Security audit log event reference

Every action that matters for security or for accountability writes one event to the audit log: a sign-in, a refusal, a change an administrator makes, a certificate, a tunnel, a remote session. This page lists the event names you meet in the log, in an export and in a webhook delivery, grouped by area. How to search, export and verify the log is in Audit log; how to forward events as they happen is in Webhooks.

1. What every event carries

Field	Meaning
`event_id`	One identifier per event.
`event_type`	The event name, as listed on this page, for example `login.failed`.
`result`	`success`, `failure` or `denied`. A refused action is `denied`; something that went wrong is `failure`.
`created_at` (`occurred_at` in a webhook delivery)	When it happened, in UTC.
`correlation_id`	The reference of the request that caused it. The same value appears on an error page and in the console’s “The server refused to …” messages, and the audit log can be filtered by it.
`actor_username` (`actor` in a webhook delivery)	Who did it, when a signed-in person did it. Absent for an action of SSOGEN itself or of a Gateway.
`user_id` (`subject_id` in a webhook delivery)	The account the event is about, when there is one.
`client_ip`	The address the request came from, when known.

Each event also carries details of its own, such as the application, the reason code or the Gateway instance. The details are bounded in size and never include a password, a one-time code, a recovery code, an authorization code, a token, a cookie, a private key or an identity provider’s full assertion.

An event name reads area.object.action. The area is the first part; the tables below follow it.

Event	Recorded when
`login.failed`	A sign-in with a password or passkey was refused. Carries the username as it was typed and a reason code; never the password.
`authentication.succeeded`	A sign-in succeeded.
`authentication.risk_scored`	A sign-in was given its risk score: the score, its reason codes and the scorer version. No address, network or device detail.
`authentication.second_step_skipped`	The second step was waived on a remembered browser.
`authentication.device_remembered`, `authentication.device_forgotten`	A browser was remembered for the second factor, or forgotten.
`authentication.device_marker_sibling`	A sign-in was taken for the remembered browser’s sibling rather than a copy: begun before the marker’s rotation it matches, within 15 seconds, from the same address. Every one is recorded.
`authentication.mapping_incomplete`	A federated sign-in could not be matched to an account because a required attribute was missing.
`authentication.directory_unavailable`	The directory a sign-in needed did not answer.
`authentication.federation_failed`	A sign-in through an identity provider failed.
`authentication.kerberos_refused`	A Windows desktop sign-in was refused.
`authentication_policy.passkey_refused`	A passkey was offered where the policy does not accept one.
`identity_connection.admission_refused`	A connection’s admission rule refused a sign-in or a Test before the account was linked, joined or provisioned: the connection, the reason and the claim name, never its value.
`sign_in.context_refused`	A sign-in step named an application other than the one it continues, or one with no sign-in in progress.
`sign_in.federated_parked`, `sign_in.federated_completed`, `sign_in.federated_refused`	A federated sign-in was parked waiting for a step, then completed or refused.
`mfa.challenge_started`, `mfa.verified`, `mfa.rejected`	A second-factor challenge was started, passed or failed.
`mfa.sign_in_enrolment_opened`, `…_completed`, `…_refused`, `…_canceled`	Set-up of a second factor at sign-in was opened, finished, refused by the policy or abandoned.
`mfa.lost_phone_recovery_verified`	A person passed the lost-phone step-up for changing their own second factors, with an email code and a text-message code together.
`mfa.reset_by_admin`	An administrator reset a person’s second factors.
`second_factor.removal_refused`	The removal of a second factor was refused because it would leave no Super Admin able to open the Admin Console.
`webauthn.registered`	A passkey was registered.
`webauthn.revoked`	A passkey was removed by the person, or one event per passkey when every factor was revoked by Reset MFA or by break-glass recovery.
`recovery_codes.rotated`	A new set of recovery codes was issued.
`otp.sent`, `otp.verified`, `otp.rejected`	A one-time code was sent by email or text message, accepted or rejected.
`sign_in_contact.verified`, `sign_in_contact.changed`	An email address or phone number used for codes was verified or changed.
`email_link.sent`, `email_link.used`, `email_link.rejected`, `email_link.refused`, `email_link.code_limit_reached`	A sign-in link was emailed, used, rejected, refused by the policy, or not sent because the limit of codes was reached.
`phone_sign_in.started`, `phone_sign_in.refused`	A sign-in by phone number started or was refused.
`local_password.user_change`	A person changed their own password.
`local_password.admin_set`, `local_password.admin_set_force_change`	An administrator set a person’s password, with or without forcing a change at next sign-in.
`local_password.self_reset`	A person reset their password through the forgotten-password flow.
`break_glass.recovered`	The break-glass command on the server recovered an administrator. See Break-glass and recovery.
`totp.enrollment_mode_override_changed`	The authenticator-app set-up mode of one account was overridden.

