> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/authentication/admin-portal/monitoring-and-reporting/event-reference.md).

# Event Reference

***

### How to read an entry

Each event below includes:

* **Event code** — the identifier that appears in the logs (for example, `E_LOGIN_SUCCEEDED`).
* **Name** — a plain-language description of what the event represents.
* **Notes** — any conditions that affect when the event is recorded, where applicable.
* **Fields captured** — the data fields included in the event's payload.

Some events include a short summary of what they capture instead of (or in addition to) a full field list.

***

### User Activity

#### E\_LOGIN\_SUCCEEDED — Successful login

**Fields captured:** `type`, `event_ts`, `version`, `journey_id`, `session_id`, `client_ip_address`, `caller_user_agent`, `login_state`, `user_id`, `user_status`, `user_email`, `user_firstname`, `user_lastname`, `source_user_directory`, `tenant_dns`, `tenant_tag`, `service_name`, `server_ip`, `auth_method`, `auth_device_os`, `auth_device_name`, `auth_device_app_name`, `auth_device_app_version`, `auth_device_latitude`, `auth_device_longitude`, `moduleId`, `otp_type`, `factsSubmitted`, `applicationId`, `machine_id`, `machine_name`, `machine_domain`, `machine_os`, `machine_os_version`, `machine_mac_addr`, `machine_ip`, `agent_version`, `groups`, `userTrustedLocations`, `mobileLocation`, `authModuleId`, `authenticationMethods`, `username`, `machine_user`, `IP`, `authFactor`, `sessionUrl`, `authJourneysMatched`, `name`, `Id`, `user_role`, `distanceUserTrustedMobileMeters`, `event_id`, `timestamp`, `epoch_time`, `tenant_id`, `community_id`, `eventName`, `event_name`, `note`

{% hint style="info" %}
**Note:** When authentication is performed via an auth proxy with client IP tracking enabled, the payload instead includes: `eventName`, `event_name`, `type`, `tenant_id`, `community_id`, `loginMethod`, `ipAddress`, `client_ip`, `radiusId`, `radiusAuthenticator`, `userName`, `user_id`, `referrer_name`, `referrer_protocol`, `event_id`, `timestamp`, `epoch_time`, `event_ts`.
{% endhint %}

#### E\_LOGIN\_FAILED — Failed login attempt

**Fields captured:** `type`, `event_ts`, `version`, `journey_id`, `client_ip_address`, `caller_user_agent`, `login_state`, `user_id`, `user_status`, `user_email`, `user_firstname`, `user_lastname`, `source_user_directory`, `tenant_dns`, `tenant_tag`, `service_name`, `server_ip`, `auth_method`, `auth_device_os`, `auth_device_name`, `auth_device_app_name`, `auth_device_app_version`, `auth_device_latitude`, `auth_device_longitude`, `moduleId`, `otp_type`, `factsSubmitted`, `applicationId`, `machine_id`, `machine_name`, `machine_domain`, `machine_os`, `machine_os_version`, `machine_mac_addr`, `machine_ip`, `agent_version`, `eventData`, `reason`, `event_id`, `timestamp`, `epoch_time`, `tenant_id`, `community_id`, `eventName`, `event_name`

***

### Onboarding Activity

#### E\_USER\_INVITED — User invited to tenant

Captures which email address the invitation was sent to and which user account created the invitation.

#### E\_USER\_ONBOARDED — User onboarded and device linked

Captures information about the user onboarded to the tenant and details about the device linked to their account.

***

### Authentication Activity

#### E\_ACCOUNT\_LOCKED — Account locked

{% hint style="info" %}
**Note:** Only records lockouts caused by exceeding the maximum number of incorrect OTP attempts.
{% endhint %}

**Fields captured:** `tenant_id`, `community_id`, `username`, `initiatedby`, `lockedAt`, `reason`, `reasonCode`, `message`

#### E\_ACCOUNT\_UNLOCKED — Account restored after lockout

{% hint style="info" %}
**Note:** Only records restorations when the lockout was due to exceeding the maximum number of incorrect OTP attempts.
{% endhint %}

**Fields captured:** `tenant_id`, `community_id`, `username`, `initiatedby`, `lockedAt`, `reason`, `reasonCode`, `message`

