[Feature] Expose new user behaviour metrics via Admin API for moderation tooling

[jainsaksham2006]

Problem

There is currently no Admin API endpoint that exposes behavioural metrics for new user accounts (accounts < 90 days old), such as:

• Messages sent per hour
• Number of distinct rooms messaged
• DM initiation rate
• URL density in messages

Proposed Solution

Add a new REST endpoint:
GET /api/v1/admin/users/behaviour-metrics?userId=xxx

Returning a structured JSON response with the above metrics for a given user, scoped to the last 7 / 30 / 90 days.

Why this matters

This endpoint would enable third-party Apps Engine apps and external moderation tools to build risk scoring systems on top of Rocket.Chat without needing direct database access.

— Saksham Jain (@jainsaksham2006), GSoC 2026 applicant for New Users Anti Spammer System

[JarvisX-Z]

This is a very valuable feature for moderation and anti-abuse systems.

A few suggestions that could further improve this endpoint:

1. Consider adding a "risk_score" field derived from weighted metrics (messages/hour, DM rate, URL density) to make it directly usable for automated moderation pipelines.

2. It might be useful to include a time-series breakdown (e.g., hourly buckets) instead of only aggregated values over 7/30/90 days.

3. Adding thresholds or flags (e.g., "high_activity", "possible_spam") could help admins quickly interpret the data.

4. Ensure rate-limiting and permission controls are strict, as this endpoint exposes sensitive behavioral insights.

5. Optional: allow filtering by time window dynamically instead of fixed ranges.

This could significantly enhance third-party integrations and security tooling around Rocket.Chat.