Authenticate
Manage Users
Customize
Auth0 AI
Platform| Event Code | Event | Event Description |
|---|---|---|
acls_summary | Network ACLs Summary | Shows the summary of the network ACLs matches for a period of time |
actions_execution_failed | Actions Execution Failed | Execution of an Action failed |
acul_sdk_notice | ACUL SDK Notice | ACUL SDK notification |
api_limit | Rate Limit on the Authentication or Management APIs | The maximum number of requests to the Authentication or Management APIs in a given time has been reached. |
api_limit_warning | Rate Limit Warning on the Authentication or Management APIs | The limit of requests to the Authentication or Management APIs in given time is about to be reached. |
appi | Notice for API Peak Performance initiated | Increases the Elevated Public Authentication API Limits by the 100 RPS multiple purchased by the customer for up to 48 hours per month. For more information, see Public performance rate limit policy. |
ciba_exchange_failed | Failed CIBA Exchange | Failed to exchange AuthReqId for Access Token |
ciba_exchange_succeeded | Successful CIBA Exchange | Successful exchange of AuthReqId for Access Token |
ciba_start_failed | Failed CIBA Start | Client-Initiated Backchannel Authentication Flow failed to be initiated. |
ciba_start_succeeded | Successful CIBA Start | Client-Initiated Backchannel Authentication Flow has been successfully initiated. |
cls | Code/Link Sent | Passwordless login code/link has been sent |
connected_accounts_connection_failed | Failed Connected Account Connection | User failed to connect a third-party account |
connected_accounts_connection_succeeded | Successful Connected Account Connection | User successfully connected a third-party account |
connected_accounts_delete_failed | Failed Connected Account Delete | User failed to delete a connected third-party account |
connected_accounts_delete_succeeded | Successful Connected Account Delete | User successfully deleted a connected third-party account |
cs | Code Sent | Passwordless login code has been sent |
custom_domain_verification_failed | Custom Domain Verification Failed | Unable to verify a custom domain |
depnote | Deprecation Notice | |
directory_sync_completed | Inbound Directory Sync Completed | |
directory_sync_failed | Inbound Directory Sync Failed | |
directory_sync_started | Inbound Directory Sync Started | |
f | Failed Login | |
failed_on_behalf_of_token_exchange | Failed Exchange | Failed Exchange via On-Behalf-Of Token Exchange |
fc | Failed by Connector | |
fce | Failed Change Email | Failed to change user email |
fco | Failed by CORS | Origin is not in the Allowed Origins list for the specified application |
fcoa | Failed cross-origin authentication | |
fcp | Failed Change Password | |
fcph | Failed Post Change Password Hook | |
fcpn | Failed Change Phone Number | |
fcpr | Failed Change Password Request | |
fcpro | Failed Connector Provisioning | Failed to provision an AD/LDAP connector |
fcu | Failed Change Username | Failed to change username |
fd | Failed Delegation | Failed to generate delegation token |
fdeac | Failed Device Activation | Failed to activate device. |
fdeaz | Failed Device Authorization Request | Device authorization request failed. |
fdecc | User Canceled Device Confirmation | User did not confirm device. |
fdu | Failed User Deletion | |
feacft | Failed Exchange | Failed to exchange authorization code for Access Token |
feccft | Failed Exchange | Failed exchange of Access Token for a Client Credentials Grant |
fecte | Failed Exchange | Failed Exchange via Custom Token Exchange |
fede | Failed Exchange | Failed to exchange Device Code for Access Token |
federated_logout_failed | Failed Federated Logout | Failed to logout of the upstream Identity Provider |
fens | Failed Exchange | Failed exchange for Native Social Login |
feoobft | Failed Exchange | Failed exchange of Password and OOB Challenge for Access Token |
feotpft | Failed Exchange | Failed exchange of Password and OTP Challenge for Access Token |
fepft | Failed Exchange | Failed exchange of Password for Access Token |
fepotpft | Failed Exchange | Failed exchange of Passwordless OTP for Access Token |
fercft | Failed Exchange | Failed Exchange of Password and MFA Recovery code for Access Token |
ferrt | Failed Exchange | Failed Exchange of Rotating Refresh Token. This could occur when reuse is detected. |
fertft | Failed Exchange | Failed Exchange of Refresh Token for Access Token. This could occur if the refresh token is revoked or expired. |
feta | Failed Exchange | Failed token exchange at Token Vault |
fi | Failed invite accept | Failed to accept a user invitation. This could happen if the user accepts an invitation using a different email address than provided in the invitation, or due to a system failure while provisioning the invitation. |
flo | Failed Logout | User logout failed |
flows_execution_completed | Flows Execution Completed | |
flows_execution_failed | Flows Execution Failed | |
fn | Failed Sending Notification | Failed to send notification |
forms_submission_failed | Forms Submission Failed | |