Authenticator app and push (the SSOGEN Authenticator): authenticator.enrollment_started, authenticator.enrollment_completed, authenticator.enrollment_failed, authenticator.device_revoked, authenticator.device_renamed, authenticator.push_token_updated, authenticator.push_requested, authenticator.push_delivery_failed, authenticator.push_approved, authenticator.push_denied, authenticator.push_number_mismatch, authenticator.push_reported, authenticator.push_expired, authenticator.push_canceled, authenticator.push_suspended, authenticator.push_suspension_cleared, authenticator.proof_rejected, authenticator.settings_changed, authenticator.push_provider_changed, authenticator.push_provider_tested, authenticator.push_delivery_changed. The name states the action: push_number_mismatch is a tap on the wrong number, push_reported is a request the person reported, push_suspended is push paused for an account.

Names in this area whose meaning is their name: totp.enrolled, totp.revoked, authentication.device_marker_replayed, authentication.failover_used, identity_migration.account_linked, identity_migration.link_conflict, mfa.locked, password_reset.email_otp_blocked.

3. Identity providers and OAuth clients

Event	Recorded when
`saml.slo.accepted`, `saml.slo.rejected`	A SAML single-logout request or response was accepted or rejected.
`oauth.client.authentication_failed`	An OAuth or OpenID Connect client failed to authenticate itself.
`oauth.client.keys_changed`	A client’s public keys were changed.
`oauth.client.secret_rotated`	A client secret was rotated.
`oauth.client_credentials.issued`	A token was issued to a client with its own credentials.
`oauth.refresh_family.created`, `oauth.refresh_family.revoked`	A refresh-token family began or was revoked.
`oidc.backchannel_logout.sent`, `oidc.backchannel_logout.failed`	A back-channel logout was sent to an application, or could not be.

4. Sessions

Event	Recorded when
`platform.session.revoked`	A person’s SSOGEN session was revoked.
`remote_session.authorized`	A remote session was authorized for a person; see section 8.

