API ReferenceSSF
SSF (Shared Signals Framework)
OpenID Shared Signals Framework - stream real-time security events to external receivers.
SSF -- Shared Signals Framework
SSFService implements the OpenID Shared Signals Framework (draft -- spec: openid.net/specs/openid-sharedsignals-framework-1_0.html). Use it to push CAEP / RISC events (session revoked, credential changed, account suspended, device compliance lost) to downstream consumers -- Google Workspace, Microsoft 365, your SIEM, or another Avnology tenant.
Both push and poll delivery modes are supported.
Base URL: https://<Domain id="api"/>
Authentication: Bearer token with ssf:write for stream management, :read for configuration.
Sub-sections
| Area | RPCs |
|---|---|
| Streams | CRUD for SSF streams |
| Events | PollEvents / AcknowledgeEvents (poll-mode delivery) |
| Configuration | GetConfiguration -- .well-known/ssf-configuration |
Stream shape