Audit Event Catalog
Docs version v1 (main)Nauthera is pre-1.0, in a design-partner programUpdated
The audit log records a closed set of actions. This page lists all
of them, generated from the server's event catalog; the running server publishes the same
catalog at GET /.
How to read the tables:
- Action is the stable wire name. Actions are never renamed, and the outcome is not
part of the name: a refused sign-in is
auth.sign_in.completedwithoutcome: failure. - Level is the lowest
audit.levelat which the action's successes are recorded. A refusal or a server fault is recorded atsecuritywhatever the level says. mandatory actions are recorded whateverlevelandexcludesay (why); platform actions belong to no organization, so through the API onlyplatform.auditholders see them. - Severity is the default for a success. A refusal is raised to at least
warning. - Metadata is the closed allowlist of keys a record of that action may carry in its
metadata. Nothing outside the list is stored, and no key carries a credential.repeat_count,first_seen_atandlast_seen_atmark actions whose refusals are coalesced.
Catalog
Authentication
Category authentication.
| Action | What it records | Level | Severity | Metadata |
|---|---|---|---|---|
auth.account.locked | An account, or an identifier no account holds, was soft-locked after consecutive failed password verifications. | security, mandatory | warning | identifier client_id limit_scope attempts locked_until |
auth. | Someone verified an email address from a link. | security | notice | cause stage header origin fetch_site |
auth. | Someone asked for a link to verify an email address. | security | info | identifier cause stage header origin fetch_site limit_scope |
auth.invitation.accepted | Someone chose a password from an invitation link. | security | notice | cause stage header origin fetch_site |
auth. | Someone set a new password from a reset link. | security | warning | cause stage header origin fetch_site sessions_revoked |
auth. | Someone asked for a password-reset link. | security | notice | identifier cause stage header origin fetch_site limit_scope |
auth. | A throttle refused an authentication attempt or a request, or its backend failed and it let them through. | security | warning | limit_scope identifier client_id attempts cause error_class window_start window_end count repeat_count first_seen_at last_seen_at |
auth. | A user self-registered a local account, or created one through an identity provider. | security, mandatory | notice | identifier email username client_id pushed mfa_required mfa_rules email_ cause stage rolled_back header origin fetch_site identity_provider |
auth.sign_in.alerted | A user was sent an alert about a sign-in from a new browser or network. | security | notice | new_browser new_network client_id |
auth.sign_in.completed | A user attempted an interactive sign-in, by password or through an identity provider. | security, mandatory | notice | identifier client_id pushed mfa_required amr acr method cause attempts remaining locked_until identifier_attempts stage header origin fetch_site new_browser new_network network_zones mfa_rules mfa_spared identity_provider status upstream_error upstream_mfa member_org |
auth.sign_out.completed | A user signed out of their interactive session. | security | info | sessions_revoked cause |
http. | A request carried a credential over a hop a trusted proxy reported as unencrypted. | security | warning | carried_in repeat_count first_seen_at last_seen_at |
http.forwarding.ignored | Forwarding headers from a peer outside the trusted-proxy list were ignored. | security | warning | headers repeat_count first_seen_at last_seen_at |
http.header.repeated | A request was refused because a single-valued header field was repeated. | security | warning | header repeat_count first_seen_at last_seen_at |
http.request.screened | A request was refused before a handler judged it: its size, its shape, its origin or the cross-site request forgery check. | trace | info | cause violations rejected_values client_id header origin fetch_site repeat_count first_seen_at last_seen_at |
oauth. | A client's authentication at the token, introspection, revocation, pushed-authorization or device-authorization endpoint was refused. | trace | info | client_id cause auth_method registered_auth_method alg key_id audience skew_seconds grant_type |
Sessions
Category session.