5. Applications and policies

Event	Recorded when
`application.access_refused`	A person was refused an application they tried to open.
`application.principal_unavailable`	An application could not be opened because the attribute it uses to identify the person was empty.
`application.tested`	An administrator ran Test on an application.
`application.assignment.added`, `application.assignment.removed`	A person or group was assigned to an application, or removed from it.
`application.assignment_required.changed`	Whether an application requires an assignment was changed.
`application.output_mapping.replaced`	The attributes an application receives were changed.
`application.principal_attribute.changed`	The attribute that identifies the person to the application was changed.
`application.roles_changed`	The roles an application receives for a person were changed.
`application.form_fill_account_set`, `application.form_fill_account_cleared`	A shared form-fill account was stored or removed.
`application.form_fill_settings_changed`	An application’s form-fill settings were changed.
`application.person_credential_saved`, `…_removed`, `…_needs_update`	A person saved or removed their own sign-in for a form-fill application, or SSOGEN marked it as needing an update after the application rejected it.
`policy.decision`	A policy decided a launch or a sign-in.
`policy.what_if_evaluated`	An administrator ran a what-if evaluation of a policy.
`policy.rules_changed`	A policy’s rules were changed.
`policy.migrated`	A policy was converted to the current format.
`policy.monitor_started`, `policy.monitor_observed`, `policy.monitor_promoted`, `policy.monitor_stopped`, `policy.monitor_ended`	A policy in monitor mode started, recorded what it would have decided, was promoted to enforce, was stopped, or reached its end.
`policy.network_zone_changed`	A network zone was changed.
`apppack.installed`	An App Pack was installed.
`apppack.revision_disabled`	A revision of an App Pack was disabled.
`apppack.publisher_key_added`, `apppack.publisher_key_removed`	A publisher key that App Packs are verified with was added or removed.
`apppack.verification_failed`	An App Pack’s signature did not verify.

Names in this area whose meaning is their name: application.created, application.updated, application.deleted, application.provisioning_changed, application.provisioning_run, application.provisioning_account_deactivated, saml_sp.metadata_previewed.

6. Web Agents and Gateways

Event	Recorded when
`agent.key.issued`, `agent.key.regenerated`, `agent.key.revoked`	A Web Agent application’s agent key was issued for the first time, regenerated (the previous key kept for the chosen time), or revoked at once.
`agent.credential_refused`	A Web Agent presented a credential SSOGEN did not accept.
`agent.workload_proof.refused`	A Web Agent’s proof of identity was refused.
`agent.enrollment.revoked`	A Web Agent enrolment was revoked.
`edge.enrolment_refused`	A Gateway enrolment was refused, with a reason; `over_max_instances` when more than 256 enrolments, live or revoked, were made within a day.
`edge.event_reported`	A Gateway reported an event of its own to SSOGEN.
`gateway.grant_issued`	SSOGEN issued a Gateway the short-lived grant that opens an application for a person.
`gateway.session_ended`	A Gateway session ended.
`gateway.backend_sign_in_released`, `gateway.backend_sign_in_withheld`	The sign-in a Gateway performs towards an application was released, or withheld.
`gateway_route.backend_sign_in_changed`, `gateway_route.credential_destination_changed`	A route’s application sign-in settings, or where its credential goes, were changed.
`gateway.form_fill_capture_offered`, `…_consented`, `…_stored`	A person was offered to let SSOGEN capture their sign-in to an application, agreed, and the sign-in was stored.
`gateway.ingress_changed`	A Gateway group’s listeners or hostnames were changed.
`gateway.ingress_withheld`	A route that needs listener settings was held back from a Gateway group whose Gateways are older than those settings need.
`gateway.connector_addresses_changed`	The Connector addresses a Gateway group admits were changed.
`gateway.uplink_changed`	A Gateway group’s uplink was changed.
`gateway.certificate_uploaded`, `gateway.certificate_rotated`, `gateway.certificate_deleted`	An App Proxy certificate was added, replaced or removed.
`gateway.certificate_expiring`	An App Proxy certificate reached 30, 14, 7 or 1 day before expiry; one event per threshold.
`gateway.route_set_uncompilable`	A Gateway group’s set of routes could not be turned into a configuration.
`gateway.mcp_route_withheld`	A route was left out of a Gateway group’s configuration because its application is an MCP resource that configuration cannot carry.
`gateway.route_withheld_by_rule`	A saved route was left out of a Gateway group’s configuration because it breaks a route rule added after it was saved.
`gateway.cross_group_write_refused`	A Gateway’s report named a grant or a group other than its own; refused, and recorded at most once a minute per instance.
`edge.tunnel.up`, `edge.tunnel.down`	A tunnel from an Outbound Connector, or a Gateway’s uplink, connected or disconnected.
`edge.tunnel.refused`, `edge.tunnel.recheck_failed`, `edge.tunnel.stream_refused`	A tunnel handshake was refused, a connected tunnel failed its periodic re-check, or a stream inside a tunnel was refused.
`edge.tunnel.alarm_raised`, `edge.tunnel.alarm_cleared`	A tunnel SSOGEN expects (a connector group admitted by a Gateway group, or a Gateway’s uplink) was missing for longer than the grace period, or came back.
`edge.certificate.acme_failed`	An automatic certificate order for a Gateway group failed.
`edge.certificate.unexpected_issuance`	A certificate for one of your hostnames was issued that SSOGEN did not order.

