Another question: are there any patterns / best practices on how to keep Ory identities in sync with BL identities (identities enriched with business-domain data, maintained by the downstream service)?

We keep it completely separate. As in, ory is just used for authn (and probably authz later). And then we use the identifier to map it to our own tables. in theory you can enrich identities through meta fields (public or private), but I don't know if we are mixing too much if we do that. so for example, most of our identities will also have a billing record and that's kept in another database closer to the billing services.

Not exactly sync into ory, rather how to keep our own identity store up-to-date with ory in an efficient and reliable way.

You could use webhooks then and call your system whenever a change is registered on ory

Does ory resend webhooks? Or is it a one-time shot. In other words, what are the guarantees of the delivery?

I don't know, that's a question for someone who works on this 😄

I would not know. Just came across webhook resend policies in other products.

sorry, mixed up i the threads 😄