Audit log

This page helps you find out what happened on your auth server, and alert on the events that matter.

Goiabada records security events as they happen: sign-ins, refused passwords, tokens issued, and every change an administrator makes. Each one is an audit event, with a name such as auth_failed_pwd and details saying who and what.

See what happened

1. In the admin console, open Admin, Audit log.

2. Pick an event from the list, or paste a request id into Request id, and click Filter.

3. Read the entries, newest first. Each one shows its Time, its Event and its Details, with its Request id under the event when it has one.

By default, events are kept for 180 days and then deleted. To change that, or where events go, open Admin, Audit logging.

Events to alert on

Most events are routine. These are the ones worth an alert rule, or a saved filter in the viewer. Each is one event, so a single filter on its name sees every occurrence.

Who is an administrator

These record who can administer Goiabada and who tried to reach past that. See Administrators for the rule they’re about, and administrative scopes for which clients may ask for them on a user’s behalf.

Event	Written when	Details
administrator_change_refused	An Admin API request reached for something only authserver:manage may do, and was refused 403 MANAGE_SCOPE_REQUIRED. That’s creating or changing an administrator, granting or revoking an administrative permission, changing what reaches an administrator, or changing the email or audit log settings. It also covers reading an administrator client’s secret, rewording an administrative permission’s description, switching a client’s May request administrative scopes, and deleting a group holding an administrative permission. One entry per refused request, so a client that retries leaves one per attempt. A token with none of a route’s scopes is refused INSUFFICIENT_SCOPE instead, and writes nothing.	logged_in_user, method, route (the route pattern, such as /api/v1/admin/users/{id}/permissions), ceiling (grant, target or settings), target_kind and target_id when the request has a target, permission_ids for a grant or a description change, and group_ids for a group membership change
administrative_permission_changed	An administrative permission was granted to or revoked from a user, a group or a client, or a user joined or left a group holding one. It’s written after the change’s own entries, such as added_user_permission or user_added_to_group, never instead of them. Deleting an administrator or an administrative group writes only its own deletion entry.	change (granted or revoked), target_kind and target_id, permission_identifiers (such as authserver:manage), group_id for a membership change, and logged_in_user, or command for the recover command’s grant
updated_client_administrative_scopes	A client’s May request administrative scopes switch was saved, on or off. An allowed client is an administrator client, so watch this beside administrative_permission_changed. The Admin API writes it for every call to that route, even one that keeps the value it had; the admin console’s Save calls it only when the switch changed.	client_id, client_identifier, allowed (the new value) and logged_in_user
administrative_scope_refused	A client that isn’t allowed to ask for the administrative scopes asked for one on a signed-in user’s behalf, and was refused (see the answers on Authorize and Token). It’s written at the authorization endpoint when the browser holds a valid session and the request doesn’t ask for prompt=login, at the last step before a code or tokens are issued, and on the token endpoint’s authorization code, refresh token and password grants. A refusal at the authorization endpoint with no valid session, or held back until after the password because of prompt=login, writes a Warn log record instead, since anyone can reach that endpoint.	client_id, client_identifier, scopes, checkpoint ("authorize", "issue", "authorization_code", "refresh_token" or "password") and user_id
viewed_client_secret	Someone read a client’s secret through GET /api/v1/admin/clients/{id}/secret. The admin console reads it there each time you open a confidential client’s Authentication tab. Reading a client with no secret writes nothing.	client_id, client_identifier and logged_in_user

The updated_client_permissions entry names what a client permission save changed, the ids of the permissions it granted and of those it revoked, so you can trace a grant to a client back to the permission it was.

Signs of an attack

Each of these means the server caught something and refused it. One entry is worth a look; a run of them is worth an alert.

Event	Why it matters
refresh_token_replay_detected	A refresh token that had already been rotated came back. Either it was stolen or a client sent it twice. The server can’t tell which, so it revoked the rest of that token’s family.
auth_code_reuse_detected	A client redeemed an authorization code a second time, after authenticating and passing PKCE. The server revoked any refresh tokens issued through that code’s session and, if it revoked any, ended the session. When the entry’s list of revoked refresh tokens is empty, nothing was left to revoke.
otp_code_replay_detected	An authenticator code that had already been used was sent again. That usually means a phishing proxy relaying a user’s sign-in in real time.
otp_authenticator_disabled	A user’s authenticator got its 100th wrong code in a row and was disabled. Someone who knew the user’s password, or held one of their sessions, got that far, so treat the password as known. A user who lost their authenticator is the way back.
rate_limit_exceeded	A rate limiter started refusing requests, often a password or code guessing run. Each auth server instance writes it at most once per limiter and key per window, not once per refused request.

