Integrate once. Two calls in the hot path.

# $ADMIN: the admin API. $ADMIN_KEY: a key with admin.write
# Where the customer's id is in the event
curl -X POST "$ADMIN/event-types" \
  -H "Authorization: Bearer $ADMIN_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"name":"login_failed",
       "spec":{"entities":{"customer":"attrs.customer_id"}}}'

# What to keep: failed logins per customer, in 1-minute buckets
curl -X POST "$ADMIN/states" \
  -H "Authorization: Bearer $ADMIN_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"name":"failed_logins",
       "spec":{"on":"login_failed","key":["customer"],
               "op":"count","resolution":"1m","retention":"24h"}}'

# What to ask, and when to ask it by itself
curl -X POST "$ADMIN/profiles" \
  -H "Authorization: Bearer $ADMIN_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"name":"login_check",
       "spec":{"entity":"customer",
               "features":{"failedLogins15m":{"state":"failed_logins",
                                              "window":{"rolling":"15m"}}},
               "reasons":[{"name":"too_many_failures",
                           "when":"failedLogins15m >= 3"}],
               "triggers":[{"name":"on_failure","on":"login_failed",
                            "outputs":["stream"]}]}}'

# $P: your workspace's public API. $KEY: a key with the ingest scope
# Three failed logins for one customer, each with its own id
for n in 1 2 3; do
  curl -X POST "$P/events" \
    -H "Authorization: Bearer $KEY" \
    -H 'Content-Type: application/json' \
    -d '{"id":"evt_00'"$n"'","type":"login_failed",
         "ts":"'"$(date -u +%Y-%m-%dT%H:%M:%SZ)"'",
         "attrs":{"customer_id":"c_1001"}}'
done

# 200 each time: counted. Send one again and it comes back "duplicate"
# {"id": "evt_003", "status": "accepted", "states": 1}

curl -X POST \
  "$P/entities/customer/c_1001/profiles/login_check:evaluate" \
  -H "Authorization: Bearer $KEY" \
  -H 'Content-Type: application/json' -d '{}'

# 200: the answer, with the versions that gave it
# {
#   "entity": {"type": "customer", "id": "c_1001"},
#   "values": {"failedLogins15m": 3},
#   "reasons": ["too_many_failures"],
#   "degraded": [],
#   "skipped": [],
#   "profileVersion": "login_check@v1",
#   "configVersion": 4,
#   "evaluatedAt": "2026-11-02T09:30:00.286144752Z"
# }

# Aggrelis calls your endpoint, signed to the Standard Webhooks spec
POST https://ops.example.com/hooks/aggrelis
webhook-id: d7c1e9a0-52f4-4b8e-9c1a-6f0e2b7d3a15
webhook-timestamp: 1793611801
webhook-signature: v1,K5oZfzN9…=

{
  "type": "trigger.result",
  "timestamp": "2026-11-02T09:30:01.469783324Z",
  "data": {
    "trigger": "on_failure",
    "profile": "login_check",
    "status": "ok",
    "entity": {"type": "customer", "id": "c_1001"},
    "values": {"failedLogins15m": 3},
    "reasons": ["too_many_failures"],
    "event": {"id": "evt_003", "type": "login_failed",
              "ts": "2026-11-02T09:30:00Z"},
    "profileVersion": "login_check@v1"
  }
}

# Verify the signature over the raw body, then answer 2xx quickly