Connect your identity provider

Vrymdor records the sign in activity that matters for security: successful and failed sign ins, sign outs, password resets and changes, second factors added or removed, session renewals and revocations, account lockouts, and user and role changes. You see each one in plain language in your dashboard.

The endpoint

POST https://api.vrymdor.com/v1/ingest/identity
Content-Type: application/json
X-Awareness-Token: <your AWARENESS_TOKEN>

If your provider cannot set a custom header, put the token in the JSON body as "awareness_token" instead. Vrymdor removes it before the event is stored.

Event format

Send one event per request, in either format.

Normalized (any provider):

{
  "event_type": "login_failed",
  "subject": "[email protected]",
  "provider": "okta",
  "occurred_at": "2026-10-20T14:03:00Z",
  "id": "evt-8f2c1"
}

event_type is one of: login, login_failed, logout, password_reset, password_changed, mfa_enrolled, mfa_removed, session_update, session_revoked, account_locked, user_created, user_deleted, role_granted, role_revoked. subject is the user the event is about. id is optional but recommended: a retried event with the same id is stored once.

Keycloak (event listener payload, sent as is):

{ "type": "LOGIN_ERROR", "realmId": "acme", "userId": "6c1d...", "time": 1760968980000, "id": "..." }

Mapped types: LOGIN, LOGIN_ERROR, LOGOUT, RESET_PASSWORD, UPDATE_PASSWORD, UPDATE_TOTP, REMOVE_TOTP, REFRESH_TOKEN, CODE_TO_TOKEN, REGISTER, DELETE_ACCOUNT, and the lockout events. Other types are acknowledged and ignored.

Vrymdor stores the event type, the subject, the provider and the time. IP addresses in the payload are not stored.

Keycloak

Keycloak does not ship an HTTP event sender, so install an event listener extension that POSTs events to a URL (for example an open source "events to HTTP" or webhook listener provider). Configure it with the endpoint above and the X-Awareness-Token header, then enable it under Realm settings, then Events, then Event listeners, and turn on saving of user events.

Any other provider

Most providers can stream logs to a webhook, or you can run a small relay that reformats their events into the normalized shape. A minimal relay call:

curl -sS https://api.vrymdor.com/v1/ingest/identity \
  -H "Content-Type: application/json" \
  -H "X-Awareness-Token: $AWARENESS_TOKEN" \
  -d '{"event_type":"password_reset","subject":"[email protected]","provider":"entra"}'

A 200 with "status": "stored" means it worked. A 403 means the token is wrong or was rotated, and a 422 means the event is not in a supported format (the response says which field).

Providers that require the receiving endpoint to answer a verification challenge first (for example Okta event hooks) are not supported directly yet. Use a relay for those.