## Audit logs Audit logs record who did what, and when, across your Frontegg environment. Frontegg writes an audit entry when a user, an administrator, or an API client changes users, accounts, security settings, or other configuration, and for key authentication events such as successful and failed logins. This page explains where to find audit logs, how events appear, and lists the audit events that Frontegg records. ### Where to view audit logs Audit logs are available in two places: - **Self-service portal** → Audit logs. Your customers see the audit entries for their own account. For more information, see [Audit logs in the self-service portal](/ciam/guides/admin-portal/workspace-modules#audit-logs). - **Environment portal** → Audit trail. You see the entries for the whole environment, including actions that are not tied to a specific account. You can filter by account. By default, each entry shows the following columns: | Column | Description | | --- | --- | | Time | When the action happened. | | User | The user, or the system actor, that performed the action. | | Resource | The resource that the action affected. | | Action | The name of the event. The names are listed in this page. | | Severity | How significant the event is. See [Severity levels](#severity-levels). | | IP address | The IP address that the request came from. | You can search the list and filter it by time range. In the self-service portal you can also filter by severity and download the entries as a CSV file. You can change which columns the self-service portal shows in the Frontegg builder. Permissions and retention To read audit logs, a user needs the `fe.secure.read.audits` permission. By default, audit logs are kept for 30 days, and older entries are deleted. The retention period is configurable per environment. ### Severity levels Each audit entry has a severity: **Info**, **Medium**, **High**, or **Critical**. Almost all events are recorded with **Info** severity. The following events use a higher severity: | Action | Severity | | --- | --- | | `User failed to login` | High | | `Webhook disabled` | High | | `Public key deleted` | Medium | | `private_key_jwt assertion rejected` | Medium | | `Webhook paused` | Medium | ### How events appear The following behaviors affect which entries you see and how the **Action** column reads. - **Custom audits are not part of this catalog.** You can send your own application audits to Frontegg, and they appear alongside Frontegg events. Their action names are defined by you. For more information, see [Add custom audit logs](/ciam/guides/admin-portal/workspace-modules#add-custom-audit-logs). - **The Action column shows the stored name.** Frontegg does not translate or relabel events, so the names in this page match what you see in the portal. - **Impersonated actions have a prefix.** When someone performs an action while [impersonating a user](/ciam/guides/management/manage-users/impersonation), the action is recorded as `Impersonated by - `, where `` is the email address of the person who impersonates. These entries always appear in the environment Audit trail. They appear in an account's self-service audit logs only when you turn on **Send audit logs to accounts** in the impersonation settings. - **Delegated actions are renamed.** When a user acts on behalf of another user through delegation, the action is recorded as `Delegated to ` instead of the original action name. - **Only successful operations are recorded.** Events that are recorded when an API call finishes are not created when the call fails. The exception is `User failed to login`, which is recorded for a failed password login. - **Environment-level actions appear in the Audit trail.** Actions performed with an environment (vendor) token, such as creating a tenant through the management API, are recorded without an account. They appear in the environment Audit trail, not in a specific account's self-service audit logs. - **Feature flag events are environment-only.** Feature flag events are recorded without an account and appear in the environment only. - **Some events embed a value in the name.** Where the name contains a value that changes per entry, the catalog shows it in angle brackets, for example ``. - **Some events are optional.** Events that depend on a feature, such as `private_key_jwt` authentication, are recorded only when the feature is enabled for your environment. Tenant events and feature flag events can also be turned off for an environment. - **Some actors are not recorded.