> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation. # View and export audit logs From the **Dashboard** page you can view and export audit logs. **Authentication** audit logs track authentications made to your IDaaS account by location, user, and authentication type. **Management** audit logs track actions performed in your IDaaS account by action and user. Use these procedures to view and export audit logs. tip You can open prefiltered audit results from **Dashboard** **>** **Authentication Activity** by selecting an item in **Top Applications** or **Top Authenticators**. ## View audit events 1. Click Menu icon **>** **Dashboard**. The **Dashboard** page appears. 2. Click the **Authentication** or **Management** radio button to set the type of audit log you want to view. 3. Set the number of audits on a page: 1. Scroll to the bottom of the page. 2. From the **Rows per page** drop-down list, select the number of rows to display on the page. 3. To move to a new page, on the right-hand side of the page, do the following, as required: - Click **>** to go to the next page. - Click **<** to go to the previous page. - Click **|<** to go to the first page. ## View a specific audit event 1. Click Menu icon **>** **Dashboard**. The **Dashboard** page appears. 2. Click the **Authentication** or **Management** radio button to set the type of audit log you want to view. 3. Click the row for the specific audit log you want to investigate. 4. Review **Audit Event** details in the right-side details drawer. 5. Optional. Use field-level quick actions in the drawer to view similar events by user, application, or event type. 6. Optional. Use the copy action in the drawer to copy all displayed event details. ## View audit logs for specific users 1. Click Menu icon **>** **Members** **>** **Users**. The **Users List** page appears. 2. Click the **UserID** of the user. The **User Details** page appears. ## Audit data dictionary Use the following table to review common fields that appear in audit records. | Event attribute | Description | Example | | ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `id` | Unique ID for the event. | `313b43e7-098a-4cc9-a6fd-a1ac1c703e53` | | `eventTime` | When the event happened in UTC time. The format is `YYYY-MM-DDThh:mm:ssZ`. | `2016-08-21T14:27:55Z` | | `eventCategory` | The event category. Valid values are `AUTHENTICATION` or `MANAGEMENT`. | `AUTHENTICATION` | | `eventType` | Identifies the source of the event. Valid `AUTHENTICATION` values are listed under Authentication events below. For `MANAGEMENT` actions, event types are built from the entity and action performed using the format `Event` where `EntityType` and `EntityAction` are capitalized. | `AuthenticationDeniedEvent`, `AuthenticationOtpSuccessEvent`, `AuthenticationTokenSuccessEvent`, `AuthenticationTokenPushSuccessEvent`, `AuthenticationOtpEmailSentEvent`, `AuthenticationOtpSmsSentEvent`, `UsersAddEvent`, `ContextrulesEditEvent`, `ApplicationsRemoveEvent` | | `accountId` | The account UUID. | `a6cb609f-c6ea-48ad-ab61-433b4054a1f8` | | `subjectId` | The subject identifier. The value depends on `subjectType`. For `USER`, this is the internal UUID for the user authenticating or the administrator performing a management action. For `ADMIN_API`, this is the UUID of the Admin API application. For Microsoft Entra ID Conditional Access authentication audits where a mapping to an IDaaS user is not found or validation fails, the value is a random UUID. | `72fd8717-fffe-462f-83c6-131c12539af7` | | `subjectName` | The subject display name. The value depends on `subjectType`. For `USER`, this is the `userId` value of the user authenticating or the administrator performing a management action. For `ADMIN_API`, this is the Admin API application name. For Microsoft Entra ID Conditional Access authentication audits where a mapping to an IDaaS user is not found or validation fails, this is the Microsoft Entra ID-provided user value (for example, UPN). | `lp1415@brawlers.es` | | `subjectType` | The type of subject. Common values include `USER`, `ADMIN_API`, `SERVICE_PROVIDER`, and `AGENT`. | `USER` | | `eventOutcome` | The event outcome. Valid values are `SUCCESS` or `FAIL`. | `SUCCESS` | | `message` | Message key indicating what the event did. For management actions, the key is built from the entity and action performed. | `service_authentication.otp_sms_send`, `users.add` | | `resourceId` | The resource identifier (for example, an application UUID). | `a6cb609f-c6ea-48ad-ab61-433b4054a1f8` | | `resourceName` | The resource name (for example, application name). | `Salesforce` | | `sourceIp` | The request IP address, or IP