> For the complete documentation index, see [llms.txt](https://community-test.logicnets.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://community-test.logicnets.com/release-9/platform-documentation/system-administration/security/security-event-logging.md).

# Security Event Logging

The following grid contains the security event the system logs with release v8.1+.

| Event                                                                        | Description                                                                                                                                                                                                                                                  | Value                                                  | Additional Payload                                  |
| ---------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------ | --------------------------------------------------- |
| <p>authentication.<br>account\_reactivated\_password\_ok</p>                 | During logon: account-status is expired, but password expired date is updated, retry count is reset                                                                                                                                                          | -                                                      | -                                                   |
| <p>authentication.<br>authentication\_id<br>\_loginhint\_mismatch</p>        | During SSO: login-hint doesn't match the current logged in user => SSO failed                                                                                                                                                                                | authentication-id                                      | -                                                   |
| <p>authentication.<br>authentication\_id\_session\_mismatch</p>              | During SSO: session-pin cookie and authentication-cookie doesn't belong together => SSO failed                                                                                                                                                               | authentication-id                                      | -                                                   |
| <p>authentication.<br>authentication\_issued\_more\_than<br>\_max\_age</p>   | During SSO: authentication issued morethan the specific max-age => SSO failed                                                                                                                                                                                | authentication-id                                      | -                                                   |
| <p>authentication.<br>authorized</p>                                         | HTTP Header: authentication: Passed                                                                                                                                                                                                                          | -                                                      | -                                                   |
| <p>authentication.<br>bearer\_ok</p>                                         | HTTP Header: authentication: Passed                                                                                                                                                                                                                          | -                                                      | iss, tid                                            |
| <p>authentication.<br>cookie\_authentication\_succeeded</p>                  | During SSO: authentication using cookie passed                                                                                                                                                                                                               | authentication-id                                      | -                                                   |
| <p>authentication.<br>expired\_authentication\_id</p>                        | During SSO: Authentication cookie is expired                                                                                                                                                                                                                 | authentication-id                                      | -                                                   |
| <p>authentication.<br>expired\_jwt\_token</p>                                | During logon: access-token is expired (JWT.payload.exp) or issued after current time (JWT.payload.iat)                                                                                                                                                       | -                                                      | -                                                   |
| <p>authentication.<br>failed\_due\_to\_account\_not\_active</p>              | Authentication failed since account is not active (anymore)                                                                                                                                                                                                  | -                                                      | -                                                   |
| <p>authentication.<br>guest\_ok</p>                                          | Guest authentication and authorization passed                                                                                                                                                                                                                | -                                                      | -                                                   |
| <p>authentication.<br>invalid\_jwt\_aud</p>                                  | HTTP Header authentication: JWT aud-claim is not corrected; this should be the client-id or any configured valid aud-values                                                                                                                                  | -                                                      | aud, iss, tid                                       |
| <p>authentication.<br>invalid\_jwt\_purpose</p>                              | HTTP Header authentication: JWT.purpose is invalid; 'access\_token' or 'access' expected                                                                                                                                                                     | -                                                      | token\_type, iss, tid                               |
| <p>authentication.<br>jwt\_token\_from\_nottrusted\_iss</p>                  | HTTP Header authentication: JWT signature cannot be verified (ISS not recognized or non matching public key)                                                                                                                                                 | -                                                      | iss, tid                                            |
| <p>authentication.<br>jwt\_token\_validation\_failed</p>                     | HTTP Header authentication: JWT signature check failed                                                                                                                                                                                                       | -                                                      | iss, tid                                            |
| <p>authentication.<br>logged\_out</p>                                        | User logged out                                                                                                                                                                                                                                              | email/user-id                                          | -                                                   |
| <p>authentication.<br>non\_jwt\_bearer\_token</p>                            | HTTP Header authentication: Non JWT bearer token                                                                                                                                                                                                             | -                                                      | -                                                   |
| <p>authentication.<br>not\_allowed\_to\_login<br>\_with\_server\_account</p> | During logon: Server user tries to login via UI                                                                                                                                                                                                              | -                                                      | -                                                   |
| <p>authentication.<br>not\_authenticated</p>                                 | During SSO: Authentication cookie not usable anymore                                                                                                                                                                                                         | -                                                      | -                                                   |
| <p>authentication.<br>ok</p>                                                 | Logon: authentication: Passed                                                                                                                                                                                                                                | email/user-id                                          |                                                     |
| <p>authentication.<br>password\_ok</p>                                       | During logon: password matches                                                                                                                                                                                                                               | -                                                      | -                                                   |
| <p>authentication.<br>returned\_from\_logon</p>                              | Authentication+Authorized done returning to original session                                                                                                                                                                                                 | authentication-state (AUTHENTICATION, NOT\_AUTHORIZED) | -                                                   |
| <p>authentication.<br>unknown\_authentication\_id</p>                        | During SSO: Authentication id referenced by cookie not found                                                                                                                                                                                                 | -                                                      | -                                                   |
| <p>authentication.<br>user\_profile\_generated</p>                           | Generate user token: Passed                                                                                                                                                                                                                                  | scope                                                  | token                                               |