| Action | What it records | Level | Severity | Metadata |
|---|---|---|---|---|
oidc. | A front-channel logout page was rendered, asking the browser to call each relying party's logout URI. | security | info | count client_id cause metadata_field |
oidc.logout.initiated | An RP-initiated logout was requested. | write | info | client_id post_logout_redirect_uri redirect_honored redirect_refused cause audience hint |
oidc. | A relying party was recorded as a participant in a login session, making it a back-channel logout target. | security, mandatory | info | client_id sid |
oidc. | A relying party that took part in an ending session was not sent a back-channel logout token. | security | info | client_id sid cause |
oidc. | A back-channel logout token was delivered to a relying party. | security, mandatory | notice | client_id sid status attempts stage cause rp_error endpoint_host duration_ms jti |
session.created | An interactive login session was established. | security | info | amr acr expires_at client_id |
session.history.listed | A page of a user's ended sessions was listed through the admin API. | trace | info | count sort from to cause target_user_id slug |
session.listed | A page of an organization's active sessions was listed through the admin API. | read | info | count sort cause slug |
session.presented | An endpoint that acts for a signed-in user refused the login session a request presented. | trace | info | cause repeat_count first_seen_at last_seen_at |
session.revoked | One or more login sessions were revoked. | security, mandatory | notice | count trigger target_user_id justification |
Multi-factor authentication
Category mfa.
| Action | What it records | Level | Severity | Metadata |
|---|---|---|---|---|
mfa.email.activated | An email factor was activated for an account. | security, mandatory | notice | codes_issued method cause attempts attempts_remaining client_id |
mfa. | A sign-in code was sent to an account's email factor, or the send was refused. | security | info | method cause limit_scope stage client_id |
mfa. | An email factor's enrollment code was sent, or the send was refused. | security | info | method cause limit_scope stage client_id |
mfa.email.revoked | An email factor was removed because the account's address changed. | security, mandatory | warning | trigger method |
mfa.email.verified | An emailed code was answered. | security | info | method cause attempts attempts_remaining client_id |
mfa.factor.locked | A second factor was locked after too many consecutive failed attempts. | security, mandatory | warning | method limit_scope expires_at attempts client_id |
mfa. | A passkey authentication ceremony began for an account. | security | info | method cause client_id |
mfa. | A passkey registration ceremony began for an account. | security | info | method cause client_id |
mfa. | A user declined the offer to add a passkey after a password sign-in. | security | info | method cause client_id |
mfa.passkey.registered | A passkey was enrolled for an account, or a registration was refused. | security, mandatory | notice | codes_issued method cause attempts attempts_remaining client_id |
mfa.passkey.verified | A passkey assertion was answered. | security | info | method cause attempts attempts_remaining client_id |
mfa. | A single-use MFA recovery code was redeemed. | security, mandatory | warning | remaining codes_remaining method cause attempts attempts_remaining client_id |
mfa. | A user confirmed they had stored their recovery codes. | security | info | method cause client_id |
mfa. | A fresh set of MFA recovery codes was issued, invalidating the previous set. | security, mandatory | notice | issued method cause attempts attempts_remaining drift_steps |
mfa. | A second-factor endpoint refused the pending sign-in or session a request presented. | security | info | cause |
mfa.status.read | A user's MFA enrollment status was read. | read | info | — |
mfa.totp.activated | A TOTP factor was activated for an account. | security, mandatory | notice | codes_issued method cause attempts attempts_remaining drift_steps client_id |
mfa.totp.disabled | A TOTP factor was removed from an account. | security, mandatory | warning | trigger method cause attempts attempts_remaining drift_steps |
mfa. | A TOTP enrollment began (a secret was generated but not yet confirmed). | security | info | method cause redisplayed client_id |
mfa.totp.verified | A TOTP challenge was answered. | security | info | method cause attempts attempts_remaining drift_steps client_id |
OAuth and OpenID Connect
Category token.
