curl --request GET \
--url https://aquila.attaxr.com/api/oob/endpoint \
--cookie better-auth.session_token=const options = {method: 'GET', headers: {cookie: 'better-auth.session_token='}};
fetch('https://aquila.attaxr.com/api/oob/endpoint', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://aquila.attaxr.com/api/oob/endpoint"
headers = {"cookie": "better-auth.session_token="}
response = requests.get(url, headers=headers)
print(response.text){
"enabled": true,
"hostname": "<string>",
"identifier": "<string>",
"reversedIdentifier": "<string>",
"dnsProvisioned": true,
"correlationId": "<string>",
"domain": "<string>"
}{
"error": "<string>"
}Get the OOB endpoint
The caller’s out-of-band payload host: one random 33-character label (the correlation unit) under the deployment’s OOB domain. The hostname itself carries the key, so no separate payload string exists — any DNS, HTTP, HTTPS, or SMTP request to it records to the caller’s account. Labels for individual tests ride the URL path or the SMTP mailbox local part, never the hostname.
curl --request GET \
--url https://aquila.attaxr.com/api/oob/endpoint \
--cookie better-auth.session_token=const options = {method: 'GET', headers: {cookie: 'better-auth.session_token='}};
fetch('https://aquila.attaxr.com/api/oob/endpoint', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://aquila.attaxr.com/api/oob/endpoint"
headers = {"cookie": "better-auth.session_token="}
response = requests.get(url, headers=headers)
print(response.text){
"enabled": true,
"hostname": "<string>",
"identifier": "<string>",
"reversedIdentifier": "<string>",
"dnsProvisioned": true,
"correlationId": "<string>",
"domain": "<string>"
}{
"error": "<string>"
}Authorizations
Browser session cookie set by Better Auth sign-in.
Response
The endpoint status and hostname.
Whether OOB testing is configured for this deployment.
The payload host: .. One random 33-character label — the label itself carries the key, so any request to this host records to the caller's account.
The 33-character label: a 20-character correlation key plus a 13-character nonce.
Legacy display material. Payloads never use it.
Whether the DNS delegation for the hostname is live. A false value self-heals on the next sign-in.
The 20-character correlation key inside the label.
The deployment's OOB domain the label sits under (bhunt.win in production).