Events

Respond to activity that occurs within WorkOS and third-party providers.

Events represent activity that has occurred within WorkOS or within third-party identity and directory providers. Your app can sync the data via either the events API or webhooks.

Event object

All event objects share a similar structure.

Attribute	Description
`event`	A string that distinguishes the event type.
`id`	Unique identifier for the event.
`data`	Event payload. Payloads match the corresponding API objects.
`created_at`	Timestamp of when the event occurred.
`context`	An optional object of extra information relevant to the event.

API key events

Events emitted when API keys are created, updated, or revoked.

API key created event

JSON

 {
  "object": "event",
  "id": "event_01KD8Z96BMTAXC8Z9VAQJEYJPW",
  "event": "api_key.created",
  "data": {
    "object": "api_key",
    "id": "api_key_01KD8Z96B7CEWS9F792MVPFZ5X",
    "name": "testing key",
    "owner": {
      "id": "org_01KC5960YS14A61DAEZ30DJ0EG",
      "type": "organization"
    },
    "obfuscated_value": "sk_…kZL1",
    "permissions": ["posts:read"],
    "last_used_at": null,
    "expires_at": null,
    "created_at": "2025-12-24T20:02:23.200Z",
    "updated_at": "2025-12-24T20:02:23.200Z"
  },
  "created_at": "2025-12-24T20:02:23.220Z",
  "context": {}
}

Triggered when an API key is created.

API key revoked event

JSON

 {
  "object": "event",
  "id": "event_01KD8ZGJK4YWC2WHWHQA71DERV",
  "event": "api_key.revoked",
  "data": {
    "object": "api_key",
    "id": "api_key_01KD8Z96B7CEWS9F792MVPFZ5X",
    "name": "testing key",
    "owner": {
      "id": "org_01KC5960YS14A61DAEZ30DJ0EG",
      "type": "organization"
    },
    "obfuscated_value": "sk_…kZL1",
    "permissions": ["posts:read"],
    "last_used_at": null,
    "expires_at": "2025-12-24T20:02:23.220Z",
    "created_at": "2025-12-24T20:02:23.200Z",
    "updated_at": "2025-12-24T20:02:23.200Z"
  },
  "created_at": "2025-12-24T20:02:23.220Z",
  "context": {}
}

Triggered when an API key is revoked.

API key updated event

JSON

 {
  "object": "event",
  "id": "event_01KD8ZJ8P66VW2J8YJ9V8KH2RN",
  "event": "api_key.updated",
  "data": {
    "object": "api_key",
    "id": "api_key_01KD8Z96B7CEWS9F792MVPFZ5X",
    "name": "testing key",
    "owner": {
      "id": "org_01KC5960YS14A61DAEZ30DJ0EG",
      "type": "organization"
    },
    "obfuscated_value": "sk_…kZL1",
    "permissions": ["posts:read"],
    "last_used_at": null,
    "expires_at": "2026-01-24T20:02:23.200Z",
    "previous_attributes": {
      "expires_at": null
    },
    "created_at": "2025-12-24T20:02:23.200Z",
    "updated_at": "2025-12-24T20:05:11.420Z"
  },
  "created_at": "2025-12-24T20:05:11.430Z",
  "context": {}
}

Triggered when an API key expiration is set, changed, or cleared.

Authentication events

Each step in the authentication flow emits an authentication event. Authentication success events are emitted even when additional steps, such as MFA, are required to complete the process.

Email verification failed event

JSON

 {
  "event": "authentication.email_verification_failed",
  "id": "event_04FKJ843CVE8F7BXQSPFH0M53V",
  "data": {
    "type": "email_verification",
    "status": "failed",
    "user_id": "user_01E4ZCR3C5A4QZ2Z2JQXGKZJ9E",
    "email": "todd@example.com",
    "ip_address": "192.0.2.1",
    "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36",
    "error": {
      "code": "invalid_one_time_code",
      "message": "Invalid one-time code"
    }
  },
  "created_at": "2023-11-18T04:18:13.126Z",
  "context": {
    "client_id": "client_123456789"
  }
}

Triggered when a user fails to verify their email.

Email verification succeeded event

JSON

 {
  "event": "authentication.email_verification_succeeded",
  "id": "event_04FKJ843CVE8F7BXQSPFH0M53V",
  "data": {
    "type": "email_verification",
    "status": "succeeded",
    "user_id": "user_01E4ZCR3C5A4QZ2Z2JQXGKZJ9E",
    "email": "todd@example.com",
    "ip_address": "192.0.2.1",
    "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36"
  },
  "created_at": "2023-11-18T04:18:13.126Z",
  "context": {
    "client_id": "client_123456789"
  }
}

Triggered when a user successfully verifies their email.

Magic Auth failed event

JSON

 {
  "event": "authentication.magic_auth_failed",
  "id": "event_04FKJ843CVE8F7BXQSPFH0M53V",
  "data": {
    "type": "magic_auth",
    "status": "failed",
    "user_id": "user_01E4ZCR3C5A4QZ2Z2JQXGKZJ9E",
    "email": "todd@example.com",
    "ip_address": "192.0.2.1",
    "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36",
    "error": {
      "code": "authentication_method_not_allowed",
      "message": "Google OAuth is disabled."
    }
  },
  "created_at": "2023-11-18T04:18:13.126Z",
  "context": {
    "client_id": "client_123456789"
  }
}

Triggered when a user fails to authenticate via Magic Auth.

Magic Auth succeeded event

JSON

 {
  "event": "authentication.magic_auth_succeeded",
  "id": "event_04FKJ843CVE8F7BXQSPFH0M53V",
  "data": {
    "type": "magic_auth",
    "status": "succeeded",
    "user_id": "user_01E4ZCR3C5A4QZ2Z2JQXGKZJ9E",
    "email": "todd@example.com",
    "ip_address": "192.0.2.1",
    "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36"
  },
  "created_at": "2023-11-18T04:18:13.126Z",
  "context": {
    "client_id": "client_123456789"
  }
}

Triggered when a user successfully authenticates via Magic Auth.

MFA failed event

JSON

 {
  "event": "authentication.mfa_failed",
  "id": "event_04FKJ843CVE8F7BXQSPFH0M53V",
  "data": {
    "type": "mfa",
    "status": "failed",
    "user_id": "user_01E4ZCR3C5A4QZ2Z2JQXGKZJ9E",
    "email": "todd@example.com",
    "ip_address": "192.0.2.1",
    "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36",
    "error": {
      "code": "invalid_one_time_code",
      "message": "Invalid one-time code."
    }
  },
  "created_at": "2023-11-18T04:18:13.126Z",
  "context": {
    "client_id": "client_123456789"
  }
}

Triggered when a user fails to authenticate with a multi-factor authentication code.

MFA succeeded event

JSON

 {
  "event": "authentication.mfa_succeeded",
  "id": "event_04FKJ843CVE8F7BXQSPFH0M53V",
  "data": {
    "type": "mfa",
    "status": "succeeded",
    "user_id": "user_01E4ZCR3C5A4QZ2Z2JQXGKZJ9E",
    "email": "todd@example.com",
    "ip_address": "192.0.2.1",
    "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36"
  },
  "created_at": "2023-11-18T04:18:13.126Z",
  "context": {
    "client_id": "client_123456789"
  }
}

Triggered when a user successfully authenticates with a multi-factor authentication code.

OAuth failed event

JSON

 {
  "event": "authentication.oauth_failed",
  "id": "event_04FKJ843CVE8F7BXQSPFH0M53V",
  "data": {
    "type": "oauth",
    "status": "failed",
    "user_id": "user_01E4ZCR3C5A4QZ2Z2JQXGKZJ9E",
    "email": "todd@example.com",
    "ip_address": "192.0.2.1",
    "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36",
    "error": {
      "code": "invalid_credentials",
      "message": "Invalid credentials."
    }
  },
  "created_at": "2023-11-18T04:18:13.126Z",
  "context": {
    "client_id": "client_123456789"
  }
}

Triggered when a user fails to authenticate via OAuth.

OAuth succeeded event

JSON

 {
  "event": "authentication.oauth_succeeded",
  "id": "event_04FKJ843CVE8F7BXQSPFH0M53V",
  "data": {
    "type": "oauth",
    "status": "succeeded",
    "user_id": "user_01E4ZCR3C5A4QZ2Z2JQXGKZJ9E",
    "email": "todd@example.com",
    "ip_address": "192.0.2.1",
    "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36"
  },
  "created_at": "2023-11-18T04:18:13.126Z",
  "context": {
    "client_id": "client_123456789"
  }
}

Triggered when a user successfully authenticates via OAuth.

Password authentication failed event

JSON

 {
  "event": "authentication.password_failed",
  "id": "event_04FKJ843CVE8F7BXQSPFH0M53V",
  "data": {
    "type": "password",
    "status": "failed",
    "user_id": "user_01E4ZCR3C5A4QZ2Z2JQXGKZJ9E",
    "email": "todd@example.com",
    "ip_address": "192.0.2.1",
    "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36",
    "error": {
      "code": "invalid_credentials",
      "message": "Invalid credentials."
    }
  },
  "created_at": "2023-11-18T04:18:13.126Z",
  "context": {
    "client_id": "client_123456789"
  }
}

Triggered when a user fails to authenticate with password credentials.

Password authentication succeeded event

JSON

 {
  "event": "authentication.password_succeeded",
  "id": "event_04FKJ843CVE8F7BXQSPFH0M53V",
  "data": {
    "type": "password",
    "status": "succeeded",
    "user_id": "user_01E4ZCR3C5A4QZ2Z2JQXGKZJ9E",
    "email": "todd@example.com",
    "ip_address": "192.0.2.1",
    "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36"
  },
  "created_at": "2023-11-18T04:18:13.126Z",
  "context": {
    "client_id": "client_123456789"
  }
}

Triggered when a user successfully authenticates with password credentials.

