Login

flagActivity([reason]) Last updated: 22. Oct 2026

API only function

flagActivity flags suspicious request patterns to deter potential brute force attacks. After a set number of flagged requests from a single IP, it blocks that IP to protect the platform.

Only the first call in a request registers a flag. Later calls in the same request register nothing, but still report whether the IP is blocked.

See also: writeJwt deleteJwt denyAccess logOut getProfilePictureUrl Custom JWT login example

Parameters

Name Type Description
reason (optional) string

Why the request is flagged. Shown in the block notification, prefixed with "site-script:".

Returns

true if the calling IP is blocked (now or already), otherwise false.

Example

Code example (JS)

JS is normal JavaScript either running in the browser or on the Docly™ server. 
// Typical use in a login endpoint — flag failed attempts so brute force
// from a single IP is throttled and eventually blocked.

// #/API/login.js
export default (username, password) => {

    let user = lookupUser(username);

    if (!user || !verifyPassword(password, user.passwordHash)) {

        // Tick the "flag" counter for the calling IP.
        // Returns true if this IP has now been blocked.
        let blocked = docly.flagActivity();

        if (blocked) {
            return { error: "Too many failed attempts. Try again later." };
        }
        return { error: "Invalid username or password." };
    }

    // Success — issue the session JWT
    docly.writeJwt({ username: user.name, access: user.role });
    return { success: true };
}