Settings

Tenant context used on every API request, plus a read-only view of the configured API origin and a live health check.

Tenant context

Sent as Authorization: Bearer <token> + X-Tenant-Id + X-Actor-Id on every request except GET /health (src/api/context.ts -- a format-only auth stub, not real auth)

API origin

NEXT_PUBLIC_AUD0_API_URL (build-time env var)

https://api.aud0.siax.io

Requests are proxied same-origin through /api/aud0/* (next.config.ts rewrites) to avoid browser CORS blocking, since the real Fastify API sends no CORS headers.

Health check

Live GET /v1/aud0/health (no auth required)

Not checked yet this session.

Retention policies

Not available. No GET /v1/aud0/retention-policies endpoint exists on the real API -- aud0_retention_policies is one of 3 tables explicitly not built this pass (see docs/ARCHITECTURE.md section 7). Shown here honestly rather than built or silently omitted.