| <p>category.<br>deactivate\_non\_latest</p>                                  | All packages of a specific category are deactivated; except the latest                                                                                                                                                                                       | category                                               | package, category                                   |
| company.created                                                              | A company is created                                                                                                                                                                                                                                         | company                                                | -                                                   |
| company.deleted                                                              | A company is deleted                                                                                                                                                                                                                                         | company                                                | -                                                   |
| company.uploaded                                                             | A new company is uploaded                                                                                                                                                                                                                                    | company                                                | -                                                   |
| error.account\_expired                                                       | During logon: When account appears to be expired, set account-status to expired                                                                                                                                                                              | email/user-id                                          | -                                                   |
| error.account\_expired                                                       | During logon: Password is expired, set account status to expired                                                                                                                                                                                             |                                                        |                                                     |
| <p>error.<br>authentication\_external\_failed</p>                            | Remote IDP authentication failed                                                                                                                                                                                                                             | error                                                  | authentication\_status, error-description           |
| error.authentication\_failed                                                 | During logon: wrong password is entered                                                                                                                                                                                                                      | -                                                      | -                                                   |
| error.authentication\_guest\_failed                                          | No authorization header passed and guest account is disabled or not authorized                                                                                                                                                                               | -                                                      | -                                                   |
| <p>error.<br>authentication\_password\_failed</p>                            | During logon: Wrong password entered                                                                                                                                                                                                                         | email                                                  | -                                                   |
| error.invalid\_session\_type                                                 | Corrupted session                                                                                                                                                                                                                                            | -                                                      | -                                                   |
| <p>error.<br>missing\_authentication\_header</p>                             | Missing HTTP authorization header                                                                                                                                                                                                                            | -                                                      | -                                                   |
| error.not\_authorized                                                        | Authentication passed, but authorization failed                                                                                                                                                                                                              | -                                                      | -                                                   |
| error.password\_expired                                                      | During logon: Account is blocked when temporary password is expired, set account-status to blocked                                                                                                                                                           | -                                                      | -                                                   |
| error.session\_create\_failed                                                | Failed to create session, disk rights problem?                                                                                                                                                                                                               | -                                                      | -                                                   |
| error.session\_expired                                                       | User accessed an expired session                                                                                                                                                                                                                             | -                                                      | -                                                   |
| error.session\_finished                                                      | User accessed an finished/closed session                                                                                                                                                                                                                     | -                                                      | -                                                   |
| error.system\_busy                                                           | Sesssion request is rejected since other requests of the same session are running longer than a timeout                                                                                                                                                      | -                                                      | -                                                   |
| error.system\_no\_permission                                                 | Session pin and session-id doesn't belong to eachother                                                                                                                                                                                                       | -                                                      | -                                                   |
| error.unknown\_authentication\_state                                         | Unknown authentication state while processing the session                                                                                                                                                                                                    | -                                                      | -                                                   |
| <p>error.<br>unsupported\_authorization<br>\_header\_type</p>                | HTTP authorization header type is not supported; only basic and bearer are supported                                                                                                                                                                         | -                                                      | -                                                   |
| external\_accounts.created                                                   | External account (Server connection) is created                                                                                                                                                                                                              | for                                                    | username, url, purpose, scope                       |
| external\_accounts.deleted                                                   | External account (Server connection) is deleted                                                                                                                                                                                                              | for                                                    | username, url                                       |
| oauth.authentication\_failed                                                 | Authentication via external IdP failed                                                                                                                                                                                                                       | access\_provider/idp                                   | error-code, error-description, access\_provider/idp |
| oauth.authentication\_succeeded                                              | Authentication via external IdP password                                                                                                                                                                                                                     | access\_provider/idp                                   | access\_provider/idp                                |
| package.activated                                                            | Package is activated                                                                                                                                                                                                                                         | package                                                | package, category                                   |
