Audit log event catalog

This page lists the events recorded in the audit logs, as they appear in the Event column and in the Event type filter. The technical name, in monospace, is the one used by the API.

Users

Event	Technical name	Recorded when
Organization user created	MEMBERSHIP_CREATED	A user is added, provisioned through SCIM, or creates the organization.
Organization user updated	MEMBERSHIP_UPDATED	A user’s profile, role or status changes. The entry includes the changes.
Organization user deleted	MEMBERSHIP_DELETED	A user is deleted from the organization.
User invitation sent	MEMBERSHIP_INVITE_CREATED	A guest is invited.
User invitation accepted	MEMBERSHIP_INVITE_ACCEPTED	A guest accepts the invitation.
User invitation declined	MEMBERSHIP_INVITE_REJECTED	A guest declines the invitation.
User active session ended	MEMBERSHIP_SESSION_REVOKED	An administrator ends one of a managed user’s sessions.
All user active sessions ended	MEMBERSHIP_ALL_ACTIVE_SESSIONS_REVOKED	An administrator ends all of a managed user’s sessions.

Accounts (managed users only)

These events are about the person’s own BreezeAuth account. They are recorded only for managed users, in the organization that manages them.

Event	Technical name	Recorded when
User signed in	USER_LOGGED_IN	The person signs in to BreezeAuth.
User authentication failed	USER_LOGIN_FAILED	A sign-in fails because of a wrong password, passkey or MFA code.
User signed out	USER_LOGGED_OUT	The person signs out.
User password updated	USER_PASSWORD_UPDATED	The person changes their password.
User MFA enabled	USER_MFA_ENABLED	The person sets up multi-factor authentication.
User MFA disabled	USER_MFA_DISABLED	The person, or an administrator, removes MFA.
User passkey registered	USER_PASSKEY_REGISTERED	The person adds a passkey.
User passkey removed	USER_PASSKEY_REMOVED	The person removes a passkey.

Groups

Event	Technical name	Recorded when
Group created	GROUP_CREATED	A group is created, in the admin console or through SCIM.
Group updated	GROUP_UPDATED	A group’s name, identifier or description changes.
Group deleted	GROUP_DELETED	A group is deleted.
Member added to group	GROUP_ASSIGNMENT_CREATED	A user or another group is added to a group.
Member removed from group	GROUP_ASSIGNMENT_DELETED	A user or another group is removed from a group.

Applications

Event	Technical name	Recorded when
Application created	APPLICATION_CREATED	An application is added.
Application updated	APPLICATION_UPDATED	An application’s configuration changes.
Application deleted	APPLICATION_DELETED	An application is deleted.
Application attribute mapping created	APPLICATION_ATTRIBUTE_MAPPING_CREATED	An attribute sent to the application is added.
Application attribute mapping updated	APPLICATION_ATTRIBUTE_MAPPING_UPDATED	An attribute mapping changes.
Application attribute mapping removed	APPLICATION_ATTRIBUTE_MAPPING_DELETED	An attribute mapping is removed.
Application signing certificate created	APPLICATION_SIGN_CERTIFICATE_CREATED	A signing certificate is added to an application.
Application signing certificate updated	APPLICATION_SIGN_CERTIFICATE_UPDATED	A signing certificate changes.
Application signing certificate deleted	APPLICATION_SIGN_CERTIFICATE_DELETED	A signing certificate is deleted.
Application allowed network zone created	APPLICATION_ALLOWED_NETWORK_ZONE_CREATED	A network zone is added to the application’s network restriction.
Application allowed network zone deleted	APPLICATION_ALLOWED_NETWORK_ZONE_DELETED	A network zone is removed from the application’s network restriction.
Application assignment created	MEMBERSHIP_APPLICATION_ASSIGNMENT_CREATED	A user is given access to an application.
Application assignment updated	MEMBERSHIP_APPLICATION_ASSIGNMENT_UPDATED	A user’s roles or attributes in an application change.
Application assignment removed	MEMBERSHIP_APPLICATION_ASSIGNMENT_DELETED	A user’s direct access to an application is removed.
Group application assignment created	GROUP_APPLICATION_ASSIGNMENT_CREATED	A group is given access to an application.
Group application assignment updated	GROUP_APPLICATION_ASSIGNMENT_UPDATED	A group’s roles or attributes in an application change.
Group application assignment removed	GROUP_APPLICATION_ASSIGNMENT_DELETED	A group’s access to an application is removed.
SAML2 access started	APPLICATION_SAML2_ACCESS_STARTED	A person is allowed to sign in to a SAML application through BreezeAuth.

Service users

Event	Technical name	Recorded when
Service user created	SERVICE_MEMBERSHIP_CREATED	A service user is created.
Service user updated	SERVICE_MEMBERSHIP_UPDATED	A service user’s name, role or status changes.
Service user deleted	SERVICE_MEMBERSHIP_DELETED	A service user is deleted.
Service user credential created	SERVICE_USER_CREDENTIAL_CREATED	A credential is created.
Service user credential updated	SERVICE_USER_CREDENTIAL_UPDATED	A credential is renamed, its expiration changes, or it is activated or deactivated.
Service user credential deleted	SERVICE_USER_CREDENTIAL_DELETED	A credential is deleted.
Service user credential used	SERVICE_USER_CREDENTIAL_USED	A credential is used to obtain an access token.

Organization

Event	Technical name	Recorded when
Organization created	ORGANIZATION_CREATED	The organization is created.
Organization updated	ORGANIZATION_UPDATED	Any organization setting changes, including the application lock. The entry includes the changes.
Organization allowed network zone created	ORGANIZATION_ALLOWED_NETWORK_ZONE_CREATED	A network zone is added to the organization’s network restriction.
Organization allowed network zone deleted	ORGANIZATION_ALLOWED_NETWORK_ZONE_DELETED	A network zone is removed from the organization’s network restriction.
All organization active sessions ended	ORGANIZATION_ALL_ACTIVE_SESSIONS_REVOKED	An administrator selects End sessions on the Incident response tab.
Password update required for everyone	ORGANIZATION_PASSWORD_UPDATE_ENFORCED	An administrator selects Force password change on the Incident response tab.
Network zone created	NETWORK_ZONE_CREATED	A network zone is created.
Network zone updated	NETWORK_ZONE_UPDATED	A network zone’s name or addresses change.
Network zone deleted	NETWORK_ZONE_DELETED	A network zone is deleted.

Domains and webhooks

Event	Technical name	Recorded when
Domain created	DOMAIN_CREATED	A domain is added.
Domain verification started	DOMAIN_VERIFICATION_ATTEMPT_STARTED	An administrator selects Start verification.
Domain verified	DOMAIN_VERIFIED	BreezeAuth finds the DNS record and verifies the domain. The actor is System.
Domain updated	DOMAIN_UPDATED	A verification attempt ends without finding the DNS record. The actor is System.
Domain deleted	DOMAIN_DELETED	A domain is deleted.
Webhook created	WEBHOOK_CREATED	A webhook is created.
Webhook updated	WEBHOOK_UPDATED	A webhook’s name, URL, events or status change.
Webhook deleted	WEBHOOK_DELETED	A webhook is deleted.

The Entity / Resource column is empty for domain and webhook events: the event name tells you what changed.