---
title: "Record a pre-auth attempt"
method: POST
path: "/telemetry/auth-events"
tags: ["telemetry"]
---

# Record a pre-auth attempt

`POST /telemetry/auth-events`

## Request

- Base URL: `https://api.instruxi.dev/api/v1/enforcer`
- URL: `https://api.instruxi.dev/api/v1/enforcer/telemetry/auth-events`
- Auth: none declared

Unauthenticated ingest for auth-funnel events from callers with no account context yet — the population that cannot emit ordinary client telemetry. event must be one of otp_requested, otp_send_failed, otp_verify_failed, login_failed; anything else is a 400 rather than a stored row, because a free-text event on an unauthenticated write would let anyone mint rows a support feed then displays as fact. The email is stored HASHED (for lookup) and MASKED (for reading), never in the clear. Well-formed requests answer 202 whether or not a row was written — an unknown tenant_code is dropped silently so this cannot be used to probe which tenant codes exist. Per-IP rate limited.

## Request body

- InternalDeliveryHttpHandlerAuthAttemptRequest
  - `context` object
  - `email` string: Email is the address the attempt was made with. Stored hashed and masked, never in the clear.
  - `event` string: Event must be one of the closed set: otp_requested, otp_send_failed, otp_verify_failed, login_failed.
  - `message` string
  - `tenant_code` string: TenantCode names the tenant — the same handle the client already passes to GET /auth/config, since a pre-auth caller has no other.

## Response `202`

Accepted

- InternalDeliveryHttpHandlerOKResponse
  - `success` boolean

## Other responses

- `400`: Bad Request
- `429`: Too Many Requests

---

[API](https://skmtc.dev/instruxi/apis/enforcer-api.md) · [All operations](https://skmtc.dev/instruxi/apis/enforcer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/instruxi/apis/enforcer-api/revisions/fa82bc1becc0?raw)