address provided for authentication API applications. | `1.23.47.122` | | `eventVersion` | Reserved for future use. Currently always `v1`. | `v1` | | `token` | Depending on the stage at which the event is generated, this can be empty, the authentication type (`OTP`, `TOKEN`, `TOKENPUSH`), or the token serial number. | `1234-5678` | | `requiredPermission` | Permission required to access a management entity. The permission is a tuple `` in lowercase. | `users:add` | | `subscriberRoleId` | The role UUID used to access the Admin Portal management application. | `775419bf-efff-467a-8743-e77930cc7ed9` | | `subscriberRoleName` | The subscriber role name. | `Super Administrator` | | `serviceProviderRoleId` | The role UUID used to access the Service Provider management application. | `a6cb609f-c6ea-48ad-ab61-433b4054a1f8` | | `serviceProviderRoleName` | The service provider role name. | `Auditor` | | `entityType` | Identifies the business entity type. Valid values are listed under Entity types below. | `USERS` | | `entityAction` | Identifies the action invoked on the entity. Valid values are `ADD`, `EDIT`, `REMOVE`, and `VIEW`. A few non-standard actions can appear (for example, `ACTIVATE`). | `ADD` | | `entityId` | The entity UUID identifier. | `a6cb609f-c6ea-48ad-ab61-433b4054a1f8` | | `entityName` | The entity name (for example, role name, group name, user ID). | `Auditor`, `Contractors`, `jdoe` | | `auditDetails` | Additional audit details in JSON format. Possible attributes include `messageTokens` (reserved), `modifiedEntityAttributes` (`[{name, oldValue, newValue}]`), and `entityAttributes` (`[{name, value}]`). Values are event-specific. | See example JSON below. | Example `auditDetails` payload: ```json { "entityAttributes": [ { "name": "Identity Provider", "value": "SP::twoco" }, { "name": "Type", "value": "SP" }, { "name": "Issuer", "value": "https://mycorp.us.trustedauth.com/api/oidc" } ], "messageTokens": null, "modifiedEntityAttributes": null } ``` ### Risk-based authentication audit details Authentication audit events can include the following risk-based authentication fields in `auditDetails.entityAttributes`: | Attribute | Description | | ------------------------------ | ------------------------------------------------------------ | | `ruleName` | Resource rule selected for the request. | | `totalRiskPoint` | Total configured risk points for the resource rule. | | `generatedRiskPoint` | Risk points generated by the factor evaluations. | | `generatedRiskPointNormalized` | Generated risk points normalized as a percentage. | | `riskLevel` | Evaluated risk level. | | `authenticationFlow` | Authentication flow selected for the evaluated risk level. | | `riskFactorEvaluationResults` | Results recorded for the individual risk factor evaluations. | The following illustrative `entityAttributes` value shows a request where Geolocation passed and Travel Velocity generated risk points. Attribute values are strings. The value of `riskFactorEvaluationResults` is a JSON-encoded array within the audit payload. ```json { "entityAttributes": [ { "name": "ruleName", "value": "Authentication API RBA example" }, { "name": "totalRiskPoint", "value": "40" }, { "name": "generatedRiskPoint", "value": "20" }, { "name": "generatedRiskPointNormalized", "value": "50" }, { "name": "riskLevel", "value": "MEDIUM" }, { "name": "authenticationFlow", "value": "Password and second factor" }, { "name": "riskFactorEvaluationResults", "value": "[{\"type\":\"LOCATION\",\"decision\":\"PERMIT\",\"riskPoints\":0,\"message\":\"service_authentication.in_allowed_countries\"},{\"type\":\"TRAVEL_VELOCITY\",\"decision\":\"DENY\",\"riskPoints\":20,\"message\":\"service_authentication.invalid_travel_velocity\"}]" } ] } ``` A risk factor result of `DENY` means that the factor contributed its configured risk points. It does not necessarily mean that authentication was denied. The evaluated `riskLevel` and its configured authentication flow determine whether IDaaS permits authentication, requires stronger authentication, or denies access. ### Audit event reference Use the following lists to review supported entity types and authentication events that can appear in audit records. #### Entity types Entity type values are internal audit values; descriptions use current product terminology. ##### Service Provider account entities | Category | Entity type | Description | | ------------------------- | -------------------------- | ------------------------------------------------------------------------------------------- | | Account management | `SERVICEPROVIDERS` | Service provider accounts. | | Account management | `SERVICEPROVIDERACCOUNTS` | Tenant