Passkey authentication failed event

JSON

 {
  "event": "authentication.passkey_failed",
  "id": "event_01HS2EAGQA9EZW6D0MFCV5S38D",
  "data": {
    "type": "passkey",
    "status": "failed",
    "email": "todd@example.com",
    "user_id": "user_01EHWNC0FCBHZ3BJ7EGKYXK0E6",
    "error": {
      "code": "invalid_credentials",
      "message": "Invalid credentials."
    },
    "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36",
    "ip_address": "0.0.0.0"
  },
  "created_at": "2023-11-18T04:18:13.126Z",
  "context": {
    "client_id": "client_123456789"
  }
}

Triggered when a user fails to authenticate with a passkey.

Passkey authentication succeeded event

JSON

 {
  "event": "authentication.passkey_succeeded",
  "id": "event_01HS2EAGQA9EZW6D0MFCV5S38D",
  "data": {
    "type": "passkey",
    "status": "succeeded",
    "email": "todd@example.com",
    "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36",
    "ip_address": "0.0.0.0",
    "user_id": "user_01EHWNC0FCBHZ3BJ7EGKYXK0E6"
  },
  "created_at": "2023-11-18T04:18:13.126Z",
  "context": {
    "client_id": "client_123456789"
  }
}

Triggered when a user successfully authenticates with a passkey.

SSO failed event

JSON

 {
  "event": "authentication.sso_failed",
  "id": "event_04FKJ843CVE8F7BXQSPFH0M53V",
  "data": {
    "type": "sso",
    "status": "failed",
    "user_id": "user_01E4ZCR3C5A4QZ2Z2JQXGKZJ9E",
    "email": "todd@example.com",
    "ip_address": "192.0.2.1",
    "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36",
    "error": {
      "code": "authentication_method_not_allowed",
      "message": "SSO is disabled for this environment."
    },
    "sso": {
      "connection_id": "conn_01FKJ843CVE8F7BXQSPFH0M53V",
      "organization_id": "org_01E4ZCR3C5A4QZ2Z2JQXGKZJ9E"
    }
  },
  "created_at": "2023-11-18T04:18:13.126Z",
  "context": {
    "client_id": "client_123456789"
  }
}

Triggered when a user fails to authenticate with Single Sign-On.

SSO succeeded event

JSON

 {
  "event": "authentication.sso_succeeded",
  "id": "event_04FKJ843CVE8F7BXQSPFH0M53V",
  "data": {
    "type": "sso",
    "status": "succeeded",
    "user_id": "user_01E4ZCR3C5A4QZ2Z2JQXGKZJ9E",
    "email": "todd@example.com",
    "ip_address": "192.0.2.1",
    "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36",
    "sso": {
      "connection_id": "conn_01FKJ843CVE8F7BXQSPFH0M53V",
      "organization_id": "org_01E4ZCR3C5A4QZ2Z2JQXGKZJ9E",
      "session_id": "saml_session_01FKJ843CVE8F7BXQSPFH0M53V"
    }
  },
  "created_at": "2023-11-18T04:18:13.126Z",
  "context": {
    "client_id": "client_123456789"
  }
}

Triggered when a user successfully authenticates with Single Sign-On.

Radar risk detected event

JSON

 {
  "event": "authentication.radar_risk_detected",
  "id": "event_04FKJ843CVE8F7BXQSPFH0M53V",
  "data": {
    "auth_method": "magic_auth",
    "action": "signup",
    "control": "restriction",
    "blocklist_type": "ip_address",
    "ip_address": "192.0.2.1",
    "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36",
    "user_id": "user_01E4ZCR3C5A4QZ2Z2JQXGKZJ9E"
  },
  "created_at": "2023-11-18T04:18:13.126Z",
  "context": {
    "client_id": "client_123456789"
  }
}

Triggered when an authentication succeeds but is flagged by Radar. For example, the authentication may have succeeded at passing a Radar challenge.

Connection events

Events emitted when Single Sign-On connections are activated, deactivated, or deleted. Also emitted when a SAML certificate is renewed for the connection.

Connection activated event

JSON

 {
  "event": "connection.activated",
  "id": "event_10FKJ843CVE8F7BXQSPFH0M53V",
  "data": {
    "object": "connection",
    "id": "conn_01EHWNC0FCBHZ3BJ7EGKYXK0E6",
    "organization_id": "org_01EHWNCE74X7JSDV0X3SZ3KJNY",
    "state": "active",
    "connection_type": "OktaSAML",
    "name": "Foo Corp's Connection",
    "created_at": "2021-06-25T19:07:33.155Z",
    "updated_at": "2021-06-25T19:07:33.155Z",
    "domains": [
      {
        "id": "org_domain_01EHWNFTAFCF3CQAE5A9Q0P1YB",
        "object": "connection_domain",
        "domain": "foo-corp.com"
      }
    ]
  },
  "created_at": "2021-06-25T19:07:33.155Z",
  "context": {}
}

Payload data corresponds to the Connection object.

Triggered when a connection is activated.

Connection deactivated event

JSON

 {
  "event": "connection.deactivated",
  "id": "event_11FKJ843CVE8F7BXQSPFH0M53V",
  "data": {
    "object": "connection",
    "id": "conn_01EHWNC0FCBHZ3BJ7EGKYXK0E6",
    "organization_id": "org_01EHWNCE74X7JSDV0X3SZ3KJNY",
    "state": "inactive",
    "connection_type": "OktaSAML",
    "name": "Foo Corp's Connection",
    "created_at": "2021-06-25T19:07:33.155Z",
    "updated_at": "2021-06-25T19:07:33.155Z",
    "domains": [
      {
        "id": "org_domain_01EHWNFTAFCF3CQAE5A9Q0P1YB",
        "object": "connection_domain",
        "domain": "foo-corp.com"
      }
    ]
  },
  "created_at": "2021-06-25T19:07:33.155Z",
  "context": {}
}

Payload data corresponds to the Connection object.

Triggered when a connection is deactivated.

Connection deleted event

JSON

 {
  "event": "connection.deleted",
  "id": "event_12FKJ843CVE8F7BXQSPFH0M53V",
  "data": {
    "object": "connection",
    "id": "conn_01EHWNC0FCBHZ3BJ7EGKYXK0E6",
    "organization_id": "org_01EHWNCE74X7JSDV0X3SZ3KJNY",
    "state": "inactive",
    "connection_type": "OktaSAML",
    "name": "Foo Corp's Connection",
    "created_at": "2021-06-25T19:07:33.155Z",
    "updated_at": "2021-06-25T19:07:33.155Z",
    "domains": [
      {
        "id": "org_domain_01EHWNFTAFCF3CQAE5A9Q0P1YB",
        "object": "connection_domain",
        "domain": "foo-corp.com"
      }
    ]
  },
  "created_at": "2021-06-25T19:07:33.155Z",
  "context": {}
}

Payload data corresponds to the Connection object.

Triggered when a connection is deleted. The state attribute indicates connection state before deletion.

Connection certificate renewed event

JSON

 {
  "event": "connection.saml_certificate_renewed",
  "id": "event_12FKJ843CVE8F7BXQSPFH0M53V",
  "data": {
    "connection": {
      "id": "conn_12FKJ843CVE8F7BXQSPFH0M53V",
      "organization_id": "org_12FKJ843CVE8F7BXQSPFH0M53V"
    },
    "certificate": {
      "certificate_type": "ResponseSigning",
      "expiry_date": "2025-06-28T19:07:33.155Z"
    },
    "renewed_at": "2021-06-25T19:07:33.155Z"
  },
  "created_at": "2021-06-25T19:07:33.155Z",
  "context": {}
}

The certificate_type can be one of ResponseSigning, RequestSigning, or ResponseEncryption.

Triggered when a SAML certificate is renewed either in the Dashboard or Admin Portal.

Connection certificate renewal required event

JSON

 {
  "event": "connection.saml_certificate_renewal_required",
  "id": "event_12FKJ843CVE8F7BXQSPFH0M53V",
  "data": {
    "connection": {
      "id": "conn_12FKJ843CVE8F7BXQSPFH0M53V",
      "organization_id": "org_12FKJ843CVE8F7BXQSPFH0M53V"
    },
    "certificate": {
      "certificate_type": "ResponseSigning",
      "expiry_date": "2021-06-28T19:07:33.155Z",
      "is_expired": false
    },
    "days_until_expiry": 3
  },
  "created_at": "2021-06-25T19:07:33.155Z",
  "context": {}
}

The certificate_type can be one of ResponseSigning, RequestSigning, or ResponseEncryption.

Triggered when a SAML certificate is expiring (multiple events are sent out as it approaches expiry), or expired (once every 7 days after expiry).

Directory Sync events

Events emitted when directory-related resources are changed. To learn what exactly each of these events represents, see the in-depth Directory Sync events guide.

Directory activated event

JSON

 {
  "event": "dsync.activated",
  "id": "event_01FKJ843CVE8F7BXQSPFH0M53V",
  "data": {
    "object": "directory",
    "external_key": "UWuccu6o1E0GqkYs",
    "name": "Foo Corp's Directory",
    "organization_id": "org_01EZTR6WYX1A0DSE2CYMGXQ24Y",
    "id": "directory_01EHWNC0FCBHZ3BJ7EGKYXK0E6",
    "state": "active",
    "type": "generic scim v2.0",
    "created_at": "2021-06-25T19:07:33.155Z",
    "updated_at": "2021-06-25T19:07:33.155Z",
    "domains": [
      {
        "object": "organization_domain",
        "id": "org_domain_01EZTR5N6Y9RQKHK2E9F31KZX6",
        "domain": "foo-corp.com"
      }
    ]
  },
  "created_at": "2021-06-25T19:07:33.155Z",
  "context": {}
}

Payload data is based on the Directory object, but the domain property is replaced with a domains array of Organization Domain.

