01 / Event path
From a fingerprint to your workflow.
Use the existing API reference for request shapes and authentication.
Arm
Register the decoy fingerprint under the appropriate account and integration.
API reference ↗Observe
A monitored decrypt endpoint must see the armed decoy for a hosted detection event.
Decoy alerts dashboard ↗Respond
Connect alerts and signed webhooks to your incident workflow. Rotation is your integration’s responsibility.
Webhook settings ↗02 / Test the boundary
Rejection is not detection.
A credential provider refusing a fake key is not a deny.sh observation. Offline decryption does not reach a monitored hosted endpoint.
Keep the real key out of context.
Tripwires supplement the boundary; they do not replace it. Compromise of the real-key resolver and misuse of an authorised tool need their own controls.
Read the threat model ↗