Event reference

Customer events are delivered to subscribed webhook endpoints in one common envelope. Only the event types listed here are published; each type has its own page.

Event envelope

Every event carries these top-level members. The data.object member holds the changed resource; its content depends on the payload mode (thin carries identifiers, changed_fields and state fields, full carries the management API representation of the resource).

Member Type Required
id string Yes
type string Yes
schema_version integer Yes
environment_id string Yes
occurred_at string Yes
recorded_at string Yes
seq integer Yes
data object Yes
context object Yes

Event types

Users

Event type Schema version Release wave
user.blocked 1 GA
user.created 1 GA
user.deleted 1 GA
user.email_verified 1 GA
user.identity_linked 1 GA
user.identity_unlinked 1 GA
user.locked 1 GA
user.password_changed 1 GA
user.sessions_revoked 1 GA
user.unblocked 1 GA
user.unlocked 1 GA
user.updated 1 GA

Sessions and sign-in

Event type Schema version Release wave
authentication.failed 1 GA
authentication.succeeded 1 GA
session.created 1 GA
session.revoked 1 GA
token.revoked 1 GA

Organizations

Event type Schema version Release wave
organization.created 1 GA
organization.deleted 1 GA
organization.updated 1 GA
organization_domain.verification_failed 1 GA
organization_domain.verified 1 GA
organization_membership.created 1 GA
organization_membership.deleted 1 GA
organization_membership.updated 1 GA

Roles

Event type Schema version Release wave
role.created 1 GA
role.deleted 1 GA
role.updated 1 GA

Invitations

Event type Schema version Release wave
invitation.accepted 1 GA
invitation.created 1 GA
invitation.expired 1 GA
invitation.revoked 1 GA

Connections (SSO)

Event type Schema version Release wave
connection.activated 1 GA
connection.certificate_expiry_warned 1 GA
connection.deactivated 1 GA
connection.deleted 1 GA

Directories (SCIM)

Event type Schema version Release wave
directory.activated 1 GA
directory.deactivated 1 GA
directory.deleted 1 GA
directory_group.created 1 GA
directory_group.deleted 1 GA
directory_group.updated 1 GA
directory_group.user_added 1 GA
directory_group.user_removed 1 GA
directory_user.created 1 GA
directory_user.deleted 1 GA
directory_user.updated 1 GA

Authenticators

Event type Schema version Release wave
authenticator.enrolled 1 GA
authenticator.removed 1 GA

Keys and credentials

Event type Schema version Release wave
api_key.expiry_warned 1 GA
api_key.revoked 1 GA
signing_key.rotated 1 GA

Message delivery

Event type Schema version Release wave
email.delivery_failed 1 GA
sms.delivery_failed 1 GA

Extensibility

Event type Schema version Release wave
hook.circuit_closed 1 GA
hook.circuit_opened 1 GA

Management audit

Event type Schema version Release wave
audit_export.completed 1 GA
audit_export.failed 1 GA

Other events

Event type Schema version Release wave
account_recovery.cancelled 1 -
account_recovery.completed 1 -
account_recovery.started 1 -
api.created 1 -
api.deleted 1 -
api.updated 1 -
api_key.created 1 -
application.created 1 -
application.deleted 1 -
application.health_degraded 1 -
application.redirect_uri_mismatch_detected 1 -
application.suspended 1 GA-2
application.updated 1 -
application_assignment.created 1 -
application_assignment.deleted 1 -
application_credential.created 1 GA
application_credential.revoked 1 GA
attack_mode.activated 1 -
attack_mode.deactivated 1 -
attack_protection.mode_changed 1 -
attack_protection.updated 1 -
authenticator.flagged 1 -
breached_password.detected 1 -
ciba_request.approved 1 GA+1
ciba_request.created 1 GA+1
ciba_request.denied 1 GA+1
ciba_request.expired 1 GA+1
connected_account.created 1 GA+1
connected_account.deleted 1 GA+1
connected_account.reauth_required 1 GA+1
connection.created 1 -
connection.ldap_agent_unavailable 1 -
connection.replay_burst_detected 1 -
connection.restored 1 -
connection.sp_certificate_rotation_started 1 -
connection.test_completed 1 -
connection.updated 1 -
consent.granted 1 -
consent.revoked 1 -
consent_record.created 1 -
custom_domain.activated 1 -
custom_domain.certificate_failed 1 -
custom_domain.certificate_renewal_failed 1 -
custom_domain.degraded 1 -
custom_domain.disabled 1 -
custom_domain.verified 1 -
directory.agent_health_degraded 1 -
directory.deprovision_held 1 -
directory.token_anomaly_detected 1 -
directory.token_expiry_warned 1 -
email_sender_domain.degraded 1 GA
email_sender_domain.verified 1 GA
email_sending.suspended 1 GA
environment.issuer_changed 1 -
hook.execution_failed 1 -
invitation.resent 1 -
ip_address.throttled 1 -
legal_document.published 1 -
log_stream.paused 1 GA-2
log_stream.resumed 1 GA-2
org_custom_role_permissions.updated 1 -
organization_app_request.approved 1 GA-2
organization_app_request.created 1 GA-2
organization_app_request.denied 1 GA-2
organization_application.disabled 1 -
organization_application.enabled 1 -
organization_domain.created 1 -
organization_domain.deleted 1 -
organization_domain.revoked 1 -
organization_domain.updated 1 -
passkey_rp_id.migration_completed 1 -
passkey_rp_id.migration_started 1 -
password.changed 1 -
password_reset.completed 1 -
password_reset.requested 1 -
password_reset.scheduled 1 -
privacy_request.completed 1 -
privacy_request.created 1 -
privacy_request.deadline_passed 1 -
privacy_request.deadline_warned 1 -
recovery_code.used 1 -
recovery_codes.regenerated 1 -
session.anomaly_detected 1 -
signing_key.revoked 1 -
signup.blocked 1 -
sms.daily_cap_reached 1 -
sms_country.paused 1 -
sms_country.resumed 1 -
support_access_grant.created 1 -
support_access_grant.expired 1 -
support_access_grant.revoked 1 -
token_exchange_policy.created 1 GA-2
token_exchange_policy.deleted 1 GA-2
token_exchange_policy.updated 1 GA-2
user.data_exported 1 -
user.deletion_cancelled 1 -
user.deletion_scheduled 1 -
user.impersonation_ended 1 -
user.impersonation_started 1 -
user_deletion_job.completed 1 -
user_export.completed 1 -
user_import.completed 1 -
webhook.delivery_failed 1 -
webhook_endpoint.disabled 1 -