accounts managed by a service provider. | | Account management | `CREATETENANT` | Tenant account creation operations for service providers. | | Account management | `TENANTS` | Tenant accounts managed by a service provider. | | Account management | `HOSTNAMESETTINGS` | Hostname settings. | | Entitlements | `SPENTITLEMENTS` | Service provider entitlements. | | Identity providers | `SPIDENTITYPROVIDERS` | Service provider Identity Provider configuration. | | OTP providers | `OTPPROVIDERS` | OTP provider configuration. | | OTP providers | `PREFERREDOTPPROVIDERS` | Preferred OTP provider mappings. | | Platform and credentials | `SPCLIENTCREDENTIALS` | Service provider client credentials. | | Platform and credentials | `SPMANAGEMENTPLATFORM` | Service provider management platform configuration. | | Platform and credentials | `PKIAASCREDENTIALS` | PKIaaS credentials. | | Platform and credentials | `PUSHCREDENTIALS` | Push credential configuration. | | Platform and credentials | `PLAYINTEGRITYCREDENTIALS` | Google Play Integrity credential configuration for Android custom application verification. | | Policy and controls | `RATELIMITING` | Rate limiting policy configuration. | | Roles and user management | `SPROLES` | Service provider administrator roles. | | Roles and user management | `USERSPROLES` | Service provider role assignments for users. | | Roles and user management | `SPUSERMGMT` | Service provider user management configuration. | ##### IDaaS account entities | Category | Entity type | Description | | ---------------------------- | --------------------------- | ---------------------------------------------------------------------------------------------------------- | | Account configuration | `SUBSCRIBERS` | IDaaS account configuration. | | Account configuration | `SETTINGS` | IDaaS account settings. | | Account configuration | `TEMPLATES` | Application or notification templates. | | Account configuration | `CUSTOMIZATIONVARIABLES` | Deprecated customization variables. | | Account configuration | `ENTITLEMENTS` | IDaaS account entitlement configuration and usage. | | Account configuration | `USERATTRIBUTES` | Custom user attribute configuration. | | Administration | `ROLES` | Administrator roles in an IDaaS account. | | Administration | `USERSITEROLES` | IDaaS account administrator role assignments for users. | | Applications and access | `APPLICATIONS` | Applications configured for authentication or access. | | Applications and access | `CONTEXTRULES` | Resource rules and contextual access rules. | | Applications and access | `AUTHENTICATIONFLOWS` | Authentication flow configuration. | | Applications and access | `ACRS` | Authentication context class references. | | Applications and access | `AUTHORIZATIONGROUPS` | Authorization groups associated with users or access policy. | | Applications and access | `PASSTHROUGH` | Passthrough authentication configuration. | | Applications and access | `IPLISTS` | IP address lists used by access policy. | | Applications and access | `CLAIMS` | OIDC/OAuth claim configuration. | | Applications and access | `RESOURCESERVERAPIS` | OAuth resource server APIs. | | Applications and access | `RESOURCESERVERSCOPES` | OAuth resource server scopes. | | Applications and access | `OAUTHROLES` | OAuth role configuration and assignments. | | Applications and access | `USEROAUTHTOKENS` | OAuth tokens associated with users. | | Applications and access | `IDENTITYPROVIDERS` | Identity Provider configuration. | | Applications and access | `ORGANIZATIONS` | Organization records used for SAML and OIDC/OAuth claims, organization selection, and membership. | | Applications and access | `WORKLOADIDENTITY` | Workload identity records. | | Authenticators | `TOKENS` | User token authenticators. | | Authenticators | `BULKHARDWARETOKENS` | Bulk hardware token operations. | | Authenticators | `TEMPACCESSCODES` | Temporary access code authenticators. | | Authenticators | `TEMPACCESSCODECONTENTS` | Temporary access code contents. | | Authenticators | `GRIDS` | Grid card authenticators. | | Authenticators | `GRIDCONTENTS` | Grid card contents. | | Authenticators | `FIDOTOKENS` | Passkey/FIDO2 authenticators. | | Authenticators | `OTPS` | OTP records and OTP delivery actions. | | Authenticators | `USERMACHINES` | Machines associated with users. | | Authenticators | `FACE` | Face biometric configuration or activity. | | Authenticators | `USERPASSWORDS` | User password records and password management actions. | | Authenticators | `NAMEDPASSWORDS` | Named Password definitions and password policy configuration. | | Authenticators | `BLACKLISTEDPASSWORDS` | Blocked password entries. | | Authenticators | `QUESTIONS` | Knowledge-based authentication question definitions. | | Authenticators | `USERQUESTIONS` | Knowledge-based authentication questions assigned to users. | | Authenticators | `USERQUESTIONANSWERS` | Answers for user knowledge-based authentication questions. | | Authenticators | `USERKBACHALLENGES` | Knowledge-based authentication challenge records. | | Authenticators | `WORDSYNONYMS` | Word synonym records used by knowledge-based authentication. | | Authenticators | `TOKENACTIVATIONCONTENTS` | Token activation content records. | | Authenticators | `MAGICLINKS` | Magic Link authenticator, registration link, and password reset link configuration and delivery actions. | | Authenticators | `MAGICLINKCONTENTS` | Magic Link content records. | | Bulk and migration | `BULKUSERS` | Bulk user operations. | | Bulk and migration | `BULKGROUPS` | Bulk group operations. | | Bulk and migration | `BULKIDENTITYGUARD` | Bulk Identity Enterprise migration operations. | | Certificates and credentials | `CAS` | Certificate authority configuration. | | Certificates and credentials | `CERTIFICATES` | Certificates used by applications or integrations. | | Certificates and credentials | `DIGITALIDCONFIGS` | Digital ID configuration. | | Certificates and credentials | `DIGITALIDCONFIGVARIABLES` | Variables used by Digital ID configuration. | | Certificates and credentials | `DIGITALIDCONFIGCERTTEMPS` | Certificate templates used by Digital ID configuration. | | Certificates and credentials | `DIGITALIDCONFIGSANS` | Subject alternative name settings used by Digital ID configuration. | | Certificates and credentials | `SCDEFNS` | Smart Credential definitions. | | Certificates and credentials | `SCDEFNPIVAPPLETCONFIGS` | PIV applet settings for Smart Credential definitions. | | Certificates and credentials | `SCDEFNVARIABLES` | Variables used by Smart Credential definitions. | | Certificates and credentials | `SMARTCREDENTIALS` | Smart Credentials assigned to users. | | Certificates and credentials | `SMARTCREDENTIALSSIGNATURE` | Smart Credential signing transactions. | | Certificates and credentials | `BULKSMARTCARDS` | Bulk smart card operations. | | Certificates and credentials | `SMARTCARDS` | Smart card records. | | Certificates and credentials | `DOMAINCONTROLLERCERTS` | Domain controller certificates. | | Certificates and credentials | `DIGITALIDCERTIFICATES` | Digital ID certificates. | | Certificates and credentials | `PIVCONTENTSIGNER` | PIV content signer configuration. | | Directories and provisioning | `DIRECTORIES` | Directory integrations. | | Directories and provisioning | `DIRECTORYSYNC` | Directory synchronization configuration and activity. | | Directories and provisioning | `DIRECTORYCONNECTIONS` | Directory connection settings. | | Directories and provisioning | `AD_CONNECTOR_DIRECTORIES` | Active Directory connector directory configuration. | | Directories and provisioning | `AZURE_DIRECTORIES` | Microsoft Entra ID directory configuration. | | Directories and provisioning | `DIRECTORYPASSWORD` | Directory password configuration or actions. | | Directories and provisioning | `DIRECTORYSEARCHATTRIBUTES` | Directory search attribute configuration. | | Directories and provisioning | `DIRECTORYATTRIBUTES` | Directory attribute configuration. | | Directories and provisioning | `HIGH_AVAILABILITY_GROUPS` | High availability groups for AD Connector directory configuration. | | Directories and provisioning | `SCIMPROVISIONINGS` | SCIM provisioning configuration. | | Directories and provisioning | `SENDSCIM` | SCIM delivery or synchronization actions. | | Directories and provisioning | `SENDAZUREAD` | Microsoft Entra ID delivery or synchronization actions. | | Notifications and messaging | `EMAILTEMPLATES` | Email template configuration. | | Notifications and messaging | `EMAILVARIABLES` | Email template variables. | | Notifications and messaging | `SENDEMAIL` | Email delivery actions. | | Notifications and messaging | `CONTACTVERIFICATION` | Contact verification records and actions. | | Policy and risk | `EXPECTEDLOCATIONS` | Expected user location records used by risk policy. | | Policy and risk | `USERLOCATIONS` | User location records used by risk policy. | | Policy and risk | `USERRBASETTINGS` | User-specific risk-based authentication settings. | | Policy and risk | `GROUPPOLICIES` | Group policy configuration. | | Policy and risk | `POLICYOVERRIDE` | Policy override audit records, such as administrator actions that override a user's group policy settings. | | Policy and risk | `RISKENGINES` | External risk engine configuration. | | Policy and risk | `TRANSACTIONITEMS` | Transaction item