Two more are worth watching. A run of auth_ceremony_mismatch against one client is a page trying to act on sign-ins its users never started. And redemption_refused_redirect_uri means someone who held a valid code, and passed client authentication and PKCE, tried to redeem it after you removed its redirect URI.

Where events go

Goiabada writes each event to two places, and Audit logging has a switch for each. Both are on by default.

• Write audit events to the server’s output writes one log record per event, with the message audit event, the event’s name in event, its details in details, and the request_id. Your container or host log pipeline picks it up. The record is at INFO, so it’s written only while the auth server’s log level is info or debug.
• Store audit events in the database stores the event in the audit_logs table. The viewer and the Admin API read it from there.

Turn both off and nothing is recorded. Changing either switch, or the retention, needs authserver:manage. The change is recorded once it’s saved, under the settings it replaced, so turning logging off still leaves an entry saying who did it.

Recording an event never fails the request that raised it. If an event can’t be written, the server logs an error and carries on.

Caution

If the database is what you’re auditing, keep Write audit events to the server’s output on too, so your events also reach a log collector outside it.

The request id

Every entry carries the id of the request that raised it. That’s the X-Request-Id the client or a proxy sent, or one Goiabada generated when none came. Use it to find the request’s own log lines next to the event. It’s not proof of who sent the request, since a client can send any id it likes.

Retention

Setting	Default	Range
Retention, in days	180	0 to 3650. 0 keeps events forever.

A background worker runs every 12 hours and deletes stored events older than the retention. It deletes at most 100,000 per run, 1,000 at a time, so a big backlog clears over several runs. It runs whatever the database switch says, so events you stored earlier still age out after you turn that switch off.

The audit_logs table

Each stored event is one row:

Column	Holds
id	The row’s id.
created_at	When the event was recorded.
audit_event	The event’s name.
details	The details, as JSON text.
request_id	The id of the request that raised it, or empty when there was none.

Details

The details are a JSON object saying who and what. Which keys an entry has depends on its event, and the table below lists every key the auth server writes.

Every key is snake_case, and a key means the same thing in every event that carries it. Where the auth server’s own log records name the same value, the key uses their name, so client_id, client_identifier, user_id, group_id, session_identifier and ip read the same in both. client_id is always the client’s row id, and client_identifier always the identifier the client is known by.

Events are about people and clients, so details carry ids, not secrets. A refresh token appears only as its jti, and an authenticator code only as its time step.

An email address typed into a form nobody has signed in to is recorded only as email_digest, the SHA-256 hex digest of the address as that form looks it up. That covers a failed sign-in, a refused password grant, a registration, a forgot-password request, and a rate limit on any of them. The digest lets you match attempts on one address, and check an address you know against them. Anyone holding a candidate address can do the same, so treat it as a pseudonym, not a secret. An address an account holds is recorded as it is, since administrators already see it in the users list, and so is the address an administrator sends a test email to.

