Auth and logging data map

Domains: auth, loggingStatus: implementedReviewed: 2026-09-04

These services hold operational security and audit data. Secret values are never recoverable from the database; only hashes and issuance metadata are retained.

OAuth client

Field	Type	Source / purpose
client_id	string(128), unique	Public OAuth machine identity; included in client JWTs.
name	string(100), unique	Operator-facing caller name.
secret_hash	string(64)	SHA-256 of the client secret; never returned. The secret is 256 bits of token_urlsafe, so there is no salt: a rainbow table has nothing to precompute against a random 256-bit value.
is_active	boolean	Disables new token issuance. Already issued JWTs remain valid until expiry.
token_lifetime	60–86400 seconds	Lifetime used by /auth/oauth/token.
created_at, last_used_at	timestamps	Creation and latest successful exchange.

OAuth grant

Field	Type	Source / purpose
client	OAuthClient FK	Owning machine caller.
scope	string(128)	One catalogue scope; unique per client.

The scope catalogue is listed in Authentication.

Issued long-lived token ledger

Field	Type	Source / purpose
jti	string(32), unique	JWT identifier printed when the token is issued.
client	OAuthClient FK	Caller represented by the token.
scope	string(4096)	Space-separated granted scopes embedded in the JWT.
expires_at	timestamp	Required for key-rotation and incident decisions.
issued_at	timestamp	Audit time.

Deleting a ledger row does not revoke the stateless JWT. Revocation requires waiting for expiry or rotating the signing key and accepting the effect on all tokens signed by that key.

Human access group

Field	Type	Source / purpose
name	string(100), unique	Operator-facing local group.
bundle	string(64)	Validated permission bundle such as platform_user or platform_admin.
users	User many-to-many	Locally assigned users; merged with Entra-derived access at login.

Human access JWTs also carry Microsoft profile data (sub, e-mail and name) plus per-service access entries. Microsoft group ids are evaluated at login and are not persisted as a second authorization database.

External API log

Field	Type	Source / purpose
service	string(100)	Platform service that initiated the call.
provider	string(100)	External system called.
method	string(10)	HTTP method.
endpoint	text	Requested external endpoint.
status_code	integer	Provider response status.
duration_ms	integer	End-to-end request duration.
request_id	string(128)	Indexed correlation ID, so one inbound request can be followed across the external calls it caused.
user_id	string(100)	Optional originating human or machine identifier.
user_name	string(255)	Optional display name.
actor_type	enum	user or system.
timestamp	timestamp	Log ingestion time.

Request and response bodies are deliberately absent from this model. Payload logging, if added, requires separate retention, redaction and data-protection rules.