** Actions performed by super users and hidden (invisible) users do not create entries. ### Audit events catalog The catalog is grouped by area. In every table, the **Action** column shows the exact name that appears in the portal. #### Authentication and sessions | Action | Description | Triggered when | | --- | --- | --- | | `User logged in` | A user signed in to your application. | A user logs in successfully with a password, SSO (SAML or OIDC), or a social login, or completes MFA. A single login can create more than one entry, for example one for the password and one for MFA. | | `User failed to login` | A user failed to sign in with a password. | A user enters a wrong password. Other failed-login reasons appear in the [environment logs](/ciam/guides/monitoring/events-overview), not in audit logs. | | `User logged out` | A user signed out of the application. | A user logs out of their own session. | | `User's session was revoked` | A user's session was ended by someone other than the user. | An administrator or another actor revokes a user's session. | | `User was logged out` | A user was signed out automatically. | The user's session ends because of the concurrent sessions limit or the session timeout (force re-login). | | `User Session deleted` | The oldest sessions of a user were removed. | A user exceeds the maximum number of concurrent sessions, and Frontegg removes the oldest sessions. | | `Login attempt from restricted IP` | A login was blocked by IP restrictions. | A user tries to log in from an IP address that the IP restrictions do not allow. | | `Email domain restricted` | An email address was rejected by domain restrictions. | A sign-up, invitation, or email change uses an email domain that the domain restrictions block. | | `private_key_jwt assertion verified` | A client authenticated with a signed assertion. | An API token is authenticated with a `private_key_jwt` assertion, and Frontegg issues a token. Recorded only when the `private_key_jwt` feature is enabled. | | `private_key_jwt assertion rejected` | A signed assertion failed verification. | Frontegg rejects a `private_key_jwt` assertion. The entry includes the reason. Recorded only when the `private_key_jwt` feature is enabled. | #### Users | Action | Description | Triggered when | | --- | --- | --- | | `Added user` | A user was added to an account. | A user is created in, or invited to, an account. | | `Accepted invitation` | An invited user joined an account. | An invited user accepts the invitation. | | `Activated account` | A user activated their account. | A user activates their account through the activation link. | | `Updated profile` | A user changed their profile details. | A user edits their own profile. | | `Changed password` | A user set a new password. | A user completes a password reset, or changes their password while signed in. | | `Reset password` | A user requested a password reset. | A user submits the forgot password request. The entry is recorded when the user requests the reset, not when the reset is completed. | | `Removed user from account` | A user lost access to an account. | A user is removed from an account, or a user is deleted, which removes them from each of their accounts. `` is the email address of the removed user. | | `Assigned roles` | Roles were assigned to a user. | Roles are assigned to a user in an account. The entry lists the number of roles and their names. | | `Removed roles` | Roles were removed from a user. | Roles are removed from a user in an account. The entry lists the removed role names. | | `Bulk role update` | A user's roles were updated across several accounts. | A bulk role update runs for a user. The entry lists the number of accounts and the changes. | | `Invitation with temporary access` | A user was invited with time-limited access. | An administrator invites a user with temporary access to an account. | | `Temporary access edited` | The time limit of a user's temporary access changed. | An administrator edits the duration of a user's temporary access. | | `Permanent access given` | A user with temporary access now has permanent access. | An administrator changes temporary access to permanent access. | | `Temporary access given` | A user with permanent access now has temporary access. | An administrator changes permanent access to temporary access. | #### Groups | Action | Description | Triggered when | | --- | --- | --- | | `Group created` | A group was created. | A group is created in the portal, through the API, or through SCIM provisioning. | | `Group deleted` | A group was deleted. | A group is deleted in the portal, through the API, or through SCIM provisioning. | | `Groups bulk deleted` | Several groups were deleted together. | Groups are deleted as part of an account cleanup. | | `Group roles updated` | The roles of a group changed. | Roles are added to, or removed from, a group. | | `Users added to group` | Users joined a group. | Users are added to a group. | | `Users removed from group` | Users left a group. | Users are removed from a group. | #### MFA and security policies Environment-level settings `Changed MFA configuration`, `Changed MFA strategy`, `Upserted country restriction rules`, and `Updated security rules` are recorded when an environment-level API call changes the setting. They appear in the environment Audit trail. | Action | Description | Triggered when | | --- | --- | --- | | `Enabled MFA` | A user registered an MFA method. | A user enrolls an authenticator app, SMS, or WebAuthn method. | | `Disabled MFA` | A user removed an MFA method. | A user removes an MFA method, or disables MFA with a recovery code. | | `Unenroll MFA` | An administrator removed a user's MFA enrollment. | An administrator unenrolls a user from MFA. | | `Changed MFA configuration` | The MFA