Fake Authentication Session API

Q: Can I generate MFA failures and lockouts?

Yes. /login-attempts supports required and failed MFA plus account lockout outcomes, with coherent challenge, failure and lock timestamps.

MOCK DATA

Generate coherent fake authentication sessions and login attempts with exact expiry, revocation, MFA, risk and outcome states.

Generated test data for fixtures and development

Base URL: /api/auth-sessions
Category: Developer Tools
Capabilities: 2 routes Seedable
Last updated: July 29, 2026

GET /api/auth-sessions Generate coherent fictional authentication sessions Returns a list

Live requestRuns against the public API

No key required

GET/api/auth-sessions?status=active&method=passkey&asOf=2026-07-10T12%3A00%3A00.000Z&count=8&seed=42

Request parameters

statusdefault any

Pin active, expired or revoked status, or allow any.

methoddefault any

Pin a password, passkey, OAuth or SAML authentication method, or allow any.

mfadefault any

Pin the MFA method; none means no second factor. MFA outcomes reject none.

riskdefault any

Pin the synthetic risk classification, or allow any.

windowDaysdefault 30

How many elapsed days before asOf may contain fixture activity.

asOf

Replay anchor. Defaults to the request clock and is always echoed in meta.params.

Advanced response options7 options

countdefault 10

How many records to generate (1–100).

seed

Deterministic output: the same seed always returns the same records. Omit for random (the used seed is echoed in meta.seed).

fields

Return only these fields (comma-separated). Mutually exclusive with 'exclude'.

exclude

Return all fields except these (comma-separated).

formatdefault json

Response format: json envelope, ndjson (one record per line) or csv.

prettydefault false

Pretty-print the JSON response.

unwrapdefault false

Drop the envelope: return the raw array/object without data/meta wrapper.

Response

Example parameters are ready. Send the request to inspect the live response.

Route reference

Code, request parameters, response fields and verified examples 13 params · 14 fields · 2 examples

Code samples Ready-to-copy requests in 4 languages

curl JavaScript Python PHP

curl "https://randomapi.dev/api/auth-sessions?status=active&method=passkey&count=8&seed=42&asOf=2026-07-10T12%3A00%3A00.000Z"

const res = await fetch("https://randomapi.dev/api/auth-sessions?status=active&method=passkey&count=8&seed=42&asOf=2026-07-10T12%3A00%3A00.000Z");
const { data, meta } = await res.json();

import requests

data = requests.get("https://randomapi.dev/api/auth-sessions?status=active&method=passkey&count=8&seed=42&asOf=2026-07-10T12%3A00%3A00.000Z").json()["data"]

$json = json_decode(file_get_contents(
  "https://randomapi.dev/api/auth-sessions?status=active&method=passkey&count=8&seed=42&asOf=2026-07-10T12%3A00%3A00.000Z"
), true);
$data = $json["data"];

Parameters Route-specific request inputs 6

Parameter	Type	Default & allowed	Description
`status`	enum	default: any allowed: active \| expired \| revoked \| any example: revoked	Pin active, expired or revoked status, or allow any.
`method`	enum	default: any allowed: password \| passkey \| oauth \| saml \| any example: passkey	Pin a password, passkey, OAuth or SAML authentication method, or allow any.
`mfa`	enum	default: any allowed: none \| totp \| sms \| webauthn \| any example: totp	Pin the MFA method; none means no second factor. MFA outcomes reject none.
`risk`	enum	default: any allowed: low \| medium \| high \| any example: high	Pin the synthetic risk classification, or allow any.
`windowDays`	int	default: 30 allowed: 1 – 90 example: 14	How many elapsed days before asOf may contain fixture activity.
`asOf`	date	example: 2026-07-10T12:00:00.000Z	Replay anchor. Defaults to the request clock and is always echoed in meta.params.

status enum

Pin active, expired or revoked status, or allow any.

