System Log
Every sign-in, policy decision and admin change in IdRa: filters, transactions, export, retention and the list of event types.
Reports → System Log records every sign-in, policy decision and admin change in your organization. Click an event to see its detail.
Find events
Filter by time range, event type, outcome and free text over the actor, target, type, reason and IP. Event type is a prefix: user.session matches user.session.start and user.session.revoke. The field suggests the types listed below.
Transactions
Every event a single request or background job logs shares a transaction id. To see everything one action did, open an event and choose Show this transaction. The link form is /admin/reports/system-log?transactionId=….
- For a request, the id is the response's
X-Request-Id, so someone quoting that header leads straight to the events. IdRa always sets it: a client's ownX-Request-Idis ignored, because a caller doesn't choose what the log says. - For a background job, the id is the job's id, with type
JOB. All retries of a job share it. - A job a request queues has its own transaction.
- Events logged before this feature, and those outside any request or job, have no transaction in the console. In the API each one reports its own event id.
Choose a time range when filtering by transaction: the search isn't indexed, so long ranges in a large log are slow.
Export and retention
CSV downloads what the filters match, up to 50,000 rows. The transaction is in the data column. Settings → Account sets how long events are kept, with a minimum of 7 days. Privacy tools can erase a person from retained events: see Users.
System Log API
GET /api/v1/logs returns Okta-style LogEvent objects. See the Admin API.
| Field | Value |
|---|---|
displayMessage | The message below. A type not listed reads as itself. |
transaction | id and type (WEB or JOB) as above. |
access_request.approve | Access request approved |
access_request.cancel | Access request cancelled |
access_request.create | Access request created |
access_request.deny | Access request denied |
access_request.expire | Access request expired |
access_request.revoke | Granted access revoked |
api.authorization_server.client.link | Client linked to authorization server |
api.authorization_server.client.unlink | Client unlinked from authorization server |
api.authorization_server.create | Authorization server created |
api.authorization_server.delete | Authorization server deleted |
api.authorization_server.policy.create | Authorization server policy created |
api.authorization_server.policy.delete | Authorization server policy deleted |
api.authorization_server.policy.update | Authorization server policy updated |
api.authorization_server.update | Authorization server updated |
app.access | User access to app evaluated |
app.assignment.add | App assigned |
app.assignment.remove | App assignment removed |
app.lifecycle.activate | App activated |
app.lifecycle.create | App created |
app.lifecycle.deactivate | App deactivated |
app.lifecycle.delete | App deleted |
app.lifecycle.update | App updated |
app.oauth2.client.secret_rotate | OAuth client secret rotated |
app.oauth2.client.update | OAuth client updated |
app.oauth2.client_registration.token_create | Client registration token created |
app.oauth2.client_registration.token_revoke | Client registration token revoked |
app.oauth2.client_registration.update | Client registration settings updated |
app.oauth2.token.grant | OAuth token issued without a sign-in |
app.oauth2.token.revoke | OAuth token revoked |
app.oauth_grant.create | OAuth grant created |
app.oauth_grant.revoke | OAuth grant revoked |
app.provisioning.group_push.add | Group push added to app |
app.provisioning.group_push.remove | Group push removed from app |
app.provisioning.push | User pushed to app |
app.provisioning.update | App provisioning settings updated |
app.saml.sso | SAML sign-on to app |
app.universal_logout | Universal logout sent to app |
client.device | Computer, Mobile, Tablet or Unknown, from the user agent. An iPad that reports itself as a Mac reads as Computer. |
client.zone | The name of a network zone matching the event's IP, country or ASN, or the string "null". If several match, the first by name. Worked out from today's zones when the event is read, so editing a zone changes older events too. |
device.fleet.lock | Fleet device lock requested |
device.fleet.refetch | Fleet device refresh requested |
device.fleet.unlock | Fleet device unlock requested |
device.fleet.wipe | Fleet device wipe requested |
device.lifecycle.activate | Device activated |
device.lifecycle.deactivate | Device deactivated |
device.lifecycle.delete | Device deleted |
device.lifecycle.suspend | Device suspended |
device.mdm.create | MDM integration created |
device.mdm.delete | MDM integration deleted |
device.mdm.partial_sync | MDM sync read only part of the inventory |
device.mdm.sync | MDM integration synced |