#### E\_OTP\_RATE\_LIMIT\_HIT — OTP request limit exceeded

**Fields captured:** `user_id`, `retry_after_seconds`, `eventName`, `tenant_dns`, `tenant_id`, `community_id`, `community_name`, `license_hash`, `request_id`, `requested_at`, `type`, `event_id`, `timestamp`, `epoch_time`, `event_name`, `event_ts`

#### E\_PUSH\_RATE\_LIMIT\_HIT — Push request limit exceeded

**Fields captured:** `user_id`, `retry_after_seconds`, `eventName`, `tenant_dns`, `tenant_id`, `community_id`, `community_name`, `license_hash`, `request_id`, `requested_at`, `type`, `event_id`, `timestamp`, `epoch_time`, `event_name`, `event_ts`

#### E\_DEVICE\_DELINKED — Mobile device removed

**Fields captured:** `tenant_id`, `community_id`, `username`, `actor`, `auth_device_application_id`, `auth_device_did`, `auth_device_id`, `auth_device_longitude`, `auth_device_latitude`, `auth_device_name`, `initiatedby`, `user_id`

#### E\_PWDRESET\_SUCCEEDED — Password reset successful

**Fields captured:** `data`, `type`, `event_ts`, `user_id`, `directory_id`, `directory_type`, `directory_name`, `tenant_id`, `community_id`, `event_id`, `timestamp`, `epoch_time`, `eventName`, `event_name`

#### E\_PWDRESET\_FAILED — Password reset failed

**Fields captured:** `data`, `type`, `event_ts`, `user_id`, `directory_id`, `directory_type`, `directory_name`, `tenant_id`, `community_id`, `failure_reason`, `event_id`, `timestamp`, `epoch_time`, `eventName`, `event_name`

#### E\_PUSH\_REQUESTED — Push notification login requested

Records user account details and the time the push notification was requested.

#### E\_OTP\_GENERATED — OTP generated and sent

Captures the time an OTP was generated, user details, and which email or phone it was sent to.

#### E\_OTP\_LOCKED — Account locked due to incorrect OTP attempts

Triggered when a user has entered an incorrect OTP the maximum number of times allowed.

#### E\_OTP\_REQUESTED — OTP requested by user

Captures which user requested an OTP, the time of request, and which email or phone it was sent to.

#### E\_OTP\_VERIFIED — OTP verification outcome

Captures the outcome of an OTP verification, including the time.

#### E\_SP\_REDIRECT\_SUCCEEDED — SSO application login

**Fields captured:** `event_id`, `event_ts`, `version`, `journey_id`, `session_id`, `client_ip_address`, `caller_user_agent`, `user_id`, `user_status`, `user_email`, `user_firstname`, `user_lastname`, `source_user_directory`, `source_user_directory_name`, `caller_ip`, `tenant_dns`, `auth_method`, `auth_device_os`, `auth_device_name`, `auth_device_app_name`, `auth_device_app_version`, `auth_device_ip_address`, `auth_device_latitude`, `auth_device_longitude`, `sp_type`, `sp_name`, `sp_id`, `tenant_id`, `community_id`, `type`, `eventName`, `timestamp`, `epoch_time`, `reports_producer_time`

#### E\_AUTH\_REQUEST\_DENIED — User cancelled consent screen

**Fields captured:** `authenticator_id`, `authenticator_name`, `authenticator_os`, `authenticator_version`, `device_id`, `event_name`, `license_hash`, `network_info`, `person_id`, `person_publickey`, `sender`, `sender_version`, `status`, `type`, `user_agent`, `user_id`, `origin`, `api`, `authPage`, `community`, `communityId`

#### E\_ORPHAN\_ACCOUNT\_REMOVED — Orphaned account removed

**Fields captured:** `data`, `authenticator_id`, `authenticator_name`, `authenticator_os`, `authenticator_version`, `device_id`, `event_name`, `license_hash`, `network_info`, `origin`, `api`, `community_name`, `tag`, `person_id`, `person_publickey`, `reason`, `sender`, `sender_version`, `status`, `type`, `user_agent`, `user_id`, `event_id`, `timestamp`, `epoch_time`, `tenant_id`, `community_id`, `eventName`, `event_ts`

#### E\_ADAPTIVE\_AUTH\_MODIFIED — Adaptive authentication journey modified

**Fields captured:** `event_name`, `journey_id`, `journey_name`, `event_ts`, `tenant_id`, `community_id`, `eventCategory`, `type`, `old_groups.operator`, `new_groups.operator`, `user_id`, `user_name`, `connection_ip_address`, `connection_useragent`, `event_id`, `timestamp`, `epoch_time`, `eventName`