| package.deactivated                                                          | Package is deactivated                                                                                                                                                                                                                                       | package                                                | package                                             |
| package.installed                                                            | Package is installed                                                                                                                                                                                                                                         | package                                                | package, stamp                                      |
| package.uninstalled                                                          | Package is uninstalled                                                                                                                                                                                                                                       | package                                                | package                                             |
| package.updated                                                              | Package is updated                                                                                                                                                                                                                                           | package                                                | package, stamp                                      |
| runtime.bootstrap                                                            | Webserver is started                                                                                                                                                                                                                                         | -                                                      | -                                                   |
| <p>session.<br>authentication\_refresh\_failed</p>                           | Refreshing the authentication-session failed, probably since the authentication is expired (no other session kept the authentication alive)                                                                                                                  | -                                                      | -                                                   |
| session.authentication\_refreshed                                            | Authentication refreshed                                                                                                                                                                                                                                     | -                                                      | -                                                   |
| session.pin\_created                                                         | Session cookie created                                                                                                                                                                                                                                       | new-pin-id                                             | -                                                   |
| session\_cloned                                                              | Session is cloned                                                                                                                                                                                                                                            | -                                                      | -                                                   |
| session\_closed                                                              | Session is closed                                                                                                                                                                                                                                            | -                                                      | -                                                   |
| session\_created                                                             | Session is created                                                                                                                                                                                                                                           | -                                                      | current-session                                     |
| startcode.activated                                                          | A start code is activated                                                                                                                                                                                                                                    | of                                                     | startcode, package                                  |
| startcode.attached                                                           | A start code is attached to package                                                                                                                                                                                                                          | of                                                     | startcode, package                                  |
| startcode.deactivated                                                        | A start code is deactivated                                                                                                                                                                                                                                  | of                                                     | startcode, package                                  |
| startcode.detached                                                           | A start code is detached from package                                                                                                                                                                                                                        | from                                                   | startcode, package                                  |
| user.created                                                                 | User is created                                                                                                                                                                                                                                              | email/user-id                                          | -                                                   |
| user.deleted                                                                 | User is deleted                                                                                                                                                                                                                                              | email/user-id                                          | -                                                   |
| user.details\_updated                                                        | User details are updated                                                                                                                                                                                                                                     | email/user-id                                          | (no password)                                       |
| user.password\_updated                                                       | Password updated: temporary, update, rehash                                                                                                                                                                                                                  | :\<email/userid>                                       | email/userid, reason                                |
| user.reactivate\_account                                                     | Expired user account is reactivated                                                                                                                                                                                                                          | email/user-id                                          | -                                                   |
| user.status\_updated                                                         | Change account status                                                                                                                                                                                                                                        | \<email/userid>:=>                                     | email/userid, old-status, new-status                |
| user\_role.created                                                           | Package/Category role is attached to user                                                                                                                                                                                                                    | . for \<email/user-id>                                 | created\_by, category, role, email/user-id          |
| usergroup.created                                                            | User group is created                                                                                                                                                                                                                                        | group                                                  | group                                               |
| usergroup.deleted                                                            | User group Is deleted                                                                                                                                                                                                                                        | group                                                  | group                                               |
| usergroup.updated                                                            | User group details are updated                                                                                                                                                                                                                               | =>                                                     | updated-name, description, pwd-policy, mfa-methods  |
| usergroup\_admingroup.created                                                | An admin group is added to an usergroup. Members of an admin group can manage the user group                                                                                                                                                                 | added to                                               | usergroup, admin-group                              |
