Mosaic captures activity events across your applications—whether triggered via APIs, SDKs, Journeys, or the Admin Portal—to give you visibility into identity-related actions for monitoring, auditing, and compliance.
You can access activity events through multiple channels, depending on your needs:
Admin Portal: For in-portal filtering, search, and analysis:
- User activity dashboard: allows reviewing user actions like logins, password resets, and verification sessions. Additionally, it includes journey interaction events.
- Admin activity dashboard: allows reviewing configuration changes made through the Admin Portal or APIs.
- Journey analytics dashboard: focuses on journey-related events and allows in-depth research of how your journeys perform at scale.
Event streaming: For exporting events to third-party systems
To learn how to search and analyze these events in the Admin Portal, refer to Journey analytics.
| Event type | Description |
|---|---|
assertion_end | A journey step interaction finished. See event objectactivitystringrequired The activity performed by the user Value:"assertion_end" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
assertion_error | A journey step interaction failed. See event objectactivitystringrequired The activity performed by the user Value:"assertion_error" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
assertion_escape | The user left a journey step through an escape interaction. See event objectactivitystringrequired The activity performed by the user Value:"assertion_escape" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
assertion_start | A journey step interaction started. See event objectactivitystringrequired The activity performed by the user Value:"assertion_start" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
condition_evaluated | A Condition or Match Case node was evaluated. See event objectactivitystringrequired The activity performed by the user Value:"condition_evaluated" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
consume_ticket | A Process Cross-Session Message step consumed a ticket and stored the reply. See event objectactivitystringrequired The activity performed by the user Value:"consume_ticket" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
create_ticket | A Create Cross-Session Message step created a ticket. See event objectactivitystringrequired The activity performed by the user Value:"create_ticket" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
custom_data | Customer-defined data was written to the user, device, or session. See event objectactivitystringrequired The activity performed by the user Value:"custom_data" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
custom_event | An event recorded as a result of the Log custom event step execution. This event includes custom data sent from the journey. See event objectactivitystringrequired The activity performed by the user Value:"custom_event" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
custom_token_enrichment | An Enrich Access and ID Token step added customer-defined claims to the token. See event objectactivitystringrequired The activity performed by the user Value:"custom_token_enrichment" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
email | A Send Email step sent an email. See event objectactivitystringrequired The activity performed by the user Value:"email" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
external_connection_call | An external connection was invoked. See event objectactivitystringrequired The activity performed by the user Value:"external_connection_call" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
http_auth_pass | An HTTP Complete Journey step finished the HTTP response. See event objectactivitystringrequired The activity performed by the user Value:"http_auth_pass" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
ido_error | A journey error occurred. See event objectactivitystringrequired The activity performed by the user Value:"ido_error" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
journey_completed_successfully | A journey completed successfully. See event objectactivitystringrequired The activity performed by the user Value:"journey_completed_successfully" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
journey_completed_unsuccessfully | A journey completed unsuccessfully. See event objectactivitystringrequired The activity performed by the user Value:"journey_completed_unsuccessfully" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
journey_started | A journey was initiated. See event objectactivitystringrequired The activity performed by the user Value:"journey_started" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
ldap_bind_entry | A Bind LDAP Entry step completed an LDAP bind. See event objectactivitystringrequired The activity performed by the user Value:"ldap_bind_entry" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
Loop | A While Loop node ran. See event objectactivitystringrequired The activity performed by the user Value:"Loop" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
oidc_token_exchange_request | An OpenID Connect token exchange was requested. See event objectactivitystringrequired The activity performed by the user Value:"oidc_token_exchange_request" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
policy_decision | A journey evaluation finished and recorded the resulting actions, or the error if evaluation failed. See event objectactivitystringrequired The activity performed by the user Value:"policy_decision" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
session_logout | A journey session ended. See event objectactivitystringrequired The activity performed by the user Value:"session_logout" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
session_pending | The journey session is still active and further steps are required. See event objectactivitystringrequired The activity performed by the user Value:"session_pending" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
set_variables | A Set Temporary Variables step stored values for later steps. See event objectactivitystringrequired The activity performed by the user Value:"set_variables" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
sms | A Send SMS step sent an SMS message. See event objectactivitystringrequired The activity performed by the user Value:"sms" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
step_completed | A journey or sub-journey step has completed. This is the primary event for step invocation details, including failure status, duration, and error details. It may also include next_step_data; see the note below for journey progression analysis. May include rich event data, for more see Report event data See event objectactivitystringrequired The activity performed by the user Value:"step_completed" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
step_started (deprecated) | A journey or sub-journey step was initiated successfully. Step invocation details are now surfaced in step_completed. See event objectactivitystringrequired The activity performed by the user Value:"step_started" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
sub_journey_completed_successfully | A sub-journey completed successfully. See event objectactivitystringrequired The activity performed by the user Value:"sub_journey_completed_successfully" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
sub_journey_completed_unsuccessfully | A sub-journey completed unsuccessfully. See event objectactivitystringrequired The activity performed by the user Value:"sub_journey_completed_unsuccessfully" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
sub_journey_started | A sub-journey was initiated. See event objectactivitystringrequired The activity performed by the user Value:"sub_journey_started" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
transmit_identity_verification | An identity verification session completed with an allow or deny recommendation. See Platform IDV Recommendation. See event objectactivitystringrequired The activity performed by the user Value:"transmit_identity_verification" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
transmit_platform_custom_authentication | A Custom Authentication step validated an external authentication token. See event objectactivitystringrequired The activity performed by the user Value:"transmit_platform_custom_authentication" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
typescript_function_node | A custom TypeScript node in a journey completed. See event objectactivitystringrequired The activity performed by the user Value:"typescript_function_node" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
update_ticket | An Update Cross-Session Message step updated a ticket. See event objectactivitystringrequired The activity performed by the user Value:"update_ticket" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
validate_response | A response from an external identity provider was validated. See Invoke External IDP. See event objectactivitystringrequired The activity performed by the user Value:"validate_response" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
Use the step_completed event to understand both the result of the current step and how the journey progressed afterward.
To understand the current step, use the failure field, step_duration_millis, and any data.error details in the same event.
