---
schema_version: "1"
id: e7eac36e439881b243c25663e0e1fa7e9c411950d745cd10070d8307e6802b57
title: API Request Anomaly Detection Examples
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/real_time_em_threat_detection_api_anomaly_examples.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_detection_api_anomaly_examples.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: fba00ffe0a5d72db337f237a7c72e5368afea9fea883a898c8f33391c0847547
description: Here are several examples that illustrate how you can investigate anomalous API request events thoroughly.
products:
  - Salesforce Platform
  - Cross Cloud
release: "264"
---
# API Request Anomaly Detection Examples

Here are several examples that illustrate how you can investigate anomalous API request events thoroughly.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition">
      <colgroup>
        <col>
      </colgroup>
      <tbody>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">Available in both Salesforce Classic (not available in all orgs) and Lightning
            Experience.</td>

        </tr>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">
            <p>Available in: <strong>Enterprise</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong>
              Editions</p>
            <p style="margin-bottom:0;">Requires Salesforce Shield or Salesforce Event Monitoring add-on
              subscriptions.</p>
          </td>

        </tr>
      </tbody>
    </table>

- **[API Detection Event Isn’t Anomalous](https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_examples_api_notanomalous.htm&release=264.0.0&type=5)**  
    Jason, a developer, uses APIs to query an Account object on a Sunday. He retrieves 10,000 records.
- **[API Detection Event Possibly Anomalous](https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_examples_api_maybeanomalous.htm&release=264.0.0&type=5)**  
    Rob, a relatively new Sales Operation Lead, uses an API to query the Opportunity object and extracts 10 million records. He previously queried the same object using a different browser and from a different IP address.
- **[API Detection Event Is an Anomaly but Isn’t Clearly Malicious](https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_examples_api_anomalous.htm&release=264.0.0&type=5)**  
    Alice is a sales rep based in St. Louis. She’s often on the road to meet with clients. When she travels, she generally, but not consistently, uses her company’s VPN to log into Salesforce.
- **[API Detection Event Is Confirmed Malicious](https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_examples_api_malicious.htm&release=264.0.0&type=5)**  
    Alan, a Salesforce user, employs an API to query the Opportunity object and extracts 10 million records. It’s the first time that Alan queries the Opportunity object and uses this IP address to log in.