Names in this area whose meaning is their name: agent.enrolled, agent.enrollment_token.minted, agent.enrollment_token.revoked, agent.certificate.rotated, edge.enrolment_token_used, edge.ingress_credential_issued, edge.instance_enrolled, edge.instance_revoked, edge.configuration_withheld, edge.grants_revoked, gateway.revocation_coalesced.

7. Administration, directory and provisioning

Event	Recorded when
`admin.elevation_issued`	An administrator entered the Admin Console.
`admin.console_policy_created`	The Admin Console’s own sign-in policy was created.
`admin.target_action_refused`	An administrator tried to change an account that holds a role they cannot assign.
`platform_log.viewed`	An administrator was shown the newest lines of a server’s log in the console: which log and how many lines.
`audit.integrity_verified`	A full verification of the audit log’s hash chain ran, by an administrator or by the daily schedule; `result` says whether it passed.
`audit.integrity_failed`	A verification failed. Written in the log it concerns; it cannot be removed.
`audit.segment.archived`	The oldest part of the audit log was exported and removed, as retention requires.
`audit.retention_changed`	The retention period was changed.
`audit.retention_started`, `audit.retention_completed`, `audit.retention_skipped`, `audit.retention_failed`	A retention run started, finished, was skipped or failed.
`audit.anchor_adopted`, `audit.anchor_adoption_refused`	An administrator adopted the log’s archive anchor after a full verification held from it, or the adoption was refused.
`branding.changed`	The sign-in page’s branding was changed.
`identity_connection.created`, `…_activated`, `…_enabled`, `…_disabled`, `…_rolled_back`, `…_archived`, `…_deleted`	An identity connection (directory or identity provider) moved through its lifecycle.
`identity_connection.tried`, `identity_connection.try_unclaimed`	An administrator ran Test on a connection; or a Test’s outcome arrived in a browser other than the one that started it and was discarded unseen.
`identity_connection.directory_diagnosed`	An administrator ran the directory diagnosis.
`identity_connection.new_people_changed`, `…_sign_in_domains_changed`, `…_upstream_mfa_changed`, `…_attribute_release_changed`, `…_account_matching_changed`, `…_reordered`	A setting of a connection was changed: what happens with new people, its sign-in domains, whether the identity provider’s own second factor counts, which attributes it releases, how accounts are matched, or its order.
`identity_connection.health_changed`	SSOGEN moved a connection between health states.
`directory.user.created`, `…_profile_updated`, `…_enabled`, `…_disabled`, `…_locked`, `…_archived`, `…_deleted`	An account was created or changed in the console or by a sync. `directory.user.created` says how the account was made: by an administrator, by a CSV import, by an identity connection, or by sign-up.
`directory.users.imported`	Accounts were imported from a file.
`directory.reconciled`	A directory reconciliation ran.
`directory.sync.started`, `directory.sync.halted`, `directory.sync.failed`, `directory.sync.schedule_changed`	A directory sync ran, was halted, failed, or had its schedule changed.
`directory.user.provisioned`, `directory.user.deprovisioned`	A SCIM client created or updated an account, or deactivated or removed one. A deactivation that would leave no Super Admin is `denied` with reason `would_strand_administrators`.
`directory.group.member_added`, `directory.group.deleted`	A group gained a member, or was deleted.
`scim_client.issued`, `scim_client.revoked`	A SCIM client token was issued or revoked. See SCIM reference.
`directory_bridge.connection_tested`, `directory_bridge.changed`	The Directory Connector was tested or changed.
`authentication_policy.created`, `…_updated`, `…_deleted`, `…_assigned`, `…_tested`	A sign-in policy was created, changed, deleted, assigned or tested.
`authentication_policy.change_refused`	A policy save was refused because of the administrator’s role; nothing was stored.
`authentication_policy.sign_in_enrolment_migrated`	Once, at the first start after the upgrade that moved the set-up-at-sign-in switch into the policies.
`platform.bootstrap.attempt_superseded`	A first-run setup attempt was replaced by a newer one.