Use next_step_data to understand journey progression. For example, if the step_completed event for step A points to step B, the invocation moved from A toward B. If no later step_completed event is recorded for B, you can infer that the flow stopped after B was selected.
Some journey event types append a suffix to the name in the table.
assertion_start,assertion_end,assertion_error,assertion_escape, andsession_logoutcan include the step and interaction, for exampleassertion_start/login_form/action.condition_evaluatedis emitted ascondition_evaluated/genericorcondition_evaluated/match_case.typescript_function_nodecan include an author-defined branch, for exampletypescript_function_node/success.transmit_identity_verificationincludes the recommendation:transmit_identity_verification/decision/allowortransmit_identity_verification/decision/deny.
To learn how to search and analyze these events in the Admin Portal, refer to View user activity events.
| Event type | Description |
|---|---|
add_password | A password was added to a user account. See event objectactivitystringrequired The activity performed by the user Value:"add_password" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
assign_user_to_organization | A user was assigned to an organization. See event objectactivitystringrequired The activity performed by the user Value:"assign_user_to_organization" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
authentication_failed | An authentication attempt failed. See event objectactivitystringrequired The activity performed by the user Value:"authentication_failed" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
authentication_resumed | An in-progress authentication was resumed, such as a social login callback, federated login validation, or a device attaching to a cross-device WebAuthn flow. See event objectactivitystringrequired The activity performed by the user Value:"authentication_resumed" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
authentication_started | An authentication attempt was initiated. See event objectactivitystringrequired The activity performed by the user Value:"authentication_started" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
authentication_succeeded | A user successfully authenticated. See event objectactivitystringrequired The activity performed by the user Value:"authentication_succeeded" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
create_client_authority | A client authority was created. See event objectactivitystringrequired The activity performed by the user Value:"create_client_authority" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
create_iat | An initial access token was created for a client authority. See event objectactivitystringrequired The activity performed by the user Value:"create_iat" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
create_scope | A scope was created. See event objectactivitystringrequired The activity performed by the user Value:"create_scope" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
create_sso_client_group | An SSO client group was created in an app. See event objectactivitystringrequired The activity performed by the user Value:"create_sso_client_group" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
create_user | A new user was created. See event objectactivitystringrequired The activity performed by the user Value:"create_user" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
create_user_failure | A user creation attempt failed. See event objectactivitystringrequired The activity performed by the user Value:"create_user_failure" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
delegated_access_login | A logged-in user exchanged their token for a delegated user's token. See event objectactivitystringrequired The activity performed by the user Value:"delegated_access_login" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
delete_iat | An initial access token was deleted. See event objectactivitystringrequired The activity performed by the user Value:"delete_iat" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
delete_scope | A scope was deleted. See event objectactivitystringrequired The activity performed by the user Value:"delete_scope" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
delete_sso_client_group | An SSO client group was deleted. Includes only the group ID. See event objectactivitystringrequired The activity performed by the user Value:"delete_sso_client_group" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
delete_user | A user was deleted. See event objectactivitystringrequired The activity performed by the user Value:"delete_user" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
failed_OTP_attempt | A user failed an OTP verification attempt. See event objectactivitystringrequired The activity performed by the user Value:"failed_otp_attempt" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
failed_webauthn_attempt | A WebAuthn authentication attempt failed. See event objectactivitystringrequired The activity performed by the user Value:"failed_webauthn_attempt" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
failover_switch | A failover switch changed the active pool. See event objectactivitystringrequired The activity performed by the user Value:"failover_switch" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
get_user | A user record was retrieved. See event objectactivitystringrequired The activity performed by the user Value:"get_user" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
get_users | A list of users was retrieved. See event objectactivitystringrequired The activity performed by the user Value:"get_users" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
locked_authenticator | A user's authenticator was locked. See event objectactivitystringrequired The activity performed by the user Value:"locked_authenticator" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
oidc_code_issued | (In journey flows only) An authorization code was issued for an OpenID Connect authorization code flow orchestrated with journeys. See event objectactivitystringrequired The activity performed by the user Value:"oidc_code_issued" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
oidc_completed | (In journey flows only) An OpenID Connect token request for an authorization code, CIBA, or device flow orchestrated with journeys was completed, including failed requests. See event objectactivitystringrequired The activity performed by the user Value:"oidc_completed" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
oidc_started | (In journey flows only) An OpenID Connect authorization code, CIBA, or device flow orchestrated with journeys was initiated. See event objectactivitystringrequired The activity performed by the user Value:"oidc_started" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
on_behalf_of_token_exchange | A client exchanged a presented token for a new token issued to itself, so it can act on behalf of the token subject. Includes failed attempts. See event objectactivitystringrequired The activity performed by the user Value:"on_behalf_of_token_exchange" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
passwordless_authentication | A token was issued after a passkey authentication. See event objectactivitystringrequired The activity performed by the user Value:"passwordless_authentication" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
passwordless_registration | A token was issued after a passkey registration. See event objectactivitystringrequired The activity performed by the user Value:"passwordless_registration" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
passwordless_transaction | A token was issued after a passkey authentication that included approval data. See event objectactivitystringrequired The activity performed by the user Value:"passwordless_transaction" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
refresh_token_exchange | A refresh token was exchanged. See event objectactivitystringrequired The activity performed by the user Value:"refresh_token_exchange" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
remove_user_from_org | A user was removed from an organization. See event objectactivitystringrequired The activity performed by the user Value:"remove_user_from_org" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
resend_user_invitation_link | A user invitation link was resent. See event objectactivitystringrequired The activity performed by the user Value:"resend_user_invitation_link" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
reset_password | A user reset their password. See event objectactivitystringrequired The activity performed by the user Value:"reset_password" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
saml_completed | (In journey flows only) A SAML response was produced for a sign-in request in a flow orchestrated with journeys, including failed authentication. See event objectactivitystringrequired The activity performed by the user Value:"saml_completed" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
saml_started | (In journey flows only) A service provider initiated a SAML sign-in request for a flow orchestrated with journeys. See event objectactivitystringrequired The activity performed by the user Value:"saml_started" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
send_user_passkey_registration | An organization admin sent a member a passkey registration email. See event objectactivitystringrequired The activity performed by the user Value:"send_user_passkey_registration" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
silent_authentication | A silent OpenID Connect authentication occurred. See event objectactivitystringrequired The activity performed by the user Value:"silent_authentication" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
