System Context — OL Analytics API
Generated 2026-10-14 15:27 UTC · c4gen dev
The widest view: OL Analytics API and every external actor and system it exchanges data with. Edges shown are curated and code-verified; raw graph-derived candidates are listed under Dependencies & Cycles.
Interactive
Drag to pan, scroll to zoom. Click the OL Analytics API box to drill into its container view.
External systems & peers
| System | Role |
|---|---|
| MIT Learn | Consumer of the b2b_dashboard tenant. Its Next.js organization dashboard calls the API from the browser (client component) with the mit-learn session cookie, behind the b2b-contract-manager-dashboard and b2b-learner-analytics PostHog flags. |
| MITx Online | System of record for B2B organizations, contracts and the is_manager flag. Serves GET /api/v0/b2b/service/organization-manager-check/ to this service's OAuth2 client (scope b2b:manager-check). |
| OL Data Platform (StarRocks) | StarRocks lakehouse FE (lakehouse-starrocks-fe-service.starrocks.svc.cluster.local:9030). dbt (tag:starrocks) builds manual-refresh MVs in the b2b_analytics and b2b_learner_records databases from the dimensional Iceberg tables (dim_contract, bridge_organization_courserun, tfact_enrollment, ...) through the ol_data_lake_{env} external catalog; Dagster's b2b_analytics_starrocks_nightly schedule (06:00 UTC) rebuilds and refreshes them once enabled; it ships with DefaultScheduleStatus.STOPPED. |
| APISIX Gateway | Three routes to this service: ol-analytics-api (analytics.ol.mit.edu, openid-connect unauth_action auth), ol-analytics-api-learn (analytics.learn.mit.edu, mit-learn's OIDC client and session cookie, unauth_action pass) and ol-analytics-api-learner-records (both hosts, priority 20, bearer_only with JWKS, required scope learner-records:read, audience check). |
| Keycloak (SSO) | olapps realm. Issues the mit-learn browser session the dashboard reuses, the ol-analytics-api-client OIDC client, and the per-contract learner-records client-credentials clients (300s tokens). |
| HashiCorp Vault | K8s auth role ol-analytics-api (mount k8s-data). Issues dynamic StarRocks users from database-starrocks/creds/app; the vault-secrets-operator syncs SENTRY_DSN, the MITx Online OAuth pair and the learner-records issuer/audience into env. |
| Grafana Alloy (OTLP receiver) | In-cluster OTLP/HTTP receiver (grafana-k8s-monitoring-alloy-receiver.grafana:4318) forwarding traces to Grafana Cloud; it also scrapes the pods' JSON stdout as logs. |
| Sentry | Error reporting (send_default_pii false); DSN owned by the ol-infrastructure Sentry stack. |