#### E\_ADAPTIVEAUTH\_CREATED — Adaptive authentication journey created

**Fields captured:** `event_name`, `journey_id`, `journey_type`, `journey_name`, `event_ts`, `tenant_id`, `community_id`, `eventCategory`, `type`, `decision.action`, `user_id`, `user_name`, `connection_ip_address`, `connection_useragent`, `decision.authenticationMethods`, `groups.value`, `requestingAppId.value`, `event_id`, `timestamp`, `epoch_time`, `eventName`

#### E\_ADAPTIVEAUTH\_DELETED — Adaptive authentication journey deleted

**Fields captured:** `event_name`, `journey_id`, `journey_type`, `journey_name`, `event_ts`, `tenant_id`, `community_id`, `eventCategory`, `type`, `user_id`, `user_name`, `connection_ip_address`, `connection_useragent`, `event_id`, `timestamp`, `epoch_time`, `eventName`

#### E\_SESSIONS\_TERMINATED — User session revoked

**Fields captured:** `data`, `type`, `tenant_dns`, `tenant_tag`, `caller_user_agent`, `eventCategory`, `revoked_by`, `user_role`, `client_ip_address`, `server_ip`, `user_ip`, `user_details`, `user_id`, `uid`, `user_status`, `user_email`, `user_firstname`, `user_lastname`, `module_id`, `source_user_directory`, `active_sessions`, `event_id`, `timestamp`, `epoch_time`, `tenant_id`, `community_id`, `eventName`, `event_name`, `event_ts`

#### E\_ACCESSCODE\_GENERATED — Onboarding invite generated by admin

**Fields captured:** `tenant_id`, `initiated_by`, `caller_ip`, `purpose`, `expiry_date`, `sent_to`, `type`, `tenant_tag`, `community_id`, `user_id`, `caller_user_agent`, `event_ts`, `eventName`, `event_name`, `tenant_dns`, `accesscode_type`, `event_id`, `timestamp`, `epoch_time`

#### E\_USER\_PROFILE\_UPDATED — User enrolled a new phone number

**Fields captured:** `type`, `tenant_id`, `community_id`, `eventName`, `event_id`, `ip_address`, `user_agent`, `request_id`, `username`, `action`, `event_ts`, `updated_by`, `phone_number`, `timestamp`, `epoch_time`, `event_name`, `user_id`

#### E\_AFFIDAVIT\_ISSUED — Affidavit issued to user

**Fields captured:** `type`, `tenant_name`, `community_name`, `issued_by`, `issued_to`, `date`, `doc_type`, `doc_id`, `expiry`, `user_id`, `event_id`, `timestamp`, `epoch_time`, `tenant_id`, `community_id`, `eventName`, `event_name`, `event_ts`

#### E\_BEHAVIOR\_AUTH\_SUCCESS — Behavior authentication succeeded

**Fields captured:** `type`, `tenant_id`, `community_id`, `event_ts`, `version`, `eventName`, `event_name`, `request_id`, `client_ip_address`, `license_hash`, `login_state`, `user_id`, `user_email`, `user_firstname`, `user_lastname`, `user_status`, `source_user_directory`, `urn`, `urn_b64`, `moduleId`, `tenant_dns`, `auth_method`, `auth_device_app_name`, `authFactor`, `behaviorAuth`, `success`, `result`, `score`, `confidence_interval`, `confidence`, `net_score`, `device_similarity`, `compared_samples`, `action`, `previous_samples`, `status`, `event_id`, `timestamp`, `epoch_time`

#### E\_BEHAVIOR\_AUTH\_FAILED — Behavior authentication failed

**Fields captured:** `type`, `tenant_id`, `community_id`, `event_ts`, `version`, `eventName`, `event_name`, `request_id`, `client_ip_address`, `license_hash`, `login_state`, `user_id`, `user_email`, `user_firstname`, `user_lastname`, `user_status`, `source_user_directory`, `urn`, `urn_b64`, `moduleId`, `tenant_dns`, `auth_method`, `auth_device_app_name`, `authFactor`, `behaviorAuth`, `success`, `result`, `score`, `confidence_interval`, `confidence`, `net_score`, `device_similarity`, `compared_samples`, `action`, `previous_samples`, `status`, `event_id`, `timestamp`, `epoch_time`