| Action | What it records | Level | Severity | Metadata |
|---|---|---|---|---|
oauth. | An authorization request was answered: refused, or with a code, a sign-in or a consent prompt. | write | info | client_id scope response_type redirect_uri response_mode pkce_method prompt max_age resource detail_types jkt pushed request_object flow_id result amr acr expires_in cause alg key_id skew_seconds surface |
oauth.consent.decided | A user approved or refused a client's authorization request. | security, mandatory | notice | client_id scope approved resource detail_types pushed resulting_scope expires_at grant_change cause redirect_uri |
oauth.consent.revoked | A user withdrew a client's standing authorization. | security, mandatory | notice | client_id count trigger |
oauth.device.decided | A user approved or denied a device authorization request. | security, mandatory | notice | client_id approved scope resource dpop_bound attempts flow_id |
oauth.device.redeemed | A device_code was redeemed for tokens, ending a device authorization (RFC 8628). | write | info | client_id scope resource dpop_bound flow_id grant_family jkt |
oauth.device.requested | A device authorization was requested (RFC 8628). | write | info | client_id scope resource dpop_bound flow_id cause |
oauth. | A user_code submitted on the device verification page was refused. | security, mandatory | notice | attempts remaining session_ended client_id flow_id stage |
oauth.token.introspected | A token was introspected (RFC 7662). | read | info | active token_type_hint cause grant_family owner_client_id |
oauth.token.issued | An access (and possibly ID) token was issued. | trace | info | grant_type scope token_types expires_in cause audience jkt grant_family consumed owner_client_id reuse_delay_seconds flow_id proof_jkt skew_seconds stage |
oauth.token.presented | An access token presented at a protected resource was refused. | security | warning | client_id audience jkt grant_family cause proof_jkt skew_seconds stage |
oauth.token.refreshed | An access token was renewed with a refresh token. | trace | info | grant_type scope token_types expires_in cause audience jkt grant_family consumed owner_client_id reuse_delay_seconds proof_jkt skew_seconds stage |
oauth.token.revoked | A token was revoked: by the client through /revoke, by the server after a replay, for every grant of a deleted account, or for every refresh token of a session that ended. | security, mandatory | notice | token_type_hint trigger grant_type cause revocation_status grant_family owner_client_id reuse_delay_seconds |
oidc.userinfo.read | The UserInfo endpoint returned claims for an access token. | read | info | scope claims_released subject_status |
Users
Category user.
| Action | What it records | Level | Severity | Metadata |
|---|---|---|---|---|
user.blocked | A user was blocked through the admin API, ending their sessions. | security, mandatory | warning | status cause target_user_id slug justification notified |
user.created | A local user was created through the admin API. | security, mandatory | notice | email username email_verified invited slug cause |
user.deleted | A local user was deleted, cascading to their sessions and factors. | security, mandatory | warning | email username roles target_user_id slug justification |
user.devices.listed | The browsers and networks a user signed in from were listed through the admin API. | read | info | count target_user_id slug |
user.identities.listed | The identity provider accounts linked to a user were listed through the admin API. | read | info | count target_user_id slug |
user.invitation.sent | A user was emailed an invitation to choose a password. | write | notice | cause stage limit_scope target_user_id slug |
user.listed | A page of users was listed through the admin API. | read | info | count sort cause slug |
user. | An administrator required a user to set a new password at their next sign-in. | security, mandatory | notice | cause target_user_id slug justification |
user.password_reset.sent | An administrator emailed a user a password reset link through the admin API. | write | notice | cause stage limit_scope target_user_id slug |
user.password.changed | A user's password was replaced. | security, mandatory | warning | sessions_revoked self_service target_user_id slug justification cause |
user.reactivated | A suspended or blocked user was reactivated through the admin API. | security, mandatory | notice | status target_user_id slug justification notified |
user.read | A single user record was read through the admin API. | read | info | target_user_id slug |
user. | A user's browsers remembered for their second factor were forgotten through the admin API. | security, mandatory | notice | count target_user_id slug justification |
user.suspended | A user was suspended through the admin API, ending their sessions. | security, mandatory | warning | expires_at status cause target_user_id slug justification notified |
user.unlocked | The lock a user's wrong passwords set was released through the admin API. | security, mandatory | notice | count target_user_id slug justification |
user.updated | A local user's profile was updated through the admin API. | write | notice | changed target_user_id slug cause |
Organizations
Category organization.
