5 is worth a quick look.

Host

Destination hostnames. Useful in multi-environment or multi-region setups.

Method

HTTP verb mix. Usually GET-dominant; a sudden POST surge is worth investigating.

Path

Endpoints by volume — the most common drill-down target.

Status

Response-code distribution. A growing 4xx/5xx share means trouble.

User Agent

SDKs and browsers hitting the API. Drift here can flag rogue integrations.

Requests per second (RPS)

Peak Requests-Per-Second across the selected range, bucketed hour by hour, with your configured RPS limit drawn over it. Use it to see the throughput your tenant generates at peak and how much headroom is left against the limit in force.

Measures

Hourly peak (not average)

Dimension

Tenant by default

Filters

Do not apply

Hourly peak RPS with the configured limit overlaid. The limit line steps at the hour the limit was changed, so breaches read at a glance.

Dimensions

The dimension dropdown above the chart selects which rate limiter you are viewing. Tenant is the default and is always available. The remaining dimensions appear only when the matching feature is enabled on your tenant. For IP, Workflow Session, and SCIM Directory the plotted value is the busiest single key in that hour, compared against that key's own limit, not the sum across all keys.

Tenant

Always available. Peak is the busiest second across your whole tenant.

IP

Requires IP rate limiting. Peak is the busiest single IP, measured over a per-minute window.

Workflow Session

Requires Identity Orchestration. Peak is the busiest single orchestration session.

SCIM Directory

Requires SCIM provisioning. Peak is the busiest single directory.

Filters do not apply here. This tab's Add Filters control deliberately bypasses the RPS chart. RPS measures the load your tenant places on the platform, so it always reflects total traffic regardless of what you have filtered down to above.

Controls and actions

Three controls scope the data and produce shareable output: Filters and Date Range at the top of this tab, plus Export as PDF or per-card CSV.

Filters

Filters narrow every chart in this tab to the slice of traffic you care about. They are global — apply once, every widget re-runs against them. The only exception is the RPS chart, which always reflects unfiltered traffic so capacity stays honest.

Scope

All charts except RPS

Rules

Combined with AND

Persistence

Cleared on reload

Anatomy of a filter

Each filter is one or more rules — attribute · operator · value. Click the + to add another rule; rules are combined with AND.

Clicking Select Rule opens the attribute list — pick one to start a filter.

Examples

Show only 5xx errors from auth endpoints

1. Select Status Code from the Group requests by dropdown.
2. Add filter: Status Code · Greater Than · 499.
3. Add filter: API Path · Contains · /auth.
4. Apply. The trend chart now shows only matching requests; Top 5 cards reveal the worst paths and IPs.

Hide health-check noise from a specific IP

1. Find the noisy IP in the Top 5 · IP Address card.
2. Add filter: IP Address · Not Equals · <that IP>.
3. Apply. Latency and trend charts now exclude that IP.

Investigate one client SDK across all endpoints

1. Add filter: User Agent · Contains · axios/1.15.
2. Select API Path from the Group requests by dropdown to see which endpoints that SDK version is hitting.

Date Range

The date range at the top right of this tab bounds every trend chart and the latency graph. The RPS chart uses this same picker, so its hourly buckets line up with the Request Volume chart.

Minimum

15 minutes

Maximum

30 days

Default

Last 24 hours

Timezone

Account-configured

The date range field

The date range field at the top right of the dashboard. Click either input to open the picker.

Timezone

Every timestamp you see — picker inputs, chart axes, tooltip values, exported reports — uses your account's configured timezone (displayed as (UTC±HH:MM) next to the time inputs). To change it, update your account preferences in the Admin Console.

Export

Two ways to take data out of the dashboard: a page-wide PDF for what you are looking at right now, and per-card CSV for raw analysis.

Export as PDF

Click Export as PDF at the top right of this tab. The export captures the entire view as currently shown — including the active filters, date range, every chart, and every Top 5 card. Active filters are stamped at the top of the PDF, which makes it suitable for audit trails and incident write-ups.

The Export as PDF button sits in the top right of this tab.

Download CSV (per Top 5 card)

Each Top 5 card has a download icon in its header. Clicking it exports the top 100 ranked rows for that attribute. Filters and the dashboard date range are applied before the file is generated.

Every card in the Top 5 grid has a download icon at the right of its header.