records. | | Policy and risk | `TRANSACTIONRULES` | Transaction rule configuration. | | Reports and audit operations | `REPORTS` | Generated reports and report actions. | | Reports and audit operations | `EXPORTREPORTS` | Exported reports. | | Reports and audit operations | `ARCHIVES` | Audit archive files. | | Reports and audit operations | `SCHEDULEDTASKS` | Scheduled automated tasks, such as report generation. | | User data | `USERS` | User accounts and user profile records. | | User data | `GROUPS` | User groups. | | User data | `USERATTRIBUTEVALUES` | Custom user attribute values assigned to users. | | User data | `INTELLITRUSTDESKTOPS` | Desktop client configuration. | | User data | `ACTIVESYNC` | ActiveSync configuration. | | User data | `IDPROOFING` | Identity proofing configuration or activity. | | User data | `IDPROOFINGLICENSE` | Identity proofing license configuration. | | User verification | `VERIFYUSER` | Admin Verify User operation. | | Verifiable credentials | `VCDEFNS` | Verifiable credential definitions. | | Verifiable credentials | `VCS` | Verifiable credentials. | | Verifiable credentials | `VPDEFNS` | Verifiable presentation definitions. | | Webhooks | `WEBHOOKS` | Webhook configuration. | | Webhooks | `WEBHOOK_NOTIFICATION` | Webhook notification delivery records. | #### Management events Management event types are derived from the entity type and action. For standard management actions, IDaaS uses the format `Event`, where `EntityType` and `EntityAction` are converted to lowercase and then capitalized. | Action | Event type pattern | Description | | -------- | ------------------------- | ----------------------------------------------------------------- | | `ADD` | `AddEvent` | An administrator or authorized process added the entity. | | `EDIT` | `EditEvent` | An administrator or authorized process changed the entity. | | `REMOVE` | `RemoveEvent` | An administrator or authorized process removed the entity. | | `VIEW` | `ViewEvent` | An administrator or authorized process viewed the entity. | | `ALL` | `AllEvent` | A role or permission grants all available actions for the entity. | For example, `USERS` with `ADD` appears as `UsersAddEvent`, and `APPLICATIONS` with `REMOVE` appears as `ApplicationsRemoveEvent`. Some management workflows use custom actions in addition to the standard actions. Use the following table to review custom management event types found in audit records. | Event type | Description | | -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- | | `CreatetenantResultsEvent` | A tenant account creation result was recorded. | | `DigitalidcertificatesHoldEvent` | A digital ID certificate was placed on hold. | | `DigitalidcertificatesRevokeEvent` | A digital ID certificate was revoked. | | `DigitalidcertificatesUnholdEvent` | A digital ID certificate hold was removed. | | `DirectorysyncCrawlEvent` | Directory synchronization crawl activity was recorded. | | `FaceEmailEvent` | Face biometric email delivery was attempted. Check the event outcome to determine whether delivery succeeded or failed. | | `GatewaysRegistercompleteEvent` | Gateway registration was completed. | | `GridsAssignEvent` | A grid card was assigned. | | `GridsChangestateEvent` | A grid card state changed. | | `GridsRemovedEvent` | A grid card was removed. | | `GridsSelfassignEvent` | A user self-assigned a grid card. | | `GridsUnassignEvent` | A grid card was unassigned. | | `GroupsSyncaddEvent` | Directory synchronization added a group. | | `GroupsSyncdeleteEvent` | Directory synchronization deleted a group. | | `GroupsSynclocalizeEvent` | Directory synchronization localized a group. | | `MagiclinksEmailEvent` | Magic link email delivery was attempted. Check the event outcome to determine whether delivery succeeded or failed. | | `OrganizationsAdduserEvent` | A user was added to an organization. | | `OrganizationsRemoveuserEvent` | A user was removed from an organization. | | `RatelimitingRemovetenantpolicyEvent` | An IDaaS account rate-limiting policy was removed. | | `RatelimitingSettenantpolicyEvent` | An IDaaS account rate-limiting policy was set. | | `SendemailToken_renewEvent` | Email service OAuth token renewal was recorded. Check the event outcome to determine whether renewal succeeded or failed. | | `SendscimToken_renewEvent` | SCIM OAuth token renewal was recorded. Check the event outcome to determine whether renewal succeeded or failed. | | `SmartcardsCreateEvent` | A smart card was created. | | `SmartcardsLoadEvent` | Smart card load activity was recorded. | | `SmartcredentialsActivateEvent` | A Smart Credential was activated. | | `SmartcredentialsChangestateEvent` | A Smart Credential