configuration of the environment changed. | The MFA configuration is updated, for example the available MFA factors. | | `Changed MFA strategy` | An MFA strategy was turned on or off. | An MFA strategy is set to active or inactive. The entry shows the strategy and its new state. | | `Created MFA security policy` | An MFA security policy was created. | An MFA security policy is created. | | `Changed MFA policy` | The MFA security policy was updated. | The MFA security policy is changed. | | `Changed lockout policy` | The lockout policy was updated. | The lockout policy is changed. | | `Created password history security policy` | A password history policy was created. | A password history policy is created. | | `Changed password history policy` | The password history policy was updated. | The password history policy is changed. | | `Maximum concurrent sessions enabled` | The concurrent sessions limit was turned on. | An administrator enables the maximum concurrent sessions setting. | | `Maximum concurrent sessions disabled` | The concurrent sessions limit was turned off. | An administrator disables the maximum concurrent sessions setting. | | `Maximum concurrent sessions changed` | The concurrent sessions limit changed. | An administrator changes the maximum number of concurrent sessions. The entry shows the old and new values. | | `Idle session enabled` | The idle session timeout was turned on. | An administrator enables the idle session setting. | | `Idle session disabled` | The idle session timeout was turned off. | An administrator disables the idle session setting. | | `Idle session policy changed` | The idle session timeout changed. | An administrator changes the idle session timeout. The entry shows the old and new values. | | `Force re-login enabled` | The session timeout (force re-login) was turned on. | An administrator enables the force re-login setting. | | `Force re-login disabled` | The session timeout (force re-login) was turned off. | An administrator disables the force re-login setting. | | `Force re-login policy changed` | The session timeout (force re-login) changed. | An administrator changes the force re-login period. The entry shows the old and new values. | | `IP changed to allowlist` | IP restrictions now use an allow list. | The IP restriction strategy is switched from a deny list to an allow list. | | `IP changed to denylist` | IP restrictions now use a deny list. | The IP restriction strategy is switched from an allow list to a deny list. | | `Added IP rule` | An IP rule was added. | A rule is added to the IP allow list or deny list. | | `Removed IP rule` | An IP rule was removed. | A rule is removed from the IP allow list or deny list. | | `Domain restriction strategy changed to allowlist` | Domain restrictions now use an allow list. | The domain restriction strategy is switched from a deny list to an allow list. | | `Domain restriction strategy changed to deny` | Domain restrictions now use a deny list. | The domain restriction strategy is switched from an allow list to a deny list. | | `Domain restrictions enabled` | Domain restrictions were turned on. | An administrator enables domain restrictions. | | `Domain restrictions disabled` | Domain restrictions were turned off. | An administrator disables domain restrictions. | | `Added domain rule` | A domain rule was added. | A rule is added to the domain allow list or deny list. | | `Removed domain rule` | A domain rule was removed. | A rule is removed from the domain allow list or deny list. | | `Upserted country restriction rules` | Country restriction rules were created or updated. | Country restriction rules are saved through the API. The entry shows the number of countries. | | `Updated security rules` | Security rules were updated. | A security engine rule set is updated through the API. The entry lists the changed sections. | #### API keys and tokens | Action | Description | Triggered when | | --- | --- | --- | | `Created API key` | An account API key was created. | An account API key is created. | | `Deleted API key` | An account API key was deleted. | An account API key is deleted. | | `Created personal API key` | A user's personal API key was created. | A user creates a personal API key. | | `Deleted personal API key` | A user's personal API key was deleted. | A user deletes a personal API key. | | `Exported API keys` | Account API keys were exported. | API keys are exported through the API. The entry shows the number of keys. | | `Imported API keys` | Account API keys were imported. | API keys are imported through the API. The entry shows how many were imported and how many failed. | | `Public key uploaded` | A public key was added to an API key. | A public key is uploaded for `private_key_jwt` authentication. The entry shows the key ID, algorithm, and fingerprint. | | `Public key updated` | A public key of an API key was updated. | A public key is updated. | | `Public key deleted` | A public key of an API key was deleted. | A public key is deleted. Recorded with **Medium** severity. | | `Created Access Token` | An account access token was created. | An account access token is created. | | `Deleted Access Token` | An account access token was deleted. | An account access token is deleted. | | `Created personal Access Token` | A user's personal access token was created. | A user creates a personal access token. | | `Deleted personal Access Token` | A user's personal access token was deleted. | A user deletes a personal access token. | #### Roles and permissions Environment-level actions `Role created`, `Role updated`, `Role deleted`, `Permission created`, `Permission updated`, and `Permission deleted` are recorded when roles or permissions are managed through the environment-level API. They appear in the environment Audit trail. A role change can also be recorded as an `Account role was ...