See api-docs Menu

Event Resource and Types

The section Event Resource provides details about common event elements that you’ll encounter while working with the Event API.

The section Event Type IDs provides event type IDs and their descriptions.

You can also get a list of all event types, their names, IDs, and descriptions by calling the Get Event Types API.

Event Resource

Event-related dates and times use the Coordinated Universal Time (UTC) format: YYYY-MM-DDThh:mm:ss.mscZ. For example: 2016-01-21T09:20:15.990Z.

Element Description


Account that triggered the event.


Acting system that triggered the event when the actor is not a user.


ID of the user whose action triggered the event.


First and last name of the user whose action triggered the event.


ID of the app involved in the event, if applicable.


Name of the app involved in the event, if applicable.


Name of the user who assumed the role of the acting user to trigger the event, if applicable.

client_id Client ID used to generate the access token that made the API call that generated the event.


Time and date at which the event was created. This value is autogenerated by OneLogin.


More details about the event.


Directory sync run ID.

error_description Provisioning error details, if applicable.


Type of event triggered.

For details, see “Event Type IDs” below.


ID of a group involved in the event.


Name of a group involved in the event.


Event’s unique ID in OneLogin. Autogenerated by OneLogin.


IP address of the machine used to trigger the event.


More details about the event.


ID of a device involved in the event.


Name of a device involved in the event.


ID of the policy involved in the event.


Name of the policy involved in the event.

resource_type_id ID of the resource (user, role, group, and so forth) associated with the event.


ID of a role involved in the event.


Name of a role involved in the event.


ID of the user that was acted upon to trigger the event.


Name of the user that was acted upon to trigger the event.

Event Type IDs

This is a list of the available Event Types. You can also get a list of all event types, their names, IDs, and descriptions by calling the Get Event Types API.

