HonkIOHonkIO

HonkIO Auth

Security

Abuse settings, attack mode, per-app blocklists and the security summary.

Get security settings

GET/v1/auth-apps/:id/security

Permission: auth_apps: r

The app’s abuse settings, attack mode and whether texts are paused.

Request
curl https://api.honkio.ca/v1/auth-apps/APP_ID/security \
  -H "Authorization: Bearer mk_test_YOUR_KEY"
Response · 200
{
  "app_id": "clxxxappxxxxxxxxxxxxxxxxx",
  "block_throwaway_emails": true,
  "aliases_are_same": false,
  "block_voip": false,
  "new_device_alerts": true,
  "sms_daily_limit_cents": 500,
  "attack_mode": {
    "setting": "auto",
    "active": false,
    "since": null,
    "trigger": null
  },
  "texts_paused": null,
  "sign_in_mail_paused": null,
  "suspended_by_honkio": null
}

Update security settings

PATCH/v1/auth-apps/:id/security

Permission: auth_apps: m

Changes the settings you send.

Body

NameTypeDescription
block_throwaway_emailsbooleanRefuse throwaway email providers. On by default.
aliases_are_samebooleanTreat email aliases (dots, plus tags) as one address. Off by default.
block_voipbooleanRefuse VoIP numbers for text sign-in. Pro and Business.
new_device_alertsbooleanSend new-device alerts with “This wasn’t me”. On by default.
sms_daily_limit_centsintegerThe daily text spending limit, in CAD cents. 500 by default.
attack_mode"on" | "off" | "auto"on or off forces attack mode; auto (the default) lets HonkIO switch it.
Request
curl -X PATCH https://api.honkio.ca/v1/auth-apps/APP_ID/security \
  -H "Authorization: Bearer mk_test_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "aliases_are_same": true,
    "sms_daily_limit_cents": 1000
  }'
Response · 200
{
  "app_id": "clxxxappxxxxxxxxxxxxxxxxx",
  "block_throwaway_emails": true,
  "aliases_are_same": true,
  "block_voip": false,
  "new_device_alerts": true,
  "sms_daily_limit_cents": 1000,
  "attack_mode": {
    "setting": "auto",
    "active": false,
    "since": null,
    "trigger": null
  },
  "texts_paused": null,
  "sign_in_mail_paused": null,
  "suspended_by_honkio": null
}

List blocklist entries

GET/v1/auth-apps/:id/security/blocklist

Permission: auth_apps: r

The app’s own blocklist.

Query parameters

NameTypeDescription
kindstringemail, email_domain, phone, phone_prefix, ip, ip_range, network_provider or country.
Request
curl https://api.honkio.ca/v1/auth-apps/APP_ID/security/blocklist \
  -H "Authorization: Bearer mk_test_YOUR_KEY"
Response · 200
{
  "data": [
    {
      "id": "RU1BSUxfRE9NQUlOOm1haWxpbmF0b3IuZXhhbXBsZQ",
      "kind": "EMAIL_DOMAIN",
      "value": "mailinator.example",
      "note": "Seen in a bot run",
      "created_at": "2026-11-02T15:04:05.000Z"
    }
  ]
}

Add a blocklist entry

POST/v1/auth-apps/:id/security/blocklist

Permission: auth_apps: w

Blocks sign-ups and code sends that match.

Body

NameTypeDescription
kindrequired"EMAIL" | "EMAIL_DOMAIN" | "PHONE" | "PHONE_PREFIX" | "IP" | "IP_RANGE" | "NETWORK_PROVIDER" | "COUNTRY"email, email_domain, phone, phone_prefix, ip, ip_range, network_provider or country.
valuerequiredstringWhat to block: an address, a domain, an E.164 number or prefix, an IP or CIDR range, a provider’s ASN, or a two-letter country code.
notestringYour own note, shown in the dashboard.
Request
curl -X POST https://api.honkio.ca/v1/auth-apps/APP_ID/security/blocklist \
  -H "Authorization: Bearer mk_test_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "kind": "EMAIL_DOMAIN",
    "value": "mailinator.example",
    "note": "Seen in a bot run"
  }'
Response · 201
{
  "id": "RU1BSUxfRE9NQUlOOm1haWxpbmF0b3IuZXhhbXBsZQ",
  "kind": "EMAIL_DOMAIN",
  "value": "mailinator.example",
  "note": "Seen in a bot run",
  "created_at": "2026-11-02T15:04:05.000Z"
}

Remove a blocklist entry

DELETE/v1/auth-apps/:id/security/blocklist/:entryId

Permission: auth_apps: d

Removes one entry.

Request
curl -X DELETE https://api.honkio.ca/v1/auth-apps/APP_ID/security/blocklist/ENTRY_ID \
  -H "Authorization: Bearer mk_test_YOUR_KEY"

204 · No content.

Get the security summary

GET/v1/auth-apps/:id/security/summary

Permission: auth_apps: r

Recent counts behind the Security tab: sign-ins, failures, challenges, blocked sign-ups by reason, texts by exchange and attack-mode periods.

Query parameters

NameTypeDescription
window"24h" | "7d" | "30d"The period: 24h (the default), 7d or 30d.
Request
curl https://api.honkio.ca/v1/auth-apps/APP_ID/security/summary \
  -H "Authorization: Bearer mk_test_YOUR_KEY"
Response · 200
{
  "window": "24h",
  "from": "2026-11-01T15:04:05.000Z",
  "to": "2026-11-02T15:04:05.000Z",
  "sign_ins": {
    "total": 1824,
    "by_outcome": {
      "succeeded": 1775,
      "failed": 37,
      "challenged": 12
    }
  },
  "challenges_shown": 12,
  "blocked": {
    "total": 5,
    "by_reason": {
      "throwaway_email": 3,
      "app_blocklist": 2
    },
    "blocked_by_honkio": 3
  },
  "texts_by_number_range": [
    {
      "range": "+1416555",
      "sent": 41
    }
  ],
  "attack_mode": {
    "active": false,
    "since": null,
    "trigger": null,
    "periods": []
  },
  "sign_in_mail": {
    "window_hours": 24,
    "delivered": 4120,
    "bounced": 12,
    "complained": 0,
    "bounce_rate": 0.0029,
    "complaint_rate": 0,
    "paused": false,
    "pause_reason": null
  },
  "available": {
    "history": true,
    "texts": true,
    "attack_mode_periods": true
  }
}