` entry. | Action | Description | Triggered when | | --- | --- | --- | | `Role created` | A role was created. | A role is created through the API. The entry lists the role names and IDs. | | `Role updated` | A role was updated. | A role is updated through the API. | | `Role deleted` | A role was deleted. | A role is deleted through the API. | | `Permission created` | A permission was created. | A permission is created through the API. The entry lists the permission names and IDs. | | `Permission updated` | A permission was updated. | A permission is updated through the API. | | `Permission deleted` | A permission was deleted. | A permission is deleted through the API. | | `Account role was created` | An account role was created. | A role is created for an account. The entry shows the role name. | | `Account role was updated` | An account role was updated. | A role of an account is updated. | | `Account role was deleted` | An account role was deleted. | A role of an account is deleted. | | `Permissions were assigned to account role` | The permissions of an account role changed. | Permissions are assigned to an account role. The entry lists the permissions. | #### Accounts and applications Environment-level actions Most account and application events are recorded when an environment-level API call performs the action, so they appear in the environment Audit trail. An account change can be recorded both as a `... tenant` entry and as a `Tenant ...` entry. Tenant events can be turned off for an environment. | Action | Description | Triggered when | | --- | --- | --- | | `Created tenant` | An account (tenant) was created. | An account is created through the API. The entry shows the account name and ID. | | `Updated tenant` | An account was updated. | An account is updated through the API. The entry lists the changed fields. | | `Deleted tenant` | An account was deleted. | An account is deleted through the API. | | `Deleted current tenant` | The current account was deleted. | The current account is deleted through the API. | | `Deleted tenants` | Several accounts were deleted. | Accounts are deleted in bulk or by a filter through the API. | | `Locked tenants` | Accounts were locked. | Accounts are locked. The entry shows the number of accounts. For more information, see [Lock accounts](/ciam/guides/management/manage-accounts/lock-account). | | `Unlocked tenants` | Accounts were unlocked. | Accounts are unlocked. The entry shows the number of accounts. | | `Tenant created` | An account was created. | Frontegg processes an account creation event. | | `Tenant updated` | An account was updated. | Frontegg processes an account update event. | | `Tenant deleted` | An account was deleted. | Frontegg processes an account deletion event. | | `Assigned tenant to application` | An account was given access to an application. | An account is assigned to an application. The entry shows the access type. | | `Updated application tenant assignment` | An account's access to an application changed. | The access type of an account for an application is updated. | | `Unassigned tenant from application` | An account lost access to an application. | An account is unassigned from an application. | | `Created application` | An application was created. | An application is created through the API. | | `Updated application` | An application was updated. | An application is updated through the API. | | `Deleted application` | An application was deleted. | An application is deleted through the API. | #### SSO, SCIM, and login configuration | Action | Description | Triggered when | | --- | --- | --- | | `Updated SSO (SAML) configuration` | The SAML SSO configuration changed. | A SAML configuration is saved, or IdP metadata is uploaded. The entry lists the updated fields. | | `Deleted SSO (SAML) configuration` | The SAML SSO configuration was deleted. | A SAML configuration is deleted. | | `Updated SSO (OIDC) configuration` | The OIDC SSO configuration changed. | An OIDC configuration is saved. The entry lists the updated fields. | | `Updated metadata configuration` | A configuration entity was updated. | A configuration other than SAML is saved through the metadata API. The entry lists the updated fields. | | `SAML Connection created` | A SAML connection was created. | A SAML SSO connection is created. | | `SAML Connection updated` | A SAML connection was updated. | A SAML SSO connection is updated. | | `SAML Connection deleted` | A SAML connection was