forms_submission_succeeded | Forms Submission Succeeded | |
fp | Failed Login (Incorrect Password) | |
fpar | Failed Pushed Authorization Request | |
fpurh | Failed Post User Registration Hook | |
fs | Failed Signup | |
fsa | Failed Silent Auth | |
fu | Failed Login (Invalid Email/Username) | |
fui | Failed users import | Failed to import users |
fv | Failed Verification Email | Failed to send verification email |
fvr | Failed Verification Email Request | Failed to process verification email request |
gd_auth_email_verification | Email Verification Confirmed | Email verification completed successfully |
gd_auth_fail_email_verification | Email Verification Failed | Email verification failed. |
gd_auth_failed | MFA Auth failed | Multi-factor authentication failed. This could happen due to a wrong code entered for SMS/Voice/Email/TOTP factors, or a system failure. |
gd_auth_rejected | MFA Auth rejected | A user rejected a Multi-factor authentication request via push-notification. |
gd_auth_succeed | MFA Auth success | Multi-factor authentication success. |
gd_enrollment_complete | MFA enrollment complete | A first time MFA user has successfully enrolled using one of the factors. |
gd_otp_rate_limit_exceed | Too many MFA failures | A user sends more than 10 requests to their device within one hour. Note that the request limit does not reset upon a successful login event. |
gd_recovery_failed | Recovery failed | A user enters a wrong recovery code when attempting to authenticate. |
gd_recovery_rate_limit_exceed | Multi-factor recovery code has failed too many times | A user has entered a wrong recovery code too many times. |
gd_recovery_succeed | MFA recovery success | A user successfully authenticates with a recovery code. |
gd_send_email | MFA Email Sent | Email for MFA successfully sent. |
gd_send_email_verification | Email Verification Sent | Verification email sent successfully. |
gd_send_email_verification_failure | Email Verification Failed | Email verification failed. |
gd_send_pn | Push notification sent | Push notification for MFA successfully sent. |
gd_send_pn_failure | Error Sending MFA Push Notification | Push notification for MFA failed. |
gd_send_sms | MFA SMS Sent | SMS for MFA successfully sent. |
gd_send_sms_failure | Error Sending MFA SMS | Attempt to send SMS for MFA failed. |
gd_send_voice | MFA voice call success | Voice call for MFA successfully made. |
gd_send_voice_failure | MFA voice call failed | Attempt to make Voice call for MFA failed. |
gd_start_auth | Second factor started | Second factor authentication event started for MFA. |
gd_start_enroll | MFA Enroll started | Multi-factor authentication enroll has started. |
gd_start_enroll_failed | MFA Enrollment Failed | Push to start enrollement failed. |
gd_tenant_update | Guardian tenant update | |
gd_unenroll | Unenroll device account | Device used for second factor authentication has been unenrolled. |
gd_update_device_account | Update device account | Device used for second factor authentication has been updated. |
gd_webauthn_challenge_failed | WebAuthn browser error | User failed to verify Webauthn factor. |
gd_webauthn_enrollment_failed | WebAuthn browser error | WebAuthn browser enrollment failed. |
idjag_exchange_failed | Failed Exchange | Failed Exchange of Identity Assertion Authorization Grant JWT for Access Token |
idjag_exchange_succeeded | Success Exchange | Successful Exchange of Identity Assertion Authorization Grant JWT for Access Token |
jwt_bearer_exchange_failed | Failed Exchange | Failed Exchange of JWT Bearer Assertion for Access Token |
kms_key_management_failure | Failed KMS API Operation | KMS operation failed |
kms_key_management_success | Success KMS API Operation | KMS operation completed successfully |
kms_key_state_changed | KMS Key State Change | KMS key state changed |
limit_delegation | Too Many Calls to /delegation | Rate limit exceeded to /delegation endpoint |
limit_mu | Blocked IP Address | An IP address is blocked because it attempted too many failed logins without a successful login. Or an IP address is blocked because it attempted too many sign-ups, whether successful or failed. For more information, see Attack Protection. |
limit_sul | Blocked Account | A user is temporarily prevented from logging in because they reached the maximum logins per time period from the same IP address. For more information, see Attack Protection. |
limit_wc | Blocked Account | An IP address is blocked because it reached the maximum failed login attempts into a single account. |
mfar | MFA Required | A user has been prompted for multi-factor authentication (MFA). When using Adaptive MFA, Auth0 includes details about the risk assessment. Available in only the Resource Owner Password Flow. |
mgmt_api_read | Management API read Operation | API GET operation returning secrets completed successfully |
my_account_authentication_method_failed | Failed authentication method operation in My Account API | Failed to complete authentication method operation in My Account API |