#### E\_BIOMETRIC\_CONSENT\_UPDATED — Biometric consent setting updated

**Fields captured:** `event_name`, `event_ts`, `tenant_id`, `community_id`, `eventCategory`, `type`, `consent_doc_id`, `actions`, `user_id`, `user_name`, `client_ip_address`, `caller_user_agent`, `event_id`, `timestamp`, `epoch_time`, `eventName`

#### E\_LIVEID\_CONSENT\_ACCEPTED — User accepted consent

**Fields captured:** `event_name`, `event_ts`, `user_id`, `user_name`, `client_ip_address`, `caller_useragent`, `tenant_id`, `community_id`, `consent_status`, `type`, `consent_record_id`, `consent_doc_id`, `event_id`, `timestamp`, `epoch_time`, `eventName`

#### E\_LIVEID\_CONSENT\_DECLINED — User declined consent

**Fields captured:** `event_name`, `event_ts`, `user_id`, `user_name`, `client_ip_address`, `caller_useragent`, `tenant_id`, `community_id`, `consent_status`, `type`, `consent_record_id`, `consent_doc_id`, `event_id`, `timestamp`, `epoch_time`, `eventName`

***

### Authentication Policy

#### E\_AUTHPOLICY\_CHECKED — Authentication policy evaluated

Records whether access was granted, denied, or if additional step-up authentication was required.

**Fields captured:** `type`, `event_id`, `ip`, `person_publickey`, `requestid`, `rule_id`, `decision`, `caller_user_agent`, `url`, `country`, `region`, `eventName`, `timestamp`, `epoch_time`, `tenant_id`, `community_id`, `reports_producer_time`

***

### Identity Verification

#### E\_DOCUMENT\_ENROLLED — Identity document enrolled

Tracks enrollment of passports, driver's licenses, state IDs, social security numbers, and LiveID. No personally identifiable information is captured.

**Fields captured:** `type`, `tenant_name`, `community_name`, `username`, `email`, `timestamp`, `document_type`, `live_id`, `ip_address`, `user_agent`, `document_id`, `transaction_id`, `event_id`, `eventName`, `epoch_time`, `tenant_id`, `community_id`

#### E\_DOCUMENT\_UNENROLLED — Identity document removed

Records the document type and the user's IAL level resulting from the removal.

**Fields captured:** `tenantid`, `communityid`, `username`, `did`, `document_id`, `document_type`, `ial`

#### E\_USER\_CONSENT — User consent granted

Records that consent has been granted and details about the items consent was granted for.

**Fields captured:** `tenantid`, `communityid`, `username`, `relying_party`, `wallet_did`, `wallet_publickey`, `document_ids`, `scopes`

***

### Administrator Activity

{% hint style="info" %}
**Note:** Administrator activity events contain the `AUDIT_LOG` event category, distinguishing them from user events.
{% endhint %}

#### E\_BROKER\_DISCONNECTED — Broker disconnected

**Fields captured:** `type`, `tenantid`, `communityid`, `client_id`, `auth_module_id`, `license_hash`, `software_version`, `ts`, `eventName`, `broker_id`, `broker_name`, `broker_version`, `broker_last_seen`, `reason`, `connected`, `event_id`, `timestamp`, `epoch_time`, `event_name`, `event_ts`, `user_id`

#### E\_ROLE\_CHANGED — User role changed

**Fields captured:** `type`, `version`, `server_ip`, `service_name`, `authorization`, `tenant_id`, `community_id`, `username`, `initiatedby`, `caller_user_agent`, `caller_ip`, `role_changed_from`, `role_changed_to`, `event_id`, `timestamp`, `epoch_time`, `eventName`, `event_name`, `event_ts`, `user_id`

#### E\_DIRECTORY\_ADDED — Directory added

Covers: new AD directory (via AD Broker), LDAP directory (via LDAP Broker), Direct LDAP directory, and Azure AD directory.