Triggered when a directory is activated.

Directory deleted event

JSON

 {
  "event": "dsync.deleted",
  "id": "event_03FKJ843CVE8F7BXQSPFH0M53V",
  "data": {
    "object": "directory",
    "id": "directory_01EHWNC0FCBHZ3BJ7EGKYXK0E6",
    "organization_id": "org_01EZTR6WYX1A0DSE2CYMGXQ24Y",
    "type": "generic scim v2.0",
    "state": "deleting",
    "name": "Foo Corp's Directory",
    "created_at": "2021-06-25T19:07:33.155Z",
    "updated_at": "2021-06-25T19:07:33.155Z"
  },
  "created_at": "2021-06-25T19:07:33.155Z",
  "context": {}
}

Payload data is based on the Directory object, except the domain property is omitted.

Triggered when a directory is deleted. The state attribute indicates directory state before deletion.

Directory group created event

JSON

 {
  "event": "dsync.group.created",
  "id": "event_44FKJ843CVE8F7BXQSPFH0M53V",
  "data": {
    "id": "directory_group_01E1X5GPMMXF4T1DCERMVEEPVW",
    "idp_id": "02grqrue4294w24",
    "directory_id": "directory_01ECAZ4NV9QMV47GW873HDCX74",
    "organization_id": "org_01EZTR6WYX1A0DSE2CYMGXQ24Y",
    "name": "Developers",
    "created_at": "2021-06-25T19:07:33.155Z",
    "updated_at": "2021-06-25T19:07:33.155Z"
  },
  "created_at": "2021-06-25T19:07:33.155Z",
  "context": {}
}

Payload data corresponds to the Directory Group object.

Triggered when a directory group is created.

Directory group deleted event

JSON

 {
  "event": "dsync.group.deleted",
  "id": "event_06FKJ843CVE8F7BXQSPFH0M53V",
  "data": {
    "id": "directory_group_01E1X5GPMMXF4T1DCERMVEEPVW",
    "idp_id": "02grqrue4294w24",
    "directory_id": "directory_01ECAZ4NV9QMV47GW873HDCX74",
    "organization_id": "org_01EZTR6WYX1A0DSE2CYMGXQ24Y",
    "name": "Developers",
    "created_at": "2021-06-25T19:07:33.155Z",
    "updated_at": "2021-06-25T19:07:33.155Z"
  },
  "created_at": "2021-06-25T19:07:33.155Z",
  "context": {}
}

Payload data corresponds to the Directory Group object.

Triggered when a directory group is deleted.

Directory group updated event

JSON

 {
  "event": "dsync.group.updated",
  "id": "event_54FKJ843CVE8F7BXQSPFH0M53V",
  "data": {
    "id": "directory_group_01E1X5GPMMXF4T1DCERMVEEPVW",
    "idp_id": "02grqrue4294w24",
    "directory_id": "directory_01ECAZ4NV9QMV47GW873HDCX74",
    "organization_id": "org_01EZTR6WYX1A0DSE2CYMGXQ24Y",
    "name": "Developers",
    "created_at": "2021-06-25T19:07:33.155Z",
    "updated_at": "2021-06-25T19:07:33.155Z",
    "previous_attributes": {}
  },
  "created_at": "2021-06-25T19:07:33.155Z",
  "context": {}
}

Payload data corresponds to the Directory Group object.

Triggered when a directory group is updated.

Directory group user added event

JSON

 {
  "event": "dsync.group.user_added",
  "id": "event_04FKJ843CVE8F7BXQSPFH0M53V",
  "data": {
    "directory_id": "directory_01ECAZ4NV9QMV47GW873HDCX74",
    "user": {
      "id": "directory_user_01E1X56GH84T3FB41SD6PZGDBX",
      "directory_id": "directory_01ECAZ4NV9QMV47GW873HDCX74",
      "organization_id": "org_01EZTR6WYX1A0DSE2CYMGXQ24Y",
      "idp_id": "2936",
      "email": "eric@example.com",
      "first_name": "Eric",
      "last_name": "Schneider",
      "name": "Eric Schneider",
      "state": "active",
      "created_at": "2021-06-25T19:07:33.155Z",
      "updated_at": "2021-06-25T19:07:33.155Z",
      "custom_attributes": {
        "emails": [
          {
            "primary": true,
            "type": "work",
            "value": "eric@example.com"
          }
        ],
        "department": "Engineering",
        "job_title": "Software Engineer",
        "username": "eric@example.com"
      },
      "role": { "slug": "member" },
      "roles": [{ "slug": "member" }]
    },
    "group": {
      "id": "directory_group_01E1X5GPMMXF4T1DCERMVEEPVW",
      "idp_id": "02grqrue4294w24",
      "directory_id": "directory_01ECAZ4NV9QMV47GW873HDCX74",
      "organization_id": "org_01EZTR6WYX1A0DSE2CYMGXQ24Y",
      "name": "Developers",
      "created_at": "2021-06-25T19:07:33.155Z",
      "updated_at": "2021-06-25T19:07:33.155Z"
    }
  },
  "created_at": "2021-06-25T19:07:33.155Z",
  "context": {}
}

Payload data contains a user which corresponds to the Directory User object and a group which corresponds to the Directory Group object. The groups field is omitted from the user object to avoid performance issues in large directories.

Triggered when a directory group user is added.

Directory group user removed event

JSON

 {
  "event": "dsync.group.user_removed",
  "id": "event_05FKJ843CVE8F7BXQSPFH0M53V",
  "data": {
    "directory_id": "directory_01ECAZ4NV9QMV47GW873HDCX74",
    "user": {
      "id": "directory_user_01E1X56GH84T3FB41SD6PZGDBX",
      "directory_id": "directory_01ECAZ4NV9QMV47GW873HDCX74",
      "organization_id": "org_01EZTR6WYX1A0DSE2CYMGXQ24Y",
      "idp_id": "2936",
      "email": "eric@example.com",
      "first_name": "Eric",
      "last_name": "Schneider",
      "name": "Eric Schneider",
      "state": "active",
      "created_at": "2021-06-25T19:07:33.155Z",
      "updated_at": "2021-06-25T19:07:33.155Z",
      "custom_attributes": {
        "emails": [
          {
            "primary": true,
            "type": "work",
            "value": "eric@example.com"
          }
        ],
        "department": "Engineering",
        "job_title": "Software Engineer",
        "username": "eric@example.com"
      },
      "role": { "slug": "member" },
      "roles": [{ "slug": "member" }]
    },
    "group": {
      "id": "directory_group_01E1X5GPMMXF4T1DCERMVEEPVW",
      "idp_id": "02grqrue4294w24",
      "directory_id": "directory_01ECAZ4NV9QMV47GW873HDCX74",
      "organization_id": "org_01EZTR6WYX1A0DSE2CYMGXQ24Y",
      "name": "Developers",
      "created_at": "2021-06-25T19:07:33.155Z",
      "updated_at": "2021-06-25T19:07:33.155Z"
    }
  },
  "created_at": "2021-06-25T19:07:33.155Z",
  "context": {}
}

Triggered when a directory group user is removed.

Directory user created event

JSON

 {
  "event": "dsync.user.created",
  "id": "event_07FKJ843CVE8F7BXQSPFH0M53V",
  "data": {
    "id": "directory_user_01E1X1B89NH8Z3SDFJR4H7RGX7",
    "directory_id": "directory_01ECAZ4NV9QMV47GW873HDCX74",
    "organization_id": "org_01EZTR6WYX1A0DSE2CYMGXQ24Y",
    "idp_id": "8931",
    "email": "lela.block@example.com",
    "first_name": "Lela",
    "last_name": "Block",
    "name": "Lela Block",
    "state": "active",
    "created_at": "2021-06-25T19:07:33.155Z",
    "updated_at": "2021-06-25T19:07:33.155Z",
    "custom_attributes": {
      "emails": [
        {
          "primary": true,
          "type": "work",
          "value": "lela.block@example.com"
        }
      ],
      "department": "Engineering",
      "job_title": "Software Engineer",
      "username": "lela.block@example.com"
    },
    "role": { "slug": "member" },
    "roles": [{ "slug": "member" }]
  },
  "created_at": "2021-06-25T19:07:33.155Z",
  "context": {}
}

Payload data corresponds to the Directory User object. The groups field is omitted to avoid performance issues in large directories.

Triggered when a directory user is created.

Directory user deleted event

JSON

 {
  "event": "dsync.user.deleted",
  "id": "event_09FKJ843CVE8F7BXQSPFH0M53V",
  "data": {
    "id": "directory_user_01E1X1B89NH8Z3SDFJR4H7RGX7",
    "directory_id": "directory_01ECAZ4NV9QMV47GW873HDCX74",
    "organization_id": "org_01EZTR6WYX1A0DSE2CYMGXQ24Y",
    "idp_id": "8931",
    "email": "lela.block@example.com",
    "first_name": "Lela",
    "last_name": "Block",
    "name": "Lela Block",
    "state": "inactive",
    "created_at": "2021-06-25T19:07:33.155Z",
    "updated_at": "2021-06-25T19:07:33.155Z",
    "custom_attributes": {
      "emails": [
        {
          "primary": true,
          "type": "work",
          "value": "lela.block@example.com"
        }
      ],
      "department": "Engineering",
      "job_title": "Software Engineer",
      "username": "lela.block@example.com"
    },
    "role": { "slug": "member" },
    "roles": [{ "slug": "member" }]
  },
  "created_at": "2021-06-25T19:07:33.155Z",
  "context": {}
}

Payload data corresponds to the Directory User object. The groups field is omitted to avoid performance issues in large directories.

Triggered when a directory user is deleted. The state attribute indicates directory user state at time of deletion.

