Endpoints
Request groups exposed by Own Auth Cloud.
Package endpoints
The cloud() plugin calls these endpoints with an app-scoped oac_sk_ Cloud API key. Applications normally do not call them directly.
| Method | Path | Purpose |
|---|---|---|
| POST | /ingest/events | Ingest a normal event batch. |
| POST | /ingest/gaps | Record a dropped-ingestion period after delivery resumes. |
| POST | /ingest/priority | Synchronously acknowledge deletion events. |
| POST | /ingest/backfill | Import a resumable snapshot page. |
| POST | /security/check | Return an advisory allow, challenge, or deny decision. |
| POST | /security/observe | Record a successful login location for later risk checks. |
| POST | /delivery/email | Validate and queue an authentication email. |
| POST | /delivery/sms | Validate and queue an authentication SMS. |
Management endpoints
Automation authenticates with a scoped oac_mk_ management key. Dashboard requests use the signed-in Own Auth session and the same tenant checks.
| Path | Purpose |
|---|---|
| /users | Search users, inspect details, export data, and erase a user. |
| /orgs | Search organisations and inspect memberships. |
| /analytics/* | Read overview and time-series authentication metrics. /analytics/summary returns the metrics named in its metrics query value in one response. |
| /security/* | Read incidents and blocks, update controls, remove blocks, and reset user-level deny state. /security/overview returns incidents, blocks, and the current configuration in one response. |
| /audit-logs | Search and export safe audit records. |
| /delivery/logs | Read safe email and SMS delivery statuses. |
| /usage | Read current plan usage and quotas. |
| /team | Manage Cloud dashboard members and roles. |
| /management-keys | Create, list, and revoke management keys. |
| /apps/:appId/disconnect | Disconnect an app and begin its deletion window. |
Errors
Cloud returns JSON errors with a stable lowercase code and safe message. Delivery quota failures use quota_exhausted with HTTP 429. This includes the app's daily email limit across all keys, which resets at midnight UTC, and the account's monthly allowance. Paid overages do not bypass the daily app limit. Responses never include tokens, message bodies, provider credentials, raw keys, or provider diagnostics.