my_account_authentication_method_succeeded | Successful authentication method operation in My Account API | Successfully completed authentication method operation in My Account API |
oidc_backchannel_logout_failed | Failed OIDC Back-Channel Logout request | Failed OIDC Back-Channel Logout request |
oidc_backchannel_logout_succeeded | Successful OIDC Back-Channel Logout request | Successful OIDC Back-Channel Logout request |
organization_member_added | Organization Member Added | Successfully added member to organization |
passkey_challenge_failed | Passkey Challenge Failed | Native passkey challenge failed |
passkey_challenge_started | Passkey Challenge Started | Native passkey challenge was successfully initiated |
pla | Pre-login assessment | This log is generated before a login and helps in monitoring the behavior of bot detection without having to enable it. |
pwd_leak | Breached password | Someone behind the IP address ip attempted to login with a leaked password. The pwd_leak tenant log is emitted once per hour per IP address. |
reset_pwd_leak | Breached Password on Reset | Someone behind the IP address ip attempted to reset with a leaked password. |
resource_cleanup | Success Resource Cleanup | Emitted when resources exceeding defined limits were removed. |
rich_consents_access_error | Rich Consents Access Error | Error fetching a Rich Consent record |
s | Success Login | Successful login event. |
sapi | Success API Operation | Successful management API write event. |
sce | Success Change Email | |
scoa | Success cross-origin authentication | |
scp | Success Change Password | |
scpn | Success Change Phone Number | |
scpr | Success Change Password Request | |
scu | Success Change Username | |
scv | Success Credential Validation | Successful credential validation event. |
sd | Success Delegation | |
sdu | Success User Deletion | User successfully deleted |
seacft | Success Exchange | Successful exchange of authorization code for Access Token |
seccft | Success Exchange | Successful exchange of Access Token for a Client Credentials Grant |
secte | Success Exchange | Succesful Exchange via Custom Token Exchange |
sede | Success Exchange | Successful exchange of device code for Access Token |
sens | Success Exchange | Native Social Login |
seoobft | Success Exchange | Successful exchange of Password and OOB Challenge for Access Token |
seotpft | Success Exchange | Successful exchange of Password and OTP Challenge for Access Token |
sepft | Success Exchange | Successful exchange of Password for Access Token |
sepkoobft | Success Exchange | Successful exchange of Passkey and OOB Challenge for Access Token |
sepkotpft | Success Exchange | Successful exchange of Passkey and OTP Challenge for Access Token |
sepkrcft | Success Exchange | Successful exchange of Passkey and MFA Recovery Code for Access Token |
sercft | Success Exchange | Successful exchange of Password and MFA Recovery code for Access Token |
sertft | Success Exchange | Successful exchange of Refresh Token for Access Token |
seta | Success Exchange | Successful token exchange at Token Vault |
si | Successfully accepted a user invite | Successfully accepted a user invitation |
signup_pwd_leak | Breached Password on Signup | Someone behind the IP address ip attempted to signup with a leaked password. |
slo | Success Logout | User successfully logged out |
srrt | Successfully revoked a refresh token | |
ss | Success Signup | |
ss_sso_failure | Failed SS-SSO Operation | Self-Service operation failed |
ss_sso_info | Information from an SS-SSO Operation | Try-connection flow started/completed |
ss_sso_success | Success SS-SSO Operation | Self-Service operation completed successfully |
ssa | Success Silent Auth | |
sscim | Successful SCIM Operation | SCIM operation succeeded |
success_on_behalf_of_token_exchange | Success Exchange | Successful Exchange via On-Behalf-Of Token Exchange |
sui | Successfully imported users | Successfully imported users |
sv | Success Verification Email | Successfully consumed email verification link |
svr | Success Verification Email Request | Successfully called verification email endpoint. Verification email in queue to send. |
too_many_records | Max Amount of Authenticators | User has created the maximum amount of authenticators |
ublkdu | User login block released | User block setup by anomaly detection has been released |
universal_logout_failed | Failed Universal Logout request | Failed Universal Logout request |
universal_logout_succeeded | Successful Universal Logout request | Successful Universal Logout request |
w | Warning During Login | Filters for logs of type warning during login |
wn | Warning Sending Notification | Warnings that have occurred during notification sending. |
wum | Warning User Management | Filters for logs of type warning during user management operations |
Log Type Codes
Reference the full list of Auth0 log event type codes and what each means to filter tenant logs and trigger alerts on specific events.
The following table lists the codes associated with each tenant log. If you want to learn more about log event schemas, you can reference our GitHub repo.