> ## Documentation Index
> Fetch the complete documentation index at: https://docs.musterbox.org/llms.txt
> Use this file to discover all available pages before exploring further.

# Report a security event (best-effort audit log)

> Best-effort security audit logging used by the SDK's pre-flight path
(for example reporting an `ENV_COMPROMISED` block). The backend
acknowledges with `202`; failures never fail the surrounding purchase
flow.




## OpenAPI

````yaml /openapi/musterbox-public.yaml post /api/v1/security/events
openapi: 3.0.3
info:
  title: MusterBox Public API
  version: 1.0.0
  description: |
    The public surface of the MusterBox developer platform. Every path in this
    document is verified against the MusterBox backend source code. The client
    SDK (`MusterBoxSdk`) is the recommended way to drive these endpoints; these
    pages document the wire contract for teams that need to understand or
    debug the traffic the SDK produces.

    Environments are selected by the base URL. The control-plane base URL per
    environment is:

    | Environment  | Base URL                          |
    | ------------ | --------------------------------- |
    | `local`      | `http://localhost:8081`           |
    | `sandbox`    | `https://sandbox-api.musterbox.dev` |
    | `staging`    | `https://staging-api.musterbox.dev` |
    | `production` | `https://api.musterbox.com`       |

    All paths below include the `api/v1` backend prefix explicitly, matching
    how the SDK resolves URLs (`control plane base` + `/api/v1`).

    > **Security boundary**: authentication, game sessions and results are the
    > only integration surfaces. Purchase endpoints exist for the on-device
    > PIN-verification flow and should always be driven through the SDK's
    > `PurchaseClient` — never hand-rolled. Do not roll your own purchase flow.
servers:
  - url: https://api.musterbox.com
    description: Production (default)
  - url: https://sandbox-api.musterbox.dev
    description: Sandbox — pre-production validation
  - url: https://staging-api.musterbox.dev
    description: Staging — pre-release integration environment
  - url: http://localhost:8081
    description: Local development backend
security:
  - bearerAuth: []
tags:
  - name: Authentication
    description: Player login, session refresh, and logout via the backend auth API
  - name: Game SDK
    description: >-
      Match sessions and mutually-confirmed results for games hosted by
      MusterBox
  - name: Secure purchases
    description: SDK-mediated PIN sessions for secure player purchases
paths:
  /api/v1/security/events:
    post:
      tags:
        - Secure purchases
      summary: Report a security event (best-effort audit log)
      description: |
        Best-effort security audit logging used by the SDK's pre-flight path
        (for example reporting an `ENV_COMPROMISED` block). The backend
        acknowledges with `202`; failures never fail the surrounding purchase
        flow.
      operationId: reportSecurityEvent
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - event_type
                - details
              properties:
                event_type:
                  type: string
                  description: Machine-readable event name.
                  example: ENV_COMPROMISED
                details:
                  type: object
                  description: Event payload (item, amount, risks, level, ...).
      responses:
        '202':
          description: Event acknowledged for audit logging.
        '401':
          description: Missing or invalid access token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
      security:
        - bearerAuth: []
components:
  schemas:
    ApiError:
      type: object
      description: >-
        NestJS error envelope ({ error: { code, message, status } }) or the
        plain { message } shape.
      properties:
        error:
          type: object
          properties:
            code:
              type: string
            message:
              type: string
            status:
              type: integer
        message:
          type: string
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: Player access token returned by login/refresh.

````