admin

List pre-auth attempts

Auth-funnel events for one tenant, newest first — including the attempts that never reached an account, which is the whole point. Pass email to answer "did this address ever try, and what failed": the address is hashed server-side and matched against the stored hash, so the search term is never written to the database and the plaintext never had to be stored to be findable. Scoped to the caller's tenant; only a cross-tenant admin may name another via tenant_id. from/to accept RFC3339 or YYYY-MM-DD. Unknown query parameters are a 400, not a silently unfiltered list.

get/admin/auth-events

Request

  • Base URL: https://api.instruxi.dev/api/v1/enforcer
  • URL: https://api.instruxi.dev/api/v1/enforcer/admin/auth-events
  • Auth: one of:
    • API key in header Authorization
    • API key in header X-API-Key

Query parameters

tenant_idstring

tenant (cross-tenant admin only)

emailstring

exact address to search for (hashed server-side)

event'otp_requested' | 'otp_send_failed' | 'otp_verify_failed' | 'login_failed'

one of the closed set

group_idstring uuid

only attempts by members of this group — matched on the row's account, or on the address hash of a member's email; attempts from addresses no account holds never match. 404 group_not_found if the group is not visible to you

exclude_group_idstring uuid

drop attempts by members of this group (attempts from unknown addresses are kept); 404 group_not_found if not visible

fromstring

RFC3339 or YYYY-MM-DD

tostring

RFC3339 or YYYY-MM-DD

limitinteger

page size

offsetinteger

page offset

Response

OK

limitinteger
offsetinteger
tenant_idstring

TenantID is the tenant actually read, which for a tenant-scoped caller is always their own regardless of what they asked for.

totalinteger

Example response

{
  "limit": 50,
  "total": 3
}

Changes

No recorded changes to this operation across all 1 revision of this API.