Return the latest IdP drift sweep report.
SEC-HARDENING-1 M3: superadmin-gated. This endpoint exposes cross-tenant
sweep counts (users checked, drift detected, tokens revoked across every
Clerk-linked user); the router's ScopePolicy.system bypasses tenant
context, so without an explicit role gate any authenticated caller could
read it. require_superadmin restricts it to platform operators.
Response shape: { "sweep_enabled": bool, "status": "no_sweep_run" | "ok", "last_run_at": datetime | null, "users_checked": int, "drift_detected": int, "tokens_revoked": int }
Response Body
application/json
curl -X GET "https://example.com/memory/idp-drift"null