Key	Meaning
allowed	Whether the client may now ask for the administrative scopes.
audit_log_retention_days	The new audit log retention, in days.
audit_logs_in_console_enabled	Whether events are now written to the console log.
audit_logs_in_database_enabled	Whether events are now stored in the database.
auth_state	The step of the sign-in the browser most recently moved, when a page of a sign-in it no longer holds, or of none, was refused.
ceiling	Which rule refused an administrator change: grant, target or settings.
change	granted or revoked.
checkpoint	Where an administrative scope was refused: authorize, issue, or the token endpoint’s authorization_code, refresh_token or password grant.
client_id	The client’s row id, the id in the Admin API’s client paths.
client_identifier	The identifier the client is known by, sent as client_id in OAuth requests. On a refusal at the token endpoint, it’s the one the request named.
code_id	The row id of an authorization code.
command	goiabada-authserver recover, on every entry the recover command writes. An entry an API request made names its token’s subject under logged_in_user instead.
consent_id	The row id of a consent a user gave a client.
email	The address of an account: the one created, activated, or given an email verification code.
email_destination	The address an email verification code was sent to.
email_digest	The SHA-256 hex digest of an address typed into a form nobody has signed in to, or named by a password grant.
first_refresh_token_jti	The jti of the first refresh token in a replayed token’s family.
flow	How a refresh token’s family began: auth_code or ropc.
grant_type	The grant_type of a token request.
grant_types	The grant types a client asked for when it registered itself.
granted_permission_ids	The row ids of the permissions a client permission save granted.
group_attribute_id	The row id of a group’s custom attribute.
group_id	The group’s row id.
group_identifier	The identifier the group is known by.
group_ids	The row ids of the administrative groups a refused membership change would have moved the user into or out of.
include_open_id_connect_claims_in_access_token	Under old and new: whether OpenID Connect claims go in access tokens by default.
include_open_id_connect_claims_in_id_token	Under old and new: whether OpenID Connect claims go in ID tokens by default.
ip	The client’s IP address, as the auth server resolved it. On rate_limit_exceeded, the block the limiter counts: the address for IPv4, its /64 for IPv6.
is_public	Whether a client that registered itself is public, with no secret.
issue_access_token	Whether the implicit flow issued an access token.
issue_id_token	Whether the implicit flow issued an ID token.
key_id	The key id (kid) of a deleted signing key.
limiter	The name of the rate limiter that refused.
logged_in_user	The subject of the token that made an Admin API or Account API request: a user’s subject, or the client identifier for a token from the client credentials flow. Empty on the entries a sign-out or a sign-in writes, which no token makes, and on the revoked_user_auth_state a recovery writes, which names the recover command under command.
max_user_sessions_per_user	Under old and new: the most sessions one user can hold, 0 for no limit.
method	The HTTP method of a refused Admin API request.
new	The default token settings, or the session settings, after the change, keyed as below.
new_generation	The user’s authentication generation after their sessions and tokens were revoked.
new_ui_theme	The UI theme after the change.
old	The default token settings, or the session settings, before the change, keyed as below.
old_generation	The user’s authentication generation before their sessions and tokens were revoked.
old_ui_theme	The UI theme before the change.
outcome	What a registration or forgot-password request led to, such as link_issued, code_issued or unknown_address.
permission_id	The row id of a permission.
permission_identifiers	The administrative permissions changed, such as authserver:manage.
permission_ids	The row ids of the administrative permissions a refused request would have changed.
pre_registration_id	The row id of a registration waiting for its activation link.
presented_refresh_token_jti	The jti of the refresh token that came back after it was rotated.
preserved_session_identifier	The session a password change kept, the one the user changed it from. Empty when none was kept.
previous_session_identifier	The session of the other user that a sign-in on the same browser ended.
previous_user_id	The user whose session a sign-in on the same browser ended.
reason	Why a link was refused, such as code_expired, why sessions and tokens were revoked, such as account_disabled, or why a session was deleted, such as signed_out.
refresh_token_jti	The jti of the refresh token issued.
refresh_token_offline_idle_timeout_in_seconds	Under old and new: the default idle timeout of an offline refresh token, in seconds.
refresh_token_offline_max_lifetime_in_seconds	Under old and new: the default maximum lifetime of an offline refresh token, in seconds.
resource_id	The resource’s row id.
resource_identifier	The identifier the resource is known by.
response_type	The response_type of an implicit flow request.
revoked_code_count	How many authorization codes were revoked.
revoked_count	How many refresh tokens of a replayed token’s family were revoked.
revoked_permission_ids	The row ids of the permissions a client permission save revoked.
revoked_refresh_token_jtis	The jti of each refresh token revoked.
route	The route pattern of a refused Admin API request, such as /api/v1/admin/users/{id}/permissions.
scope	The scope issued, or the scope a token request asked for and was refused.
scopes	The administrative scopes a client asked for and was refused.
session_identifier	The identifier of a user’s session.
step	The time step of an authenticator code that was sent again.
target_id	The row id of the user, group, client or resource a request acted on.
target_kind	What target_id names: user, group, client or resource.
terminated_session_identifiers	The identifier of each session ended.
to	The address an administrator sent a test email to.
token_expiration_in_seconds	Under old and new: the default access token lifetime, in seconds.
user_attribute_id	The row id of a user’s custom attribute.
user_id	The user’s row id.
user_session_id	The row id of a user’s session.
user_session_idle_timeout_in_seconds	Under old and new: the session idle timeout, in seconds.
user_session_max_lifetime_in_seconds	Under old and new: the session maximum lifetime, in seconds.