device.mdm.sync_requested | MDM sync requested |
device.mdm.update | MDM integration updated |
device.mdm.webhook_rotate | MDM webhook secret rotated |
directory.profile_attribute.create | Profile attribute created |
directory.profile_attribute.delete | Profile attribute deleted |
directory.profile_attribute.update | Profile attribute updated |
event_hook.lifecycle.create | Event hook created |
event_hook.lifecycle.delete | Event hook deleted |
event_hook.lifecycle.update | Event hook updated |
event_hook.lifecycle.verify | Event hook verification attempted |
group.lifecycle.create | Group created |
group.lifecycle.delete | Group deleted |
group.lifecycle.update | Group updated |
group.rule.apply | Group rule applied |
group.rule.create | Group rule created |
group.rule.delete | Group rule deleted |
group.rule.update | Group rule updated |
group.user_membership.add | User added to group |
group.user_membership.remove | User removed from group |
hook_key.lifecycle.create | Hook key created |
hook_key.lifecycle.delete | Hook key deleted |
inline_hook.invoke | Inline hook called |
inline_hook.lifecycle.create | Inline hook created |
inline_hook.lifecycle.delete | Inline hook deleted |
inline_hook.lifecycle.update | Inline hook updated |
log_stream.delivery.fail | Log stream delivery started failing |
log_stream.lifecycle.create | Log stream created |
log_stream.lifecycle.delete | Log stream deleted |
log_stream.lifecycle.update | Log stream updated |
log_stream.test | Log stream test event |
pam.access_request.archive | Access requests archived before their person was deleted |
pam.secret.create | Secret created |
pam.secret.delete | Secret deleted |
pam.secret.reveal | Secret revealed |
pam.secret.update | Secret updated |
pam.server.create | Server created |
pam.server.delete | Server deleted |
pam.server.update | Server updated |
pam.ssh.ca_rotate | SSH certificate authority rotated |
pam.ssh.cert_issue | SSH certificate issued |
partner.app_grant.add | App granted to partner |
partner.app_grant.remove | App grant removed from partner |
partner.idp.delete | Partner identity provider deleted |
partner.idp.update | Partner identity provider updated |
partner.invitation.accept | Partner invitation accepted |
partner.invitation.create | Partner invitation created |
partner.invitation.revoke | Partner invitation revoked |
partner.lifecycle.create | Partner created |
partner.lifecycle.delete | Partner deleted |
partner.lifecycle.update | Partner updated |
partner.member.remove | Partner member removed |
partner.member.update | Partner member updated |
policy.admin_console.recover | Admin Console Policy rules cleared by recovery |
policy.api_rule.create | API access rule created |
policy.api_rule.delete | API access rule deleted |
policy.api_rule.update | API access rule updated |
policy.device_assurance.create | Device assurance policy created |
policy.device_assurance.delete | Device assurance policy deleted |
policy.device_assurance.update | Device assurance policy updated |
policy.device_trust.update | Device trust settings updated |
policy.lifecycle.create | Policy created |
policy.lifecycle.delete | Policy deleted |
policy.lifecycle.reorder | Policies reordered |
policy.lifecycle.update | Policy updated |
policy.rule.create | Policy rule created |
policy.rule.delete | Policy rule deleted |
policy.rule.reorder | Policy rules reordered |
policy.rule.update | Policy rule updated |
posture.check.update | Posture check updated |
posture.connector.action | Posture connector action run |
posture.connector.create | Posture connector created |
posture.connector.delete | Posture connector deleted |
posture.connector.sync | Posture connector synced |
posture.connector.update | Posture connector updated |
posture.finding.comment | Comment added to finding |
posture.finding.comment.delete | Comment deleted from finding |
posture.finding.ignore | Finding ignored |
posture.finding.notify | Finding notification sent |
posture.finding.open | Finding opened |
posture.finding.remediate | Finding remediation run |
posture.finding.reopen | Finding reopened |
posture.finding.resolve | Finding resolved |
posture.finding.ticket | Ticket created for finding |
posture.finding.update | Finding updated |
posture.identity.link | Connector account linked to person |
posture.identity.unlink | Connector account unlinked from person |
posture.run | Posture checks run |
posture.settings.update | Posture settings updated |
privacy.person.erase | Person erased from the System Log |
privacy.person.export | Person's data exported |
security.api_token.network_denied | API token refused from this network |
security.authenticator.update | Authenticator settings updated |
security.behavior_detection.update | Behavior detection settings updated |
security.captcha.update | CAPTCHA settings updated |
security.key.retire | Signing key retired |
security.key.rotate | Signing key rotated |
security.log.tamper_detected | System Log no longer matches its checkpoints |
