Mosaic captures activity events across your applications—whether triggered via APIs, SDKs, Journeys, or the Admin Portal—to give you visibility into identity-related actions for monitoring, auditing, and compliance.
You can access activity events through multiple channels, depending on your needs:
Admin Portal: For in-portal filtering, search, and analysis:
- User activity dashboard: allows reviewing user actions like logins, password resets, and verification sessions. Additionally, it includes journey interaction events.
- Admin activity dashboard: allows reviewing configuration changes made through the Admin Portal or APIs.
- Journey analytics dashboard: focuses on journey-related events and allows in-depth research of how your journeys perform at scale.
Event streaming: For exporting events to third-party systems
To learn how to search and analyze these events in the Admin Portal, refer to Journey analytics.
| Event type | Description |
|---|---|
| Journey started | A journey was initiated. |
| Sub-journey started | A sub-journey was initiated. |
| Journey completed successfully | A journey or sub-journey has completed successfully. |
| Journey completed unsuccessfully | A journey or sub-journey has completed unsuccessfully. |
| Step started (deprecated) | A journey or sub-journey step was initiated successfully. Step invocation details are now surfaced in Step completed. |
| Step completed | A journey or sub-journey step has completed. This is the primary event for step invocation details, including failure status, duration, and error details. It may also include next_step_data; see the note below for journey progression analysis. May include rich event data, for more see Report event data |
| Custom event | An event recorded as a result of the Log custom event step execution. This event includes custom data sent from the journey. |
| External connection call | A external connection was invoked. |
Understanding journey progression
Use the Step completed event to understand both the result of the current step and how the journey progressed afterward.
To understand the current step, use the failure field, step_duration_millis, and any data.error details in the same event.
Use next_step_data to understand journey progression. For example, if the Step completed event for step A points to step B, the invocation moved from A toward B. If no later Step completed event is recorded for B, you can infer that the flow stopped after B was selected.
To learn how to search and analyze these events in the Admin Portal, refer to View user activity events.
| Event type | Description |
|---|---|
add_password | A password was added to a user account. |
assign_user_to_organization | A user was assigned to an organization. |
authentication_failed | An authentication attempt failed. |
authentication_resumed | An in-progress authentication was resumed, such as a social login callback, federated login validation, or a device attaching to a cross-device WebAuthn flow. |
authentication_started | An authentication attempt was initiated. |
authentication_succeeded | A user successfully authenticated. |
create_user | A new user was created. |
create_user_failure | A user creation attempt failed. |
failed_otp_attempt | A user failed an OTP verification attempt. |
get_user | A user record was retrieved. |
locked_authenticator | A user's authenticator was locked. |
oidc_code_issued | (In journey flows only) An authorization code was issued for an OpenID Connect authorization code flow orchestrated with journeys. |
oidc_completed | (In journey flows only) An OpenID Connect token request for an authorization code, CIBA, or device flow orchestrated with journeys was completed, including failed requests. |
oidc_started | (In journey flows only) An OpenID Connect authorization code, CIBA, or device flow orchestrated with journeys was initiated. |
on_behalf_of_token_exchange | A client exchanged a presented token for a new token issued to itself, so it can act on behalf of the token subject. Includes failed attempts. |
refresh_token_exchange | A refresh token was exchanged. |
remove_user_from_org | A user was removed from an organization. |
resend_user_invitation_link | A user invitation link was resent. |
reset_password | A user reset their password. |
saml_completed | (In journey flows only) A SAML response was produced for a sign-in request in a flow orchestrated with journeys, including failed authentication. |
saml_started | (In journey flows only) A service provider initiated a SAML sign-in request for a flow orchestrated with journeys. |
sms_sent | An SMS message was sent. |
unsuspend_user | A user was unsuspended. |
update_password | A user updated their password. |
update_user | A user profile was updated. |
update_user_org_roles | A user's organization roles were updated. |
user_create_managed_org | A user created a managed organization. |
user_export_org_members_list_csv_download | An organization members list was downloaded as a CSV file. |
user_failed_login | A user login attempt failed. |
user_login | A user successfully logged in. |
user_logout | A user logged out. |
user_password_reset | A user's password was reset. |
user_update_managed_org | A user updated a managed organization. |
webauthn_registration | A user registered WebAuthn credentials. |
Authentication events
Every authentication emits authentication_started, authentication_succeeded or authentication_failed. In orchestrated flows, Mosaic also emits oidc_started, oidc_code_issued, oidc_completed, saml_started, and saml_completed as envelope events. They record the OpenID Connect or SAML protocol around an authentication that occured within a journey.