sms_sent | An SMS message was sent. See event objectactivitystringrequired The activity performed by the user Value:"sms_sent" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
sso_group_authentication_started | An authentication attempt started for an SSO service flow. See event objectactivitystringrequired The activity performed by the user Value:"sso_group_authentication_started" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
sso_group_authentication_succeeded | An authentication attempt succeeded for an SSO service flow. See event objectactivitystringrequired The activity performed by the user Value:"sso_group_authentication_succeeded" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
suspend_user | A user was suspended. See event objectactivitystringrequired The activity performed by the user Value:"suspend_user" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
suspend_user_from_org_app | An organization admin suspended a member from an app in an organization. See event objectactivitystringrequired The activity performed by the user Value:"suspend_user_from_org_app" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
unsuspend_user | A user was unsuspended. See event objectactivitystringrequired The activity performed by the user Value:"unsuspend_user" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
unsuspend_user_from_org_app | An organization admin unsuspended a member from an app in an organization. See event objectactivitystringrequired The activity performed by the user Value:"unsuspend_user_from_org_app" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
update_client_authority | A client authority was updated. See event objectactivitystringrequired The activity performed by the user Value:"update_client_authority" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
update_password | A user updated their password. See event objectactivitystringrequired The activity performed by the user Value:"update_password" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
update_scope | A scope was updated. See event objectactivitystringrequired The activity performed by the user Value:"update_scope" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
update_sso_client_group | An SSO client group was modified. Includes only the changed settings, with their previous and current values. See event objectactivitystringrequired The activity performed by the user Value:"update_sso_client_group" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
update_user | A user profile was updated. See event objectactivitystringrequired The activity performed by the user Value:"update_user" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
update_user_failure | A user update attempt failed. See event objectactivitystringrequired The activity performed by the user Value:"update_user_failure" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
update_user_org_roles | A user's organization roles were updated. See event objectactivitystringrequired The activity performed by the user Value:"update_user_org_roles" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
user_authenticator_deleted | An organization admin deleted an authenticator. See event objectactivitystringrequired The activity performed by the user Value:"user_authenticator_deleted" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
user_authenticator_locked | An organization admin locked a user's authenticator. See event objectactivitystringrequired The activity performed by the user Value:"user_authenticator_locked" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
user_authenticator_unlocked | An organization admin unlocked a user's authenticator. See event objectactivitystringrequired The activity performed by the user Value:"user_authenticator_unlocked" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
user_consent_granted | A user approved a consent request. See event objectactivitystringrequired The activity performed by the user Value:"user_consent_granted" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
user_consent_requested | A user requested consent for delegated access. See event objectactivitystringrequired The activity performed by the user Value:"user_consent_requested" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
user_consent_revoked | A consent grant was revoked. See event objectactivitystringrequired The activity performed by the user Value:"user_consent_revoked" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
user_create_managed_org | A user created a managed organization. See event objectactivitystringrequired The activity performed by the user Value:"user_create_managed_org" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
user_create_organization | An organization admin created an organization. See event objectactivitystringrequired The activity performed by the user Value:"user_create_organization" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
user_delete_managed_org | An organization admin deleted a managed organization. See event objectactivitystringrequired The activity performed by the user Value:"user_delete_managed_org" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
user_delete_mobile_native_biometrics | Mobile biometric credentials were deleted for a user. See event objectactivitystringrequired The activity performed by the user Value:"user_delete_mobile_native_biometrics" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
user_delete_organization | An organization admin deleted an organization. See event objectactivitystringrequired The activity performed by the user Value:"user_delete_organization" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
user_delete_pin_authenticator | A user's PIN credentials were deleted. See event objectactivitystringrequired The activity performed by the user Value:"user_delete_pin_authenticator" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
user_delete_webauthn_credential | A WebAuthn credential was deleted for a user. See event objectactivitystringrequired The activity performed by the user Value:"user_delete_webauthn_credential" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
user_disable_managed_org | An organization admin disabled a managed organization. See event objectactivitystringrequired The activity performed by the user Value:"user_disable_managed_org" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
user_disable_organization | An organization admin disabled an organization. See event objectactivitystringrequired The activity performed by the user Value:"user_disable_organization" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
user_enable_managed_org | An organization admin enabled a managed organization. See event objectactivitystringrequired The activity performed by the user Value:"user_enable_managed_org" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
user_enable_organization | An organization admin enabled an organization. See event objectactivitystringrequired The activity performed by the user Value:"user_enable_organization" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
user_export_org_members_list_csv_download | An organization members list was downloaded as a CSV file. See event objectactivitystringrequired The activity performed by the user Value:"user_export_org_members_list_csv_download" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
user_failed_login | A user login attempt failed. See event objectactivitystringrequired The activity performed by the user Value:"user_failed_login" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
user_login | A user successfully logged in. See event objectactivitystringrequired The activity performed by the user Value:"user_login" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
user_logout | A user logged out. See event objectactivitystringrequired The activity performed by the user Value:"user_logout" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
user_password_reset | A user's password was reset. See event objectactivitystringrequired The activity performed by the user Value:"user_password_reset" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
user_register_mobile_native_biometrics | Mobile biometric credentials were registered for a user. See event objectactivitystringrequired The activity performed by the user Value:"user_register_mobile_native_biometrics" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
user_register_pin_authenticator | PIN credentials were registered for a user. See event objectactivitystringrequired The activity performed by the user Value:"user_register_pin_authenticator" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
user_update_managed_org | A user updated a managed organization. See event objectactivitystringrequired The activity performed by the user Value:"user_update_managed_org" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
user_update_organization | An organization admin updated an organization's details. See event objectactivitystringrequired The activity performed by the user Value:"user_update_organization" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
webauthn_authentication | A WebAuthn OpenID Connect authentication completed. See event objectactivitystringrequired The activity performed by the user Value:"webauthn_authentication" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
webauthn_registration | A user registered WebAuthn credentials. See event objectactivitystringrequired The activity performed by the user Value:"webauthn_registration" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
Every authentication emits authentication_started, authentication_succeeded or authentication_failed. In orchestrated flows, Mosaic also emits oidc_started, oidc_code_issued, oidc_completed, saml_started, and saml_completed as envelope events. They record the OpenID Connect or SAML protocol around an authentication that occured within a journey.