deleted. | A SAML SSO connection is deleted. | | `OIDC Connection created` | An OIDC connection was created. | An OIDC SSO connection is created. | | `OIDC Connection updated` | An OIDC connection was updated. | An OIDC SSO connection is updated. | | `OIDC Connection deleted` | An OIDC connection was deleted. | An OIDC SSO connection is deleted. | | `SCIM Configuration created` | A SCIM connection was created. | A SCIM provisioning connection is created. The entry shows the source and connection name. | | `SCIM Configuration deleted` | A SCIM connection was deleted. | A SCIM provisioning connection is deleted. | | `Updated social login configuration` | A social login provider configuration changed. | A social login provider is configured. The entry shows the provider and the changed settings, such as the redirect URL, custom credentials, or additional scopes. | | `Social login provider activated` | A social login provider was turned on. | A social login provider is activated. | | `Social login provider deactivated` | A social login provider was turned off. | A social login provider is deactivated. | | `Mail configuration updated` | The email provider configuration changed. | The mail configuration is updated. The entry shows the provider. | #### Entitlements and feature flags Feature flag events are environment-only The feature flag events (`Created a flag` through `Updated flag settings`) are recorded without an account. They appear in the environment Audit trail and in the audits of the feature flag, and can be turned off for an environment. | Action | Description | Triggered when | | --- | --- | --- | | `Created feature` | A feature was created. | A feature is created through the API. The entry shows the name, key, and ID. | | `Updated feature` | A feature was updated. | A feature is updated through the API. | | `Deleted feature` | A feature was deleted. | A feature is deleted through the API. | | `Created plan` | A plan was created. | A plan is created through the API. | | `Updated plan` | A plan was updated. | A plan is updated through the API. | | `Deleted plan` | A plan was deleted. | A plan is deleted through the API. | | `Created a flag` | A feature flag was created. | A feature flag is created. | | `Deleted a flag` | A feature flag was deleted. | A feature flag is deleted. | | `Turned on a flag` | A feature flag was turned on. | A feature flag is turned on. | | `Turned off a flag` | A feature flag was turned off. | A feature flag is turned off. | | `Updated flag rules` | The targeting rules of a feature flag changed. | The rules of a feature flag are updated. | | `Updated flag settings` | The settings of a feature flag changed. | The settings of a feature flag are updated. | #### Webhooks and prehooks Environment-level actions Webhook and prehook configuration events are recorded when the configuration is changed through the environment-level API, so they appear in the environment Audit trail. For more information, see [Webhooks](/ciam/guides/integrations/webhooks) and [Prehooks](/ciam/guides/integrations/prehooks). | Action | Description | Triggered when | | --- | --- | --- | | `Created webhook` | A webhook was created. | A webhook is created. The entry shows the display name and ID. | | `Updated webhook` | A webhook was updated. | A webhook is updated. The entry lists the changed fields. | | `Deleted webhook` | A webhook was deleted. | A webhook is deleted. | | `Created custom webhook` | A custom webhook was created. | A custom webhook is created. | | `Webhook paused` | A webhook was paused after failed deliveries. | Deliveries to the webhook keep failing and Frontegg pauses it. Recorded with **Medium** severity. The entry shows the reason, the retry attempt, and the next retry time. | | `Webhook disabled` | A webhook was disabled after repeated failures. | Frontegg disables a webhook after it exhausts its retries. Recorded with **High** severity. | | `Webhook recovered` | A paused webhook was re-enabled. | A delivery succeeds and Frontegg re-enables the webhook automatically. | | `Created prehook` | A prehook was created. | A prehook is created. The entry shows the name and ID. | | `Updated prehook` | A prehook was updated. | A prehook is updated. The entry lists the changed fields. | | `Deleted prehook` | A prehook was deleted. | A prehook is deleted. | | `Created flow prehook` | A flow prehook was created. | A flow prehook is created or assigned. | | `Created custom code prehook` | A custom code prehook was created. | A custom code prehook is created or assigned. | | `Updated custom code prehook` | A custom code prehook was updated. | A custom code prehook is updated. | | `Created API prehook` | An API prehook was created. | An API prehook is created. | | `Updated API prehook` | An API prehook was updated. | An API prehook is updated. | ### Related documentation - [Audit logs in the self-service portal](/ciam/guides/admin-portal/workspace-modules#audit-logs) - [User impersonation](/ciam/guides/management/manage-users/impersonation) - [Lock accounts](/ciam/guides/management/manage-accounts/lock-account) - [Add audits through the API](/ciam/api/audits/main/auditscontroller_addaudits)