> ## Documentation Index
> Fetch the complete documentation index at: https://docs.attaxr.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Out-of-band (OOB)

> Your catch-all interaction endpoint and the hits it records.

Every Aquila user gets an out-of-band endpoint: a wildcard hostname that
records DNS lookups, HTTP and HTTPS requests, and SMTP mail. Point blind
payloads at it, and Aquila tells you when something calls home.

## Your endpoint

`GET /api/oob/endpoint` returns your hostname and identifier:

```json theme={"theme":{"light":"github-light","dark":"one-dark-pro"}}
{
  "identifier": "q7x2m9",
  "hostname": "q7x2m9.bhunt.win"
}
```

The endpoint lives under the `bhunt.win` domain. Aquila provisions it at
sign-up. You never create one yourself.

## How recording works

* The hostname is a catch-all. Any subdomain under it resolves.
* A hit on the bare hostname answers with a banner and is **not** recorded.
* A hit on a labeled subdomain, such as `poc1.q7x2m9.bhunt.win`, **is**
  recorded. Put a label in every payload so each callback identifies itself.

## Supported protocols

The endpoint records four protocols:

* **DNS** — any query type (A, MX, TXT, and more) under your hostname.
* **HTTP** — the full request: method, path, headers, and body.
* **HTTPS** — the same requests over TLS.
* **SMTP** — mail sent to your hostname: sender, recipient, and message.

Every hit records the protocol, the source IP, and the time.

## Read interactions

`GET /api/oob/interactions` lists the recorded hits, newest first:

| Parameter       | Meaning                                                       |
| --------------- | ------------------------------------------------------------- |
| `limit`         | Page size.                                                    |
| `correlationId` | Only hits under one labeled subdomain.                        |
| `protocol`      | Only hits of one protocol: `http`, `https`, `dns`, or `smtp`. |
| `before`        | Only hits before this ISO timestamp.                          |

HTTP hits carry the raw request and the response Aquila sent. Every hit
carries the source IP and the time.

## Clean up

* `DELETE /api/oob/interactions/{id}` — delete one hit.
* `DELETE /api/oob/interactions?correlationId=...` — delete a whole
  correlation group. Omit the parameter to delete all your hits.

The dashboard OOB page shows the same data with a live view.