Record an authentication audit event (FM-494)
POST
/api/v1/me/auth-event
const url = 'http://localhost:3000/api/v1/me/auth-event';const options = { method: 'POST', headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'}, body: '{"event":"auth.login.success","success":true,"provider":"example","errorCode":"example","errorDescription":"example","metadata":{}}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url http://localhost:3000/api/v1/me/auth-event \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "event": "auth.login.success", "success": true, "provider": "example", "errorCode": "example", "errorDescription": "example", "metadata": {} }'Emits a tamper-evident audit-log entry for an auth-flow event observed by the BFF (login, refresh, logout, federated, session termination). The signing uses the same AUDIT_HMAC_SECRET as the rest of the audit pipeline.
Authorizations
Section titled “Authorizations ”Request Body required
Section titled “Request Body required ” Media type application/json
object
event
required
Canonical auth-audit event name (FM-494).
string
success
required
Whether the underlying auth operation succeeded.
boolean
provider
OAuth/OIDC provider name when relevant (e.g. “keycloak”, “entra”).
string
errorCode
Short error code for failed events (e.g. “expired_token”).
string
errorDescription
Human-readable error description for failed events.
string
metadata
Free-form metadata (small JSON object). MUST NOT contain access tokens.
object
Responses
Section titled “ Responses ”Audit event recorded
Invalid payload
Unauthorized