/api/client-errors/{client_app_id}PublicReport a client error
Error reporting intake for client applications. The auth client SDK (@schemavaults/auth-client-sdk) reports the errors of its own flows here unless the app sets disable_telemetry: true; apps can report their own through reportError(). Administrators browse the reports on /admin/client-errors.
CORS follows the app's registered origins: a report from a browser must come from an origin registered for client_app_id in this environment (403 otherwise) and its response carries the CORS headers; web apps must send an Origin, native apps may omit it. The body may be labelled text/plain (a CORS simple request, which the SDK uses to skip the preflight); answer OPTIONS for callers that send application/json. Reports are rate limited per IP and per app (429); bodies over 64 KiB are refused with 413. The page URL is stored without its query string or fragment, and credentials in the message, stack and context (JWTs, Authorization values, the values of keys such as access_token, password or code_verifier, and code query parameters) are replaced with [redacted].
Administrators control the intake with server settings: accept_client_error_reports (while off: 403 with error: "client_error_reporting_disabled"), client_error_reports_max_storage_mb (once the stored reports reach it: 503 with error: "client_error_storage_full" and Retry-After) and client_error_reports_retention_days (older reports are deleted automatically). Refusals made before the origin check (intake off, IP rate limit) carry Access-Control-Allow-Origin: *; Retry-After is exposed to cross-origin callers.
post_api_client_errors_client_app_idTelemetryAuthentication & permissionsPublic
Anyone — no credentials required
- Accepted credentials
- None required
- Notes
- Needs no credentials: the report is attributed to
client_app_idafter theOrigincheck.
Path parameters
| Name | Type | Description |
|---|---|---|
| client_app_id* | string | Client application the error happened in |
Request body
Required
disable_telemetry; apps can send their own through SchemaVaultsAuthClient.reportError().| Property | Type | Description |
|---|---|---|
| name* | string | The error's class name ( minLength: 1maxLength: 200 |
| message* | string | The error message. maxLength: 2000 |
| stack | string | Stack trace, with the maxLength: 16000 |
| operation | string | What the client was doing, e.g. the SDK method ( minLength: 1maxLength: 200 |
| occurred_at | integer | When the error happened on the client (Unix epoch milliseconds). minimum: 0 |
| sdk_name | string | Package that sent the report, e.g. minLength: 1maxLength: 100 |
| sdk_version | string | Version of minLength: 1maxLength: 64 |
| app_env | "development" | "staging" | "test" | "production" | Environment the client app runs in. |
| page_url | string | Page the error happened on. The server keeps only its origin and path. maxLength: 2048 |
| reported_uid | string (uuid) | The signed-in user as the client knows it. Reported by the client, not verified. |
| context | object | Extra structured details (at most 8192 characters as JSON). |
Responses
| Property | Type | Description |
|---|---|---|
| success* | true | |
| message* | string | |
| client_error_id* | string (uuid) | Id of the stored report |
Example request
curl -X POST 'https://auth.schemavaults.com/api/client-errors/<client_app_id>' \
-H 'Content-Type: application/json' \
-d '{
"name": "string",
"message": "string",
"stack": "string",
"operation": "string",
"occurred_at": 1,
"sdk_name": "string",
"sdk_version": "string",
"app_env": "development",
"page_url": "string",
"reported_uid": "123e4567-e89b-12d3-a456-426614174000",
"context": {}
}'