Directory user updated event

JSON

 {
  "event": "dsync.user.updated",
  "id": "event_08FKJ843CVE8F7BXQSPFH0M53V",
  "data": {
    "id": "directory_user_01E1X1B89NH8Z3SDFJR4H7RGX7",
    "directory_id": "directory_01ECAZ4NV9QMV47GW873HDCX74",
    "organization_id": "org_01EZTR6WYX1A0DSE2CYMGXQ24Y",
    "idp_id": "8931",
    "email": "lela.block@example.com",
    "first_name": "Lela",
    "last_name": "Block",
    "name": "Lela Block",
    "state": "active",
    "created_at": "2021-06-25T19:07:33.155Z",
    "updated_at": "2021-06-25T19:07:33.155Z",
    "custom_attributes": {
      "emails": [
        {
          "primary": true,
          "type": "work",
          "value": "lela.block@example.com"
        }
      ],
      "department": "Engineering",
      "job_title": "Software Engineer",
      "username": "lela.block@example.com"
    },
    "role": { "slug": "member" },
    "roles": [{ "slug": "member" }],
    "previous_attributes": {}
  },
  "created_at": "2021-06-25T19:07:33.155Z",
  "context": {}
}

Payload data corresponds to the Directory User object. The groups field is omitted to avoid performance issues in large directories.

Triggered when a directory user is updated.

Email verification events

Events emitted when a user is required to verify their email.

Email verification created event

JSON

 {
  "event": "email_verification.created",
  "id": "event_01HYGAQ6DVKP4TKDF8P8AHFP47",
  "data": {
    "object": "email_verification",
    "id": "email_verification_01HYGAQN7DTHPWDDMMTW6GRN4Z",
    "user_id": "user_01E4ZCR3C5A4QZ2Z2JQXGKZJ9E",
    "email": "todd@example.com",
    "expires_at": "2023-11-16T21:32:25.235Z",
    "created_at": "2023-11-16T21:32:25.235Z",
    "updated_at": "2023-11-16T21:32:25.235Z"
  },
  "created_at": "2023-11-16T16:32:25.239Z",
  "context": {
    "client_id": "client_123456789"
  }
}

Payload data corresponds to the Email verification object with the code omitted.

Triggered when a user is required to verify their email and a code is created.

Feature flag events

Events emitted when WorkOS feature flags are created, updated, deleted, or their rules are updated.

Feature flag created event

JSON

 {
  "event": "flag.created",
  "id": "event_01K43DMGDK941Z4YPH6XGHTY3S",
  "data": {
    "id": "flag_01K43DMGCCK0STXE0EJT2AHQN0",
    "name": "Advanced Audit Logging",
    "slug": "advanced-audit-logging",
    "object": "flag",
    "created_at": "2025-08-28T17:56:30.985Z",
    "updated_at": "2025-08-28T17:56:30.985Z",
    "description": ""
  },
  "context": {
    "client_id": "client_07FA3DZGSL941Z4YPH6XGHTY3S",
    "actor": {
      "id": "user_01K9ZXY7Q2W8V5LJ3T4B8N6M5",
      "name": "Colin Morikawa",
      "source": "dashboard"
    }
  },
  "created_at": "2025-08-28T17:56:31.027Z"
}

Payload data corresponds to the Feature Flag object.

Triggered when a feature flag is created.

Feature flag updated event

JSON

 {
  "event": "flag.updated",
  "id": "event_01K43DS82YTHC4BN2J0F6QNVW1",
  "data": {
    "id": "flag_01K43DMGCCK0STXE0EJT2AHQN0",
    "name": "Advanced Audit Logging",
    "slug": "advanced-audit-logging",
    "object": "flag",
    "created_at": "2025-08-28T17:56:30.985Z",
    "updated_at": "2025-09-01T15:49:06.300Z",
    "description": "Enable advanced audit logging for users",
    "tags": ["audit", "logging", "beta"]
  },
  "context": {
    "client_id": "client_07FA3DZGSL941Z4YPH6XGHTY3S",
    "actor": {
      "id": "user_01K9ZXY7Q2W8V5LJ3T4B8N6M5",
      "name": "Colin Morikawa",
      "source": "dashboard"
    },
    "previous_attributes": {
      "description": "",
      "tags": ["audit", "logging"]
    }
  },
  "created_at": "2025-09-01T15:49:06.334Z"
}

Payload data corresponds to the Feature Flag object.

Triggered when a feature flag is updated.

Feature flag deleted event

JSON

 {
  "event": "flag.deleted",
  "id": "event_01K43DMGDK941Z4YPH6XGHTY3S",
  "data": {
    "id": "flag_01K43DMGCCK0STXE0EJT2AHQN0",
    "name": "Advanced Audit Logging",
    "slug": "advanced-audit-logging",
    "object": "flag",
    "created_at": "2025-08-28T17:56:30.985Z",
    "updated_at": "2025-08-28T17:56:30.985Z",
    "description": "Improved logging for audit trail"
  },
  "context": {
    "client_id": "client_07FA3DZGSL941Z4YPH6XGHTY3S",
    "actor": {
      "id": "user_01K9ZXY7Q2W8V5LJ3T4B8N6M5",
      "name": "Colin Morikawa",
      "source": "dashboard"
    }
  },
  "created_at": "2025-08-28T17:56:31.027Z"
}

Payload data corresponds to the Feature Flag object.

Triggered when a feature flag is deleted.

Feature flag rule updated event

JSON

 {
  "event": "flag.rule_updated",
  "id": "event_01K43DV45EXDX2M6M903MHYHP3",
  "data": {
    "id": "flag_01K43DMGCCK0STXE0EJT2AHQN0",
    "name": "Advanced Audit Logging",
    "slug": "advanced-audit-logging",
    "object": "feature_flag",
    "created_at": "2025-08-28T17:56:30.985Z",
    "updated_at": "2025-08-28T17:56:30.985Z",
    "description": ""
  },
  "context": {
    "client_id": "client_07FA3DZGSL941Z4YPH6XGHTY3S",
    "actor": {
      "id": "user_01K1C557F5P0P36MJ1HE3GRXBN",
      "name": "Tom Kim",
      "source": "dashboard"
    },
    "access_type": "some",
    "configured_targets": {
      "organizations": [
        { "id": "org_01K1C52WNZ2CR3A9QYHHVWXYZ1", "name": "Acme Corp" },
        { "id": "org_01K1C52WNZ2CR3A9QYHHVWXYZ2", "name": "Globex Inc" }
      ],
      "users": []
    },
    "previous_attributes": {
      "context": {
        "access_type": "none",
        "configured_targets": {
          "organizations": [],
          "users": []
        }
      }
    }
  },
  "created_at": "2025-09-01T20:00:07.854Z"
}

Payload data corresponds to the Feature Flag object.

Triggered when a feature flag’s rules are modified.

Group events

Events emitted when groups are created, updated, deleted, or their members change.

Group created event

JSON

 {
  "event": "group.created",
  "id": "event_01EHZNVPK3SFK441A1RGBFSHRT",
  "data": {
    "object": "group",
    "id": "group_01HXYZ123456789ABCDEFGHIJ",
    "organization_id": "org_01EHWNCE74X7JSDV0X3SZ3KJNY",
    "name": "Engineering",
    "description": "The engineering team",
    "created_at": "2026-01-15T12:00:00.000Z",
    "updated_at": "2026-01-15T12:00:00.000Z"
  },
  "context": {},
  "created_at": "2026-01-15T12:00:00.000Z"
}

Payload data corresponds to the Group object.

Triggered when a group is created.

Group updated event

JSON

 {
  "event": "group.updated",
  "id": "event_01EHZNVPK3SFK441A1RGBFSHRT",
  "data": {
    "object": "group",
    "id": "group_01HXYZ123456789ABCDEFGHIJ",
    "organization_id": "org_01EHWNCE74X7JSDV0X3SZ3KJNY",
    "name": "Engineering",
    "description": "The engineering team",
    "created_at": "2026-01-15T12:00:00.000Z",
    "updated_at": "2026-01-20T09:30:00.000Z"
  },
  "context": {},
  "created_at": "2026-01-20T09:30:00.000Z"
}

Payload data corresponds to the Group object.

Triggered when a group is updated.

Group deleted event

JSON

 {
  "event": "group.deleted",
  "id": "event_01EHZNVPK3SFK441A1RGBFSHRT",
  "data": {
    "object": "group",
    "id": "group_01HXYZ123456789ABCDEFGHIJ",
    "organization_id": "org_01EHWNCE74X7JSDV0X3SZ3KJNY",
    "name": "Engineering",
    "description": "The engineering team",
    "created_at": "2026-01-15T12:00:00.000Z",
    "updated_at": "2026-01-15T12:00:00.000Z"
  },
  "context": {},
  "created_at": "2026-01-25T15:45:00.000Z"
}

Payload data corresponds to the Group object.

Triggered when a group is deleted.

Group member added event

JSON

 {
  "event": "group.member_added",
  "id": "event_01EHZNVPK3SFK441A1RGBFSHRT",
  "data": {
    "group_id": "group_01HXYZ123456789ABCDEFGHIJ",
    "organization_membership_id": "om_01EHWNCE74X7JSDV0X3SZ3KJNY"
  },
  "context": {},
  "created_at": "2026-01-15T12:00:00.000Z"
}

Payload data contains the group_id and organization_membership_id of the added member.

Triggered when an organization membership is added to a group.

Group member removed event

JSON

 {
  "event": "group.member_removed",
  "id": "event_01EHZNVPK3SFK441A1RGBFSHRT",
  "data": {
    "group_id": "group_01HXYZ123456789ABCDEFGHIJ",
    "organization_membership_id": "om_01EHWNCE74X7JSDV0X3SZ3KJNY"
  },
  "context": {},
  "created_at": "2026-01-15T12:00:00.000Z"
}

Payload data contains the group_id and organization_membership_id of the removed member.

Triggered when an organization membership is removed from a group.

