Event attributes

Every event carries a number of attributes that document various aspects of the event. The event attributes are structured in the following categories:

Event attributes

Description

The core information provided by an event.

A unique identifier for the event.

Information on the event producer.

Information about the request that caused the event to be triggered.

Event object data

Event object data are the core information provided by an event. All end-user notification events have in common that they provide the username concerned by the event as well as additional information depending on the concrete use case. This could for example be a device ID, when an Airlock 2FA device is activated, or the reason why a user has been locked.

A full list of all events including their event data is listed below:

Event

Description

Event Data

Attribute

Description

Example

Airlock 2FA Device Activated

User activated a new Airlock 2FA device

event.data.userId

Username concerned by the event

jdoe

event.data.airlock2FAAccountId

User's Airlock 2FA account ID

7adc0abe-4820-4ba8-b8ea-a3eaa2860eb6

event.data.airlock2FADeviceId

ID of activated Airlock 2FA device

02286500-87c2-43da-9b32-d514a18500af

Airlock 2FA Device Deleted

An Airlock 2FA device was deleted

event.data.userId

Username concerned by the event

jdoe

event.data.airlock2FAAccountId

User's Airlock 2FA account ID

7adc0abe-4820-4ba8-b8ea-a3eaa2860eb6

event.data.airlock2FADeviceId

ID of deleted Airlock 2FA device

02286500-87c2-43da-9b32-d514a18500af

Authentication Flow Successfully Completed

User completed an authentication flow

event.data.userId

Username concerned by the event

jdoe

event.data.authenticationMethods

List of authentication methods used during the authentication flow

[PASSWORD, MTAN]

Context Data Changed

Context data of a user has been changed

event.data.userId

Username concerned by the event

jdoe

event.data.contextDataChanged.<context-data-key>.oldValue

Original value of the context data item

Bridge Road

event.data.contextDataChanged.<context-data-key>.newValue

New value of the context data item

Castle Road

Cronto Device Activated

User activated a new Cronto device

event.data.userId

Username concerned by the event

jdoe

event.data.crontoDeviceId

ID of activated Cronto device

TCXCN

Cronto Device Deleted

A Cronto device was deleted

event.data.userId

Username concerned by the event

jdoe

event.data.crontoDeviceId

ID of deleted Cronto device

TCXCN

Device Token Deleted

A device token was deleted

event.data.userId

Username concerned by the event

jdoe

event.data.deviceTokenId

ID of the deleted device token

1234

Device Token Registered

A device token was registered

event.data.deviceTokenId

ID of the newly registered device token

1234

Email Address Added

An Email address was added to the account

event.data.userId

Username concerned by the event

jdoe

event.data.newEmailAddress

Newly added email address

test@example.com

Email Address Changed

The email address of the account was changed

event.data.userId

Username concerned by the event

jdoe

event.data.oldEmailAddress

Original value of the email address

old@example.com

event.data.newEmailAddress

New value of the email address

new@example.com

Email Address Deleted

The email address of the account was removed

event.data.userId

Username concerned by the event

jdoe

event.data.oldEmailAddress

Deleted email address

test@example.com

FIDO Credential Registered

User registered a new FIDO security key

event.data.userId

Username concerned by the event

jdoe

event.data.fidoRelyingPartyId

Configured identifier of the relying party

virtinc.com

event.data.fidoPublicKeyCredentialId

Binary data (Base64url encoded) provided by the FIDO authenticator during registration

crnfqvenr5vvNKBn9m[...]

FIDO Credential Deleted

FIDO credential was deleted

event.data.userId

Username concerned by the event

jdoe

event.data.fidoCredentialId

Internal identifier of deleted FIDO credential

87e82979-a85b-42bb-8cb2-2c3c029fd3d7

Logged in from new Device

A user logged in from a previously unknown browser or device.

event.data.userId

Username concerned by the event

jdoe

event.data.browser

Short name used of the browser.

Safari

event.data.operatingSystem

Short name of the operating system.

Mac OS X

event.data.device

Short name of the device.

Mac

event.data.countryCode

Code of the country (if geo location available).

CH

event.data.city

Name of the city (if geo location available).

Bern

MTAN Token Deleted

Mobile phone number was deleted

event.data.userId

Username concerned by the event

jdoe

event.data.mtanNumberId

Identifier of the mobile phone number to be deleted

1

event.data.mtanOldPhoneNumber

The phone number to be deleted

0791111111

MTAN Token Phone Number Changed

Mobile phone number was changed

event.data.userId

Username concerned by the event

jdoe

event.data.mtanNumberId

Identifier for the registered mobile phone number

1

event.data.mtanOldPhoneNumber

previously registered modile phone number

0791111111

event.data.mtanNewPhoneNumber

newly registered mobile phone number

0792222222

MTAN Token Registered

User registered a new mobile phone number

event.data.userId

Username concerned by the event

jdoe

event.data.mtanNumberId

Identifier for the registered mobile phone number

1

event.data.mtanNewPhoneNumber

The phone number to be registered

0791111111

User Created

New user was created

event.data.userId

Username concerned by the event.

jdoe

Password Changed

User changes his or her password

event.data.userId

Username concerned by the event

jdoe

User Locked

User account was locked

event.data.userId

Username concerned by the event.

jdoe

event.data.lockReason

Reason why the user's account was locked.

TOO_MANY_LOGIN_FAILED

User Unlocked

User account was unlocked

event.data.userId

Username concerned by the event.

jdoe

User Deleted

User was deleted

event.data.userId

Username concerned by the event.

jdoe

Event identification data

Every event provides information to identify a concrete instance uniquely.

Event identification data

Attribute

Description

Example

event.id

Identifier which uniquely identifies this event.

b0207ba5-baab-4adf-9c57-6cd29f715dff

event.createdAt

The instant when the event was created.

2021-03-18 11:43

Event source data

Every event provides information about the source creating this particular instance. Depending on where the event originated from (e.g., Adminapp or Authentication Flow in the Loginapp), different information may be provided that we list below.

Note that every instance of an event has exactly one source.

Event source data

Source

Attribute

Description

Example

Adminapp

event.source.adminId

Name of the administrator who produced the event

admin

Authentication Flow

event.source.configurationContext

The configuration context in which this event was produced

[DEFAULT]

event.source.applicationId

Configured application ID for this authentication flow

demo

event.source.flowId

ID of this authentication flow. For non-custom authentication flows, the value is always default.

default

Non-Authentication Flow (e.g., Protected Self-Service Flow)

event.source.configurationContext

The configuration context in which this event was produced

[DEFAULT]

event.source.flowId

Configured identifier of this flow

password-change

Authentication Flow Step

event.source.configurationContext

The configuration context in which this event was produced

[DEFAULT]

event.source.applicationId

Configured application ID for this authentication flow

demo

event.source.flowId

ID of this authentication flow. For non-custom authentication flows, the value is always default.

default

event.source.stepId

Identifier for this step if configured

pwcheck

Non-Authentication Flow Step

event.source.configurationContext

The configuration context in which this event was produced

[DEFAULT]

event.source.flowId

Configured identifier of this flow

password-change

event.source.stepId

Identifier for this step if configured

pwchange

Event metadata

Every event provides information about the request leading to its creation.

Event Metadata

Attribute

Description

Example

event.metadata.userAgent

Raw value of the User-Agent request header

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:86.0) Gecko/20100101 Firefox/86.0

event.metadata.requestIp

IP address of the request

192.168.0.1