security.notifications.update | Security notification settings updated |
security.ssf_receiver.create | Shared Signals receiver created |
security.ssf_receiver.delete | Shared Signals receiver deleted |
security.ssf_receiver.update | Shared Signals receiver updated |
security.ssf_stream.create | Shared Signals stream created |
security.ssf_stream.delete | Shared Signals stream deleted |
security.ssf_stream.rotate | Shared Signals stream credential rotated |
security.ssf_stream.subject_add | Subject added to Shared Signals stream |
security.ssf_stream.subject_remove | Subject removed from Shared Signals stream |
security.ssf_stream.update | Shared Signals stream updated |
security.ssf_stream.verify | Shared Signals stream verified |
security.threat.detected | Threat detected |
security.threat.response | Threat response run |
security.threat_insight.refresh | ThreatInsight feed refreshed |
security.threat_insight.update | ThreatInsight settings updated |
security.threat_protection.update | Identity Threat Protection settings updated |
security.universal_logout.delete | Universal logout configuration deleted |
security.universal_logout.update | Universal logout configuration updated |
security.zone.create | Network zone created |
security.zone.delete | Network zone deleted |
security.zone.update | Network zone updated |
settings.email_template.reset | Email template reset |
settings.email_template.update | Email template updated |
system.account.update | Account settings updated |
system.api_token.create | API token created |
system.api_token.revoke | API token revoked |
system.branding.update | Branding updated |
system.domain.add | Custom domain added |
system.domain.cookie_domain | Cookie domain changed |
system.domain.primary | Primary domain changed |
system.domain.remove | Custom domain removed |
system.domain.verify | Custom domain verified |
system.idp.domain_proof.add | Domain ownership proof started |
system.idp.domain_proof.remove | Domain ownership proof removed |
system.idp.domain_proof.verify | Domain ownership verified |
system.idp.lifecycle.create | Identity provider created |
system.idp.lifecycle.delete | Identity provider deleted |
system.idp.lifecycle.update | Identity provider updated |
system.idp.linking.update | Identity provider account linking updated |
system.idp.routing_rule.create | Identity provider routing rule created |
system.idp.routing_rule.delete | Identity provider routing rule deleted |
system.idp.routing_rule.update | Identity provider routing rule updated |
system.log.checkpoint | System Log checkpoint sealed |
system.log.verify | System Log integrity verified |
system.oauth_token.use | Service app token used on the management API |
system.retention.purge | Expired log events and jobs purged |
system.scim.connection.create | SCIM connection created |
system.scim.connection.revoke | SCIM connection revoked |
system.scim.connection.rotate | SCIM connection token rotated |
system.setup.complete | Setup guide completed |
system.setup.dismiss | Setup guide dismissed |
system.setup.start | Setup guide started |
system.setup.step_done | Setup step completed |
system.setup.step_skipped | Setup step skipped |
user.account.clear_sessions | User's sessions cleared |
user.account.privilege.grant | Admin role granted to user |
user.account.privilege.revoke | Admin role revoked from user |
user.account.report_suspicious_activity_by_enduser | User reported suspicious activity |
user.account.reset_authenticators | User's authenticators reset |
user.account.reset_password | User's password reset |
user.account.unlock | User account unlocked |
user.account.update_password | User changed their password |
user.account.update_profile | User profile updated |
user.authentication.auth_via_mfa | User authenticated with a factor |
user.device.compliance_change | User's device compliance changed |
user.import.activate | Imported people activated |
user.import.complete | People import completed |
user.import.start | People import started |
user.lifecycle.activate | User activated |
user.lifecycle.create | User created |
user.lifecycle.deactivate | User deactivated |
user.lifecycle.delete | User deleted |
user.lifecycle.reactivate | User reactivated |
user.lifecycle.suspend | User suspended |
user.lifecycle.unsuspend | User unsuspended |
user.mfa.factor.activate | Factor enrolled |
user.mfa.factor.deactivate | Factor removed |
user.mfa.factor.reset_all | All of a user's factors reset |
user.mfa.okta_verify.deny_push | User denied a push challenge |
user.mfa.verify | User verified with MFA |
user.risk.change | User risk level changed |
user.risk.detect | User risk detected |
user.risk.reset | User risk reset |
user.session.impersonation.end | Impersonation ended |
user.session.impersonation.start | Impersonation started |
user.session.revoke | User session revoked |
user.session.start | User signed in |
user.session.universal_logout | User signed out everywhere by universal logout |