state changed. | | `SmartcredentialsRevokeEvent` | A Smart Credential was revoked. | | `SmartcredentialsUnassignEvent` | A Smart Credential was unassigned. | | `SmartcredentialsUnblockEvent` | A Smart Credential was unblocked. | | `SmartcredentialsUnholdEvent` | A Smart Credential hold was removed. | | `SmartcredentialssignatureNo_transactionEvent` | Smart Credential signature could not continue because no transaction was available. | | `SmartcredentialssignatureStartsignEvent` | Smart Credential signing started. | | `SmartcredentialssignatureTransaction_expiredEvent` | Smart Credential signing failed because the transaction expired. | | `SmartcredentialssignatureTransaction_invalidEvent` | Smart Credential signing failed because the transaction was invalid. | | `SmartcredentialssignatureUser_cancel_responseEvent` | Smart Credential signing was canceled by the user. | | `SmartcredentialssignatureUser_concern_responseEvent` | Smart Credential signing recorded a user concern response. | | `SmartcredentialssignatureUser_confirm_responseEvent` | Smart Credential signing was confirmed by the user. | | `SubscribersLoginlayoutresetEvent` | Subscriber login layout settings were reset. | | `SubscribersThemeresetEvent` | Subscriber theme settings were reset. | | `TenantsEmaildeliveryEvent` | Tenant account email delivery was attempted. Check the event outcome to determine whether delivery succeeded or failed. | | `TenantsLockEvent` | A tenant account was locked. | | `TenantsPromotetoserviceproviderEvent` | A tenant account was promoted to a service provider account. | | `TenantsResetmailserverEvent` | A tenant account mail server was reset. | | `TenantsResetresourcerulesEvent` | A tenant account resource rule configuration was reset. | | `TenantsUnlockEvent` | A tenant account was unlocked. | | `TenantsUnlockadminsEvent` | Tenant account administrator users were unlocked. | | `TokensActivateEvent` | A token was activated. | | `TokensActivatecompleteEvent` | Token activation completed. | | `TokensActivateonlinebeginEvent` | Online token activation started. | | `TokensActivateonlinecompleteEvent` | Online token activation completed. | | `TokensAssignEvent` | A token was assigned. | | `TokensChangestateEvent` | A token state changed. | | `TokensLoadEvent` | Token load activity was recorded. | | `TokensRemovedEvent` | A token was removed. | | `TokensResetEvent` | A token was reset. | | `TokensRotateseedEvent` | A token seed was rotated. | | `TokensSelfassignEvent` | A user self-assigned a token. | | `TokensUnassignEvent` | A token was unassigned. | | `TokensUnlockEvent` | A token was unlocked. | | `UserpasswordsEmailexpirynotificationEvent` | Password expiry email notification delivery was attempted. Check the event outcome to determine whether delivery succeeded or failed. | | `UserpasswordsSmsexpirynotificationEvent` | Password expiry SMS notification delivery was attempted. Check the event outcome to determine whether delivery succeeded or failed. | | `UsersAddcontactEvent` | A user contact was added. | | `UsersChangestateEvent` | A user state changed. | | `UsersDeletecontactEvent` | A user contact was deleted. | | `UsersLockEvent` | A user was locked. | | `UsersModifycontactEvent` | A user contact was modified. | | `UsersSyncaddEvent` | Directory synchronization added a user. | | `UsersSyncdeleteEvent` | Directory synchronization deleted a user. | | `UsersSynclocalizeEvent` | Directory synchronization localized a user. | | `UsersUnlinkEvent` | A user was unlinked from a synchronized directory source. | | `UsersUnlockEvent` | A user was unlocked. | | `UsersUser_registration_completeEvent` | User registration completed. | | `UsersWechat_openid_registration_auth_code_failureEvent` | WeChat OpenID registration failed because of an authorization code failure. | | `UsersWechat_openid_registration_callbackEvent` | WeChat OpenID registration callback activity was recorded. | | `UsersWechat_openid_registration_completeEvent` | WeChat OpenID registration completed. | | `UsersWechat_openid_registration_initEvent` | WeChat OpenID registration started. | | `VerifyuserVerifyEvent` | Verify User activity was recorded. Check the event outcome and audit details for the authenticator and result. | #### Authentication events Use the following table to review supported authentication event types. | Event type | Description | | --------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `AuthenticationDeniedEvent` | Authentication failed or access was denied. The `token` field can identify the authenticator involved. | | `VerificationDeniedEvent` | Identity verification failed or was denied. | | `VerificationIdpSuccessEvent` | Identity