Platform Operations

These endpoints expose platform-wide operational counters and MFA security telemetry.

Endpoints

Method	Path	Description
`GET`	`/api/platform/operations/status`	Background jobs, failed webhooks, and SIEM counters
`GET`	`/api/platform/mfa/metrics`	MFA usage metrics
`GET`	`/api/platform/mfa/suspicious-activity`	Suspicious MFA events
`GET`	`/api/platform/mfa/metrics/generate`	Generate daily MFA metrics for a date

`GET /api/platform/operations/status`

Example response:

{
  "jobs_pending": 4,
  "jobs_running": 1,
  "jobs_failed": 0,
  "webhook_deliveries_failed": 2,
  "siem_configs_enabled": 3,
  "siem_configs_with_failures": 1
}

`GET /api/platform/mfa/metrics`

The handler accepts an optional org_id filter and returns usage metrics for MFA adoption and activity. When you need org-specific numbers, call:

curl "https://sso.example.com/api/platform/mfa/metrics?org_id=org_123" \
  -H "Authorization: Bearer {platform_owner_jwt}"

`GET /api/platform/mfa/suspicious-activity`

Use this to retrieve the current suspicious MFA alerts, optionally filtered by org_id.

`GET /api/platform/mfa/metrics/generate`

This endpoint is intended for operational workflows that backfill or generate daily MFA aggregates for a specific date.