To learn how to search and analyze these events in the Admin Portal, refer to View user activity events.
| Event type | Description |
|---|---|
add_fraud_image_data | A fraud-face image was stored. See event objectactivitystringrequired The activity performed by the user Value:"add_fraud_image_data" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation |
add_multiple_session_detector_data | Face data from the session was added to the multiple-session detector index. See event objectactivitystringrequired The activity performed by the user Value:"add_multiple_session_detector_data" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation |
allow_by_restriction_criterion | Indicates the verification can continue according to the restriction criteria. See event objectactivitystringrequired The activity performed by the user Value:"allow_by_restriction_criterion" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation |
app_settings_updated | Application or tenant verification settings were updated. See event objectactivitystringrequired The activity performed by the user Value:"app_settings_updated" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation |
check_image_quality | Indicates checking the image quality after capturing an image. See event objectactivitystringrequired The activity performed by the user Value:"check_image_quality" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation |
consent_approved | Indicates saving consent info. See event objectactivitystringrequired The activity performed by the user Value:"consent_approved" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation |
delete_fraud_image_data | A fraud-face image was deleted. See event objectactivitystringrequired The activity performed by the user Value:"delete_fraud_image_data" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation |
delete_image_from_entity | A fraud image was removed from its fraud entity. See event objectactivitystringrequired The activity performed by the user Value:"delete_image_from_entity" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation |
delete_multiple_session_detector_data | Session data was removed from the multiple-session detector index. See event objectactivitystringrequired The activity performed by the user Value:"delete_multiple_session_detector_data" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation |
deny_by_restriction_criterion | Indicates the verification was rejected based on restriction criteria. See event objectactivitystringrequired The activity performed by the user Value:"deny_by_restriction_criterion" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation |
download_session_data | Verification session data was downloaded from the Admin Portal. See event objectactivitystringrequired The activity performed by the user Value:"download_session_data" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation |
error | Indicates an error on frontend, such as "something went wrong" page. See event objectactivitystringrequired The activity performed by the user Value:"error" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation |
expiration_session | A verification session expired before it completed. See event objectactivitystringrequired The activity performed by the user Value:"expiration_session" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation |
face_auth_error | A face authentication operation failed. See event objectactivitystringrequired The activity performed by the user Value:"face_auth_error" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation |
face_auth_face_registered | A face was enrolled for face authentication. See event objectactivitystringrequired The activity performed by the user Value:"face_auth_face_registered" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation |
face_auth_face_verified | A face authentication check recorded whether the live face matched the enrolled face. See event objectactivitystringrequired The activity performed by the user Value:"face_auth_face_verified" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation |
image_uploaded | An image was uploaded. See event objectactivitystringrequired The activity performed by the user Value:"image_uploaded" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation |
image_uploaded_info | Indicates an image upload, including metadata information (processing time, etc.). See event objectactivitystringrequired The activity performed by the user Value:"image_uploaded_info" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation |
page_loaded | Indicates a page load. See event objectactivitystringrequired The activity performed by the user Value:"page_loaded" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation |
read_fraud_image_data | A fraud-face reference image was read. See event objectactivitystringrequired The activity performed by the user Value:"read_fraud_image_data" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation |
read_image_data | Image data was accessed. See event objectactivitystringrequired The activity performed by the user Value:"read_image_data" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation |
redirect | Indicates redirection to callback URL. See event objectactivitystringrequired The activity performed by the user Value:"redirect" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation |
sdk_process_completed | An SDK process was successfully completed. See event objectactivitystringrequired The activity performed by the user Value:"sdk_process_completed" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation |
search_multiple_session_detector_data | A multiple-session detector search compared the session with other sessions. See event objectactivitystringrequired The activity performed by the user Value:"search_multiple_session_detector_data" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation |
security_insight_added | A security insight linked one or more verification sessions to a risk pattern. See event objectactivitystringrequired The activity performed by the user Value:"security_insight_added" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation |
session_created | Indicates creating a new verification session. See event objectactivitystringrequired The activity performed by the user Value:"session_created" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation |
session_deleted | Indicates a session deletion (via API or by retention). See event objectactivitystringrequired The activity performed by the user Value:"session_deleted" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation |
session_started | Indicates starting a verification session. See event objectactivitystringrequired The activity performed by the user Value:"session_started" tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation |
user_action_performed | Indicates an action was performed by the user, such as a button click. See event objectactivitystringrequired The activity performed by the user Value:"user_action_performed" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation |
verification_status_updated | Indicates the status of the internal verification process. See event objectactivitystringrequired The activity performed by the user Value:"verification_status_updated" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation |
To learn how to search and analyze these events in the Admin Portal, refer to View user activity events.
| Event type | Description |
|---|---|
risk_fraud_ring | Indicates that an entity (user, device, or IP address) has been grouped into a fraud ring. See event objectactivitystringrequired The activity performed by the user Value:"risk_fraud_ring" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment |
risk_recommendation | Risk recommendation given to a user action See event objectactivitystringrequired The activity performed by the user Value:"risk_recommendation" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment |
risk_report_action_result | Outcome reported for a previously recommended action (e.g., whether the user passed or failed a challenge) See event objectactivitystringrequired The activity performed by the user Value:"risk_report_action_result" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment |
To learn how to search and analyze these events in the Admin Portal, refer to View admin activity events for filtering and grouping user logs.