default: any

allowed: active | expired | revoked | any

example: status=revoked

method enum

Pin a password, passkey, OAuth or SAML authentication method, or allow any.

default: any

allowed: password | passkey | oauth | saml | any

example: method=passkey

mfa enum

Pin the MFA method; none means no second factor. MFA outcomes reject none.

default: any

allowed: none | totp | sms | webauthn | any

example: mfa=totp

risk enum

Pin the synthetic risk classification, or allow any.

default: any

allowed: low | medium | high | any

example: risk=high

windowDays int

How many elapsed days before asOf may contain fixture activity.

default: 30

allowed: 1 – 90

example: windowDays=14

asOf date

Replay anchor. Defaults to the request clock and is always echoed in meta.params.

example: asOf=2026-07-10T12:00:00.000Z

Universal parameters Shared response and formatting options 7

Parameter	Type	Default & allowed	Description
`count`	int	default: 10 allowed: 1 – 100 example: 3	How many records to generate (1–100).
`seed`	int	example: 42	Deterministic output: the same seed always returns the same records. Omit for random (the used seed is echoed in meta.seed).
`fields`	list	example: id,user	Return only these fields (comma-separated). Mutually exclusive with 'exclude'.
`exclude`	list	example: active	Return all fields except these (comma-separated).
`format`	enum	default: json allowed: json \| ndjson \| csv example: csv	Response format: json envelope, ndjson (one record per line) or csv.
`pretty`	boolean	default: false example: true	Pretty-print the JSON response.
`unwrap`	boolean	default: false example: true	Drop the envelope: return the raw array/object without data/meta wrapper.

count int

How many records to generate (1–100).

default: 10

allowed: 1 – 100

example: count=3

seed int

Deterministic output: the same seed always returns the same records. Omit for random (the used seed is echoed in meta.seed).

example: seed=42

fields list

Return only these fields (comma-separated). Mutually exclusive with 'exclude'.

example: fields=id,user

exclude list

Return all fields except these (comma-separated).

example: exclude=active

format enum

Response format: json envelope, ndjson (one record per line) or csv.

default: json

allowed: json | ndjson | csv

example: format=csv

pretty boolean

Pretty-print the JSON response.

default: false

example: pretty=true

unwrap boolean

Drop the envelope: return the raw array/object without data/meta wrapper.

default: false

example: unwrap=true

Response schema Fields returned in each record 14

Field	Type	Description	Example
`id`	string	Distinct fictional session ID.	ses_fixture_0_a12b34c56d78ef
`user`	object	Synthetic user id, name and reserved-domain email.	{"id":"usr_fixture_12ab34cd56ef","name":"Avery Jensen","email":"user-a1b2c3d4@example.net"}
`status`	string	active \| expired \| revoked.	active
`method`	string	password \| passkey \| oauth \| saml.	passkey
`mfa`	string	none \| totp \| sms \| webauthn.	webauthn
`risk`	string	low \| medium \| high synthetic classification.	low
`device`	object	Coherent type, browser, OS and user-agent fixture.	{"type":"desktop","browser":"Chrome","os":"Windows","userAgent":"Mozilla/5.0 ..."}
`ip`	string	RFC 5737 documentation-only IPv4 address.	192.0.2.1
`createdAt`	string (ISO 8601)	Session creation inside the asOf window.	2026-07-01T08:00:00.000Z
`lastSeenAt`	string (ISO 8601)	Last activity, ordered after creation and before termination/asOf.	2026-07-10T10:00:00.000Z
`expiresAt`	string (ISO 8601)	Exact expiry instant.	2026-07-17T08:00:00.000Z
`revokedAt` nullable	string (ISO 8601)	Revocation instant for revoked sessions only.	null
`revocationReason` nullable	string	Fixture revocation reason for revoked sessions only.	null
`active`	boolean	True exactly when status is active.	true

id string

Distinct fictional session ID.

example: ses_fixture_0_a12b34c56d78ef

user object

Synthetic user id, name and reserved-domain email.