Invitation events

Events emitted when an AuthKit user is invited to join an organization.

Invitation accepted event

JSON

 {
  "event": "invitation.accepted",
  "id": "event_01HWWSM92W0M1GE0DV8BZS00E5",
  "data": {
    "object": "invitation",
    "id": "invitation_01HWWSMMQSP0FAN9PF071E77W9",
    "email": "todd@example.com",
    "state": "accepted",
    "accepted_at": "2023-11-16T21:32:25.235Z",
    "revoked_at": null,
    "expires_at": "2023-11-23T21:32:25.235Z",
    "organization_id": "org_01HWWSSTF0QKDCXMZC911T8BTG",
    "inviter_user_id": "user_01HYGAVW79Z32XVDXZJV0WM6Y9",
    "accepted_user_id": "user_01HYGAVW79Z32XVDXZJV0WM6Y9",
    "role_slug": "admin",
    "created_at": "2023-11-16T21:32:25.235Z",
    "updated_at": "2023-11-16T21:32:25.235Z"
  },
  "created_at": "2023-11-16T22:32:25.239Z",
  "context": {
    "client_id": "client_123456789"
  }
}

Payload data corresponds to the Invitation object with the token and accept_invitation_url omitted.

Triggered when a user accepts an invitation.

Invitation created event

JSON

 {
  "event": "invitation.created",
  "id": "event_01HWWSM92W0M1GE0DV8BZS00E5",
  "data": {
    "object": "invitation",
    "id": "invitation_01HWWSMMQSP0FAN9PF071E77W9",
    "email": "todd@example.com",
    "state": "pending",
    "accepted_at": null,
    "revoked_at": null,
    "expires_at": "2023-11-23T21:32:25.235Z",
    "organization_id": "org_01HWWSSTF0QKDCXMZC911T8BTG",
    "inviter_user_id": "user_01HYGAVW79Z32XVDXZJV0WM6Y9",
    "accepted_user_id": null,
    "role_slug": "admin",
    "created_at": "2023-11-16T21:32:25.235Z",
    "updated_at": "2023-11-16T21:32:25.235Z"
  },
  "created_at": "2023-11-16T21:32:25.239Z",
  "context": {
    "client_id": "client_123456789"
  }
}

Payload data corresponds to the Invitation object with the token and accept_invitation_url omitted.

Triggered when a user is invited to sign up or to join an organization.

Invitation resent event

JSON

 {
  "event": "invitation.resent",
  "id": "event_01HWWSM92W0M1GE0DV8BZS00E5",
  "data": {
    "object": "invitation",
    "id": "invitation_01HWWSMMQSP0FAN9PF071E77W9",
    "email": "todd@example.com",
    "state": "pending",
    "accepted_at": null,
    "revoked_at": null,
    "expires_at": "2023-11-23T21:32:25.235Z",
    "organization_id": "org_01HWWSSTF0QKDCXMZC911T8BTG",
    "inviter_user_id": "user_01HYGAVW79Z32XVDXZJV0WM6Y9",
    "accepted_user_id": null,
    "role_slug": "admin",
    "created_at": "2023-11-16T21:32:25.235Z",
    "updated_at": "2023-11-16T21:32:25.235Z"
  },
  "created_at": "2023-11-16T22:32:25.239Z",
  "context": {
    "client_id": "client_123456789"
  }
}

Payload data corresponds to the Invitation object with the token and accept_invitation_url omitted.

Triggered when an invitation is resent.

Invitation revoked event

JSON

 {
  "event": "invitation.revoked",
  "id": "event_01HWWSM92W0M1GE0DV8BZS00E5",
  "data": {
    "object": "invitation",
    "id": "invitation_01HWWSMMQSP0FAN9PF071E77W9",
    "email": "todd@example.com",
    "state": "revoked",
    "accepted_at": null,
    "revoked_at": "2023-11-16T21:32:25.235Z",
    "expires_at": "2023-11-23T21:32:25.235Z",
    "organization_id": "org_01HWWSSTF0QKDCXMZC911T8BTG",
    "inviter_user_id": "user_01HYGAVW79Z32XVDXZJV0WM6Y9",
    "accepted_user_id": null,
    "role_slug": "admin",
    "created_at": "2023-11-16T21:32:25.235Z",
    "updated_at": "2023-11-16T21:32:25.235Z"
  },
  "created_at": "2023-11-16T22:32:25.239Z",
  "context": {
    "client_id": "client_123456789"
  }
}

Payload data corresponds to the Invitation object with the token and accept_invitation_url omitted.

Triggered when an invitation is revoked.

Magic Auth events

Events emitted when a user requests a Magic Auth code.

Magic Auth created event

JSON

 {
  "event": "magic_auth.created",
  "id": "event_01HWWSTZVFADJG9M9EJMKXB043",
  "data": {
    "object": "magic_auth",
    "id": "magic_auth_01HWWSVXCRMA5481VK9601SKQX",
    "user_id": "user_01E4ZCR3C5A4QZ2Z2JQXGKZJ9E",
    "email": "todd@example.com",
    "expires_at": "2023-11-16T21:32:25.235Z",
    "created_at": "2023-11-16T21:32:25.235Z",
    "updated_at": "2023-11-16T21:32:25.235Z"
  },
  "created_at": "2023-11-16T16:32:25.239Z",
  "context": {
    "client_id": "client_123456789"
  }
}

Payload data corresponds to the Magic Auth object with the code omitted.

Triggered when a user initiates Magic Auth and an authentication code is created.

Organization events

Events emitted when WorkOS organizations are created, updated, or deleted.

Organization created

JSON

 {
  "event": "organization.created",
  "id": "event_04FKJ843CVE8F7BXQSPFH0M30K",
  "data": {
    "id": "org_01HV1VNQBQ24JVREYB94RFCNDC",
    "name": "Foo Corp",
    "object": "organization",
    "external_id": null,
    "domains": [
      {
        "id": "org_domain_01HV1VX5N18E48ETTHNNK54R6S",
        "state": "verified",
        "domain": "foo-corp.com",
        "object": "organization_domain",
        "organization_id": "org_01HV1VNQBQ24JVREYB94RFCNDC",
        "verification_strategy": "manual",
        "verification_prefix": "superapp-domain-verification-z3kjny",
        "verification_token": "gBIJgYXZLjW8uHHpz614dkgqm",
        "created_at": "2023-11-27T19:07:33.155Z",
        "updated_at": "2023-11-27T19:07:33.155Z"
      }
    ],
    "created_at": "2023-11-16T16:32:25.239Z",
    "updated_at": "2023-11-16T16:32:25.239Z"
  },
  "created_at": "2023-11-16T16:32:25.239Z",
  "context": {}
}

Payload data corresponds to the Organization object.

Triggered when an organization is created.

Organization updated

JSON

 {
  "event": "organization.updated",
  "id": "event_04FKJ843CVE8F7BXQSPFH0M30K",
  "data": {
    "id": "org_01HV1VNQBQ24JVREYB94RFCNDC",
    "name": "Foo Corp",
    "object": "organization",
    "external_id": null,
    "domains": [
      {
        "id": "org_domain_01HV1VX5N18E48ETTHNNK54R6S",
        "state": "verified",
        "domain": "foo-corp.com",
        "object": "organization_domain",
        "organization_id": "org_01HV1VNQBQ24JVREYB94RFCNDC",
        "verification_strategy": "manual",
        "verification_prefix": null,
        "verification_token": null,
        "created_at": "2023-11-27T19:07:33.155Z",
        "updated_at": "2023-11-27T19:07:33.155Z"
      }
    ],
    "created_at": "2023-11-16T16:32:25.239Z",
    "updated_at": "2023-11-16T17:32:25.239Z"
  },
  "created_at": "2023-11-16T17:32:25.239Z",
  "context": {}
}

Payload data corresponds to the Organization object.

Triggered when an organization is updated.

Organization deleted

JSON

 {
  "event": "organization.deleted",
  "id": "event_04FKJ843CVE8F7BXQSPFH0M30K",
  "data": {
    "id": "org_01HV1VNQBQ24JVREYB94RFCNDC",
    "name": "Foo Corp",
    "object": "organization",
    "external_id": null,
    "domains": [
      {
        "id": "org_domain_01HV1VX5N18E48ETTHNNK54R6S",
        "state": "verified",
        "domain": "foo-corp.com",
        "object": "organization_domain",
        "organization_id": "org_01HV1VNQBQ24JVREYB94RFCNDC",
        "verification_strategy": "manual"
      }
    ],
    "created_at": "2023-11-16T16:32:25.239Z",
    "updated_at": "2023-11-16T17:32:25.239Z"
  },
  "created_at": "2023-11-16T17:32:25.239Z",
  "context": {}
}

Payload data corresponds to the Organization object.

Triggered when an organization is deleted

Organization domain events

Events emitted when organization domains are created, updated, deleted, or their verification status changes.

Organization domain created event

JSON

 {
  "event": "organization_domain.created",
  "id": "event_01G69A9MDSW8MM1XW5S0EHA0NA",
  "data": {
    "object": "organization_domain",
    "id": "org_domain_01EZTR5N6Y9RQKHK2E9F31KZX6",
    "organization_id": "org_01EHWNCE74X7JSDV0X3SZ3KJNY",
    "domain": "foo-corp.com",
    "state": "pending",
    "verification_token": "gBIJgYXZLjW8uHHpz614dkgqm",
    "verification_strategy": "dns",
    "verification_prefix": "superapp-domain-verification-z3kjny",
    "created_at": "2023-11-27T19:07:33.155Z",
    "updated_at": "2023-11-27T19:07:33.155Z"
  },
  "created_at": "2023-11-27T19:07:33.155Z",
  "context": {}
}

Payload data corresponds to the Organization Domain object.

Triggered when an organization domain is created.

