10.9.2. Event attributes

Every event object carries a number of attributes that document various aspects of the event:

Event attributes
Description
The core information provided by an event.
A unique identifier for the event.
Information on the event producer.
Information about the request that caused the event to be triggered.

Event object data

Event object data are the core information provided by an event. All end-user notification events have in common that they provide the username concerned by the event as well as additional information depending on the concrete use case. This could for example be a device ID, when an Airlock 2FA device is activated, or the reason why a user has been locked.

A full list of all events including their event data is listed below:

Event
Semantic
Event Data
Information
Description
Example
USER_LOCKED
User account was locked
Username
Username concerned by the event
jdoe
Lock reason
Reason why the user's account was locked
TOO_MANY_LOGIN_FAILED
AUTHENTICATION_FLOW_SUCCESSFULLY_COMPLETED
User completed an authentication flow
Username
Username concerned by the event
jdoe
Authentication Methods
List of authentication methods used during the authentication flow
[PASSWORD, MTAN]
PASSWORD_CHANGED
User changes his or her password
Username
Username concerned by the event
jdoe
AIRLOCK_2FA_DEVICE_ACTIVATED
User activated a new Airlock 2FA device
Username
Username concerned by the event
jdoe
Account ID
User's Airlock 2FA account ID
7adc0abe-4820-4ba8-b8ea-a3eaa2860eb6
Device ID
ID of activated Airlock 2FA device
02286500-87c2-43da-9b32-d514a18500af
AIRLOCK_2FA_DEVICE_DELETED
An Airlock 2FA device was deleted
Username
Username concerned by the event
jdoe
Account ID
User's Airlock 2FA account ID
7adc0abe-4820-4ba8-b8ea-a3eaa2860eb6
Device ID
ID of deleted Airlock 2FA device
02286500-87c2-43da-9b32-d514a18500af
CRONTO_DEVICE_ACTIVATED
User activated a new Cronto device
Username
Username concerned by the event
jdoe
Device ID
ID of activated Cronto device
TCXCN
CRONTO_DEVICE_DELETED
A Cronto device was deleted
Username
Username concerned by the event
jdoe
Device ID
ID of deleted Cronto device
TCXCN
FIDO_CREDENTIAL_REGISTERED
User registered a new FIDO security key
Username
Username concerned by the event
jdoe
Relying Party ID
Configured identifier of the relying party
virtinc.com
Credential ID
Binary data (Base64url encoded) provided by the FIDO authenticator during registration
crnfqvenr5vvNKBn9m[...]
FIDO_CREDENTIAL_DELETED
FIDO credential was deleted
Username
Username concerned by the event
jdoe
Internal Credential ID
Internal identifier of deleted FIDO credential
87e82979-a85b-42bb-8cb2-2c3c029fd3d7
MTAN_TOKEN_REGISTERED
User registered a new mobile phone number
Username
Username concerned by the event
jdoe
Number ID
Identifier for the registered mobile phone number
1
MTAN_TOKEN_DELETED
Mobile phone number was deleted
Username
Username concerned by the event
jdoe
Number ID
Identifier for the registered mobile phone number
1

Event identification data

Every event provides information to uniquely identify a concrete instance.

Event identification data
Information
Description
Example
ID
Identifier which uniquely identifies this event
b0207ba5-baab-4adf-9c57-6cd29f715dff
Timestamp
Instant when the event was created
2021-03-18 11:43

Event source data

Every event provides information about the source creating this particular instance. Depending on where the event originated from (e.g., Adminapp or Authentication Flow in the Loginapp), different information may be provided that we list below.

Note that every instance of an event has exactly one source.

Event source data
Source
Information
Description
Example
Adminapp
Administrator's username
Name of the administrator who produced the event
admin
Authentication Flow
Configuration Context
The configuration context in which this event was produced
[DEFAULT]
Application ID
Configured application ID for this authentication flow
demo
Flow ID
ID of this authentication flow. For non-custom authentication flows, the value is always default.
default
Non-Authentication Flow (e.g., Protected Self-Service Flow)
Configuration Context
The configuration context in which this event was produced
[DEFAULT]
Flow ID
Configured identifier of this flow
password-change
Authentication Flow Step
Configuration Context
The configuration context in which this event was produced
[DEFAULT]
Application ID
Configured application ID for this authentication flow
demo
Flow ID
ID of this authentication flow. For non-custom authentication flows, the value is always default.
default
Step ID
Identifier for this step if configured
pwcheck
Non-Authentication Flow Step
Configuration Context
The configuration context in which this event was produced
[DEFAULT]
Flow ID
Configured identifier of this flow
password-change
Step ID
Identifier for this step if configured
pwchange

Event metadata

Every event provides information about the request leading to its creation.

Event Metadata
Metadata Item
Description
Example
User Agent
Raw value of the User-Agent request header
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:86.0) Gecko/20100101 Firefox/86.0
Request IP
IP address of the request
192.168.0.1