example: {"id":"usr_fixture_12ab34cd56ef","name":"Avery Jensen","email":"user-a1b2c3d4@example.net"}

status string

active | expired | revoked.

example: active

method string

password | passkey | oauth | saml.

example: passkey

mfa string

none | totp | sms | webauthn.

example: webauthn

risk string

low | medium | high synthetic classification.

example: low

device object

Coherent type, browser, OS and user-agent fixture.

example: {"type":"desktop","browser":"Chrome","os":"Windows","userAgent":"Mozilla/5.0 ..."}

ip string

RFC 5737 documentation-only IPv4 address.

example: 192.0.2.1

createdAt string (ISO 8601)

Session creation inside the asOf window.

example: 2026-07-01T08:00:00.000Z

lastSeenAt string (ISO 8601)

Last activity, ordered after creation and before termination/asOf.

example: 2026-07-10T10:00:00.000Z

expiresAt string (ISO 8601)

Exact expiry instant.

example: 2026-07-17T08:00:00.000Z

revokedAt string (ISO 8601) nullable

Revocation instant for revoked sessions only.

example: null

revocationReason string nullable

Fixture revocation reason for revoked sessions only.

example: null

active boolean

True exactly when status is active.

example: true

Documented examples

Build-generated requests and complete responses 2

Active passkey sessions /api/auth-sessions?status=active&method=passkey&count=8&seed=42&asOf=2026-07-10T12%3A00%3A00.000Z

GET /api/auth-sessions?status=active&method=passkey&count=8&seed=42&asOf=2026-07-10T12%3A00%3A00.000Z

{
  "data": [
    {
      "id": "ses_fixture_0_016cfb6a5c85ea",
      "user": {
        "id": "usr_fixture_c58cdd40fb15",
        "name": "Kaylie Gorczany-Considine",
        "email": "user-863c1d1c@example.net"
      },
      "status": "active",
      "method": "passkey",
      "mfa": "totp",
      "risk": "high",
      "device": {
        "type": "mobile",
        "browser": "Chrome",
        "os": "Android",
        "userAgent": "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 Chrome/126.0 Mobile Safari/537.36"
      },
      "ip": "203.0.113.1",
      "createdAt": "2026-06-28T10:02:12.517Z",
      "lastSeenAt": "2026-07-02T06:33:40.392Z",
      "expiresAt": "2026-07-26T10:00:00.000Z",
      "revokedAt": null,
      "revocationReason": null,
      "active": true
    },
    {
      "id": "ses_fixture_1_248abeccba6fd4",
      "user": {
        "id": "usr_fixture_5df91c36673e",
        "name": "Waino Marvin",
        "email": "user-8fcae90d@example.net"
      },
      "status": "active",
      "method": "passkey",
      "mfa": "none",
      "risk": "low",
      "device": {
        "type": "mobile",
    …
    "generatedAt": "2026-07-29T08:13:22.000Z"
  }
}

High-risk revoked sessions /api/auth-sessions?status=revoked&risk=high&mfa=totp&count=5&seed=17&asOf=2026-07-10T12%3A00%3A00.000Z

GET /api/auth-sessions?status=revoked&risk=high&mfa=totp&count=5&seed=17&asOf=2026-07-10T12%3A00%3A00.000Z