Organization domain updated event

JSON

 {
  "event": "organization_domain.updated",
  "id": "event_01G69A9MDSW8MM1XW5S0EHA0NA",
  "data": {
    "object": "organization_domain",
    "id": "org_domain_01EZTR5N6Y9RQKHK2E9F31KZX6",
    "organization_id": "org_01EHWNCE74X7JSDV0X3SZ3KJNY",
    "domain": "foo-corp.com",
    "state": "verified",
    "verification_prefix": "superapp-domain-verification-z3kjny",
    "verification_token": "gBIJgYXZLjW8uHHpz614dkgqm",
    "verification_strategy": "dns",
    "created_at": "2022-11-27T19:07:33.155Z",
    "updated_at": "2023-11-27T19:07:33.155Z"
  },
  "created_at": "2023-11-27T19:07:33.155Z",
  "context": {}
}

Payload data corresponds to the Organization Domain object.

Triggered when an organization domain is updated.

Organization domain deleted event

JSON

 {
  "event": "organization_domain.deleted",
  "id": "event_01G69A9MDSW8MM1XW5S0EHA0NA",
  "data": {
    "object": "organization_domain",
    "id": "org_domain_01EZTR5N6Y9RQKHK2E9F31KZX6",
    "organization_id": "org_01EHWNCE74X7JSDV0X3SZ3KJNY",
    "domain": "foo-corp.com",
    "state": "verified",
    "verification_prefix": "superapp-domain-verification-z3kjny",
    "verification_token": "gBIJgYXZLjW8uHHpz614dkgqm",
    "verification_strategy": "dns",
    "created_at": "2022-11-27T19:07:33.155Z",
    "updated_at": "2023-11-27T19:07:33.155Z"
  },
  "created_at": "2023-11-27T19:07:33.155Z",
  "context": {}
}

Payload data corresponds to the Organization Domain object.

Triggered when an organization domain is deleted.

Organization domain verified event

JSON

 {
  "event": "organization_domain.verified",
  "id": "event_07FKJ843CVE8F7BXQSPFH0M53A",
  "data": {
    "object": "organization_domain",
    "id": "org_domain_01HACSKJ57W8M2Q0N2X759C5HS",
    "organization_id": "org_01EHT88Z8J8795GZNQ4ZP1J81T",
    "domain": "foo-corp.com",
    "state": "verified",
    "verification_prefix": "superapp-domain-verification-z3kjny",
    "verification_token": "gBIJgYXZLjW8uHHpz614dkgqm",
    "verification_strategy": "dns",
    "created_at": "2022-11-27T19:07:33.155Z",
    "updated_at": "2023-11-27T19:07:33.155Z"
  },
  "created_at": "2021-06-25T19:07:33.155Z",
  "context": {}
}

Payload data corresponds to the Organization Domain object.

Triggered when an organization domain is verified.

Organization domain verification failed event

JSON

 {
  "event": "organization_domain.verification_failed",
  "id": "event_07FKJ843CVE8F7BXQSPFH0M53A",
  "data": {
    "reason": "domain_verification_period_expired",
    "organization_domain": {
      "object": "organization_domain",
      "id": "org_domain_01HACSKJ57W8M2Q0N2X759C5HS",
      "organization_id": "org_01EHT88Z8J8795GZNQ4ZP1J81T",
      "domain": "foo-corp.com",
      "state": "failed",
      "verification_token": "gBIJgYXZLjW8uHHpz614dkgqm",
      "verification_strategy": "dns"
    }
  },
  "created_at": "2021-06-25T19:07:33.155Z",
  "context": {}
}

Payload data contains a reason and an organization_domain which corresponds to the Organization Domain object.

Triggered when an organization domain verification fails.

Organization membership events

Events emitted when an AuthKit user joins or leaves an organization.

Organization membership created event

JSON

 {
  "event": "organization_membership.created",
  "id": "event_04FKJ843CVE8F7BXQSPFH0M53V",
  "data": {
    "id": "om_01E4ZCR3C56J083X43JQXF3JK5",
    "object": "organization_membership",
    "user_id": "user_01E4ZCR3C5A4QZ2Z2JQXGKZJ9E",
    "organization_id": "org_01E4ZCR3C56J083X43JQXF3JK5",
    "status": "pending",
    "role": {
      "slug": "member"
    },
    "roles": [
      {
        "slug": "member"
      }
    ],
    "custom_attributes": {
      "department": "Engineering",
      "job_title": "Software Engineer"
    },
    "created_at": "2023-11-16T21:32:25.235Z",
    "updated_at": "2023-11-16T21:32:25.235Z"
  },
  "created_at": "2023-11-16T16:32:25.239Z",
  "context": {}
}

Payload data corresponds to the Organization Membership object.

Triggered when an organization membership is created.

Organization membership deleted event

JSON

 {
  "event": "organization_membership.deleted",
  "id": "event_04FKJ843CVE8F7BXQSPFH0M97T",
  "data": {
    "id": "om_01E4ZCR3C56J083X43JQXF3JK5",
    "object": "organization_membership",
    "user_id": "user_01E4ZCR3C5A4QZ2Z2JQXGKZJ9E",
    "organization_id": "org_01E4ZCR3C56J083X43JQXF3JK5",
    "status": "active",
    "role": {
      "slug": "member"
    },
    "roles": [
      {
        "slug": "member"
      }
    ],
    "custom_attributes": {
      "department": "Engineering",
      "job_title": "Software Engineer"
    },
    "created_at": "2023-11-16T21:32:25.235Z",
    "updated_at": "2023-11-27T03:14:45.864Z"
  },
  "created_at": "2023-11-16T16:32:25.239Z",
  "context": {}
}

Payload data corresponds to the Organization Membership object.

Triggered when an organization membership is deleted.

Organization membership updated event

JSON

 {
  "event": "organization_membership.updated",
  "id": "event_04FKJ843CVE8F7BXQSPFH0M30K",
  "data": {
    "id": "om_01E4ZCR3C56J083X43JQXF3JK5",
    "object": "organization_membership",
    "user_id": "user_01E4ZCR3C5A4QZ2Z2JQXGKZJ9E",
    "organization_id": "org_01E4ZCR3C56J083X43JQXF3JK5",
    "status": "active",
    "role": {
      "slug": "member"
    },
    "roles": [
      {
        "slug": "member"
      }
    ],
    "custom_attributes": {
      "department": "Engineering",
      "job_title": "Software Engineer"
    },
    "created_at": "2023-11-16T21:32:25.235Z",
    "updated_at": "2023-11-18T17:10:15.121Z"
  },
  "created_at": "2023-11-16T16:32:25.239Z",
  "context": {}
}

Payload data corresponds to the Organization Membership object.

Triggered when an organization membership is updated.

Custom role events

Events emitted when custom roles are created, updated, or deleted.

Custom role created event

JSON

 {
  "event": "organization_role.created",
  "id": "event_01HWDP814K1EN7VS6K3BD49GWD",
  "data": {
    "object": "organization_role",
    "organization_id": "org_01EHWNCE74X7JSDV0X3SZ3KJNY",
    "slug": "admin",
    "name": "Admin",
    "description": "Administrator role with full access",
    "resource_type_slug": "organization",
    "permissions": ["users:read", "users:write", "settings:manage"],
    "created_at": "2023-11-27T19:07:33.155Z",
    "updated_at": "2023-11-27T19:07:33.155Z"
  },
  "created_at": "2023-11-27T19:07:33.155Z",
  "context": {}
}

Payload data corresponds to the custom role object.

Triggered when a custom role is created.

Custom role deleted event

JSON

 {
  "event": "organization_role.deleted",
  "id": "event_01HWDP814K1EN7VS6K3BD49GWE",
  "data": {
    "object": "organization_role",
    "organization_id": "org_01EHWNCE74X7JSDV0X3SZ3KJNY",
    "slug": "admin",
    "name": "Admin",
    "description": "Administrator role with full access",
    "resource_type_slug": "organization",
    "permissions": ["users:read", "users:write", "settings:manage"],
    "created_at": "2023-11-27T19:07:33.155Z",
    "updated_at": "2023-11-27T19:07:33.155Z"
  },
  "created_at": "2023-11-27T19:07:33.155Z",
  "context": {}
}

Payload data corresponds to the custom role object.

Triggered when a custom role is deleted.

Custom role updated event

JSON

 {
  "event": "organization_role.updated",
  "id": "event_01HWDP814K1EN7VS6K3BD49GWF",
  "data": {
    "object": "organization_role",
    "organization_id": "org_01EHWNCE74X7JSDV0X3SZ3KJNY",
    "slug": "admin",
    "name": "Admin",
    "description": "Administrator role with full access",
    "resource_type_slug": "organization",
    "permissions": ["users:read", "users:write", "settings:manage"],
    "created_at": "2023-11-27T19:07:33.155Z",
    "updated_at": "2023-11-27T19:07:33.155Z"
  },
  "created_at": "2023-11-27T19:07:33.155Z",
  "context": {}
}

Payload data corresponds to the custom role object.

Triggered when a custom role is updated.

Password reset events

Events emitted when a user requests to reset their password.

Password reset created event

JSON

 {
  "event": "password_reset.created",
  "id": "event_01HYGAT2P3A8XJ4E5AR88J02ZV",
  "data": {
    "object": "password_reset",
    "id": "password_reset_01HYGATMCSBX77HQHP29XT5WV6",
    "user_id": "user_01E4ZCR3C5A4QZ2Z2JQXGKZJ9E",
    "email": "todd@example.com",
    "expires_at": "2023-11-16T21:32:25.235Z",
    "created_at": "2023-11-16T21:32:25.235Z"
  },
  "created_at": "2023-11-16T16:32:25.239Z",
  "context": {
    "client_id": "client_123456789"
  }
}

Payload data corresponds to the Organization Membership object with the token omitted.

Triggered when a user requests to reset their password.