Best practices

Compare volume and latency side by side

Reading request volume next to latency is the quickest way to gauge how your tenant is performing under real load.

Watch Top IPs for anomalies

Glance at the Top IPs card regularly — a new or dominant IP is usually the first sign of a new integration, a scraper, or a misconfigured retry loop.

Use trend graphs to anticipate surges

Trend graphs surface the rhythm of your traffic — use them to anticipate surges and plan scaling before the queue builds up.

Review hourly peak RPS against the limit

Check the hourly peak RPS against the overlaid limit line to confirm your tenant is staying within its subscribed capacity, and to spot the headroom you still have.

Leverage PDF exports

Snapshot the dashboard as a PDF for internal reviews, incident write-ups, or compliance reporting — filters and date range are stamped at the top.

Security Analytics

Modules

Pick a module to drill into one slice of authentication health. Each tab shows the headline counts on top and a trend chart below — successful events in green, failures in red.

Login Activity

Total login volume split into Successful and Failed. Filter by Login factor (Email, Passkey, Social Login) to isolate one channel.

210

Total

199(94.76%)

Successful

11(5.24%)

Failed

Failed Login Reasons

11

Total failures

4(36.4%)

Username or password wrong

4(36.4%)

User id locked

2(18.1%)

OAuth invalid grant

1(9.1%)

Provider required error

Password Reset

Reset-flow health. The Failed Reset Reasons sub-chart explains why a reset link could not be redeemed — typically token expired or already used.

15

Total

14(93.3%)

Successful

1(6.7%)

Failed

Failed Reset Reasons

1

Total failures

1(100%)

Token expired

MFA Overview

Multi-factor challenges issued, succeeded, and failed. Filter by factor to compare email OTP, authenticator-app, and SMS outcomes. Failed MFA Reasons highlights wrong codes, expired challenges, and locked factors.

816

Total

789(96.7%)

Successful

27(3.3%)

Failed

Failed MFA Reasons

27

Total failures

15(55.5%)

Wrong code

8(29.6%)

Code expired

3(11.1%)

Factor locked

1(3.7%)

Too many attempts

Protections

Background guards that block abusive sign-in attempts before they reach your application. Each tab shows the daily count of events the guard intercepted — a flat-zero baseline is the expected state.

Brute Force

Repeated authentication attempts from the same credential, IP, or account that exceeded the configured threshold are blocked at the gate.

Breached Password Protection

Sign-in attempts using credentials known to be exposed in third-party breach datasets are flagged and blocked before the password is accepted.

Bot Protection (CAPTCHA)

Requests that failed the CAPTCHA challenge — most often automated bots probing the sign-in or sign-up forms.

Failed Auth from Restricted Domains

Sign-in and sign-up attempts blocked because they originated from a disposable, blacklisted, or otherwise restricted email domain.

Controls and actions

Two controls scope what this tab shows and produce a shareable snapshot: Date Range bounds every chart in this tab, and Export downloads the current view as a PDF.

Date Range

The date range at the top of this tab bounds every chart in the Security Analytics tab. Click either input to open the picker.

Minimum

15 minutes

Maximum

7 days

Timezone

Account-configured

Two date-time inputs separated by an arrow. Click either to open the picker.

Export as PDF

Click Export at the top right of this tab to download the current view as a PDF — every chart, with the active date range stamped at the top. Use it for incident write-ups, compliance reviews, and sharing with stakeholders.

The Export button sits in the top right of this tab.

Best practices

Watch the failure ratio, not just the count

A small absolute number of failures on a low-traffic day can still be alarming if the ratio crosses 5–10%. Always compare Successful vs Failed proportionally.

Cross-reference with API Analytics

If failed logins spike, switch to the API Analytics tab's Top 5 by IP card in the same window to identify the offending clients.

Tune MFA factor mix on real outcomes

Compare failure rates across MFA factors before rolling out a default. Email OTP failures dominated by "expired" suggest tightening the TTL is wrong — users need more time, not less.

Treat protection spikes as signal, not noise

Brute Force or Breached Password spikes are often the first sign of a coordinated attack. Investigate IPs immediately and consider tightening thresholds for the duration.

Related Resources

User Insights overviewUser AnalyticsAPI Rate LimitsError Response CodesAcceptable Use Policy