Tenant Log Event Type Reference

actions_execution_failed

Execution of an Action failed

f

Failed Login This is only emitted if the error is not covered by the `fp` or `fu` log types

fcoa

Failed Cross-Origin Authentication

fens

Failed exchange for Native Social Login

fp

Failed login due to invalid password

fu

Failed login due to invalid username

organization_access_denied

Organization Access Denied A login or token request was blocked because the organization is not allowed to use the application.

scv

Successful Credential Validation.

w

A warning has happened during a login flow

s

Successful Login

scoa

Successful Cross-Origin Authentication

sdel

Successful Delegated Login

sens

Successful Exchange - Native Social Login

federated_logout_failed

Failed to logout of the upstream Identity Provider

flo

Failed Logout

oidc_backchannel_logout_failed

Failed OIDC Back-Channel Logout request

universal_logout_failed

Failed Universal Logout request

oidc_backchannel_logout_succeeded

Successful OIDC Back-Channel Logout request

slo

Successful Logout

universal_logout_succeeded

Successful Universal Logout request

fs

Failed Signup

ss

Successful Signup

fdelsa

Failed Delegated Silent Authentication

fsa

Failed Silent Auth

sdelsa

Successful Delegated Silent Authentication

ssa

Successful Silent Auth

ciba_exchange_failed

Failed CIBA Exchange

failed_on_behalf_of_token_exchange

Failed Exchange via On-Behalf-Of Token Exchange

fdeleacft

Failed to Exchange Delegated Authorization Code for Access Token

feacft

Failed to Exchange Authorization Code for Access Token

feccft

Failed exchange of Access Token for a Client Credentials Grant

fecte

Failed Exchange via Custom Token Exchange

fede

Failed to exchange Device Code for Access Token

feoobft

Failed exchange of Password and OOB Challenge for Access Token

feotpft

Failed exchange of Password and OTP Challenge for Access Token

fepft

Failed exchange of Password for Access Token

fepotpft

Failed exchange of Passwordless OTP for Access Token

fercft

Failed Exchange of Password and MFA Recovery Code for Access Token

ferrt

Failed Exchange of Rotating Refresh Token. This could occur when reuse is detected.

fertft

Failed Exchange of Refresh Token for Access Token. This could occur if the refresh token is revoked or expired.

idjag_exchange_failed

Failed Exchange of Identity Assertion Authorization Grant JWT for Access Token

jwt_bearer_exchange_failed

Failed Exchange of JWT Bearer Assertion for Access Token

ciba_exchange_succeeded

Successful CIBA Exchange

feta

Failed token exchange at Token Vault

idjag_exchange_succeeded

Successful Exchange of Identity Assertion Authorization Grant JWT for Access Token

sdeleacft

Successful Exchange of Delegated Authorization Code for Access Token

seacft

Successful Exchange of Authorization Code for Access Token

seccft

Successful Exchange of Access Token for a Client Credentials Grant

secte

Successful Exchange via Custom Token Exchange

sede

Successful Exchange of Device Code for Access Token

seoobft

Successful Exchange of Password and OOB Challenge for Access Token

seotpft

Successful Exchange of Password and OTP Challenge for Access Token

sepft

Successful Exchange of Password for Access Token

sepkoobft

Successful Exchange of Passkey and OOB Challenge for Access Token

sepkotpft

Successful Exchange of Passkey and OTP Challenge for Access Token

sepkrcft

Successful Exchange of Passkey and MFA Recovery Code for Access Token

sercft

Successful Exchange of Password and MFA Recovery Codeode for Access Token

sertft

Successful Exchange of Refresh Token for Access Token

seta

Successful token exchange at Token Vault

success_on_behalf_of_token_exchange

Successful Exchange via On-Behalf-Of Token Exchange

gd_email_settings_update

Email factor settings were updated

gd_phone_settings_update

Phone (SMS) factor settings were updated

mgmt_api_read

Successful GET request on the management API. This event will only be emitted if a secret is returned.

sapi

Successful API Operation Only emitted by the Management API on POST, DELETE, PATCH, and PUT

acls_summary

Shows the summary of the network ACLs matches for a period of time

ciba_start_failed

Failed CIBA Start

ciba_start_succeeded

Successful CIBA Start

cls

Passwordless Login Code/Link Sent

fco

Failed due to CORS. Is the origin in the Allowed Origins list for the specified application?

fdeac

Failed Device Confirmation - Device Activation Failure

fi

Failed to accept a user invitation. This could happen if the user accepts an invitation using a different email address than provided in the invitation, or due to a system failure while provisioning the invitation.

flows_execution_completed

Flows Execution Completed

flows_execution_failed

Flows Execution Failed

forms_submission_failed

Forms Submission Failed

forms_submission_succeeded

Forms Submission Succeeded

fpar

Failed Push Authorization Request

fpurh

Failed Post User Registration Hook

gd_auth_email_verification

Email verification completed successfully

gd_auth_failed

Multi-factor authentication failed. This could happen due to a wrong code entered for SMS/Voice/Email/TOTP factors, or a system failure.

gd_auth_rejected

User rejected a multi-factor authentication request via push-notification

gd_auth_succeed

Multi-factor authentication success.

gd_otp_rate_limit_exceed

A user, during enrollment or authentication, enters an incorrect code more than the maximum allowed number of times. Ex: A user enrolling in SMS enters the 6-digit code wrong more than 10 times in a row.