verification with an Identity Provider succeeded. | | `VerificationFaceSuccessEvent` | Face verification succeeded. | | `VerificationFaceFailedEvent` | Face verification failed. | | `EntrustIdentityVerificationSuccessEvent` | Entrust identity verification succeeded. | | `EntrustIdentityVerificationFailedEvent` | Entrust identity verification failed. | | `AuthenticationOtpUnavailableEvent` | OTP authentication could not continue because the user has no available OTP delivery contact, such as a mobile number, phone number, email address, or external OTP contact. | | `AuthenticationExternalSuccessEvent` | Authentication with an external authenticator succeeded. | | `AuthenticationExternalSecondFactorBypassEvent` | Authentication with an external authenticator succeeded and the configured second-factor requirement was bypassed. | | `AuthenticationOtpSentToAllEvent` | OTP delivery to all available user contacts was attempted. Check the event outcome to determine whether delivery succeeded or failed. | | `AuthenticationOtpEmailSentEvent` | An authentication OTP was sent by email. | | `AuthenticationOtpNoCreditEvent` | SMS or voice OTP delivery could not continue because the account did not have enough OTP credits. | | `AuthenticationOtpSmsSentEvent` | An authentication OTP was sent by SMS. | | `AuthenticationOtpVoiceSentEvent` | An authentication OTP was sent by voice call. | | `AuthenticationOtpWeChatSentEvent` | An authentication OTP was sent by WeChat, or WeChat delivery was attempted and failed. Check the event outcome and audit details. | | `AuthenticationOtpWeChatFetchMessageAccessTokenFail` | WeChat OTP delivery failed because IDaaS could not fetch the WeChat message access token. | | `AuthenticationOtpWhatsappSentEvent` | An authentication OTP was sent by WhatsApp, or WhatsApp delivery was attempted and failed. Check the event outcome and audit details. | | `AuthenticationOtpCreatedEvent` | An authentication OTP was created for the user. | | `AuthenticationLockedEvent` | Authentication was blocked because the user or authenticator was locked. | | `UserPasswordChangeLockedEvent` | A mobile password change attempt was blocked because the password authenticator or user was locked, or the failed attempt caused lockout. | | `UserPasswordChangeFailedEvent` | A mobile password change failed because the supplied current password did not match the existing password. | | `UserStepUpAuthenticationSuccess` | The user successfully completed step-up authentication for the user portal edit profile flow. | | `SamlAuthenticationFailedEvent` | SAML authentication failed. | | `SamlAuthenticationSuccessEvent` | SAML authentication succeeded. | | `OidcAuthenticationFailedEvent` | OIDC authentication failed. | | `OidcAuthenticationSuccessEvent` | OIDC authentication succeeded. | | `WorkloadClientCredentialsSuccessEvent` | A workload identity successfully authenticated with the OAuth 2.0 client credentials flow. | | `WorkloadClientCredentialsFailedEvent` | A workload identity failed to authenticate with the OAuth 2.0 client credentials flow. | | `MachineLockedEvent` | Machine authentication was blocked because the machine was locked. | | `AuthenticationAdminApiSuccessEvent` | Authentication for an Admin API request succeeded. | | `AuthenticationMagicLinkSuccessEvent` | Magic link authentication succeeded. | | `AuthenticationPasswordSuccessEvent` | Password authentication succeeded. | | `AuthenticationKbaSuccessEvent` | Knowledge-based authentication succeeded. | | `AuthenticationTempAccessCodeSuccessEvent` | Temporary access code authentication succeeded. | | `AuthenticationOtpSuccessEvent` | OTP authentication succeeded. | | `AuthenticationOtpWithTempAccessCodeSuccessEvent` | OTP authentication succeeded by using a temporary access code as the alternative authenticator. | | `AuthenticationGridSuccessEvent` | Grid card authentication succeeded. | | `AuthenticationGridWithTempAccessCodeSuccessEvent` | Grid card authentication succeeded by using a temporary access code as the alternative authenticator. | | `AuthenticationTokenSuccessEvent` | Token authentication succeeded. | | `AuthenticationTokenWithTempAccessCodeSuccessEvent` | Token authentication succeeded by using a temporary access code as the alternative authenticator. | | `AuthenticationTokenCRSuccessEvent` | Challenge-response token authentication succeeded. | | `AuthenticationTokenPushSuccessEvent` | Token push authentication succeeded. | | `AuthenticationFIDOSuccessEvent` | FIDO authentication succeeded. | | `AuthenticationPasskeySuccessEvent` | Passkey authentication succeeded. | | `AuthenticationSmartCredentialPushSuccessEvent` | Smart Credential