| Event type | Description |
|---|---|
add_admin | A new admin user was created See event objectactivitystringrequired The activity performed by the actor Value:"add_admin" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
add_fraud_entity_data | A fraud entity record was created See event objectactivitystringrequired The activity performed by the actor Value:"add_fraud_entity_data" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
add_fraud_image_data | A fraud-face image was stored See event objectactivitystringrequired The activity performed by the actor Value:"add_fraud_image_data" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
add_image_to_entity | A fraud image was linked to a fraud entity See event objectactivitystringrequired The activity performed by the actor Value:"add_image_to_entity" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
Add list items | Items were added to a list See event objectactivitystringrequired The activity performed by the actor Value:"Add list items" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
add_multiple_session_detector_data | Face data from a verification session was added to the multiple-session detector index See event objectactivitystringrequired The activity performed by the actor Value:"add_multiple_session_detector_data" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_assign_role_groups | A role group was assigned through the Admin Portal, a management app, or an organization admin See event objectactivitystringrequired The activity performed by the actor Value:"admin_assign_role_groups" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_assign_roles | A role was assigned to a user through the Admin Portal, a management app, or an organization admin See event objectactivitystringrequired The activity performed by the actor Value:"admin_assign_roles" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_assign_user_to_organization | A user was assigned to an organization through the Admin Portal or a management app See event objectactivitystringrequired The activity performed by the actor Value:"admin_assign_user_to_organization" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_authenticator_deleted | An authenticator was deleted through the Admin Portal or a management app See event objectactivitystringrequired The activity performed by the actor Value:"admin_authenticator_deleted" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_authenticator_locked | An authenticator was locked through the Admin Portal or a management app See event objectactivitystringrequired The activity performed by the actor Value:"admin_authenticator_locked" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_authenticator_unlocked | An authenticator was unlocked through the Admin Portal or a management app See event objectactivitystringrequired The activity performed by the actor Value:"admin_authenticator_unlocked" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_authenticator_unlocked_by_type | Authenticators of a specific type were unlocked through the Admin Portal or a management app See event objectactivitystringrequired The activity performed by the actor Value:"admin_authenticator_unlocked_by_type" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_client_secret_deleted | A client secret was deleted See event objectactivitystringrequired The activity performed by the actor Value:"admin_client_secret_deleted" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_client_secret_generated | A client secret was generated See event objectactivitystringrequired The activity performed by the actor Value:"admin_client_secret_generated" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_create_managed_org | A managed organization was created through the Admin Portal or a management app See event objectactivitystringrequired The activity performed by the actor Value:"admin_create_managed_org" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_create_organization | An organization was created through the Admin Portal or a management app See event objectactivitystringrequired The activity performed by the actor Value:"admin_create_organization" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_create_role | A role was created through the Admin Portal or a management app See event objectactivitystringrequired The activity performed by the actor Value:"admin_create_role" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_create_role_group | A role group was created through the Admin Portal or a management app See event objectactivitystringrequired The activity performed by the actor Value:"admin_create_role_group" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_create_tenant | A new tenant was created See event objectactivitystringrequired The activity performed by the actor Value:"admin_create_tenant" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_create_user | A user was created through the Admin Portal or a management app See event objectactivitystringrequired The activity performed by the actor Value:"admin_create_user" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_delete_managed_org | A managed organization was deleted through the Admin Portal or a management app See event objectactivitystringrequired The activity performed by the actor Value:"admin_delete_managed_org" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_delete_organization | An organization was deleted through the Admin Portal or a management app See event objectactivitystringrequired The activity performed by the actor Value:"admin_delete_organization" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_delete_role | A role was deleted through the Admin Portal or a management app See event objectactivitystringrequired The activity performed by the actor Value:"admin_delete_role" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_delete_role_group | A role group was deleted through the Admin Portal or a management app See event objectactivitystringrequired The activity performed by the actor Value:"admin_delete_role_group" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_delete_user | A user was deleted through the Admin Portal or a management app See event objectactivitystringrequired The activity performed by the actor Value:"admin_delete_user" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_delete_webauthn_credential | A WebAuthn credential was deleted through the Admin Portal or a management app See event objectactivitystringrequired The activity performed by the actor Value:"admin_delete_webauthn_credential" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_disable_managed_org | A managed organization was disabled through the Admin Portal or a management app See event objectactivitystringrequired The activity performed by the actor Value:"admin_disable_managed_org" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_disable_organization | An organization was disabled through the Admin Portal or a management app See event objectactivitystringrequired The activity performed by the actor Value:"admin_disable_organization" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_enable_managed_org | A managed organization was enabled through the Admin Portal or a management app See event objectactivitystringrequired The activity performed by the actor Value:"admin_enable_managed_org" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_enable_organization | An organization was enabled through the Admin Portal or a management app See event objectactivitystringrequired The activity performed by the actor Value:"admin_enable_organization" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_export_org_members_list_csv_download | An admin downloaded an organization member list See event objectactivitystringrequired The activity performed by the actor Value:"admin_export_org_members_list_csv_download" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_export_org_members_list_csv_request | An admin requested an organization member-list export See event objectactivitystringrequired The activity performed by the actor Value:"admin_export_org_members_list_csv_request" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_failed_login | An admin login attempt failed See event objectactivitystringrequired The activity performed by the actor Value:"admin_failed_login" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_login | An admin user logged in See event objectactivitystringrequired The activity performed by the actor Value:"admin_login" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_login_outside_IP_allowlist | An admin user logged in from an IP address outside the configured allowlist See event objectactivitystringrequired The activity performed by the actor Value:"admin_login_outside_IP_allowlist" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_logout | An admin user logged out See event objectactivitystringrequired The activity performed by the actor Value:"admin_logout" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_magic_link_login_during_sso | An admin user logged in via magic link while SSO was enforced See event objectactivitystringrequired The activity performed by the actor Value:"admin_magic_link_login_during_sso" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_recovery_otp_code_generated | An admin generated a temporary access code for a user via the Admin Portal or journeys See event objectactivitystringrequired The activity performed by the actor Value:"admin_recovery_otp_code_generated" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_remove_role_groups | A role group was removed through the Admin Portal, a management app, or an organization admin See event objectactivitystringrequired The activity performed by the actor Value:"admin_remove_role_groups" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_remove_roles | An admin removed roles from an organization See event objectactivitystringrequired The activity performed by the actor Value:"admin_remove_roles" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_remove_user_from_org | A user was