Why a session was deleted

Every deleted_user_session entry has a reason:

reason	Why the session was deleted
replaced_by_sign_in	The user signed in again, and the new session replaced the one the browser had.
same_device	The user signed in again, and the new session replaced another of their sessions from the same browser, recognized by its device cookie.
session_cap	A sign-in took the user over Maximum sessions per user, and this session, expired or the least recently used, was ended. See How many sessions a user can hold.
replaced_by_other_user	Another user signed in on the browser that held it.
signed_out	The user signed out: of the whole session, or of the last client on it, which ends the session too.
ended_by_user	The user ended it from their account.
ended_by_administrator	An administrator ended it.

The Admin API

• GET /api/v1/admin/audit-logs lists stored events, newest first, a page at a time: page, size (1 to 200; anything else gets the default, 20), and the auditEvent and requestId filters, each an exact match.
• GET /api/v1/admin/audit-logs/event-types returns every event name the server can write. The viewer’s event list comes from here, so it includes events that haven’t happened yet.
• GET /api/v1/admin/settings/audit-logs and PUT read and change the two switches and the retention.

Reading any of these needs authserver:admin-read, authserver:manage-settings or authserver:manage. Changing the settings needs authserver:manage.

Every event

This is every event the auth server writes, grouped by what raises it. The viewer’s event list holds the same names. “An administrator” means whoever called the Admin API, which is what the admin console does for you.

Sign-in

Event	Meaning
auth_success_pwd	A user’s password was accepted on the sign-in page.
auth_failed_pwd	A password was refused on the sign-in page, because no user has that email or the password was wrong.
auth_success_otp	A user’s authenticator code was accepted at sign-in, including a first code that set up their authenticator.
auth_failed_otp	An authenticator code was refused at sign-in, because it was wrong or had already been used.
otp_code_replay_detected	An authenticator code that had already been used was sent again, at sign-in or while turning on two-factor authentication, and was refused.
otp_authenticator_disabled	A user’s authenticator was disabled at sign-in, because 100 codes in a row were refused. Written once, beside that 100th refusal’s auth_failed_otp.
user_disabled	A disabled user was refused: at sign-in, when reusing a session, before a code or tokens were issued, at the token endpoint or at /userinfo.
rate_limit_exceeded	A rate limiter started refusing requests from an IP address block, for an email address or for a user. Each instance writes it at most once per key per window.
auth_ceremony_mismatch	A sign-in step was refused because its page belonged to a sign-in the browser no longer holds, or named none. Its details describe the sign-in the browser most recently moved.
started_new_user_session	A user signed in and a new session was created for them.
bumped_user_session	A user’s existing session was reused and kept alive, by single sign-on, a prompt=none request or a refresh token grant.
cross_user_session_replaced	A user signed in on a browser that still held another user’s session, so that session was ended.
saved_consent	A user approved a client’s consent screen, and the scopes they granted were saved.
created_auth_code	An authorization code was issued to a client for a user.
issuance_refused_session_invalid	The last step of a sign-in was refused because the user’s session had passed its idle timeout or maximum lifetime.
issuance_refused_scope_denied	The last step of a sign-in was refused because the user no longer held any of the scopes the client asked for.
issuance_refused_redirect_uri	The last step of a sign-in was refused because the client’s redirect URI was removed while the user was signing in. Nothing was sent to the client.
administrative_scope_refused	A client that isn’t allowed to ask for the administrative scopes asked for one on a signed-in user’s behalf, and was refused.