Names in this area whose meaning is their name: authentication_policy.failover_started, authentication_policy.failover_ended, identity_migration.created, identity_migration.cohort_stage_changed, identity_migration.completed, profile_attribute.defined, profile_attribute.deleted, platform.bootstrap.admin_created, platform.bootstrap.activated.

8. Remote Access and Secure Access

Events written by SSOGEN:

Event	Recorded when
`remote_access.requested`, `…_approved`, `…_denied`, `…_cancelled`, `…_expired`, `…_revoked`	A request for remote access was made and then decided, withdrawn, ran out or was revoked.
`remote_access.policy_changed`	The remote access policy was changed.
`remote_access.endpoint_changed`, `remote_access.endpoint_removed`	The address browsers send a Gateway group’s remote sessions to was set, changed or removed.
`remote_resource.changed`	A Remote Access resource was changed.
`remote_resource.capability_changed`	A capability (clipboard, file transfer) was turned on, off or changed, with a reason.
`remote_resource.probe_requested`	An administrator pressed Pair or Test for a host.
`remote_resource.host_trusted`	A host’s key or certificate was trusted.
`remote_resource.host_trust_downgraded`	A resource was saved so that its host is no longer verified; the console asks for confirmation first.
`remote_resource.credential_set`, `remote_resource.credential_removed`	A stored account was saved or removed.
`remote_resource.credential_cleared`	A stored password was cleared because the host’s identity changed.
`remote_resource.credential_released`	A stored account was released to the Gateway for one session.
`remote_resource.key_generated`	An SSH key was generated for a resource.
`remote_session.terminate_requested`	An administrator ended a session.
`remote_session.duplicate_use_reported`	A second Gateway instance reported accepting a one-use session authorization already accepted elsewhere in its group.
`remote.target.observed`	A Pair or Test probe observed the target’s fingerprint. No credential was sent.

Events a Gateway reports:

Event	Recorded when
`remote.session.authorized`, `remote.session.denied`	A session was authorized or denied. A denial can carry `cause=no-credential` (no stored account) or `cause=credential-unavailable` (the account could not be released).
`remote.session.target_connected`, `…_identified`, `…_authenticated`, `remote.session.started`, `remote.session.resized`, `remote.session.ended`	The session’s steps from connection to end.
`remote.session.target_auth_failed`	The target refused the account.
`remote.session.protocol_failed`	The session failed, with its cause: `worker-gone`, `worker-start`, `worker-protocol`, `target-closed`, `target-protocol`, `engine-configuration` or `unclassified`.
`remote.session.revoked`	A running session was revoked.
`remote.ssh.hostkey_mismatch`, `remote.rdp.certificate_mismatch`, `remote.vnc.certificate_mismatch`	The host did not present the key or certificate that is pinned.
`remote.clipboard.transferred`, `remote.file.transferred`	The clipboard or a file was transferred.
`remote.capability.refused`	A transfer the resource does not allow was attempted.
`remote.file.partials_swept`	A session start removed stale partial uploads older than 24 hours; counts only, no file names.

