> ## Documentation Index > Fetch the complete documentation index at: https://docs.onefirewall.com/llms.txt > Use this file to discover all available pages before exploring further. # Threat Prevention Stats > Returns threat prevention dashboard data including total connections, threats blocked, risk score, latest events, and geographic breakdown. Uses the selected organization or org_id query parameter. ## OpenAPI ````yaml GET /auth/threat-prevention-stats openapi: 3.0.0 info: title: ClosedVPN API version: 1.1.0 description: > API for managing authentication, organizations, members, VPN configurations, certificates and usage reporting for the ClosedVPN platform. The VPN capability previously delivered through the OneFirewall Application (`https://app.onefirewall.com/api/v1/vpn`) now runs on ClosedVPN and is served from `https://closedvpn.io`. The legacy OneFirewall VPN endpoints are deprecated and replaced by the operations documented here. Most endpoints require a Personal Access Token (PAT), sent as `Authorization: Bearer `. To obtain one, sign in through the magic link flow (`/auth/send-magic-link` then `/auth/verify-magic-link`, neither of which requires prior authentication) and then call `/auth/generate-pat`, or create the token from the Profile page in the web application. The plaintext token is shown only once and is stored as a bcrypt hash, so it cannot be recovered later. contact: name: OneFirewall Alliance url: https://closedvpn.io email: support@onefirewall.com servers: - url: https://closedvpn.io description: Production server security: [] tags: - name: Authentication description: Magic link sign-in, session validation and sign-out. - name: Profile description: Read and update the authenticated user's profile. - name: Personal Access Tokens description: Create, list and revoke Personal Access Tokens used for API access. - name: Organizations description: Create, update, list, select and delete organizations. - name: Members description: Add members to an organization, change their role and remove them. - name: VPN Certificates description: Issue and download the OpenVPN client profile for a member. - name: VPN Configurations description: Manage VPN server configurations and run their predefined commands. - name: VPN Exit Nodes description: List the VPN exit nodes available to the caller. - name: Statistics description: Connection status, traffic reporting and threat prevention metrics. - name: Notifications description: Read in-app notifications and mark them as read. - name: Activity Logs description: Retrieve the caller's recent activity. paths: /auth/threat-prevention-stats: get: tags: - Statistics summary: Get threat prevention statistics description: >- Returns threat prevention dashboard data including total connections, threats blocked, risk score, latest events, and geographic breakdown. Uses the selected organization or org_id query parameter. operationId: getThreatPreventionStats parameters: - name: org_id in: query required: false schema: type: string example: 60c72b2f5f1b2c001c8e4b1a description: >- Organization ID (falls back to user's selected organization if not provided) responses: '200': description: Threat prevention stats retrieved content: application/json: schema: type: object properties: success: type: boolean example: true message: type: string description: > Present only when the returned data is empty, explaining why. One of "No organization selected", "No VPN configuration found for selected org", "VPN configuration not found", "VPN private config not available", or "No log data available". example: No organization selected data: type: object properties: stats: type: object properties: totalConnections: type: integer example: 15432 threatsBlocked: type: integer example: 127 riskScore: type: number example: 8.23 protectedUsers: type: integer example: 5 latestEvents: type: array items: type: object properties: user: type: string example: john connection: type: string example: 192.168.1.1 -> 10.0.0.1 status: type: string example: blocked events: type: integer example: 12 lastTime: type: string example: '2025-06-15T10:30:00' timeSeriesData: type: array items: type: object properties: date: type: string example: '2025-06-15T10:00:00' total: type: integer example: 500 prevented: type: integer example: 15 preventedByCountry: type: array items: type: object properties: country: type: string example: CN count: type: integer example: 45 protectionByUser: type: array items: type: object properties: name: type: string example: john value: type: integer example: 32 '401': description: Unauthorized (invalid or missing PAT) content: application/json: schema: type: object properties: message: type: string example: Unauthorized '404': description: User not found content: application/json: schema: type: object properties: success: type: boolean example: false message: type: string example: User not found '500': description: Internal server error content: application/json: schema: type: object properties: success: type: boolean example: false message: type: string example: Server error security: - bearerAuth: [] components: securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: PAT description: > Personal Access Token (PAT) passed in the Authorization header (e.g., `Bearer `) for authenticated API requests. PATs are generated via `/auth/generate-pat` after authenticating through the magic link flow. ````