Sign-out and sessions

Event	Meaning
logout	A user signed out and their session ended. A sign-out confirmed with no session to end writes it too.
deleted_user_session_client	A client signed a user out, and was removed from the user’s session. The session ends only when no other client is left on it.
deleted_user_session	A session was deleted by a sign-in, a sign-out, its user or an administrator. Its reason says which: see Why a session was deleted.
terminated_user_session	A session was ended by an administrator, by its own user, or by another user signing in on the same browser, and its codes and refresh tokens were revoked.
revoked_user_auth_state	A user’s password was reset or changed, the user was disabled, or the recover command recovered the user, so their sessions and refresh tokens were revoked. A user changing their own password keeps the session they did it from.

Tokens

Event	Meaning
token_issued_authorization_code_response	The token endpoint exchanged an authorization code for tokens.
token_issued_refresh_token_response	The token endpoint exchanged a refresh token for new tokens.
token_issued_client_credentials_response	The token endpoint issued an access token to a client through the client credentials flow.
token_issued_ropc_response	The token endpoint issued tokens for a username and password, through the password grant.
token_issued_implicit_response	The authorization endpoint issued tokens straight to a client, through the implicit flow.
token_scope_denied	The token endpoint refused a request for a scope the client or user may not have, or an OpenID Connect scope on the client credentials grant, or a client credentials request that left scope out from a client holding no permissions, recorded with an empty scope.
ropc_auth_failed	The token endpoint refused a password grant, because the email or password was wrong, or the user was disabled or has two-factor authentication on.
auth_code_reuse_detected	A client redeemed an authorization code a second time. The refresh tokens issued through that code’s session were revoked, and, if there were any, the session ended.
refresh_token_replay_detected	A refresh token that had already been rotated came back, so the rest of its family was revoked.
revoked_consent_grants	A user’s consent to a client was withdrawn, by the user or by an administrator, so the refresh tokens the user held with that client, and the authorization codes not yet redeemed, were revoked. It’s written beside deleted_own_user_consent or deleted_user_consent, and names the client, the tokens revoked and how many codes.
redemption_refused_redirect_uri	The token endpoint refused an authorization code because its redirect URI was removed from the client after the code was issued.

Registration and emailed links

Event	Meaning
requested_registration	Someone sent the registration form while email verification is required. outcome says whether an activation link, a notice that the account exists, or nothing was sent.
activated_account	Someone followed their activation link and chose a password, which created their account.
failed_account_activation_code	An activation link was refused, because it was unknown, expired or already used, or its address already has an account.
requested_password_reset	Someone sent the forgot-password form. outcome says whether a reset link was sent, or why not.
failed_reset_password_code	A password reset link was refused, because it was unknown, expired or already used, or no longer valid for its account.

A user’s own account

These come from the Account API, which users reach through the admin console’s account pages.

Event	Meaning
updated_own_profile	A user saved their own profile: names, nickname, username, website, gender, birth date, time zone or locale.
updated_own_email	A user changed their own email address, after confirming their password. The new address starts unverified.
sent_email_verification_message	A user asked for an email verification code, and it was sent to their address.
verified_email	A user verified their email address with the code they were sent, or by setting their password through a link sent to it, such as the one an administrator emails a new user.
failed_email_verification_code	A user entered a wrong or expired email verification code.
updated_own_phone	A user saved or cleared their own phone number.
updated_own_address	A user saved their own address.
updated_own_profile_picture	A user uploaded or replaced their own profile picture.
deleted_own_profile_picture	A user removed their own profile picture.
changed_password	A user changed their own password, after confirming the current one.
enabled_otp	A user set up an authenticator for two-factor authentication, on their account page or when a sign-in required it.
disabled_otp	A user’s authenticator was removed, by the user, by an administrator or by the recover command.
deleted_own_user_consent	A user withdrew the consent they had given a client.

