Skip to main content

Audit Logs

LumoAuth records a comprehensive audit trail of all authentication events, administrative actions, and data changes within each tenant. Audit logs are essential for security monitoring, compliance, and incident investigation.

Viewing Audit Logs​

Portal​

Navigate to /t/{tenantSlug}/portal/audit-logs:

  • Search - Filter by event type, user, date range, IP address
  • Event Detail - View full event context including request metadata
  • Export - Download logs in CSV or JSON format

Event Categories​

Authentication Events​

EventDescription
auth.login.successUser successfully authenticated
auth.login.failureFailed login attempt
auth.logoutUser logged out
auth.password_reset.requestPassword reset requested
auth.password_reset.completePassword reset completed
auth.mfa.challengeMFA challenge presented
auth.mfa.successMFA verification succeeded
auth.mfa.failureMFA verification failed
auth.social.loginSocial login authentication
auth.saml.loginSAML SSO authentication
auth.passkey.loginPasskey authentication
auth.device.authorizeDevice flow authorization

User Management Events​

EventDescription
user.createdNew user account created
user.updatedUser profile modified
user.deletedUser account deleted
user.suspendedUser account suspended
user.activatedUser account activated
user.invitedUser invitation sent
user.role.assignedRole assigned to user
user.role.removedRole removed from user
user.group.addedUser added to group
user.group.removedUser removed from group

Application Events​

EventDescription
app.createdOAuth application created
app.updatedApplication settings modified
app.deletedApplication deleted
app.secret.rotatedClient secret rotated
token.issuedAccess token issued
token.revokedToken revoked

Administrative Events​

EventDescription
role.createdRole defined
role.updatedRole modified
role.deletedRole deleted
permission.createdPermission defined
group.createdGroup created
config.updatedTenant configuration changed
webhook.createdWebhook registered
signing_key.rotatedSigning key rotated

Compliance Events​

EventDescription
gdpr.export.requestedData export requested
gdpr.export.completedData export generated
gdpr.delete.requestedData deletion requested
gdpr.delete.completedData deletion processed

Security Events​

EventDescription
security.brute_force.detectedBrute force attempt detected
security.impossible_travelImpossible travel detected
security.risk.highHigh risk score triggered
security.account.lockoutAccount locked due to failed attempts

Log Entry Structure​

Each audit log entry contains:

FieldDescriptionExample
TimestampWhen the event occurred2025-02-01T14:30:00Z
Event TypeEvent identifierauth.login.success
ActorUser or system that triggered the eventalice@acme.com
TargetResource affecteduser:bob-uuid
IP AddressSource IP192.168.1.100
User AgentBrowser/client infoMozilla/5.0...
GeolocationApproximate locationNew York, US
DetailsAdditional context{"method": "passkey"}
ResultSuccess or failuresuccess

Querying via API​

# Get recent audit logs
curl https://your-domain.com/t/{tenantSlug}/api/v1/audit-logs \
  -H "Authorization: Bearer {admin_token}"

# Filter by event type
curl "https://your-domain.com/t/{tenantSlug}/api/v1/audit-logs?event_type=auth.login.failure" \
  -H "Authorization: Bearer {admin_token}"

# Filter by user and date range
curl "https://your-domain.com/t/{tenantSlug}/api/v1/audit-logs?actor=alice@acme.com&from=2025-01-01&to=2025-02-01" \
  -H "Authorization: Bearer {admin_token}"

Log Retention​

SettingDefaultConfigurable
Retention Period90 daysYes
Export Before DeletionAutomatic export availableYes

Configure retention at /t/{tenantSlug}/portal/configuration/auth-settings.