**Fields captured:** `timestamp`, `tenantid`, `communityid`, `username`, `connection_ip_address`, `connection_useragent`, `directory_id`, `directory_name`, `directory_type`

#### E\_DIRECTORY\_MODIFIED — Directory settings modified

**Fields captured:** `timestamp`, `tenantid`, `communityid`, `username`, `connection_ip_address`, `connection_useragent`, `directory_id`, `directory_name`, `old_directory_name`, `new_directory_name`, `old_server_protocol_type`, `new_server_protocol_type`

#### E\_DIRECTORY\_REMOVED — Directory deleted

**Fields captured:** `timestamp`, `tenantid`, `communityid`, `username`, `connection_ip_address`, `connection_useragent`, `directory_id`, `directory_name`

#### E\_DIRECTORY\_BROKER\_ENABLED — Directory broker enabled

**Fields captured:** `timestamp`, `tenantid`, `communityid`, `username`, `connection_ip_address`, `connection_useragent`, `directory_id`, `directory_name`, `broker_name`, `broker_client_id`, `last_seen_at`

#### E\_DIRECTORY\_BROKER\_DISABLED — Directory broker disabled

**Fields captured:** `timestamp`, `tenantid`, `communityid`, `username`, `connection_ip_address`, `connection_useragent`, `directory_id`, `directory_name`, `broker_name`, `broker_client_id`, `last_seen_at`

#### E\_DIRECTORY\_BROKER\_DELETED — Directory broker deleted

**Fields captured:** `timestamp`, `tenantid`, `communityid`, `username`, `connection_ip_address`, `connection_useragent`, `directory_id`, `directory_name`, `broker_name`, `broker_client_id`, `last_seen_at`

#### E\_DIRECTORY\_BROKER\_MODIFIED — Directory broker renamed

**Fields captured:** `timestamp`, `tenantid`, `communityid`, `username`, `connection_ip_address`, `connection_useragent`, `directory_id`, `directory_name`, `broker_name`, `broker_client_id`, `last_seen_at`

#### E\_DIRECTORY\_ATTRIBUTE\_ADDED — Directory attribute added

**Fields captured:** `timestamp`, `tenantid`, `communityid`, `username`, `connection_ip_address`, `connection_useragent`, `directory_id`, `directory_name`, `attribute_name`, `directory_attribute_name`

#### E\_DIRECTORY\_ATTRIBUTE\_MODIFIED — Directory attribute modified

**Fields captured:** `timestamp`, `tenantid`, `communityid`, `username`, `connection_ip_address`, `connection_useragent`, `directory_id`, `directory_name`, `old_attribute_name`, `new_attribute_name`, `old_directory_attribute_name`, `new_directory_attribute_name`

#### E\_DIRECTORY\_ATTRIBUTE\_DELETED — Directory attribute deleted

**Fields captured:** `timestamp`, `tenantid`, `communityid`, `username`, `connection_ip_address`, `connection_useragent`, `directory_id`, `directory_name`, `attribute_name`, `directory_attribute_name`

#### E\_DIRECTORY\_ADVANCED\_CONFIGURATION\_MODIFIED — Advanced directory configuration modified

**Fields captured:** `timestamp`, `tenantid`, `communityid`, `username`, `connection_ip_address`, `connection_useragent`, `directory_id`, `directory_name`, `old_login_using_smartcard`, `new_login_using_smartcard`, `old_scep_service_url`, `new_scep_service_url`, `old_enrollment_challenge_url`, `new_enrollment_challenge_url`, `old_allow_password_reset`, `new_allow_password_reset`, `old_password_policy`, `new_password_policy`, `old_kerberos_sso`, `new_kerberos_sso`

#### E\_IDP\_CONFIGURATION\_MODIFIED — IdP configuration modified

**Fields captured:** `tenantid`, `communityid`, `username`, `connection_ip_address`, `connection_useragent`, `old_idp_name`, `new_idp_name`, `old_authentication_request`, `new_authentication_request`, `old_key_size`, `new_key_size`, `old_algorithm`, `new_algorithm`, `old_service_url_signon_endpoint`, `new_service_url_signon_endpoint`, `old_service_url_logout_endpoint`, `new_service_url_logout_endpoint`

***

### Reporting Activity

#### E\_REPORT\_REQUESTED — Report requested by administrator

**Fields captured:** `tenant_id`, `community_id`, `type`, `event_name`, `event_ts`, `user_id`, `eventData`, `number_of_records`, `event_id`, `filters_used`, `tenant_dns`, `timestamp`, `epoch_time`, `eventName`

#### E\_REPORT\_GENERATED — Report generated and ready to download

**Fields captured:** `tenant_id`, `community_id`, `type`, `event_name`, `event_ts`, `user_id`, `eventData`, `number_of_records`, `event_id`, `filter_used`, `tenant_DNS`, `timestamp`, `epoch_time`, `eventName`


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.1kosmos.com/authentication/admin-portal/monitoring-and-reporting/event-reference.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.