To learn how to search and analyze these events in the Admin Portal, refer to View user activity events.
| Event type | Description |
|---|---|
| Session started | Indicates starting a verification session. |
| Consent approved | Indicates saving consent info. |
| Verification completed | A verification process was completed. |
| Face auth session completed | A face authentication session was completed. |
| Verification status updated | Indicates the status of the internal verification process. |
| Image uploaded info | Indicates an image upload, including metadata information (processing time, etc.). |
| Error | Indicates an error on frontend, such as "something went wrong" page. |
| Sdk process completed | An SDK process was successfully completed. |
| Session deleted | Indicates a session deletion (via API or by retention). |
| Session created | Indicates creating a new verification session. |
| Image capture clicked | An image capture action was triggered. |
| Image uploaded | An image was uploaded. |
| Page loaded | Indicates a page load. |
| Deny by restriction criterion | Indicates the verification was rejected based on restriction criteria. |
| Read image data | Image data was accessed. |
| Allow by restriction criterion | Indicates the verification can continue according to the restriction criteria. |
| Verification started | A verification process was initiated. |
| User action performed | Indicates an action was performed by the user, such as a button click. |
| Redirect | Indicates redirection to callback URL. |
| Face auth session started | A face authentication session was initiated. |
| Check image quality | Indicates checking the image quality after capturing an image. |
To learn how to search and analyze these events in the Admin Portal, refer to View user activity events.
| Event type | Description |
|---|---|
| Risk recommendation | Risk recommendation given to a user action |
| Risk report action result | Outcome reported for a previously recommended action (e.g., whether the user passed or failed a challenge) |
To learn how to search and analyze these events in the Admin Portal, refer to View admin activity events for filtering and grouping user logs.
| Event type | Description |
|---|---|
add_admin | A new admin user was created |
admin_create_tenant | A new tenant was created |
admin_login | An admin user logged in |
admin_logout | An admin user logged out |
admin_saml_certificate_generated | A new SAML signing certificate was generated for a SAML client |
admin_saml_certificate_activated | A Standby SAML signing certificate was activated for a SAML client |
admin_saml_certificate_deleted | A SAML signing certificate was deleted from a SAML client |
admin_update_tenant | The tenant was modified |
admin_update_user | An admin modified a user |
admin_recovery_otp_code_generated | An admin generated a temporary access code for a user via the Admin Portal or journeys |
create_api_token | An API token was created |
client_access_token_request | A client requested an access token using the client credentials grant. This is separate from oidc_completed, which covers user token requests |
enable_app_specific_signing_key | Token signing with an app-specific key was enabled |
disable_app_specific_signing_key | Token signing with an app-specific key was disabled |
create_app | An new app was created |
create_mgmt_app | A new management app was created |
create_user | A new user was created |
delete_api_token | An API token was deleted |
delete_app | An app was deleted |
delete_mgmt_app | A management app was deleted |
delete_user | A user was deleted |
edit_auth_settings | An app's authentication settings were modified |
edit_general_settings | General settings were modified |
remove_admin | An admin user was removed |
update_app | An app was modified |
update_mgmt_app | A management app was modified |
edit_preview_policy | A preview policy was modified |
push_policy_to_production | A preview policy was pushed to production |
Admin login outside ip allowlist | An admin user logged in from an IP address outside the configured allowlist |
Admin Magic Link login during SSO | An admin user logged in via magic link while SSO was enforced |