| usergroup\_admingroup.deleted                                                | An admin group is removed from an usergroup. Members of an admin group cannot manage the user group anymore                                                                                                                                                  | removed from                                           | usergroup, admin-group                              |
| usergroup\_categories.created                                                | A category is added to the usergroup portal-page                                                                                                                                                                                                             | added to                                               | usergroup, category                                 |
| usergroup\_categories.deleted                                                | A category is removed from the usergroup portal-page                                                                                                                                                                                                         | removed from                                           | usergroup, category                                 |
| usergroup\_packages.created                                                  | A package is added to the usergroup portal-page                                                                                                                                                                                                              | added to                                               | usergroup, package                                  |
| usergroup\_packages.deleted                                                  | A package is removed from the usergroup portal-page                                                                                                                                                                                                          | removed from                                           | usergroup, package                                  |
| usergroup\_role.created                                                      | A role is added to the usergroup; members of this usergroup will now have this role when packages of this category are opened                                                                                                                                | . for                                                  | usergroup, category, role                           |
| usergroup\_role.deleted                                                      | A role is removed from the usergroup; members of this usergroup will NOT have this role when packages of this category are opened                                                                                                                            | . for                                                  | usergroup, category, role                           |
| <p>usergroup\_terms\_and\_conditions.<br>created</p>                         | A new user-terms and condition item is created                                                                                                                                                                                                               | \<terms\_and\_conditions\_guid> added to               | terms\_and\_conditions\_guid, usergorup             |
| <p>usergroup\_terms\_and\_conditions.<br>deleted</p>                         | A terms and condition item is removed                                                                                                                                                                                                                        | \<terms\_and\_conditions\_guid> removed from           | terms\_and\_conditions\_guid, usergorup             |
| <p>usergroup\_usergroupchilds.<br>created</p>                                | An child group is added to an usergroup. Members of this usergroup will also inherit the rights from the child-usergroup                                                                                                                                     | added to                                               | usergroup, child-usergroup                          |
| <p>usergroup\_usergroupchilds.<br>deleted</p>                                | An child group is removed from an usergroup.                                                                                                                                                                                                                 | removed from                                           | usergroup, child-usergroup                          |
| <p>usergroup\_users.<br>created</p>                                          | An user is added to an usergroup                                                                                                                                                                                                                             | added to                                               | usergroup, user                                     |
| <p>usergroup\_users.<br>delete\_user\_from\_all\_groups</p>                  | An user is removed from an usergroup                                                                                                                                                                                                                         | removed from                                           | usergroup, user                                     |
| <p>usergroup\_users.<br>deleted</p>                                          | An user is removed from all usergroups                                                                                                                                                                                                                       |                                                        | usergroup, user                                     |
| usergroup\_workspace.created                                                 | A workspace is added to the usergroup portal-page                                                                                                                                                                                                            | added to                                               | workspace, usergroup                                |
| usergroup\_workspace.deleted                                                 | A workspace is removed from the usergroup portal-page                                                                                                                                                                                                        | removed from                                           | workspace, usergroup                                |
| usergroup\_workspace\_role.created                                           | A workspace role is added to the usergroup; members of this usergroup will now have this workspace-role when this workspace is opened                                                                                                                        | . for                                                  | workspace, usergroup, role                          |
| usergroup\_workspace\_role.deleted                                           | A workspace role is removed from the usergroup                                                                                                                                                                                                               | . for                                                  | workspace, usergroup, role                          |
| <p>users\_workspace.<br>remove\_user\_from\_all\_packages</p>                | All user assigned packages on portal-page are removed from the user' portal page                                                                                                                                                                             | user                                                   | user                                                |
| <p>users\_workspace.<br>remove\_user\_from\_all\_workspaces</p>              | All user assigned workspace on portal-page are removed from the user' portal page                                                                                                                                                                            | user                                                   | user                                                |
| workspace.created                                                            | A workspace is created                                                                                                                                                                                                                                       | workspace                                              | workspace                                           |
| workspace.deleted                                                            | A workspace is removed                                                                                                                                                                                                                                       | workspace                                              | workspace                                           |
| redirect.not\_allowed                                                        | This event will be generated when a redirect URL is not whitelisted. Redirect URLs can be whitelisted via the configuration manager (see also [Redirect Session](/release-9/platform-documentation/system-administration/security/outbound-api-security.md)) | redirect URL                                           | workspace                                           |
| <p>outbound\_webservice.<br>url\_not\_allowed</p>                            | Not approved URI used in outbound web service. Please add it to the allowed list if the URI is correct (see [Outbound API Security](/release-9/platform-documentation/system-administration/security/outbound-api-security.md))                              | Outbound URL                                           | -                                                   |
| <p>outbound\_webservice.<br>passing\_userprofile\_not\_allowed</p>           | For the outbound URL it is not allowed to pass the user profile. Please update configuration (see [Outbound API Security](/release-9/platform-documentation/system-administration/security/outbound-api-security.md))                                        | Outbound URL                                           | -                                                   |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://community-test.logicnets.com/release-9/platform-documentation/system-administration/security/security-event-logging.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.