> ## Documentation Index
> Fetch the complete documentation index at: https://docs.attaxr.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Get the OOB endpoint

> The caller's out-of-band payload host: one random 33-character label (the correlation unit) under the deployment's OOB domain. The hostname itself carries the key, so no separate payload string exists — any DNS, HTTP, HTTPS, or SMTP request to it records to the caller's account. Labels for individual tests ride the URL path or the SMTP mailbox local part, never the hostname.



## OpenAPI

````yaml /api/openapi.json get /api/oob/endpoint
openapi: 3.1.0
info:
  title: Aquila API
  version: 1.0.0
  description: >-
    Event-driven reconnaissance platform API. All /api/* routes except
    /api/public/* require an authenticated session (cookie), an X-Api-Key
    header, or a bearer token. Auth endpoints under /api/auth/* are generated by
    Better Auth.
servers:
  - url: https://aquila.attaxr.com
  - url: http://localhost
security: []
tags:
  - name: AI
  - name: Agents
  - name: Bulk Delete
  - name: Chat
  - name: Constraints
  - name: Dashboard
  - name: Events
  - name: JS
  - name: JS Analysis
  - name: JS Monitoring
  - name: Leads
  - name: MCP Key
  - name: Models
  - name: Notification Channels
  - name: Notification Event Preferences
  - name: Notifications
  - name: OOB
  - name: Provider Keys
  - name: Public Shares
  - name: Reinforcements
  - name: Reports
  - name: Scans
  - name: Schedules
  - name: Shares
  - name: Tools
  - name: User Profiles
  - name: V1
  - name: Vulnerabilities
  - name: Workflows
  - name: Workspace
paths:
  /api/oob/endpoint:
    get:
      tags:
        - OOB
      summary: Get the OOB endpoint
      description: >-
        The caller's out-of-band payload host: one random 33-character label
        (the correlation unit) under the deployment's OOB domain. The hostname
        itself carries the key, so no separate payload string exists — any DNS,
        HTTP, HTTPS, or SMTP request to it records to the caller's account.
        Labels for individual tests ride the URL path or the SMTP mailbox local
        part, never the hostname.
      operationId: getApiOobEndpoint
      responses:
        '200':
          description: The endpoint status and hostname.
          content:
            application/json:
              schema:
                $schema: https://json-schema.org/draft/2020-12/schema
                type: object
                properties:
                  enabled:
                    type: boolean
                    description: Whether OOB testing is configured for this deployment.
                  hostname:
                    description: >-
                      The payload host: <identifier>.<domain>. One random
                      33-character label — the label itself carries the key, so
                      any request to this host records to the caller's account.
                    type:
                      - string
                      - 'null'
                  identifier:
                    description: >-
                      The 33-character label: a 20-character correlation key
                      plus a 13-character nonce.
                    type:
                      - string
                      - 'null'
                  reversedIdentifier:
                    description: Legacy display material. Payloads never use it.
                    type:
                      - string
                      - 'null'
                  dnsProvisioned:
                    description: >-
                      Whether the DNS delegation for the hostname is live. A
                      false value self-heals on the next sign-in.
                    type: boolean
                  correlationId:
                    description: The 20-character correlation key inside the label.
                    type:
                      - string
                      - 'null'
                  domain:
                    description: >-
                      The deployment's OOB domain the label sits under
                      (bhunt.win in production).
                    type:
                      - string
                      - 'null'
                required:
                  - enabled
                  - hostname
                additionalProperties: false
        '401':
          description: No valid session cookie or API key.
          content:
            application/json:
              schema:
                $schema: https://json-schema.org/draft/2020-12/schema
                type: object
                properties:
                  error:
                    type: string
                required:
                  - error
                additionalProperties: false
      security:
        - apiKeyCookie: []
        - apiKeyHeader: []
        - bearerAuth: []
components:
  securitySchemes:
    apiKeyCookie:
      type: apiKey
      in: cookie
      name: better-auth.session_token
      description: Browser session cookie set by Better Auth sign-in.
    apiKeyHeader:
      type: apiKey
      in: header
      name: x-api-key
      description: Personal API key (aquila_… prefix; settings → API keys).
    bearerAuth:
      type: http
      scheme: bearer
      description: Personal API key sent as a bearer token.

````