Log Stream Filters
You can filter your log streams so only select events and event categories are delivered. To configure a log stream's filter:
Select a log stream and go to the Settings tab.
Enable or disable filters in the Filter By Event Category menu.
Click Save.
Authentication event filters
| Filter | Description |
|---|---|
| Login - Failure | Failed login events |
| Login - Notification | Login notification events |
| Login - Success | Successful login events |
| Logout - Failure | Failed logout events |
| Logout - Success | Successful logout events |
| Signup - Failure | Failed signup events |
| Signup - Success | Successful signup events |
| Silent Authentication - Failure | Failed silent authentication events |
| Silent Authentication - Success | Successful silent authentication events |
| Token Exchange - Failure | Failed token exchange events |
| Token Exchange - Success | Successful token exchange events |
Login - Failure
| Event Code | Description |
|---|---|
f |
Failed login |
fc |
Failed connector login |
fco |
Origin is not in the application's Allowed Origins list |
fcoa |
Failed cross-origin authentication |
fens |
Failed native social login |
fp |
Incorrect password |
fu |
Invalid email or username |
Login - Notification
| Event Code | Description |
|---|---|
w |
Warnings during login |
Login - Success
| Event Code | Description |
|---|---|
s |
Successful login |
scoa |
Successful cross-origin authentication |
sens |
Successful native social login |
Logout - Failure
| Event Code | Description |
|---|---|
flo |
User logout failed |
oidc_backchannel_logout_failed |
Failed OIDC back-channel logout request |
Logout - Success
| Event Code | Description |
|---|---|
oidc_backchannel_logout_succeeded |
Successful OIDC back-channel logout request |
slo |
User successfully logged out |
Signup - Failure
| Event Code | Description |
|---|---|
fs |
User signup failed |
Signup - Success
| Event Code | Description |
|---|---|
ss |
Successful user signup |
Silent Authentication - Failure
| Event Code | Description |
|---|---|
fsa |
Failed silent authentication |
Silent Authentication - Success
| Event Code | Description |
|---|---|
ssa |
Successful silent authentication |
Token Exchange - Failure
| Event Code | Description |
|---|---|
feacft |
Failed exchange of Authorization Code for Access Token |
feccft |
Failed exchange of Access Token for a Client Credentials Grant |
fede |
Failed exchange of Device Code for Access Token |
feoobft |
Failed exchange of Password and OOB Challenge for Access Token |
feotpft |
Failed exchange of Password and OTP Challenge for Access Token |
fepft |
Failed exchange of Password for Access Token |
fepotpft |
Failed exchange of Passwordless OTP for Access Token |
fercft |
Failed exchange of Password and MFA Recovery code for Access Token |
ferrt |
Failed exchange of Rotating Refresh Token |
fertft |
Failed exchange of Refresh Token for Access Token |
Token Exchange - Success
| Event Code | Description |
|---|---|
seacft |
Successful exchange of Authorization Code for Access Token |
seccft |
Successful exchange of Access Token for a Client Credentials Grant |
sede |
Successful exchange of Device Code for Access Token |
seoobft |
Successful exchange of Password and OOB Challenge for Access Token |
seotpft |
Successful exchange of Password and OTP Challenge for Access Token |
sepft |
Successful exchange of Password for Access Token |
sercft |
Successful exchange of Password and MFA Recovery code for Access Token |
sertft |
Successful exchange of Refresh Token for Access Token |
Management API event filters
| Filter | Description |
|---|---|
| Management API - Failure | Failed Management API events |
| Management API - Success | Successful Management API events |
Management API - Failure
| Event Code | Description |
|---|---|
fapi |
Failed Management API operation |
Management API - Success
| Event Code | Description |
|---|---|
sapi |
Successful Management API operation |
mgmt_api_read |
API GET operation returning secrets completed successfully |
System event filters
| Filter | Description |
|---|---|
| System - Notification | System notification events |
System - Notification
| Event Code | Description |
|---|---|
admin_update_launch |
Auth0 Update Launched |
api_limit |
The maximum number of requests to the Authentication or Management APIs in given time has reached |
coff |
AD/LDAP Connector is offline |
con |
AD/LDAP Connector is online and working |
depnote |
Deprecation Notice |
fcpro |
Failed to provision a AD/LDAP connector |
fui |
Failed to import users |
limit_delegation |
Rate limit exceeded to /delegation endpoint |
limit_mu |
An IP address is blocked with 100 failed login attempts using different usernames, all with incorrect passwords in 24 hours, or 50 sign-up attempts per minute from the same IP address |
limit_wc |
An IP address is blocked with 10 failed login attempts into a single account from the same IP address |
sys_os_update_start |
Auth0 OS Update Started |
sys_os_update_end |
Auth0 OS Update Ended |
sys_update_start |
Auth0 Update Started |
sys_update_end |
Auth0 Update Ended |
User/Behavioral event filters
| Filter | Description |
|---|---|
| User/Behavioral - Failure | Failed user/behavioral events |
| User/Behavioral - Notification | User/behavioral notification events |
| User/Behavioral - Success | Successful user/behavioral events |
User/Behavioral - Failure
| Event Code | Description |
|---|---|
fce |
Failed to change user email |
fcp |
Failed to change password |
fcpn |
Failed to change phone number |
fcpr |
Failed change password request |
fcu |
Failed to change username |
fd |
Failed to generate delegation token |
fdeaz |
Device authorization request failed |
fdecc |
User did not confirm device |
fdu |
Failed user deletion |
fn |
Failed to send email notification |
fv |
Failed to send verification email |
fvr |
Failed to process verification email request |
User/Behavioral - Notification
| Event Code | Description |
|---|---|
cs |
Passwordless login code has been sent |
du |
User has been deleted |
gd_enrollment_complete |
A first time MFA user has successfully enrolled using one of the factors |
gd_start_enroll |
Multi-factor authentication enroll has started |
gd_unenroll |
Device used for second factor authentication has been unenrolled |
gd_update_device_account |
Device used for second factor authentication has been updated |
ublkdu |
User block setup by anomaly detection has been released |
User/Behavioral - Success
| Event Code | Description |
|---|---|
sce |
Successfully changed user email |
scp |
Successfully changed password |
scpn |
Successfully changed phone number |
scpr |
Successful change password request |
scu |
Successfully changed username |
sdu |
User successfully deleted |
srrt |
Successfully revoked a Refresh Token |
sui |
Successfully imported users |
sv |
Successfully consumed email verification link |
svr |
Successfully called verification email endpoint, verification email in queue. |
Other
SCIM Events
| Event Code | Description |
|---|---|
sscim |
Successful SCIM operation |
fscim |
Failed SCIM operation |
Other Events
This category contains unclassified events.