Password reset succeeded event

JSON

 {
  "event": "password_reset.succeeded",
  "id": "event_01HYGAT2P3A8XJ4E5AR88J02ZV",
  "data": {
    "object": "password_reset",
    "id": "password_reset_01HYGATMCSBX77HQHP29XT5WV6",
    "user_id": "user_01E4ZCR3C5A4QZ2Z2JQXGKZJ9E",
    "email": "todd@example.com",
    "expires_at": "2023-11-16T21:32:25.235Z",
    "created_at": "2023-11-16T21:32:25.235Z"
  },
  "created_at": "2023-11-16T16:32:25.239Z",
  "context": {
    "client_id": "client_123456789"
  }
}

Payload data corresponds to the Password Reset object with the token omitted.

Triggered when a user successfully resets their password.

Permission events

Events emitted when permissions are created, updated, or deleted.

Permission created event

JSON

 {
  "event": "permission.created",
  "id": "event_01HWDP814K1EN7VS6K3BD49GWG",
  "data": {
    "object": "permission",
    "id": "01HWDP91J37GZW2FT9GCEX8YWV",
    "slug": "users:read",
    "name": "Read Users",
    "description": "Allows reading user data",
    "system": false,
    "created_at": "2023-11-27T19:07:33.155Z",
    "updated_at": "2023-11-27T19:07:33.155Z"
  },
  "created_at": "2023-11-27T19:07:33.155Z",
  "context": {}
}

Payload data corresponds to the permission object.

Triggered when a permission is created.

Permission deleted event

JSON

 {
  "event": "permission.deleted",
  "id": "event_01HWDP814K1EN7VS6K3BD49GWH",
  "data": {
    "object": "permission",
    "id": "01HWDP91J37GZW2FT9GCEX8YWV",
    "slug": "users:read",
    "name": "Read Users",
    "description": "Allows reading user data",
    "system": false,
    "created_at": "2023-11-27T19:07:33.155Z",
    "updated_at": "2023-11-27T19:07:33.155Z"
  },
  "created_at": "2023-11-27T19:07:33.155Z",
  "context": {}
}

Payload data corresponds to the permission object.

Triggered when a permission is deleted.

Permission updated event

JSON

 {
  "event": "permission.updated",
  "id": "event_01HWDP814K1EN7VS6K3BD49GWI",
  "data": {
    "object": "permission",
    "id": "01HWDP91J37GZW2FT9GCEX8YWV",
    "slug": "users:read",
    "name": "Read Users",
    "description": "Allows reading user data",
    "system": false,
    "created_at": "2023-11-27T19:07:33.155Z",
    "updated_at": "2023-11-27T19:07:33.155Z"
  },
  "created_at": "2023-11-27T19:07:33.155Z",
  "context": {}
}

Payload data corresponds to the permission object.

Triggered when a permission is updated.

Pipes events

Events emitted when a Pipes connected account is connected, disconnected, or requires reauthorization.

Pipes connected account connected event

JSON

 {
  "event": "pipes.connected_account.connected",
  "id": "event_01HX1ZX6Q0BP4Z1RBD8N9AD67W",
  "data": {
    "object": "connected_account",
    "id": "data_installation_01HX1ZWK1Z5H5Q7Y7X5EJ09MQ1",
    "data_integration_id": "data_integration_01HX1ZVGJTYGB4YPB4JZM0WS8E",
    "provider_slug": "github",
    "user_id": "user_01HX1ZVZRQQJ4N90R7GG4A1TRG",
    "organization_id": null,
    "scopes": ["repo", "user:email"],
    "state": "connected",
    "created_at": "2024-05-01T12:00:00.000Z",
    "updated_at": "2024-05-01T12:00:00.000Z"
  },
  "created_at": "2024-05-01T12:00:00.000Z"
}

Triggered when a connected account completes authorization.

Pipes connected account disconnected event

JSON

 {
  "event": "pipes.connected_account.disconnected",
  "id": "event_01HX1ZXK572WJMW9WSRCS6R6KG",
  "data": {
    "object": "connected_account",
    "id": "data_installation_01HX1ZWK1Z5H5Q7Y7X5EJ09MQ1",
    "data_integration_id": "data_integration_01HX1ZVGJTYGB4YPB4JZM0WS8E",
    "provider_slug": "github",
    "user_id": "user_01HX1ZVZRQQJ4N90R7GG4A1TRG",
    "organization_id": null,
    "scopes": ["repo", "user:email"],
    "state": "connected",
    "created_at": "2024-05-01T12:00:00.000Z",
    "updated_at": "2024-05-02T12:00:00.000Z"
  },
  "created_at": "2024-05-02T12:00:00.000Z"
}

Triggered when a connected account is disconnected.

Pipes connected account reauthorization needed event

JSON

 {
  "event": "pipes.connected_account.reauthorization_needed",
  "id": "event_01HX1ZY76V62RVHR7DJ56625DK",
  "data": {
    "object": "connected_account",
    "id": "data_installation_01HX1ZWK1Z5H5Q7Y7X5EJ09MQ1",
    "data_integration_id": "data_integration_01HX1ZVGJTYGB4YPB4JZM0WS8E",
    "provider_slug": "github",
    "user_id": "user_01HX1ZVZRQQJ4N90R7GG4A1TRG",
    "organization_id": null,
    "scopes": ["repo", "user:email"],
    "state": "needs_reauthorization",
    "created_at": "2024-05-01T12:00:00.000Z",
    "updated_at": "2024-05-03T12:00:00.000Z"
  },
  "created_at": "2024-05-03T12:00:00.000Z"
}

Triggered when a connected account needs to be reauthorized.

Role events

Events emitted when environment roles are created, updated, or deleted.

Role created event

JSON

 {
  "event": "role.created",
  "id": "event_02F4KLW3C56P083X43JQXF4FO9",
  "data": {
    "object": "role",
    "slug": "admin",
    "permissions": ["posts:view"],
    "created_at": "2023-11-16T21:32:25.235Z",
    "updated_at": "2023-11-16T21:32:25.235Z"
  },
  "created_at": "2023-11-16T21:32:25.245Z",
  "context": {}
}

Triggered when a role is created.

Role deleted event

JSON

 {
  "event": "role.deleted",
  "id": "event_01E4YCD3C56P083X43JQXF4JK5",
  "data": {
    "object": "role",
    "slug": "developer",
    "created_at": "2023-11-16T21:32:25.235Z",
    "updated_at": "2023-11-18T10:12:18.121Z"
  },
  "created_at": "2023-11-21T18:14:01.399Z",
  "context": {}
}

Triggered when a role is deleted.

Role updated event

JSON

 {
  "event": "role.updated",
  "id": "event_01J21G0ED0N5Q5KZT9Z127Q2MZ",
  "data": {
    "object": "role",
    "slug": "admin",
    "permissions": ["posts:create", "posts:delete"],
    "created_at": "2023-11-16T21:32:25.235Z",
    "updated_at": "2023-11-16T21:32:25.235Z"
  },
  "created_at": "2023-11-16T21:32:25.245Z",
  "context": {}
}

Triggered when a role’s permissions are updated.

Session events

Events emitted when AuthKit sessions are created.

Session created event

JSON

 {
  "event": "session.created",
  "id": "event_04FKJ843CVE8F7BXQSPFH0M53V",
  "data": {
    "object": "session",
    "id": "session_01HSCBECW0D7AY8CA45AYKA64G",
    "user_id": "user_01HQGXWZW8BSHRG3HVK2QF7XBX",
    "organization_id": "org_01HQHCBRRAVQ7N3PX81VKAYXSX",
    "impersonator": {
      "email": "admin@example.com",
      "reason": "Helping a customer fix an issue with their account."
    },
    "ip_address": "192.0.2.1",
    "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36",
    "created_at": "2024-03-19T21:56:25.080Z",
    "updated_at": "2024-03-19T21:56:25.080Z"
  },
  "created_at": "2024-03-19T21:56:25.080Z",
  "context": {
    "client_id": "client_123456789"
  }
}

Triggered when a session is created. Sessions started using impersonation will include an additional impersonator field with data about the impersonator.

Session revoked event

JSON

 {
  "event": "session.revoked",
  "id": "event_04FKJ843CVE8F7BXQSPFH0M53B",
  "data": {
    "object": "session",
    "id": "session_01HSCBECW0D7AY8CA45AYKA64G",
    "user_id": "user_01HQGXWZW8BSHRG3HVK2QF7XBX",
    "organization_id": "org_01HQHCBRRAVQ7N3PX81VKAYXSX",
    "impersonator": {
      "email": "admin@example.com",
      "reason": "Helping a customer fix an issue with their account."
    },
    "ip_address": "192.0.2.1",
    "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36",
    "created_at": "2024-03-19T21:56:25.080Z",
    "updated_at": "2024-03-19T21:56:25.080Z"
  },
  "created_at": "2024-03-19T21:56:25.080Z",
  "context": {
    "client_id": "client_123456789"
  }
}

Triggered when an issued session is revoked for a user.

User events

Events emitted when AuthKit users are created, updated, or deleted.

User created event

JSON

 {
  "event": "user.created",
  "id": "event_02F4KLW3C56P083X43JQXF4FO9",
  "data": {
    "object": "user",
    "id": "user_01E4ZCR3C5A4QZ2Z2JQXGKZJ9E",
    "email": "todd@example.com",
    "first_name": "Todd",
    "last_name": "Rundgren",
    "name": "Todd Rundgren",
    "email_verified": false,
    "profile_picture_url": "https://workoscdn.com/images/v1/123abc",
    "created_at": "2023-11-18T09:18:13.120Z",
    "updated_at": "2023-11-18T09:18:13.120Z"
  },
  "created_at": "2023-11-18T04:18:13.126Z",
  "context": {
    "client_id": "client_123456789"
  }
}

Payload data corresponds to the User object.

Triggered when a user is created.