removed from an organization through the Admin Portal or a management app See event objectactivitystringrequired The activity performed by the actor Value:"admin_remove_user_from_org" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_resend_user_invitation_link | An admin resent a user invitation link from the Admin Portal See event objectactivitystringrequired The activity performed by the actor Value:"admin_resend_user_invitation_link" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_reset_user_password | An admin reset a user's password See event objectactivitystringrequired The activity performed by the actor Value:"admin_reset_user_password" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_saml_certificate_activated | A Standby SAML signing certificate was activated for a SAML client See event objectactivitystringrequired The activity performed by the actor Value:"admin_saml_certificate_activated" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_saml_certificate_deleted | A SAML signing certificate was deleted from a SAML client See event objectactivitystringrequired The activity performed by the actor Value:"admin_saml_certificate_deleted" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_saml_certificate_generated | A new SAML signing certificate was generated for a SAML client See event objectactivitystringrequired The activity performed by the actor Value:"admin_saml_certificate_generated" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_send_user_passkey_registration | An admin sent a user a passkey registration email See event objectactivitystringrequired The activity performed by the actor Value:"admin_send_user_passkey_registration" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_suspend_user_from_org_app | A user was suspended from an app in an organization through the Admin Portal or a management app See event objectactivitystringrequired The activity performed by the actor Value:"admin_suspend_user_from_org_app" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_terminate_user_session | An admin deleted a user's sessions See event objectactivitystringrequired The activity performed by the actor Value:"admin_terminate_user_session" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_unsuspend_user_from_org_app | A user was unsuspended from an app in an organization through the Admin Portal or a management app See event objectactivitystringrequired The activity performed by the actor Value:"admin_unsuspend_user_from_org_app" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_update_custom_user_schema | An admin updated the custom user schema See event objectactivitystringrequired The activity performed by the actor Value:"admin_update_custom_user_schema" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_update_managed_org | A managed organization's details were updated through the Admin Portal or a management app See event objectactivitystringrequired The activity performed by the actor Value:"admin_update_managed_org" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_update_organization | An organization's details were updated through the Admin Portal or a management app See event objectactivitystringrequired The activity performed by the actor Value:"admin_update_organization" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_update_role | A role was updated through the Admin Portal or a management app See event objectactivitystringrequired The activity performed by the actor Value:"admin_update_role" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_update_role_group | A role group was updated through the Admin Portal or a management app See event objectactivitystringrequired The activity performed by the actor Value:"admin_update_role_group" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_update_security_insight_assignee | A security insight assignee was updated See event objectactivitystringrequired The activity performed by the actor Value:"admin_update_security_insight_assignee" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_update_security_insight_status | A security insight status was updated See event objectactivitystringrequired The activity performed by the actor Value:"admin_update_security_insight_status" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_update_tenant | The tenant was modified See event objectactivitystringrequired The activity performed by the actor Value:"admin_update_tenant" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_update_user | An admin modified a user See event objectactivitystringrequired The activity performed by the actor Value:"admin_update_user" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
admin_update_user_org_roles | A user's organization roles were updated through the Admin Portal or a management app See event objectactivitystringrequired The activity performed by the actor Value:"admin_update_user_org_roles" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
allow_by_restriction_criterion | A restriction criterion allowed the verification to continue See event objectactivitystringrequired The activity performed by the actor Value:"allow_by_restriction_criterion" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
app_settings_updated | Application or tenant settings were updated See event objectactivitystringrequired The activity performed by the actor Value:"app_settings_updated" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
certificates_create | An admin created a trusted identity certificate See event objectactivitystringrequired The activity performed by the actor Value:"certificates_create" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
certificates_delete | An admin deleted trusted identity certificates See event objectactivitystringrequired The activity performed by the actor Value:"certificates_delete" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
certificates_download | An admin downloaded a trusted identity certificate See event objectactivitystringrequired The activity performed by the actor Value:"certificates_download" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
certificates_export | An admin exported a trusted identity certificate See event objectactivitystringrequired The activity performed by the actor Value:"certificates_export" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
client_access_token_request | A client requested an access token using the client credentials grant. This is separate from oidc_completed, which covers user token requests See event objectactivitystringrequired The activity performed by the user Value:"client_access_token_request" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
create_app | An new app was created See event objectactivitystringrequired The activity performed by the actor Value:"create_app" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
Create custom action | A custom action was created See event objectactivitystringrequired The activity performed by the actor Value:"Create custom action" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
Create label | A label was created See event objectactivitystringrequired The activity performed by the actor Value:"Create label" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
Create labels | Labels were created See event objectactivitystringrequired The activity performed by the actor Value:"Create labels" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
Create list | A list was created See event objectactivitystringrequired The activity performed by the actor Value:"Create list" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
create_mgmt_app | A new management app was created See event objectactivitystringrequired The activity performed by the actor Value:"create_mgmt_app" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
Create rule | A rule was created See event objectactivitystringrequired The activity performed by the actor Value:"Create rule" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
credentials_create | An admin created a credentials identity See event objectactivitystringrequired The activity performed by the actor Value:"credentials_create" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
credentials_delete | An admin deleted a credentials identity See event objectactivitystringrequired The activity performed by the actor Value:"credentials_delete" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
credentials_export | An admin exported a credentials identity See event objectactivitystringrequired The activity performed by the actor Value:"credentials_export" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
credentials_import | An admin imported a credentials identity See event objectactivitystringrequired The activity performed by the actor Value:"credentials_import" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
credentials_revoke | An admin revoked a credentials identity See event objectactivitystringrequired The activity performed by the actor Value:"credentials_revoke" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
customer_get_results | A customer fetched verification session results See event objectactivitystringrequired The activity performed by the actor Value:"customer_get_results" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
delete_app | An app was deleted See event objectactivitystringrequired The activity performed by the actor Value:"delete_app" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
Delete custom action | A custom action was deleted See event objectactivitystringrequired The activity performed by the actor Value:"Delete custom action" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
delete_fraud_image_data | A fraud-face image was deleted See event objectactivitystringrequired The activity performed by the actor Value:"delete_fraud_image_data" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
delete_image_from_entity | A fraud image was removed from its fraud entity See event objectactivitystringrequired The activity performed by the actor Value:"delete_image_from_entity" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