| Action | What it records | Level | Severity | Metadata |
|---|---|---|---|---|
broker_ | A member organization accepted a broker's invitation, and the broker's clients may sign in its users. | security, mandatory | warning | membership_id side cause slug target_slug ref |
broker_ | A broker changed which of its clients a membership admits. | security, mandatory | warning | membership_id side all_clients client_ids cause slug |
broker_membership.ended | A broker membership was ended, and the broker's clients no longer sign in the member's users. | security, mandatory | warning | membership_id side status cause slug target_slug ref |
broker_ | An organization invited another to let its clients sign in the other's users. | security, mandatory | warning | membership_id side all_clients client_ids cause slug target_slug ref |
broker_membership.listed | An organization's broker memberships were listed through the admin API. | read | info | count slug |
email_domain.claimed | An organization claimed an email domain, pending proof that it owns it. | security, mandatory | notice | domain domain_claim_id cause slug violations |
email_domain.listed | An organization's email domain claims were listed through the admin API. | read | info | count slug |
email_domain.lost | A verified email domain's DNS record was no longer found, and the domain stopped routing to the organization. | security, mandatory | warning | domain domain_claim_id |
email_domain.removed | An organization removed its claim on an email domain. | security, mandatory | warning | domain domain_claim_id status cause slug |
email_domain.verified | An email domain claim was proved by its DNS record, and the domain routes sign-ins to the organization. | security, mandatory | warning | domain domain_claim_id cause slug |
identity_ | An operator created or replaced an organization's external identity provider through the control plane. | security, mandatory | warning | ref manager cause violations |
identity_ | An operator deleted an organization's external identity provider through the control plane. | security, mandatory | warning | ref manager cause violations |
identity_provider.listed | An organization's external identity providers were listed through the admin API. | read | info | count slug |
ldap_directory.applied | An operator created or replaced an organization's directory connection through the control plane. | security, mandatory | warning | ref manager cause violations |
ldap_directory.deleted | An operator deleted an organization's directory connection through the control plane. | security, mandatory | warning | ref manager cause violations |
organization.created | An organization was created, with its own signing key and admin clients. | security, mandatory | notice | slug display_name issuer fips_mode fapi_mode email_ key_id cause violations stage ref client_id manager client_org rolled_back |
organization.deleted | An organization was deleted. | security, mandatory | critical | slug display_name issuer fips_mode fapi_mode email_ key_id cause violations stage |
organization.listed | A page of organizations was listed through the admin API. | read | info | count sort cause |
organization.mail.tested | An administrator sent a test message through an organization's email relay. | write | info | slug relay_ok |
organization.read | A single organization was read through the admin API. | read | info | slug cause violations |
organization. | A request addressed an organization by its path and was not served as that organization's. | trace | info | slug cause repeat_count first_seen_at last_seen_at |
organization. | An organization's user, session and client counts were read through the admin API. | trace | info | from to slug |
organization.updated | An organization's settings were updated. | security, mandatory | notice | changed slug fapi_mode email_ cause violations |
resource_problem.listed | What operators reported they could not do for an organization's resources was listed through the admin API. | read | info | count slug sort cause |
resource_problem.read | One problem an operator reported for a resource was read through the admin API. | read | info | slug |
resource_status.reported | An operator reported through the control plane that one of its resources is not ready, or is ready again. | security | info | ref resource status cause violations |
Clients
Category client.