User deleted event

JSON

 {
  "event": "user.deleted",
  "id": "event_123456abcd",
  "data": {
    "object": "user",
    "id": "user_01E4ZCR3C5A4QZ2Z2JQXGKZJ9E",
    "email": "todd@example.com",
    "first_name": "Todd",
    "last_name": "Rundgren",
    "name": "Todd Rundgren",
    "email_verified": true,
    "profile_picture_url": "https://workoscdn.com/images/v1/123abc",
    "created_at": "2023-11-16T21:26:25.427Z",
    "updated_at": "2023-11-17T04:00:03.937Z"
  },
  "created_at": "2023-11-18T04:18:13.126Z",
  "context": {}
}

Payload data corresponds to the User object.

Triggered when a user is deleted.

User updated event

JSON

 {
  "event": "user.updated",
  "id": "event_02F4KLW3C56P083X43JQXF4FO9",
  "data": {
    "object": "user",
    "id": "user_01E4ZCR3C5A4QZ2Z2JQXGKZJ9E",
    "email": "todd@example.com",
    "first_name": "Todd",
    "last_name": "Rundgren",
    "name": "Todd Rundgren",
    "email_verified": true,
    "profile_picture_url": "https://workoscdn.com/images/v1/123abc",
    "created_at": "2023-11-18T09:18:13.120Z",
    "updated_at": "2023-11-19T11:05:10.539Z"
  },
  "created_at": "2023-11-19T11:05:10.550Z",
  "context": {}
}

Payload data corresponds to the User object.

Triggered when a user is updated.

Vault events

Events emitted when Vault data, keys, or metadata are accessed or modified.

Vault BYOK key deleted event

JSON

 {
  "event": "vault.byok_key.deleted",
  "id": "event_01JMD5H7X3KQXR9VBN2GW4FT8Y",
  "data": {
    "organization_id": "org_01EHWNCE74X7JSDV0X3SZ3KJNY",
    "key_provider": "AWS_KMS"
  },
  "created_at": "2024-07-15T10:30:00.000Z",
  "context": {}
}

Triggered when a bring-your-own-key (BYOK) configuration is deleted from an organization.

Vault BYOK key verification completed event

JSON

 {
  "event": "vault.byok_key.verification_completed",
  "id": "event_01JMD5H7X3KQXR9VBN2GW4FT8Y",
  "data": {
    "organization_id": "org_01EHWNCE74X7JSDV0X3SZ3KJNY",
    "key_provider": "AWS_KMS",
    "verified": true
  },
  "created_at": "2024-07-15T10:30:00.000Z",
  "context": {}
}

Triggered when bring-your-own-key (BYOK) verification completes for an organization.

Vault data created event

JSON

 {
  "event": "vault.data.created",
  "id": "event_01JMD5H7X3KQXR9VBN2GW4FT8Y",
  "data": {
    "actor_id": "key_01JMD5H7X3KQXR9VBN2GW4FT8Y",
    "actor_source": "api",
    "actor_name": "My API Key",
    "kv_name": "user-ssn",
    "key_id": "vault_key_01JMD5H7X3KQXR9VBN2GW4FT8Y",
    "key_context": {
      "user_id": "user_01E4ZCR3C5A4QZ2Z2JQXGKZJ9E"
    }
  },
  "created_at": "2024-07-15T10:30:00.000Z",
  "context": {}
}

Triggered when a new encrypted object is stored in Vault.

Vault data deleted event

JSON

 {
  "event": "vault.data.deleted",
  "id": "event_01JMD5H7X3KQXR9VBN2GW4FT9A",
  "data": {
    "actor_id": "key_01JMD5H7X3KQXR9VBN2GW4FT8Y",
    "actor_source": "api",
    "actor_name": "My API Key",
    "kv_name": "user-ssn"
  },
  "created_at": "2024-07-15T10:35:00.000Z",
  "context": {}
}

Triggered when an encrypted object is deleted from Vault.

Vault data read event

JSON

 {
  "event": "vault.data.read",
  "id": "event_01JMD5H7X3KQXR9VBN2GW4FT9B",
  "data": {
    "actor_id": "key_01JMD5H7X3KQXR9VBN2GW4FT8Y",
    "actor_source": "api",
    "actor_name": "My API Key",
    "kv_name": "user-ssn",
    "key_id": "vault_key_01JMD5H7X3KQXR9VBN2GW4FT8Y"
  },
  "created_at": "2024-07-15T10:32:00.000Z",
  "context": {}
}

Triggered when an encrypted object is read from Vault.

Vault data updated event

JSON

 {
  "event": "vault.data.updated",
  "id": "event_01JMD5H7X3KQXR9VBN2GW4FT9C",
  "data": {
    "actor_id": "key_01JMD5H7X3KQXR9VBN2GW4FT8Y",
    "actor_source": "api",
    "actor_name": "My API Key",
    "kv_name": "user-ssn",
    "key_id": "vault_key_01JMD5H7X3KQXR9VBN2GW4FT8Y",
    "key_context": {
      "user_id": "user_01E4ZCR3C5A4QZ2Z2JQXGKZJ9E"
    }
  },
  "created_at": "2024-07-15T10:31:00.000Z",
  "context": {}
}

Triggered when an existing encrypted object is updated in Vault.

Vault DEK decrypted event

JSON

 {
  "event": "vault.dek.decrypted",
  "id": "event_01JMD5H7X3KQXR9VBN2GW4FT9D",
  "data": {
    "actor_id": "key_01JMD5H7X3KQXR9VBN2GW4FT8Y",
    "actor_source": "api",
    "actor_name": "My API Key",
    "key_id": "vault_key_01JMD5H7X3KQXR9VBN2GW4FT8Y"
  },
  "created_at": "2024-07-15T10:40:00.000Z",
  "context": {}
}

Triggered when a data encryption key (DEK) is decrypted.

Vault DEK read event

JSON

 {
  "event": "vault.dek.read",
  "id": "event_01JMD5H7X3KQXR9VBN2GW4FT9E",
  "data": {
    "actor_id": "key_01JMD5H7X3KQXR9VBN2GW4FT8Y",
    "actor_source": "api",
    "actor_name": "My API Key",
    "key_ids": [
      "vault_key_01JMD5H7X3KQXR9VBN2GW4FT8Y",
      "vault_key_01JMD5H7X3KQXR9VBN2GW4FT9F"
    ],
    "key_context": {
      "user_id": "user_01E4ZCR3C5A4QZ2Z2JQXGKZJ9E"
    }
  },
  "created_at": "2024-07-15T10:38:00.000Z",
  "context": {}
}

Triggered when one or more data encryption keys (DEKs) are read.

Vault KEK created event

JSON

 {
  "event": "vault.kek.created",
  "id": "event_01JMD5H7X3KQXR9VBN2GW4FT9G",
  "data": {
    "actor_id": "key_01JMD5H7X3KQXR9VBN2GW4FT8Y",
    "actor_source": "api",
    "actor_name": "My API Key",
    "key_name": "production-kek",
    "key_id": "vault_key_01JMD5H7X3KQXR9VBN2GW4FT8Y"
  },
  "created_at": "2024-07-15T10:36:00.000Z",
  "context": {}
}

Triggered when a new key encryption key (KEK) is created.

Vault metadata read event

JSON

 {
  "event": "vault.metadata.read",
  "id": "event_01JMD5H7X3KQXR9VBN2GW4FT9H",
  "data": {
    "actor_id": "key_01JMD5H7X3KQXR9VBN2GW4FT8Y",
    "actor_source": "api",
    "actor_name": "My API Key",
    "kv_name": "user-ssn"
  },
  "created_at": "2024-07-15T10:34:00.000Z",
  "context": {}
}

Triggered when metadata for a Vault store is read.

Vault names listed event

JSON

 {
  "event": "vault.names.listed",
  "id": "event_01JMD5H7X3KQXR9VBN2GW4FT9J",
  "data": {
    "actor_id": "key_01JMD5H7X3KQXR9VBN2GW4FT8Y",
    "actor_source": "api",
    "actor_name": "My API Key"
  },
  "created_at": "2024-07-15T10:33:00.000Z",
  "context": {}
}

Triggered when the list of Vault store names is retrieved.

Events

Event object

API key events

api_key.created

api_key.revoked

api_key.updated

Authentication events

authentication.email_verification_failedComing soon

authentication.email_verification_succeeded

authentication.magic_auth_failed

authentication.magic_auth_succeeded

authentication.mfa_failedComing soon

authentication.mfa_succeeded

authentication.oauth_failed

authentication.oauth_succeeded

authentication.password_failed

authentication.password_succeeded

authentication.passkey_failed

authentication.passkey_succeeded

authentication.sso_failed

authentication.sso_succeeded

authentication.radar_risk_detected

Connection events

connection.activated

connection.deactivated

connection.deleted

connection.saml_certificate_renewed

connection.saml_certificate_renewal_required

Directory Sync events

dsync.activated

dsync.deleted

dsync.group.created

dsync.group.deleted

dsync.group.updated

dsync.group.user_added

dsync.group.user_removed

dsync.user.created

dsync.user.deleted

dsync.user.updated

Email verification events

email_verification.created

Feature flag events

flag.created

flag.updated

flag.deleted

flag.rule_updated

Group events

group.created

group.updated

group.deleted

group.member_added

group.member_removed

Invitation events

invitation.accepted

invitation.created

invitation.resent

invitation.revoked

Magic Auth events

magic_auth.created

Organization events

organization.created

organization.updated

organization.deleted

Organization domain events

organization_domain.created

organization_domain.updated

organization_domain.deleted

organization_domain.verified

organization_domain.verification_failed

Organization membership events

organization_membership.created

organization_membership.deleted

organization_membership.updated

Custom role events

organization_role.created

organization_role.deleted

organization_role.updated

Password reset events

password_reset.created

password_reset.succeeded