# Thousands of user api requests and invalidation
**URL:** https://meta.discourse.org/t/thousands-of-user-api-requests-and-invalidation/279791
**Category:** Support
**Created:** [September 22, 2023, 1:20pm UTC](https://meta.discourse.org/t/thousands-of-user-api-requests-and-invalidation/279791 "2023-09-22T13:20:20Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@RBoy](https://meta.discourse.org/u/RBoy)
#### Post date: [September 22, 2023, 1:20pm UTC](https://meta.discourse.org/t/thousands-of-user-api-requests-and-invalidation/279791/1 "2023-09-22T13:20:20Z")
I just noticed that I’m seeing thousands of user API requests per day starting April this year in the dashboard security reports.
This is very odd and off by a factor of 100 to 1000 from my expectations.
How do I get more detailed reports about the high users are requesting keys and which users are making how many and which API requests? If a key has read/write request access I’m assuming that someone can remotely read and write topics / posts. Could it be a remote site scraping posts?
Also is there a way to globally invalidate/expire all user api keys?
---
### Author:  [@simon](https://meta.discourse.org/u/simon)
#### Post date: [September 22, 2023, 6:54pm UTC](https://meta.discourse.org/t/thousands-of-user-api-requests-and-invalidation/279791/2 "2023-09-22T18:54:03Z")
> [@RBoy](#):
>
> I just noticed that I’m seeing thousands of user API requests per day starting April this year in the dashboard security reports.
Just to confirm, you are asking about User API requests and not API requests that have been run with an API key that you have generated for users on your Discourse site’s Admin / API page. User API requests are highlighted in green in the screenshot below:
Details about what User API Keys are used for are here: [User API keys specification](https://meta.discourse.org/t/user-api-keys-specification/48536).
Unless you have created an app that integrates with your Discourse site, the most likely explanations are either that users are logging into the site via the DiscourseHub App ([https://play.google.com/store/apps/details?id=com.discourse&hl=en&gl=US&pli=1](https://play.google.com/store/apps/details?id=com.discourse&hl=en&gl=US&pli=1)) or they are using an app similar to [Fig - Native Discourse client for iOS](https://meta.discourse.org/t/fig-native-discourse-client-for-ios/148352) to interact with the site.
> [@RBoy](#):
>
> How do I get more detailed reports about the high users are requesting keys and which users are making how many and which API requests?
This doesn’t answer all of your questions, but you can get a general overview of how the User API keys are being used with the following [Data Explorer](https://meta.discourse.org/t/32566?silent=true) query:
```sql
SELECT * FROM user_api_keys
```
To get a list of applications that are making User API key requests to your site, and a count of the number of users who are making requests with each application:
```sql
SELECT
application_name,
COUNT(application_name) AS user_count
FROM user_api_keys
GROUP BY application_name
```
User API keys that are being used to connect from the DiscourseHub app will have their `application_name` set to “Discourse - unknown”.
If a user makes use of a User API key to interact with the site, an Apps entry will be added to the Security tab of their preferences page:
The entry shows the scopes that have been granted to the app. It also allows you to revoke access to the app.
> [@RBoy](#):
>
> is there a way to globally invalidate/expire all user api keys?
I am not seeing any way of expiring or revoking all User API keys from the Discourse UI. There is only the option to revoke one key at a time from users preferences pages. It would be possible to revoke all User API keys from the Rails console, but it’s probably worth investigating how the keys are being used first.
---
### Author:  [@RBoy](https://meta.discourse.org/u/RBoy)
#### Post date: [September 22, 2023, 9:41pm UTC](https://meta.discourse.org/t/thousands-of-user-api-requests-and-invalidation/279791/3 "2023-09-22T21:41:11Z")
Thanks, yes it’s User API requests
---
### Author:  [@simon](https://meta.discourse.org/u/simon)
#### Post date: [September 22, 2023, 11:40pm UTC](https://meta.discourse.org/t/thousands-of-user-api-requests-and-invalidation/279791/4 "2023-09-22T23:40:55Z")
That seems like too many requests to be coming from the DiscourseHub app. If you have the [Data Explorer](https://meta.discourse.org/t/32566?silent=true) installed on your site, I’d be curious about the results of this query:
```sql
SELECT
application_name,
COUNT(application_name) AS user_count
FROM user_api_keys
GROUP BY application_name
```
I tested that query on my own test site, but it only has one `user_api_request` from the DiscourseHub app. I _think_ I’ve structured the query correctly for dealing with multiple users connecting to Discourse from multiple apps, but let me know if anything in the results seems off.