push authentication succeeded. | | `AuthenticationSmartLoginSuccessEvent` | Smart login authentication succeeded. | | `AuthenticationUserCertificateSuccessEvent` | User certificate authentication succeeded. | | `AuthenticationPassthroughSuccessEvent` | Passthrough authentication succeeded. | | `AuthenticationIdpSuccessEvent` | Identity Provider authentication succeeded. | | `AuthenticationFaceSuccessEvent` | Face authentication succeeded. | | `AuthenticationFirstFactorPasswordSuccessEvent` | Password authentication succeeded as the first factor in a multi-factor flow. | | `AuthenticationFirstFactorExternalSuccessEvent` | External authentication succeeded as the first factor in a multi-factor flow. | | `AuthenticationFirstFactorIdpSuccessEvent` | Identity Provider authentication succeeded as the first factor in a multi-factor flow. | | `AuthenticationSecondFactorKbaSuccessEvent` | Knowledge-based authentication succeeded as the second factor. | | `AuthenticationSecondFactorTempAccessCodeSuccessEvent` | Temporary access code authentication succeeded as the second factor. | | `AuthenticationSecondFactorOtpSuccessEvent` | OTP authentication succeeded as the second factor. | | `AuthenticationSecondFactorOtpWithTempAccessCodeSuccessEvent` | OTP authentication succeeded as the second factor by using a temporary access code as the alternative authenticator. | | `AuthenticationSecondFactorGridSuccessEvent` | Grid card authentication succeeded as the second factor. | | `AuthenticationSecondFactorGridWithTempAccessCodeSuccessEvent` | Grid card authentication succeeded as the second factor by using a temporary access code as the alternative authenticator. | | `AuthenticationSecondFactorTokenSuccessEvent` | Token authentication succeeded as the second factor. | | `AuthenticationSecondFactorTokenWithTempAccessCodeSuccessEvent` | Token authentication succeeded as the second factor by using a temporary access code as the alternative authenticator. | | `AuthenticationSecondFactorTokenCRSuccessEvent` | Challenge-response token authentication succeeded as the second factor. | | `AuthenticationSecondFactorTokenPushSuccessEvent` | Token push authentication succeeded as the second factor. | | `AuthenticationSecondFactorFIDOSuccessEvent` | FIDO authentication succeeded as the second factor. | | `AuthenticationSecondFactorUserCertificateSuccessEvent` | User certificate authentication succeeded as the second factor. | | `AuthenticationSecondFactorSmartCredentialPushSuccessEvent` | Smart Credential push authentication succeeded as the second factor. | | `AuthenticationSecondFactorFaceSuccessEvent` | Face authentication succeeded as the second factor. | | `AuthenticationSecondFactorPassthroughSuccessEvent` | Passthrough authentication succeeded as the second factor. | | `AuthenticationSecondFactorMagicLinkSuccessEvent` | Magic link authentication succeeded as the second factor. | | `AuthenticationAllowedCompromisedPasswordDetectedEvent` | A compromised password was detected during authentication, but policy allowed the sign-in to continue. | | `AuthenticationForceChangeCompromisedPasswordDetectedEvent` | A compromised password was detected during authentication, and policy required the user to change the password. | | `ModifyContactOtpSmsSentEvent` | An OTP was sent by SMS to verify a contact during contact modification. | | `ModifyContactOtpVoiceSentEvent` | An OTP was sent by voice call to verify a contact during contact modification. | | `ModifyContactOtpEmailSentEvent` | An OTP was sent by email to verify a contact during contact modification. | | `ModifyContactOtpWeChatSentEvent` | An OTP was sent by WeChat to verify a contact during contact modification. | | `ModifyContactOtpWhatsappSentEvent` | An OTP was sent by WhatsApp to verify a contact during contact modification. | | `VerifyUserSuccessUserResponseEvent` | Verify User completed successfully after the user submitted the expected response. | | `VerifyUserInvalidUserResponseEvent` | Verify User failed because the user submitted an invalid response. | | `PushAuthenticationDeliveryFailedEvent` | Push authentication delivery failed before the user could complete the push challenge. | ### Audit details Use the following lists to review the audit detail fields available for the listed authentication success events. #### `SamlAuthenticationSuccessEvent` - `Application Name` - `SP/IDP Initiated (IDP or SP)` - `SP Issuer` - `Name ID` - `ACR URL` - `Organization ID` - `Organization Name` #### `OidcAuthenticationSuccessEvent` - `Client ID` - `Application Name` - `Response Types` - `ID Token Subject` - `Redirect URI` - `ACR` - `AMR` - `Organization ID` - `Organization Name`