Users

Event	Meaning
created_user	A user was created: by an administrator, by someone registering, or by someone activating their registration.
updated_user_details	An administrator enabled or disabled a user.
updated_user_profile	An administrator changed a user’s profile: username, names, nickname, website, gender, birth date, time zone or locale.
updated_user_email	An administrator changed a user’s email address, or whether it’s verified.
generated_email_verification_code	An administrator generated an email verification code for a user. It was returned to the administrator, not emailed.
updated_user_phone	An administrator changed or cleared a user’s phone number.
updated_user_address	An administrator changed a user’s address.
updated_user_authentication	An administrator, or the recover command, set a new password for a user.
updated_user_profile_picture	An administrator uploaded or replaced a user’s profile picture.
deleted_user_profile_picture	An administrator removed a user’s profile picture.
added_user_attribute	An administrator added a custom attribute to a user.
updated_user_attribute	An administrator changed a user’s custom attribute.
deleted_user_attribute	An administrator deleted a user’s custom attribute.
added_user_permission	An administrator, or the recover command, granted a permission to a user. One entry per permission.
deleted_user_permission	An administrator revoked a permission from a user. One entry per permission.
deleted_user_consent	An administrator deleted a consent a user had given a client.
deleted_user	An administrator deleted a user.

Groups

Event	Meaning
created_group	An administrator created a group.
updated_group	An administrator changed a group’s identifier, description, or whether it goes in tokens.
deleted_group	An administrator deleted a group.
added_group_attribute	An administrator added a custom attribute to a group.
updated_group_attribute	An administrator changed a group’s custom attribute.
deleted_group_attribute	An administrator deleted a group’s custom attribute.
added_group_permission	An administrator granted a permission to a group. One entry per permission.
deleted_group_permission	An administrator revoked a permission from a group. One entry per permission.
user_added_to_group	An administrator added a user to a group. One entry per group.
user_removed_from_group	An administrator removed a user from a group. One entry per group.

Administrators

Event	Meaning
administrative_permission_changed	Who is an administrator changed: an administrative permission was granted or revoked, by an administrator or by the recover command, or a user joined or left a group holding one.
administrator_change_refused	An Admin API request was refused because only authserver:manage may make that change.

Clients

Event	Meaning
created_client	An administrator created a client.
dynamic_client_registration	A client registered itself through dynamic client registration.
updated_client_settings	An administrator saved a client’s settings: identifier, description, display options, enabled, consent required or default ACR level.
updated_client_authentication	An administrator saved a client’s authentication: made it public, or made it confidential with a new or the same secret.
revoked_client_grants	An administrator made a confidential client public, so its authorization codes and refresh tokens were revoked.
viewed_client_secret	Someone read a client’s secret.
updated_client_oauth2_flows	An administrator saved which flows a client may use, and whether it needs PKCE.
updated_redirect_uris	An administrator saved a client’s redirect URIs.
updated_web_origins	An administrator saved a client’s web origins.
updated_client_tokens	An administrator saved a client’s token settings: lifetimes, and which claims go in its tokens.
updated_client_permissions	An administrator changed the permissions granted to a client.
updated_client_administrative_scopes	An administrator allowed a client to ask for the administrative scopes, or stopped it.
updated_client_logo	An administrator uploaded or replaced a client’s logo.
deleted_client_logo	An administrator removed a client’s logo.
deleted_client	An administrator deleted a client.

Resources

Event	Meaning
created_resource	An administrator created a resource.
updated_resource	An administrator changed a resource’s identifier or description.
updated_resource_permissions	An administrator changed the permissions a resource defines: added, renamed, described or deleted them. Granting a permission writes a different event.
deleted_resource	An administrator deleted a resource.

Settings and keys

Event	Meaning
updated_general_settings	An administrator saved the General settings.
updated_ui_theme_settings	An administrator changed the Theme settings. The entry names the old and the new theme.
updated_sessions_settings	An administrator changed the session settings: the idle timeout, the maximum lifetime, or the most sessions one user can hold. The entry holds the old and the new values.
updated_tokens_settings	An administrator changed the default token settings. The entry holds the old and the new values.
updated_smtp_settings	An administrator changed the Email settings, including turning email on or off.
sent_test_email	An administrator sent a test email, and the mail server accepted it.
updated_audit_logs_settings	An administrator changed where audit events go or how long they’re kept. It holds the new values, and is recorded under the old ones, so turning logging off is recorded too.
rotated_keys	An administrator rotated the signing keys: the next key became the current one, and a new next key was generated.
revoked_key	An administrator deleted a previous signing key.

Next steps

Resources and permissionsWho can administer Goiabada, and what each permission allows.

MonitoringMetrics and logs to watch beside the audit log.