{
  "data": [
    {
      "id": "ses_fixture_0_bf24f73252bc1d",
      "user": {
        "id": "usr_fixture_360556385bfa",
        "name": "Mary Welch",
        "email": "user-6772197c@example.net"
      },
      "status": "revoked",
      "method": "oauth",
      "mfa": "totp",
      "risk": "high",
      "device": {
        "type": "desktop",
        "browser": "Safari",
        "os": "macOS",
        "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 Version/17.5 Safari/605.1.15"
      },
      "ip": "203.0.113.1",
      "createdAt": "2026-06-25T18:24:20.122Z",
      "lastSeenAt": "2026-06-28T06:45:13.836Z",
      "expiresAt": "2026-07-12T18:35:21.570Z",
      "revokedAt": "2026-07-02T17:35:21.570Z",
      "revocationReason": "credentialReset",
      "active": false
    },
    {
      "id": "ses_fixture_1_eea1d421a411bb",
      "user": {
        "id": "usr_fixture_239200a0eb0d",
        "name": "Erick Heller",
        "email": "user-06cb3281@example.net"
      },
      "status": "revoked",
      "method": "saml",
      "mfa": "totp",
      "risk": "high",
      "device": {
        "type": "mobile",
    …
    "generatedAt": "2026-07-29T08:13:22.000Z"
  }
}

GET /api/auth-sessions/login-attempts Generate coherent fictional login attempts Returns a list

Live requestRuns against the public API

No key required

GET/api/auth-sessions/login-attempts?outcome=mfaFailed&mfa=totp&risk=high&asOf=2026-07-10T12%3A00%3A00.000Z&count=10&seed=9

Request parameters

outcomedefault any

Pin a success or exact login failure branch, or allow any.

methoddefault any

Pin a password, passkey, OAuth or SAML authentication method, or allow any.

mfadefault any

Pin the MFA method; none means no second factor. MFA outcomes reject none.

riskdefault any

Pin the synthetic risk classification, or allow any.

windowDaysdefault 30

How many elapsed days before asOf may contain fixture activity.

asOf

Replay anchor. Defaults to the request clock and is always echoed in meta.params.

Advanced response options7 options

countdefault 10

How many records to generate (1–100).

seed

Deterministic output: the same seed always returns the same records. Omit for random (the used seed is echoed in meta.seed).

fields

Return only these fields (comma-separated). Mutually exclusive with 'exclude'.

exclude

Return all fields except these (comma-separated).

formatdefault json

Response format: json envelope, ndjson (one record per line) or csv.

prettydefault false

Pretty-print the JSON response.

unwrapdefault false

Drop the envelope: return the raw array/object without data/meta wrapper.

Response

Example parameters are ready. Send the request to inspect the live response.

Route reference

Code, request parameters, response fields and verified examples 13 params · 13 fields · 2 examples

Code samples Ready-to-copy requests in 4 languages

curl "https://randomapi.dev/api/auth-sessions/login-attempts?outcome=mfaFailed&mfa=totp&risk=high&count=10&seed=9&asOf=2026-07-10T12%3A00%3A00.000Z"

const res = await fetch("https://randomapi.dev/api/auth-sessions/login-attempts?outcome=mfaFailed&mfa=totp&risk=high&count=10&seed=9&asOf=2026-07-10T12%3A00%3A00.000Z");
const { data, meta } = await res.json();

import requests

data = requests.get("https://randomapi.dev/api/auth-sessions/login-attempts?outcome=mfaFailed&mfa=totp&risk=high&count=10&seed=9&asOf=2026-07-10T12%3A00%3A00.000Z").json()["data"]

$json = json_decode(file_get_contents(
  "https://randomapi.dev/api/auth-sessions/login-attempts?outcome=mfaFailed&mfa=totp&risk=high&count=10&seed=9&asOf=2026-07-10T12%3A00%3A00.000Z"
), true);
$data = $json["data"];

Parameters Route-specific request inputs 6

Parameter	Type	Default & allowed	Description
`outcome`	enum	default: any allowed: success \| invalidCredentials \| mfaRequired \| mfaFailed \| locked \| any example: mfaFailed	Pin a success or exact login failure branch, or allow any.
`method`	enum	default: any allowed: password \| passkey \| oauth \| saml \| any example: passkey	Pin a password, passkey, OAuth or SAML authentication method, or allow any.
`mfa`	enum	default: any allowed: none \| totp \| sms \| webauthn \| any example: totp	Pin the MFA method; none means no second factor. MFA outcomes reject none.
`risk`	enum	default: any allowed: low \| medium \| high \| any example: high	Pin the synthetic risk classification, or allow any.
`windowDays`	int	default: 30 allowed: 1 – 90 example: 14	How many elapsed days before asOf may contain fixture activity.
`asOf`	date	example: 2026-07-10T12:00:00.000Z	Replay anchor. Defaults to the request clock and is always echoed in meta.params.