ID Description
1 App %app% added to role %role%
2 App %app% removed from role %role%
3 %actor_user% assumed %user%
4 Assigned %role% to user %user%
5 %user% logged into onelogin
6 %user% failed authentication
7 %user% logged out of onelogin
8 %user% logged into %app%
9 %user% failed to log into %app%
10 %user% requested new password
11 %actor_user% changed password for %user%
12 %actor_user% unlocked %user%
13 %user% was created by %actor_user%
14 %user% updated by %actor_user%
15 %user% deactivated by %actor_user%
16 %user% was activated by %actor_user%
17 %user% was deleted by %actor_user%
18 Password request approved from %user%
19 %user% locked
20 User limit reached
21 %user% suspended by %actor_user%
22 %otp_device% registered for %user%
23 Bulk operation triggered
24 %otp_device% deregistered for %user%
25 %custom_message%
26 %custom_message%
27 Downloaded browser cert
28 %custom_message%
29 %user% logged out of %app%
30 %actor_user% updated credit card
31 Credit card update failed
32 %user% reactivated
33 %user% imported from %directory%
34 %user% requested access to %app%
35 User locked out of app
36 User lost otp device
37 User join request
38 %app% has reached user limit
39 Connector broken
40 %otp_device% unlocked for %user%
41 %directory% started
42 %directory% stopped
43 %directory% reloaded configuration
44 Notification from %directory%
45 %directory% caught an exception
46 %directory% failed over
47 %directory% caught an exception
48 %user% was imported
49 %user% could not be updated
50 %user% rejected
51 %user% provisioned in %app%
52 %user% updated in %app%
53 %user% suspended in %app%
54 %user% reactivated in %app%
55 %user% deleted in %app%
56 %custom_message%
57 Rabbit down
58 Rabbit restarted
59 %custom_message%
60 %custom_message%
61 %user% could not be suspended in %app%
62 %user% could not be reactivated in %app%
63 %user% could not be deleted in %app%
64 %user% could not be provisioned in %app%
65 %user% could not be updated in %app%
66 No users to import
67 Failed to import user from directory
68 %user% authenticated by %radius_config%
69 %user% rejected by %radius_config%
70 %account% granted permission to %privilege_name%
71 %account% revoked permission to %privilege_name%
72 %user% granted permission to %privilege_name%
73 %user% permission to %privilege_name% revoked
74 %user% has added %trusted_idp% to trusted idps
75 %user% has removed %trusted_idp% from trusted idps
76 %user% has modified the trusted idp %trusted_idp%
77 %nameid% failed to login to %app% via idp %trusted_idp%.
78 %nameid% was successfully proxied to %app% via idp %trusted_idp%.
79 %user% failed to provision in %directory%
80 %user% provisioned in %directory%
81 %user% updated by %directory%
82 %user% suspended in %directory%
83 %user% reactivated in %directory%
84 %user% deleted in %directory%
85 Could not authenticate to %app%
86 %custom_message%
87 %actor_user% viewed secure note %note%
88 %actor_user% edited secure note %note%
89 %actor_user% deleted secure note %note%
90 %user% is not authorized to access app %app%
91 User could not be determined by %radius_config%
100 Self registration request for %user%
101 Self registration approved for %user%
102 Self registration denied for %user%
103 Self registration request unverified
104 Self registration request verified
105 Sms failure
106 %actor_user% failed to change password for %user%
110 %actor_user% updated user login information
111 %actor_user% attempted to update login information
112 %user% has changed the default trusted idp to %trusted_idp%
113 Import from %directory% started
114 Import from %directory% finished
115 %user% invited by %actor_user%
116 %user% could not be created
117 Directory sync %directory_sync_run_id%
118 Saml assertion warning for %actor_user% %note%
119 %user% has removed %trusted_idp% as default trusted idp
120 %actor_user% unlocked %user% in %directory%
121 Scriptlet error: %nameid%
122 %user% authenticated via api
123 %user% failed authentication via api
124 %custom_message%
125 %custom_message%
126 One of %directory%'s connectors was enabled
127 One of %directory%'s connectors was disabled
128 %user-synch active directory connector not responding
129 %user% failed authentication with vldap, %notes%
130 %user% successfully authenticated with vldap
131 Export from %directory% started
132 Export from %directory% finished
133 Failed to provision user to directory
134 Refresh schema action failed
135 %certificate_name% is about to expire
136 Directory attributes import from %directory% started
137 %user% granted access to %app%
138 %user% denied access to %app%
139 Directory attributes import from %directory% finished
140 %user% signed in into onelogin via social network: %notes%
141 %user% authentication policy does not allow sign-in via social network: %notes%
145 Smart password updated for %user%
146 Smart password could not be updated for %user%
147 %user% added to %role% role
148 %user% removed from %role% role
149 %user% automatically added to %role% role
150 %user% automatically removed from %role% role
151 %user% granted permission to manage %role% role
152 %user% permission to manage %role% role revoked
153 %user% successfully authenticated with vldap (onelogin desktop mac), %notes%
154 %user% failed authentication with vldap (onelogin desktop mac), %notes%
155 Directory attributes import failed for %directory%
156 %user% created policy %policy%
157 %user% updated policy %policy%
158 %user% deleted policy %policy%
159 %user% created proxy agent %proxy_agent%
160 %user% deleted proxy agent %proxy_agent%
161 %user% created radius configuration %radius_config%
162 %user% updated radius configuration %radius_config%
163 %user% deleted radius configuration %radius_config%
164 %user% enabled vpn
165 %user% updated vpn settings
166 %user% disabled vpn
167 %user% enabled embedding
168 %user% updated embedding settings
169 %user% disabled embedding
170 %user% created authentication factor %authentication_factor%
171 %user% updated authentication factor %authentication_factor%
172 %user% deleted authentication factor %authentication_factor%
173 %user% updated security questions
174 %user% updated desktop sso settings
175 %user% enabled desktop sso
176 %user% disabled desktop sso
177 %user% created %certificate_name% certificate
178 %user% deleted %certificate_name% certificate