| Action | What it records | Level | Severity | Metadata |
|---|---|---|---|---|
branding.applied | An operator created or replaced a client's sign-in page branding through the control plane. | security, mandatory | notice | client_id ref manager cause violations |
branding.deleted | An operator deleted a client's sign-in page branding through the control plane. | security, mandatory | notice | client_id ref manager cause violations |
client.adopted | Provisioning took an existing admin client into an organization and granted it the organization's admin roles. | security, mandatory | warning | client_id client_type role scope minted |
client.applied | An operator created or replaced an OAuth client through the control plane. | security, mandatory | notice | client_id ref manager cause violations scope |
client. | A client read its own registration through the RFC 7592 configuration endpoint. | read | info | client_id |
client.configured | A client replaced its own registration through the RFC 7592 configuration endpoint. | security, mandatory | notice | client_id grant_types scope changed client_type |
client.deleted | An operator deleted an OAuth client through the control plane. | security, mandatory | warning | client_id ref manager cause violations |
client.deregistered | A client deprovisioned its own registration through the RFC 7592 configuration endpoint. | security, mandatory | warning | client_id software_id software_version grant_types client_type |
client.listed | A page of an organization's OAuth clients was listed through the admin API. | read | info | count sort cause slug |
client.name.suspicious | A client's display name carried characters that misrepresent it, and was shown to a user anyway. | security | warning | markers name_length surface |
client.provisioned | The server provisioned an OAuth client for an organization, or rewrote one's registered scopes. | security, mandatory | notice | client_id client_type removed_scope scope role redirect_uri post_logout_redirect_uri cause ref manager client_org |
client.read | A single OAuth client's registered configuration was read through the admin API. | read | info | target_client_ref slug |
client.registered | A client registered itself through RFC 7591 dynamic client registration. | security, mandatory | notice | client_id software_id software_version grant_types scope client_type |
client. | A request to the dynamic client registration or configuration endpoint was refused. | security | warning | client_id metadata_field cause grant_family jkt |
client.secret.issued | A confidential client's secret was minted and disclosed once. | security, mandatory | warning | client_id delivered |
client.usage.read | A single OAuth client's daily, monthly and all-time user counts were read through the admin API. | trace | info | target_client_ref slug |
Roles
Category role.
| Action | What it records | Level | Severity | Metadata |
|---|---|---|---|---|
role.granted | A role was granted to a user within an organization. | security, mandatory | warning | role justification target_user_id notified |
role.revoked | A role was taken from a user within an organization. | security, mandatory | warning | role justification target_user_id cause notified |
Admin API and edge
Category admin.
| Action | What it records | Level | Severity | Metadata |
|---|---|---|---|---|
admin.access.denied | A request to the privileged admin API was refused by authorization. | security, mandatory | warning | required_permission required_role required_scope target_slug target_user_id client_id audience scope roles cause jkt grant_family peer_identities ref proof_jkt skew_seconds stage domain |
Audit log
Category audit.
| Action | What it records | Level | Severity | Metadata |
|---|---|---|---|---|
audit.counts.read | Audit records were counted over a window. | trace | info | from to filters slug |
audit.log.read | The audit log was read. | security, mandatory | info | count from to sort filters event_id platform_records filter_actor_id filter_target_id filter_client_id filter_session_id filter_client_net cause slug |
audit.ranking.read | The subjects behind a set of audit records were ranked by their count. | trace | info | from to filters slug |
threats.overview.read | The threat overview was read over a window. | trace | info | from to slug |
System
Category system.
