Send your app's events

Your own app knows things no vendor sends: who failed to sign in, who turned MFA off, who was made an admin. Send those events to a source of kind Your app, and the ready-made rules turn bursts and risky changes into findings.

The format

One JSON object per event, or an array of them:

{
  "type": "login.failed",
  "actor": "user_42",
  "ip": "203.0.113.7",
  "country": "IN",
  "role": "admin",
  "at": "2026-10-25T09:30:00Z"
}

Send an id rather than an email where you can: the event is kept for your plan’s history window.

Prove each request

Send the source secret in the X-ShellOrbit-Token header. A request without it, or with the wrong one, is kept as evidence and marked, and no rule reads it.

export async function report(event) {
  const response = await fetch(process.env.SOURCE_URL, {
    method: "POST",
    headers: { "content-type": "application/json", "x-shellorbit-token": process.env.SOURCE_SECRET },
    body: JSON.stringify(event),
  });
  if (response.status !== 202) console.warn("ShellOrbit did not accept the event", response.status);
}

To sign instead of sending the secret, an admin sets the source’s proof to ShellOrbit signature under Manage. Then send ShellOrbit-Signature: t=<timestamp>,v1=<hex>, where v1 is an HMAC SHA256 of the Unix timestamp, a dot, and the exact body, made with the source secret. Requests more than five minutes old are refused.

Report after the response to your user has gone, or from a queue, so a slow request never slows a sign in.

What the ready-made rules detect

password.reset and login.succeeded are kept as history and feed the rules above; add your own with custom rules.