Reports

Not built yet.

Auth-failure rate still cannot be reported on -- there is no read/list endpoint at all yet (insert-only today), so this remains genuinely not built. 2026-09-01 update, the real boundary named exactly, not just 'structural gap': sql/226 added principal_id attribution, but ONLY for one of the three real failure cases -- a REVOKED key's presented hash resolves to a real, known principal (that key genuinely was issued, to someone), so THAT case can be tenant-scoped once a read endpoint exists. A missing/malformed header and an unknown/garbage credential (never a real issued key) carry no identity at all, structurally -- no migration closes that, the same way an unknown-email login attempt can never be attributed to an identity that doesn't exist. So: partial tenant-scoping is now real for revoked-key failures specifically; the other two failure reasons stay platform-wide only, by nature, not by omission. A read endpoint + report UI is the remaining real work, not attempted here.