9. Security settings, secrets and webhooks

Event	Recorded when
`token_replay.detected`	A refresh token that had already been rotated was presented again; its whole family was revoked. The client and the family are recorded, never the token.
`security_setting.changed`	A security setting was changed.
`password_policy.changed`	The password policy was changed.
`secret.created`, `secret.replaced`, `secret.deleted`	A stored secret was created, replaced or deleted; recorded by the secret’s identifier.
`secret.key_rotated`	An administrator re-encrypted the stored secrets under a new master key.
`secret.owned_created`, `…_replaced`, `…_removed`, `…_released`	A secret that belongs to one object (a route, a connection) was created, replaced, removed, or released to the component that uses it.
`trusted_certificate.added`, `trusted_certificate.removed`	An administrator changed which certificate authorities SSOGEN trusts; recorded by fingerprint.
`directory_password.admin_reset`	An administrator reset a directory account’s password.
`webhook.updated`	A webhook subscription was changed: which settings, never the URL.
`webhook.test_sent`	A test event was sent to a receiver.
`webhook.url_revealed`	A Super Admin was shown a receiver’s full URL, which the list masks.
`nhi_setting.changed`	A setting for AI agents was changed.
`mcp_client.registration_decided`, `mcp_client.registration_policy_changed`	An MCP client registration was decided, or the policy for them was changed.

10. AI agents

nhi.registered, nhi.updated, nhi.owner_changed, nhi.activated, nhi.suspended, nhi.reactivated, nhi.revoked, nhi.expired, nhi.credential_changed, nhi.grant_changed, nhi.kill_switch_changed, nhi.token_issued, nhi.token_refused, nhi.token_exchanged, nhi.delegation_granted, nhi.delegation_revoked, nhi.approval_requested, nhi.approval_decided, nhi.access_decided, nhi.resource_bearer_acknowledged, nhi.resource_binding_changed. Each records, for one registered AI agent, the step its name states: a token issued or refused to it, a decision on access it asked for, a change of its kill switch, and so on.

11. Logos

logo.uploaded, logo.updated, logo.deleted: an application or branding logo was added, replaced or removed.

These events carry no email address, name, code or token. See Invite people and Let people create their own accounts.

Event	Recorded when
`invitation.sent`	An invitation email was sent, from Create user, Resend invitation, a CSV import, or Forgot password? on an account with an open invitation.
`invitation.not_sent`	An invitation email was held by a limit or refused by the mail server. No new link was made, and the link the person holds still works.
`invitation.accepted`	The person set the first password through the invitation link.
`invitation.cancelled`	An administrator chose Cancel invitation.
`registration.requested`	A person asked for an account on Create an account and a sign-up email was due.
`registration.refused`	A sign-up request was refused, with the stage and the reason, for example a reached account limit. A refusal decided before any work is recorded at most once an hour for one entry and reason.
`registration.verified`	The person proved the mailbox with the code or the link.
`registration.approved`, `registration.rejected`	An administrator approved or rejected a waiting request; a rejection carries its reason.
`registration.completed`	The account was created.
`registration.expired`	A request was removed because its link ended or nobody decided it within the approval window.
`registration.deleted`	An administrator deleted a request under Find a sign-up.
`registration.settings_changed`, `registration.entry_changed`	The sign-up settings, or a sign-up entry, were changed.

13. Exporting and forwarding events

Need	Use
Look up one incident	The audit log page’s filters, in particular Correlation id with the reference from an error page.
Hand a selection to someone	Export CSV or Export JSON on the audit log page, up to 1,000 events of the current filter.
Keep a period	The period export, up to 50,000 events as one JSON file.
Feed a SIEM as events happen	A webhook: choose the event names from this page when you create the subscription. A name not in SSOGEN’s catalog is refused.
Prove the log was not altered	Verify integrity on the audit log page, or the daily check; its result is itself an event (`audit.integrity_verified`).

Field names, limits and the file formats are in Audit log; the delivery format, retries and the signature are in Webhooks.