Delete list | A list was deleted See event objectactivitystringrequired The activity performed by the actor Value:"Delete list" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
delete_mgmt_app | A management app was deleted See event objectactivitystringrequired The activity performed by the actor Value:"delete_mgmt_app" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
Delete rule | A rule was deleted See event objectactivitystringrequired The activity performed by the actor Value:"Delete rule" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
deny_by_restriction_criterion | A restriction criterion denied the verification See event objectactivitystringrequired The activity performed by the actor Value:"deny_by_restriction_criterion" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
disable_app_specific_signing_key | Token signing with an app-specific key was disabled See event objectactivitystringrequired The activity performed by the actor Value:"disable_app_specific_signing_key" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
edit_auth_settings | An app's authentication settings were modified See event objectactivitystringrequired The activity performed by the actor Value:"edit_auth_settings" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
Edit preview policy | A preview policy was modified See event objectactivitystringrequired The activity performed by the actor Value:"Edit preview policy" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
enable_app_specific_signing_key | Token signing with an app-specific key was enabled See event objectactivitystringrequired The activity performed by the actor Value:"enable_app_specific_signing_key" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
environment_variable_create | An admin created an environment variable See event objectactivitystringrequired The activity performed by the actor Value:"environment_variable_create" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
environment_variable_delete | An admin deleted an environment variable See event objectactivitystringrequired The activity performed by the actor Value:"environment_variable_delete" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
environment_variable_export | An admin exported an environment variable See event objectactivitystringrequired The activity performed by the actor Value:"environment_variable_export" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
environment_variable_import | An admin imported an environment variable See event objectactivitystringrequired The activity performed by the actor Value:"environment_variable_import" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
environment_variable_update | An admin updated an environment variable See event objectactivitystringrequired The activity performed by the actor Value:"environment_variable_update" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
event_stream_collection_started | Event stream collection started See event objectactivitystringrequired The activity performed by the actor Value:"Event stream collection started" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
event_stream_collection_stopped | Event stream collection stopped See event objectactivitystringrequired The activity performed by the actor Value:"Event stream collection stopped" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
event_stream_created | An event stream was created See event objectactivitystringrequired The activity performed by the actor Value:"Event stream created" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
event_stream_deleted | An event stream was deleted See event objectactivitystringrequired The activity performed by the actor Value:"Event stream deleted" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
experiences_management_branding_page_updated | An admin saved branding settings See event objectactivitystringrequired The activity performed by the actor Value:"experiences_management_branding_page_updated" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
experiences_management_branding_page_viewed | An admin opened branding settings See event objectactivitystringrequired The activity performed by the actor Value:"experiences_management_branding_page_viewed" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
experiences_management_logo_updated | An admin updated the logo as part of a branding change See event objectactivitystringrequired The activity performed by the actor Value:"experiences_management_logo_updated" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
experiences_management_setting_page_updated | An admin saved experience settings See event objectactivitystringrequired The activity performed by the actor Value:"experiences_management_setting_page_updated" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
experiences_management_settings_page_viewed | An admin opened experience settings for an app See event objectactivitystringrequired The activity performed by the actor Value:"experiences_management_settings_page_viewed" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
export fail | An export failed See event objectactivitystringrequired The activity performed by the actor Value:"export fail" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
Export recommendations | Recommendations were exported See event objectactivitystringrequired The activity performed by the actor Value:"Export recommendations" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
export success | An export succeeded See event objectactivitystringrequired The activity performed by the actor Value:"export success" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
export_users_list_csv_download | An admin downloaded an exported user list See event objectactivitystringrequired The activity performed by the actor Value:"export_users_list_csv_download" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
export_users_list_csv_request | An admin requested a user-list export See event objectactivitystringrequired The activity performed by the actor Value:"export_users_list_csv_request" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
external_connection_create | An admin created an external connection configuration See event objectactivitystringrequired The activity performed by the actor Value:"external_connection_create" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
external_connection_delete | An admin deleted an external connection configuration See event objectactivitystringrequired The activity performed by the actor Value:"external_connection_delete" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
external_connection_export | An admin exported an external connection configuration See event objectactivitystringrequired The activity performed by the actor Value:"external_connection_export" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
external_connection_import | An admin imported an external connection configuration See event objectactivitystringrequired The activity performed by the actor Value:"external_connection_import" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
external_connection_reload | An admin reloaded external connection configurations See event objectactivitystringrequired The activity performed by the actor Value:"external_connection_reload" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
external_connection_update | An admin updated an external connection configuration See event objectactivitystringrequired The activity performed by the actor Value:"external_connection_update" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
face_auth_face_unregistered | An admin removed a user's enrolled face See event objectactivitystringrequired The activity performed by the actor Value:"face_auth_face_unregistered" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
force import fail | A forced import failed See event objectactivitystringrequired The activity performed by the actor Value:"force import fail" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
force import success | A forced import succeeded See event objectactivitystringrequired The activity performed by the actor Value:"force import success" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
Get list | A list was retrieved See event objectactivitystringrequired The activity performed by the actor Value:"Get list" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
Get lists | Lists were retrieved See event objectactivitystringrequired The activity performed by the actor Value:"Get lists" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
Get network membership status | Network membership status was retrieved See event objectactivitystringrequired The activity performed by the actor Value:"Get network membership status" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
image_uploaded | A verification image was saved to the session See event objectactivitystringrequired The activity performed by the actor Value:"image_uploaded" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
import fail | An import failed See event objectactivitystringrequired The activity performed by the actor Value:"import fail" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
import success | An import succeeded See event objectactivitystringrequired The activity performed by the actor Value:"import success" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
journey_create | An admin created a journey See event objectactivitystringrequired The activity performed by the actor Value:"journey_create" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
journey_delete | An admin deleted a journey See event objectactivitystringrequired The activity performed by the actor Value:"journey_delete" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
journey_duplicate | An admin duplicated a journey See event objectactivitystringrequired The activity performed by the actor Value:"journey_duplicate" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