gd_recovery_failed

A user entered a wrong Recovery Code when attempting to authenticate

gd_recovery_succeed

Multi-factor recovery code succeeded authorization

gd_send_email

MFA email sent successfully

gd_send_email_verification

Verification email sent successfully

gd_send_pn

Push notification for MFA sent successfully sent

gd_send_pn_failure

Push notification for MFA failed

gd_send_sms

SMS for MFA successfully sent.

gd_send_sms_failure

SMS for MFA failed

gd_send_voice

Voice call for MFA succeeded

gd_send_voice_failure

Voice call for MFA failed

gd_start_auth

Second factor authentication event started for MFA.

gd_start_enroll_failed

Multi-factor authentication enroll has failed

gd_tenant_update

Multi-factor tenant settings updated

gd_webauthn_challenge_failed

WebAuthn browser failure

gd_webauthn_enrollment_failed

WebAuthn browser Enrollement Failure

kms_key_management_failure

Failed KMS API operation

kms_key_management_success

Successful KMS API operation

kms_key_state_changed

KMS key state change

limit_sul

A user is temporarily prevented from logging in because they reached the maximum logins per time period from the same IP address

mfar

A user has been prompted for multi-factor authentication (MFA). When using Adaptive MFA, Auth0 includes details about the risk assessment

organization_member_added

Organization Member Added Operation

passkey_challenge_failed

A native passkey challenge failed

passkey_challenge_started

A native passkey challenge was successfully initiated

pla

Generated before a login and helps in monitoring the behavior of bot detection without having to enable it.

pwd_leak

Someone behind the IP address ip attempted to login with a leaked password

reset_pwd_leak

Someone behind the IP address ip attempted to reset with a leaked password

resource_cleanup

Emitted when resources exceeding defined limits were removed. Normally related to refresh tokens

rich_consents_access_error

Error fetching a Rich Consent record

si

Successfully accepted a user invitation

signup_pwd_leak

Someone behind the IP address ip attempted to signup with a leaked password

wn

Warning Notification

wum

A warning has happened during user management related tasks

fscim

Failed SCIM Operation

sscim

Successful SCIM Operation

acul_sdk_notice

ACUL SDK Notification

api_limit

The maximum number of requests to the Authentication or Management APIs in given time was reached

api_limit_warning

The limit of requests to the Authentication or Management APIs in given time is about to be reached

appi

API Peak Performance Rate is initiated

custom_domain_verification_failed

Failed to Verify the Custom Domain

depnote

Deprecation Notice

directory_sync_completed

Directory synchronization has completed

directory_sync_failed

Directory synchronization has failed

directory_sync_started

Directory synchronization has started

fcpro

Failed to provision a AD/LDAP connector

fui

Failed to import users

limit_delegation

A user is temporarily prevented from logging in because of too many delegation requests

limit_mu

An IP address is blocked because it attempted too many failed logins without a successful login. Or an IP address is blocked because it attempted too many sign-ups, whether successful or failed.

limit_phone

A user is temporarily prevented from sending more SMS messages or voice calls because they reached the maximum allowed in a given time period

limit_signup_otp

A signup verification code was not sent because the identifier's send budget was exceeded. The budget is scoped to the tenant, identifier and connection, independently of the IP address.

limit_wc

An IP address is blocked because it reached the maximum failed login attempts into a single account.

connected_accounts_connection_failed

User failed to connect a third-party account

connected_accounts_delete_failed

User failed to delete a connected third-party account

fce

Failed to change user email

fcp

Failed Change Password

fcph

Failed Post Change Password Hook

fcpn

Failed Change Phone Number

fcpr

Failed Change Password Request

fcu

Failed to change username

fd

Failed to generate delegation token

fdeaz

Failed Device Confirmation - Request Failure

fdecc

Failed Device Confirmation - User Canceled

fdu

Failed User Deletion

fn

Failed Notification

fv

Failed to send verification email

fvr

Failed to proces verification email request

my_account_authentication_method_failed

Failed authentication method operation in My Account API

ss_sso_failure

Failed Self-Service Single Sign-On Operation Only emitted by snake-server

cs

Passwordless Login Code Sent

gd_enrollment_complete

A first time MFA user has successfully enrolled using one of the factors

gd_start_enroll

Multi-factor authentication enroll has started.

gd_unenroll

Device used for second factor authentication has been unenrolled

gd_update_device_account

Device used for second factor authentication has been updated.

ss_sso_info

Information from a Self-Service Single Sign-On Operation Only emitted by snake-server

ublkdu

User block setup by anomaly detection has been released

connected_accounts_connection_succeeded

User successfully connected a third-party account

connected_accounts_delete_succeeded

User successfully deleted a connected third-party account

my_account_authentication_method_succeeded

Successful authentication method operation in My Account API

sce

Successful Change Email

scp

Successful Change Password

scpn

Successful Change Phone Number

scpr

Successful Change Password Request

scu

Successful Change Username

sd

Successful Delegation

sdu

Successful User Deletion

srrt

Successfully revoked a refresh token

ss_sso_success

Successful Self-Service Single Sign-On Operation Only emitted by snake-server

sui

Successful Users Import

sv

Successfully consumed email verification link

svr

Successfully called verification email endpoint. Verification email has been queued for sending.