outcome enum

Pin a success or exact login failure branch, or allow any.

default: any

example: outcome=mfaFailed

method enum

Pin a password, passkey, OAuth or SAML authentication method, or allow any.

default: any

allowed: password | passkey | oauth | saml | any

example: method=passkey

mfa enum

Pin the MFA method; none means no second factor. MFA outcomes reject none.

default: any

allowed: none | totp | sms | webauthn | any

example: mfa=totp

risk enum

Pin the synthetic risk classification, or allow any.

default: any

allowed: low | medium | high | any

example: risk=high

windowDays int

How many elapsed days before asOf may contain fixture activity.

default: 30

allowed: 1 – 90

example: windowDays=14

asOf date

Replay anchor. Defaults to the request clock and is always echoed in meta.params.

example: asOf=2026-07-10T12:00:00.000Z

Universal parameters Shared response and formatting options 7

Parameter	Type	Default & allowed	Description
`count`	int	default: 10 allowed: 1 – 100 example: 3	How many records to generate (1–100).
`seed`	int	example: 42	Deterministic output: the same seed always returns the same records. Omit for random (the used seed is echoed in meta.seed).
`fields`	list	example: id,user	Return only these fields (comma-separated). Mutually exclusive with 'exclude'.
`exclude`	list	example: lockedUntil	Return all fields except these (comma-separated).
`format`	enum	default: json allowed: json \| ndjson \| csv example: csv	Response format: json envelope, ndjson (one record per line) or csv.
`pretty`	boolean	default: false example: true	Pretty-print the JSON response.
`unwrap`	boolean	default: false example: true	Drop the envelope: return the raw array/object without data/meta wrapper.

count int

How many records to generate (1–100).

default: 10

allowed: 1 – 100

example: count=3

seed int

Deterministic output: the same seed always returns the same records. Omit for random (the used seed is echoed in meta.seed).

example: seed=42

fields list

Return only these fields (comma-separated). Mutually exclusive with 'exclude'.

example: fields=id,user

exclude list

Return all fields except these (comma-separated).

example: exclude=lockedUntil

format enum

Response format: json envelope, ndjson (one record per line) or csv.

default: json

allowed: json | ndjson | csv

example: format=csv

pretty boolean

Pretty-print the JSON response.

default: false

example: pretty=true

unwrap boolean

Drop the envelope: return the raw array/object without data/meta wrapper.

default: false

example: unwrap=true

Response schema Fields returned in each record 13

Field	Type	Description	Example
`id`	string	Distinct fictional login-attempt ID.	login_fixture_0_a12b34c56d78ef
`user`	object	Synthetic attempted user identity.	{"id":"usr_fixture_12ab34cd56ef","name":"Avery Jensen","email":"user-a1b2c3d4@example.net"}
`method`	string	Authentication method attempted.	password
`mfa`	string	Second-factor method or none.	totp
`risk`	string	Synthetic risk classification.	high
`outcome`	string	Exact login result.	mfaFailed
`device`	object	Coherent device/browser/OS fixture.	{"type":"mobile","browser":"Safari","os":"iOS","userAgent":"Mozilla/5.0 ..."}
`ip`	string	Documentation-only IPv4 address.	198.51.100.2
`attemptedAt`	string (ISO 8601)	Attempt timestamp inside the asOf window.	2026-07-10T11:00:00.000Z
`sessionId` nullable	string	Created session ID for success only.	null
`failureCode` nullable	string	Stable reason code for failed outcomes.	mfa_failed
`challenge` nullable	object	Bounded MFA challenge state, or null when no factor applies.	{"method":"totp","required":true,"attemptedAt":"2026-07-10T11:00:05.000Z","satisfiedAt":null}
`lockedUntil` nullable	string (ISO 8601)	Future unlock instant for locked outcomes only.	null

id string

Distinct fictional login-attempt ID.

