telemetry

Record a pre-auth attempt

Unauthenticated ingest for auth-funnel events from callers with no account context yet — the population that cannot emit ordinary client telemetry. event must be one of otp_requested, otp_send_failed, otp_verify_failed, login_failed; anything else is a 400 rather than a stored row, because a free-text event on an unauthenticated write would let anyone mint rows a support feed then displays as fact. The email is stored HASHED (for lookup) and MASKED (for reading), never in the clear. Well-formed requests answer 202 whether or not a row was written — an unknown tenant_code is dropped silently so this cannot be used to probe which tenant codes exist. Per-IP rate limited.

post/telemetry/auth-events

Request

  • Base URL: https://api.instruxi.dev/api/v1/enforcer
  • URL: https://api.instruxi.dev/api/v1/enforcer/telemetry/auth-events
  • Auth: none declared

Request body

contextobject
emailstring

Email is the address the attempt was made with. Stored hashed and masked, never in the clear.

eventstring

Event must be one of the closed set: otp_requested, otp_send_failed, otp_verify_failed, login_failed.

messagestring
tenant_codestring

TenantCode names the tenant — the same handle the client already passes to GET /auth/config, since a pre-auth caller has no other.

Example request

{
  "email": "v...@msn.com",
  "event": "otp_verify_failed",
  "tenant_code": "ACME"
}

Response

Accepted

successboolean

Example response

{
  "success": true
}

Changes

No recorded changes to this operation across all 1 revision of this API.