journey_export | An admin exported a journey See event objectactivitystringrequired The activity performed by the actor Value:"journey_export" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
journey_import | An admin imported a journey See event objectactivitystringrequired The activity performed by the actor Value:"journey_import" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
journey_update | An admin updated a journey See event objectactivitystringrequired The activity performed by the actor Value:"journey_update" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
keys_delete | An admin deleted local identity keys See event objectactivitystringrequired The activity performed by the actor Value:"keys_delete" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
keys_download | An admin downloaded a local identity certificate See event objectactivitystringrequired The activity performed by the actor Value:"keys_download" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
keys_export | An admin exported a local identity key See event objectactivitystringrequired The activity performed by the actor Value:"keys_export" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
keys_generate | An admin generated a local identity key See event objectactivitystringrequired The activity performed by the actor Value:"keys_generate" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
keys_import | An admin imported a local identity key See event objectactivitystringrequired The activity performed by the actor Value:"keys_import" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
keys_revoke | An admin revoked a local identity key See event objectactivitystringrequired The activity performed by the actor Value:"keys_revoke" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
keys_upload | An admin uploaded a local identity key See event objectactivitystringrequired The activity performed by the actor Value:"keys_upload" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
partial export fail | A partial export failed See event objectactivitystringrequired The activity performed by the actor Value:"partial export fail" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
partial export success | A partial export succeeded See event objectactivitystringrequired The activity performed by the actor Value:"partial export success" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
partial force import fail | A partial forced import failed See event objectactivitystringrequired The activity performed by the actor Value:"partial force import fail" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
partial force import success | A partial forced import succeeded See event objectactivitystringrequired The activity performed by the actor Value:"partial force import success" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
partial import fail | A partial import failed See event objectactivitystringrequired The activity performed by the actor Value:"partial import fail" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
partial import success | A partial import succeeded See event objectactivitystringrequired The activity performed by the actor Value:"partial import success" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
Push policy to production | A preview policy was pushed to production See event objectactivitystringrequired The activity performed by the actor Value:"Push policy to production" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
read_fraud_entity_data | A fraud entity record was retrieved See event objectactivitystringrequired The activity performed by the actor Value:"read_fraud_entity_data" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
read_fraud_image_data | A fraud-face image was read from storage See event objectactivitystringrequired The activity performed by the actor Value:"read_fraud_image_data" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
read_image_data | A verification session image was read from storage See event objectactivitystringrequired The activity performed by the actor Value:"read_image_data" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
remove_admin | An admin user was removed See event objectactivitystringrequired The activity performed by the actor Value:"remove_admin" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
Remove list items | Items were removed from a list See event objectactivitystringrequired The activity performed by the actor Value:"Remove list items" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
restriction_criteria_added | A restriction criterion was created See event objectactivitystringrequired The activity performed by the actor Value:"restriction_criteria_added" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
restriction_criteria_deleted | A restriction criterion was deleted See event objectactivitystringrequired The activity performed by the actor Value:"restriction_criteria_deleted" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
restriction_criteria_updated | A restriction criterion was updated See event objectactivitystringrequired The activity performed by the actor Value:"restriction_criteria_updated" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
scim | A user was created through the Admin Portal or a management app See event objectactivitystringrequired The activity performed by the actor Value:"scim" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
search_multiple_session_detector_data | A multiple-session detector search was run on a verification image See event objectactivitystringrequired The activity performed by the actor Value:"search_multiple_session_detector_data" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
security_insight_added | A security insight was published See event objectactivitystringrequired The activity performed by the actor Value:"security_insight_added" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
session_deleted | A verification session was deleted See event objectactivitystringrequired The activity performed by the actor Value:"session_deleted" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
sub_journey_create | An admin created a sub-journey See event objectactivitystringrequired The activity performed by the actor Value:"sub_journey_create" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
sub_journey_delete | An admin deleted a sub-journey See event objectactivitystringrequired The activity performed by the actor Value:"sub_journey_delete" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
sub_journey_duplicate | An admin duplicated a sub-journey See event objectactivitystringrequired The activity performed by the actor Value:"sub_journey_duplicate" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
sub_journey_export | An admin exported a sub-journey See event objectactivitystringrequired The activity performed by the actor Value:"sub_journey_export" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
sub_journey_import | An admin imported a sub-journey See event objectactivitystringrequired The activity performed by the actor Value:"sub_journey_import" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
sub_journey_update | An admin updated a sub-journey See event objectactivitystringrequired The activity performed by the actor Value:"sub_journey_update" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
update_app | An app was modified See event objectactivitystringrequired The activity performed by the actor Value:"update_app" additional_paramsobject or null Additional parameters for this event. tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
Update list | A list was updated See event objectactivitystringrequired The activity performed by the actor Value:"Update list" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
Update network membership | Network membership was updated See event objectactivitystringrequired The activity performed by the actor Value:"Update network membership" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
Update rule | A rule was updated See event objectactivitystringrequired The activity performed by the actor Value:"Update rule" tenant_idstring The unique ID of the tenant ipstring or null The IP address of the actor user_agentstring or null The user agent string of the actor's device actor_idstring or null The unique ID of the actor that performed the event actor_typestring The type of the actor Enum:"user""app" target_resource_idstring or null The target resource affected by the activity target_resource_typestring or null The type of the target resource affected by the activity Enum:"user""app""tenant" activity_idstring The unique ID of the activity timestampstring, (date-time) The date and time the event occurred (ISO 8601) app_idstring or null The unique ID of the application that generated the audit event original_actor_idstring The hashed value of the actor ID before enrichment |
validate fail | A validation failed See event objectactivitystringrequired The activity performed by the user Value:"validate fail" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |
validate success | A validation succeeded See event objectactivitystringrequired The activity performed by the user Value:"validate success" additional_paramsobject Additional parameters for this event. tenant_idstring The unique ID of the tenant activity_idstring The unique ID of the activity app_idstring or null The unique ID of the application that generated the audit event user_idstring or null The unique ID of the user who performed the activity correlation_idstring or null A correlation ID that links related events ipstring or null The IP address of the user user_agentstring or null The user agent string of the user's device timestampstring, (date-time) The date and time the event occurred (ISO 8601) original_app_idstring The hashed value of the app ID before enrichment original_user_idstring The hashed value of the user ID before enrichment invocation_idstring or null The unique ID of the invocation step_invocation_idstring or null The unique ID of the step invocation |