example: login_fixture_0_a12b34c56d78ef

user object

Synthetic attempted user identity.

example: {"id":"usr_fixture_12ab34cd56ef","name":"Avery Jensen","email":"user-a1b2c3d4@example.net"}

method string

Authentication method attempted.

example: password

mfa string

Second-factor method or none.

example: totp

risk string

Synthetic risk classification.

example: high

outcome string

Exact login result.

example: mfaFailed

device object

Coherent device/browser/OS fixture.

example: {"type":"mobile","browser":"Safari","os":"iOS","userAgent":"Mozilla/5.0 ..."}

ip string

Documentation-only IPv4 address.

example: 198.51.100.2

attemptedAt string (ISO 8601)

Attempt timestamp inside the asOf window.

example: 2026-07-10T11:00:00.000Z

sessionId string nullable

Created session ID for success only.

example: null

failureCode string nullable

Stable reason code for failed outcomes.

example: mfa_failed

challenge object nullable

Bounded MFA challenge state, or null when no factor applies.

example: {"method":"totp","required":true,"attemptedAt":"2026-07-10T11:00:05.000Z","satisfiedAt":null}

lockedUntil string (ISO 8601) nullable

Future unlock instant for locked outcomes only.

example: null

Documented examples

Build-generated requests and complete responses 2

Failed TOTP challenges

 /api/auth-sessions/login-attempts?outcome=mfaFailed&mfa=totp&risk=high&count=10&seed=9&asOf=2026-07-10T12%3A00%3A00.000Z

GET /api/auth-sessions/login-attempts?outcome=mfaFailed&mfa=totp&risk=high&count=10&seed=9&asOf=2026-07-10T12%3A00%3A00.000Z

{
  "data": [
    {
      "id": "login_fixture_0_f328b22573e779",
      "user": {
        "id": "usr_fixture_f63b31b86a1a",
        "name": "Christian Lebsack",
        "email": "user-956a6409@example.net"
      },
      "method": "passkey",
      "mfa": "totp",
      "risk": "high",
      "outcome": "mfaFailed",
      "device": {
        "type": "mobile",
        "browser": "Safari",
        "os": "iOS",
        "userAgent": "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 Mobile/15E148 Safari/604.1"
      },
      "ip": "203.0.113.1",
      "attemptedAt": "2026-06-14T04:20:39.644Z",
      "sessionId": null,
      "failureCode": "mfa_failed",
      "challenge": {
        "method": "totp",
        "required": true,
        "attemptedAt": "2026-06-14T04:20:44.644Z",
        "satisfiedAt": null
      },
      "lockedUntil": null
    },
    {
      "id": "login_fixture_1_087139c9702ad8",
      "user": {
        "id": "usr_fixture_1abb1fafad2a",
        "name": "Melanie Greenholt",
        "email": "user-ede494cc@example.net"
      },
      "method": "passkey",
      "mfa": "totp",
    …
    "generatedAt": "2026-07-29T08:13:22.000Z"
  }
}

Successful OAuth logins /api/auth-sessions/login-attempts?outcome=success&method=oauth&count=6&seed=31&asOf=2026-07-10T12%3A00%3A00.000Z

GET /api/auth-sessions/login-attempts?outcome=success&method=oauth&count=6&seed=31&asOf=2026-07-10T12%3A00%3A00.000Z