| Action | What it records | Level | Severity | Metadata |
|---|---|---|---|---|
http.request.served | A request ended in a server fault nothing else recorded, or in a recovered panic. | trace | info | status cause instance boot_id |
system. | Configured admin subjects were granted main authority at startup. | security, mandatory, platform | notice | granted instance boot_id |
system.audit.checkpoint | A writer signed a checkpoint of the audit log's hash chain; each record is the statement or one part of it. | security, mandatory, platform | info | lane checkpoint_counter checkpoint_part chain_segment chain_month chain_seq chain_head chain_from chain_through chain_prev issued_at final chain_segments chain_gaps gaps_pending gaps_dropped key_id sig instance boot_id |
system.audit.configured | The server recorded the audit configuration it runs with, and what changed since the previous boot. | security, mandatory, platform | info | audit_enabled audit_level audit_include audit_exclude fail_closed retention_days coalesce_window_seconds coalesce_max_keys checkpoint_ checkpoint_key_id audit_rewrite_routes changed previous_audit_enabled previous_audit_level previous_audit_include previous_audit_exclude previous_fail_closed previous_retention_days previous_ previous_ previous_ previous_ previous_ window_start window_end instance boot_id |
system.audit.degraded | The audit pipeline is degraded: mandatory events are not being persisted promptly. | security, mandatory, platform | critical | trigger count error_class instance boot_id |
system.audit.overflow | Audit events were dropped because the write buffer was full. | security, mandatory, platform | critical | dropped dropped_mandatory window_start window_end instance boot_id |
system. | An audit-log partition was created ahead of time. | write, platform | info | partition range_start range_end instance boot_id |
system. | A month of audit history past the retention period was removed: its partition dropped. | security, mandatory, platform | warning | partition range_start range_end retention_days instance boot_id |
system.audit.recovered | The audit pipeline recovered from its degraded state. | security, mandatory, platform | notice | count instance boot_id |
system. | Mandatory audit events were persisted late, after the store refused them for a while. | security, mandatory, platform | warning | count window_start window_end max_lag_ms error_class instance boot_id |
system. | A batch of audit events could not be persisted. | security, mandatory, platform | critical | count failed_mandatory error_class error window_start window_end instance boot_id |
system.debug.accessed | A runtime profiling endpoint was read on the internal listener. | security, platform | warning | profile instance boot_id repeat_count first_seen_at last_seen_at |
system. | A dependency the server relies on started failing. | security, mandatory, platform | warning | dependency critical failed_op error_class window_start last_ok_at fails_closed fails_open instance boot_id |
system. | A dependency that had been failing answers again. | security, mandatory, platform | notice | dependency critical failed_op error_class window_start window_end count fails_closed fails_open instance boot_id |
system.keys.loaded | The server recorded the keys and cryptographic module it runs with, and what changed since the previous boot. | security, mandatory, platform | info | signing_key_mode key_id retired_key_id kek_mode kek_retired kek_unreadable mfa_key_mode mfa_key_retired mfa_key_unreadable fips fips_module fips_required changed previous_ previous_key_id previous_retired_key_id previous_kek_mode previous_kek_retired previous_kek_unreadable previous_mfa_key_mode previous_mfa_key_retired previous_ previous_fips previous_fips_module previous_fips_required instance boot_id |
system.migration.applied | Database migrations were applied. | security, mandatory, platform | notice | count version migrations instance boot_id |
system.session.reaped | The background sweeper removed absolute-expired login sessions. | trace, platform | info | count instance boot_id |
system. | A signing key was generated for an organization and added to the key set it publishes. | security, mandatory, platform | notice | key_id alg instance boot_id |
system. | An organization's signing key could not be loaded, so it was left out of the key set published for it. | security, mandatory, platform | critical | key_id alg stage cause instance boot_id |
system.started | The server started. | security, mandatory, platform | info | version commit instance boot_id |
system.stopped | The server stopped. | security, mandatory, platform | info | instance boot_id trigger stage uptime_seconds queued queued_mandatory |
system. | The server recorded which proxies it trusts and whether it terminates TLS, and what changed since the previous boot. | security, mandatory, platform | info | trusted_proxies trusted_proxies_count trusted_proxies_digest client_ip_mode client_ip_header tls_enabled hsts changed previous_trusted_proxies previous_ previous_ previous_client_ip_mode previous_ previous_tls_enabled previous_hsts instance boot_id |
146 actions, 75 of them mandatory.