Event attributes

Every event object carries a number of attributes that document various aspects of the event:

Event attributes

Description

The core information provided by an event.

A unique identifier for the event.

Information on the event producer.

Information about the request that caused the event to be triggered.

Event object data

Event object data are the core information provided by an event. All end-user notification events have in common that they provide the username concerned by the event as well as additional information depending on the concrete use case. This could for example be a device ID, when an Airlock 2FA device is activated, or the reason why a user has been locked.

A full list of all events including their event data is listed below:

Event

Semantic

Event Data

Information

Description

Example

User Locked

User account was locked

Username

Username concerned by the event

jdoe

Lock reason

Reason why the user's account was locked

TOO_MANY_LOGIN_FAILED

Authentication Flow Successfully Completed

User completed an authentication flow

Username

Username concerned by the event

jdoe

Authentication Methods

List of authentication methods used during the authentication flow

[PASSWORD, MTAN]

Password Changed

User changes his or her password

Username

Username concerned by the event

jdoe

Airlock 2FA Device Activated

User activated a new Airlock 2FA device

Username

Username concerned by the event

jdoe

Account ID

User's Airlock 2FA account ID

7adc0abe-4820-4ba8-b8ea-a3eaa2860eb6

Device ID

ID of activated Airlock 2FA device

02286500-87c2-43da-9b32-d514a18500af

Airlock 2FA Device Deleted

An Airlock 2FA device was deleted

Username

Username concerned by the event

jdoe

Account ID

User's Airlock 2FA account ID

7adc0abe-4820-4ba8-b8ea-a3eaa2860eb6

Device ID

ID of deleted Airlock 2FA device

02286500-87c2-43da-9b32-d514a18500af

Cronto Device Activated

User activated a new Cronto device

Username

Username concerned by the event

jdoe

Device ID

ID of activated Cronto device

TCXCN

Cronto Device Deleted

A Cronto device was deleted

Username

Username concerned by the event

jdoe

Device ID

ID of deleted Cronto device

TCXCN

FIDO Credential Registered

User registered a new FIDO security key

Username

Username concerned by the event

jdoe

Relying Party ID

Configured identifier of the relying party

virtinc.com

Credential ID

Binary data (Base64url encoded) provided by the FIDO authenticator during registration

crnfqvenr5vvNKBn9m[...]

FIDO Crendetial Deleted

FIDO credential was deleted

Username

Username concerned by the event

jdoe

Internal Credential ID

Internal identifier of deleted FIDO credential

87e82979-a85b-42bb-8cb2-2c3c029fd3d7

MTAN Token Registered

User registered a new mobile phone number

Username

Username concerned by the event

jdoe

Number ID

Identifier for the registered mobile phone number

1

MTAN Token Deleted

Mobile phone number was deleted

Username

Username concerned by the event

jdoe

Number ID

Identifier for the registered mobile phone number

1

Event identification data

Every event provides information to uniquely identify a concrete instance.

Event identification data

Information

Description

Example

ID

Identifier which uniquely identifies this event

b0207ba5-baab-4adf-9c57-6cd29f715dff

Timestamp

Instant when the event was created

2021-03-18 11:43

Event source data

Every event provides information about the source creating this particular instance. Depending on where the event originated from (e.g., Adminapp or Authentication Flow in the Loginapp), different information may be provided that we list below.

Note that every instance of an event has exactly one source.

Event source data

Source

Information

Description

Example

Adminapp

Administrator's username

Name of the administrator who produced the event

admin

Authentication Flow

Configuration Context

The configuration context in which this event was produced

[DEFAULT]

Application ID

Configured application ID for this authentication flow

demo

Flow ID

ID of this authentication flow. For non-custom authentication flows, the value is always default.

default

Non-Authentication Flow (e.g., Protected Self-Service Flow)

Configuration Context

The configuration context in which this event was produced

[DEFAULT]

Flow ID

Configured identifier of this flow

password-change

Authentication Flow Step

Configuration Context

The configuration context in which this event was produced

[DEFAULT]

Application ID

Configured application ID for this authentication flow

demo

Flow ID

ID of this authentication flow. For non-custom authentication flows, the value is always default.

default

Step ID

Identifier for this step if configured

pwcheck

Non-Authentication Flow Step

Configuration Context

The configuration context in which this event was produced

[DEFAULT]

Flow ID

Configured identifier of this flow

password-change

Step ID

Identifier for this step if configured

pwchange

Event metadata

Every event provides information about the request leading to its creation.

Event Metadata

Metadata Item

Description

Example

User Agent

Raw value of the User-Agent request header

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:86.0) Gecko/20100101 Firefox/86.0

Request IP

IP address of the request

192.168.0.1