{
  "data": [
    {
      "id": "login_fixture_0_f7e85bb10a1b0e",
      "user": {
        "id": "usr_fixture_6a1643811571",
        "name": "Karina West",
        "email": "user-8f84cf31@example.net"
      },
      "method": "oauth",
      "mfa": "webauthn",
      "risk": "low",
      "outcome": "success",
      "device": {
        "type": "mobile",
        "browser": "Safari",
        "os": "iOS",
        "userAgent": "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 Mobile/15E148 Safari/604.1"
      },
      "ip": "192.0.2.1",
      "attemptedAt": "2026-06-26T02:07:49.632Z",
      "sessionId": "ses_fixture_721f00f8edaba63b",
      "failureCode": null,
      "challenge": {
        "method": "webauthn",
        "required": true,
        "attemptedAt": "2026-06-26T02:07:54.632Z",
        "satisfiedAt": "2026-06-26T02:07:59.632Z"
      },
      "lockedUntil": null
    },
    {
      "id": "login_fixture_1_7d0724811eacde",
      "user": {
        "id": "usr_fixture_03e61b2bdf90",
        "name": "Terri Kunde",
        "email": "user-fef67d65@example.net"
      },
      "method": "oauth",
      "mfa": "none",
    …
    "generatedAt": "2026-07-29T08:13:22.000Z"
  }
}

About this API

Coverage, behavior and common use cases

Coverage & behavior

Generates fictional authentication fixtures for session-management, device-history and login-security interfaces. Session status is a real lifecycle contract: active sessions are unexpired and not revoked, expired sessions end no later than the resolved asOf, and revoked sessions carry an ordered revocation timestamp and reason.

The /login-attempts route models success, invalid credentials, required or failed MFA, and account lockouts. Successful attempts alone create a session ID; failure codes, challenge timestamps and lock windows are derived from the selected outcome. All identities use reserved example domains and all IP addresses use documentation networks.

This is vendor-neutral mock data, not an authentication service and not a source of usable credentials. Omitted asOf resolves from the request clock and is echoed so every time-shaped response can be replayed explicitly with the same seed.

Use it for

Populate active-device and session-revocation screens
Test login, MFA, lockout and invalid-credential UI branches
Create reproducible security fixtures without real accounts or IP addresses

Frequently asked questions

Practical answers about this endpoint 3

Do session dates match their status?

Yes. Active, expired and revoked records have mutually exclusive, contract-tested timestamp masks relative to the echoed asOf anchor.

Can I generate MFA failures and lockouts?

Yes. /login-attempts supports required and failed MFA plus account lockout outcomes, with coherent challenge, failure and lock timestamps.

Are any credentials or addresses real?

No. IDs are synthetic, emails use reserved example domains and IPs come only from documentation ranges.

Standards & references

Primary sources behind the contract

Useful next tools in the catalog

Mock RBAC and ABAC API MOCK DATA

Generate explainable mock RBAC/ABAC decisions or evaluate one request against an explicit vendor-neutral fixture policy.

Random User Data API MOCK DATA

Complete fake people — name, age-consistent birth date, email, phone, job and address — with working filters for gender, age range and email domain.

Fake API Key & Token Generator MOCK DATA

Clearly fake API keys, JWTs and hex/base64 secrets — structurally valid enough to exercise parsers and middleware, cryptographically meaningless by design.

Fake Audit Log API MOCK DATA

Generate coherent fake audit records for authentication, CRUD and permission changes — safely seeded, filterable and bounded by time.

Mock Pagination API MOCK DATA

Deterministic offset and opaque-cursor pagination fixtures with exact totals, stable sorting and no duplicated or skipped records.

Set-Cookie Parser & Cookie Delivery API REAL DATA

Parse Set-Cookie and test delivery: attribute rules, __Host-/__Secure- prefixes, SameSite+Secure, Max-Age vs Expires precedence, and domain/path matching.

GET /api/auth-sessions Generate coherent fictional authentication sessions Returns a list

Request parameters

Response

Route reference

Documented examples

GET /api/auth-sessions/login-attempts Generate coherent fictional login attempts Returns a list

Request parameters

Response

Route reference

Documented examples

About this API

Coverage & behavior

Use it for

Frequently asked questions

Standards & references

Related APIs