---
### Author:  [@RBoy](https://meta.discourse.org/u/RBoy)
#### Post date: [September 25, 2023, 11:58pm UTC](https://meta.discourse.org/t/thousands-of-user-api-requests-and-invalidation/279791/5 "2023-09-25T23:58:21Z")
Took some time to get [data explorer](https://meta.discourse.org/t/32566?silent=true) installed, my rebuild failed for some reason.
This is what I see:
| application\_name | user\_count |
| --- | --- |
| Discourse - xhanse's iPhone X | 1 |
| Discourse - iPhone | 1 |
| Discourse - xrett's iPhone | 2 |
| Discourse - xave's iPhone | 1 |
| Discourse - xixu's iPhone | 1 |
| Discourse - xevin's GS8 | 1 |
I’ve masked some the names, this looks like just a few users. Is the query returning information for a specific period of time? Thousands of API requests for a few users look excessive to me. Also one users seems to have 2 `user_count`, does that mean (s)he has 2 API keys (i.e. 2 apps)?
---
### Author:  [@ClawdiaWolf](https://meta.discourse.org/u/ClawdiaWolf)
#### Post date: [September 26, 2023, 1:32am UTC](https://meta.discourse.org/t/thousands-of-user-api-requests-and-invalidation/279791/6 "2023-09-26T01:32:27Z")
> [@RBoy](#):
>
> Also one users seems to have 2 `user_count`, does that mean (s)he has 2 API keys (i.e. 2 apps)?
There’s two possibilities on that one. Either the user has two iPhones with the same device name OR they uninstalled the app and reinstalled it at some point. In both cases they would have multiple API keys.
---
### Author:  [@simon](https://meta.discourse.org/u/simon)
#### Post date: [September 26, 2023, 2:10am UTC](https://meta.discourse.org/t/thousands-of-user-api-requests-and-invalidation/279791/7 "2023-09-26T02:10:47Z")
> [@RBoy](#):
>
> Is the query returning information for a specific period of time?
No, it’s returning details about all active user api keys.
Try running the query below:
```plaintext
SELECT * FROM user_api_keys
```
I’m assuming it will only return 7 rows. Let me know if that’s not the case.
> [@RBoy](#):
>
> Thousands of API requests for a few users look excessive to me.
Not necessarily. When users access the site via the DiscourseHub app, their requests to the site count as User API requests. If a few of the users are actively reading the site, they could generate 2k requests in a day.
---
### Author:  [@RBoy](https://meta.discourse.org/u/RBoy)
#### Post date: [September 26, 2023, 2:29am UTC](https://meta.discourse.org/t/thousands-of-user-api-requests-and-invalidation/279791/8 "2023-09-26T02:29:23Z")
> [@simon](#):
>
> I’m assuming it will only return 7 rows
Yes that’s correct, I see only 7 items.
Does this mean it’s all kosher. I don’t know the context here, is this a normal load for the forum to handle?
---
### Author:  [@simon](https://meta.discourse.org/u/simon)
#### Post date: [September 26, 2023, 3:14am UTC](https://meta.discourse.org/t/thousands-of-user-api-requests-and-invalidation/279791/9 "2023-09-26T03:14:37Z")
It all seems reasonable to me. For context, I briefly logged into my test site today through the DiscourseHub app. The site has almost no content. I browsed around it for a few minutes and generated 36 User API requests. On a site with lots of content to scroll through, it wouldn’t be unreasonable for a single user to generate a lot of requests over a day.
If you’re still concerned about this, it would be possible to use the [Data Explorer](https://meta.discourse.org/t/32566?silent=true) plugin to look at user activity for the users whose `user_id` were returned from this request:
```plaintext
SELECT * FROM user_api_keys
```
---
### Author:  [@ClawdiaWolf](https://meta.discourse.org/u/ClawdiaWolf)
#### Post date: [September 26, 2023, 3:19am UTC](https://meta.discourse.org/t/thousands-of-user-api-requests-and-invalidation/279791/10 "2023-09-26T03:19:00Z")
> [@RBoy](#):
>
> Does this mean it’s all kosher. I don’t know the context here, is this a normal load for the forum to handle?
Curiosity got the better of me, so I checked a site I almost exclusively use via the DiscourseHub app. I have just shy of 1100 user api key requesrs for the past 24 hours from that site and I’m the only user with an active key. 🙂