179 %user% created %api_credential_name% api credential
180 %user% deleted %api_credential_name% api credential
181 %user% enabled %api_credential_name% api credential
182 %user% disabled %api_credential_name% api credential
183 %user% enabled virtual ldap
184 %user% disabled virtual ldap
185 %user% updated virtual ldap settings
186 %user% enabled branding
187 %user% disabled branding
188 %user% updated branding
189 %actor_user% added %mapping_name% mapping
190 %actor_user% deleted %mapping_name% mapping
191 %actor_user% disabled %mapping_name% mapping
192 %actor_user% enabled %mapping_name% mapping
193 %actor_user% updated %mapping_name% mapping
194 %actor_user% added %user_field_name% custom user field
195 %actor_user% deleted %user_field_name% custom user fields
196 %user% updated company info
197 %user% updated account settings
198 %user% added directory %directory%
199 %user% deleted directory %directory%
200 %user% added connector instance to directory %directory%
201 %user% deleted connector instance from directory %directory%
202 %actor_user% reapplied mappings for %user%
203 %actor_user% created self registration
204 %actor_user% updated self registration
205 %actor_user% deleted self registration
206 %actor_user% manually added %user% to %app%
207 %actor_user% manually removed %user% from %app%
208 %actor_user% retried provisioning
209 Directory field(s) is not unique
210 Ldap directory %directory% caught an exception
211 Admin %actor_user% changed password for %user%
212 %custom_message%
213 %actor_user% uploaded profile picture for %user%
214 %actor_user% removed profile picture for %user%
215 Admin %actor_user% changed account settings for %object%
216 %custom_message%
217 %custom_message%
218 %actor_user% failed to reapply mappings for %user%
219 %custom_message%
220 Admin %actor_user% created payment record for %object%
221 Admin %actor_user% updated payment record for %object%
222 Admin %actor_user% deleted payment record for %object%
223 User unlicensed
224 %actor_user% added license to %user%
225 %actor_user% removed license from %user%
226 User unlicensed automatically
227 %actor_user% failed to license %user%
228 %actor_user% bulk licensed users
229 %custom_message%
230 %custom_message%
231 %custom_message%
232 %user% agreed to terms and conditions
233 %user% did not agree to terms and conditions
234 %actor_user% enabled terms and conditions for %policy%
235 %actor_user% updated terms and conditions for %policy%
236 %actor_user% disabled terms and conditions for %policy%
237 %custom_message%
238 %actor_user% redirected to an external site for password reset
239 %custom_message%
240 %actor_user% revealed password to %app% for %user%
241 %actor_user% failed to import csv
242 %custom_message%
243 %custom_message%
244 Report %report_name% was generated in background
244 Report %report_name% was generated in background
245 Report %report_name% failed generation in background
245 Report %report_name% failed generation in background
246 Report %report_name% terminated during generation in background
247 Failed to reapply mappings for %user%
248 Successfully reapplied mappings for %user%
249 Bulk operation %custom_message% failed for user %user%
250 %custom_message%
251 Provisioning app throttled
252 Failed to remove %user% from %app% app
253 Failed to reapply entitlement mappings for %app% app
291 %user% was created by tidp %trusted_idp%
300 %directory% started
301 Notification from %directory%
303 %directory% reloaded configuration
304 %directory% stopped
305 %directory% failed over
306 %actor_user% tried to manually add %user% to %app%. %custom_message
307 Active directory connector provisioning error
330 %user% disassociated from %directory%
331 %user% associated to %directory%
332 %directory% external id was updated for %user%
333 %directory% external id was deleted for %user%
400 Api - bad request using %client_name%
401 Api - unauthorized using %client_name%
402 A mapping was skipped for %user%; %notes%
410 %actor_user% created broadcaster %custom_message%
411 %actor_user% updated broadcaster %custom_message%
412 %actor_user% deleted broadcaster %custom_message%
501 Api - page of results returned on %resource% using %client_name%
502 Api - one record returned on %resource% using %client_name%
503 Api - get resource / attributes on %resource% using %client_name%
510 Api - password updated for %user% using %client_name%
511 Api - password updated for %user% using %client_name%
512 Api - custom attributes set for %user% using %client_name%
513 Api - roles added to %user% using %client_name%
514 Api - roles removed for %user% using %client_name%
515 Api - authorization token called using %client_name%
516 Api - %user% logged out using %client_name%
517 Api - password not updated for %user% using %client_name%
518 Api - password not updated for %user% using %client_name%
519 Api - failed to set custom attribute
520 Api - roles not added to %user% using %client_name%
521 Api - roles not removed for %user% using %client_name%
522 Api - authorization token call failed using %client_name%
523 Api - %user% failed to log out using %client_name%
524 Api - %user% not deleted using %client_name%
525 Api - invite link not obtained using %client_name%
526 Api - %user% not locked using %client_name%
527 Api - verify factor failed using %client_name%
528 Api - verify factor called using %client_name%
529 Api - %user% updated using %client_name%
530 Api - %user% deleted using %client_name%
531 Api - %user% locked using %client_name%
532 Api - %user% not updated using %client_name%
533 Api - user created using %client_name%
534 Api - user not created using %client_name%
535 Api - invite link using %client_name%
536 Api - get otps for %user% using %client_name%
537 Api - confirm otp for %user% using %client_name% succeeded
538 Api - confirm otp for %user% using %client_name% failed
539 Api - trigger factor for %user% using %client_name% succeeded
540 Api - otp created for %user% using %client_name%
541 %user% updated directory %directory%
542 Ous were updated for %directory%
545 Api - invite link not sent using %client_name%
546 Api - invite link sent using %client_name%
550 %user% was force logged out
551 %user% suspended by %actor_user% via api
552 %user% reactivated via api
553 %user% locked via api
554 %actor_user% unlocked %user% via api
555 %actor% from %assuming_account% assumed %user% from %account_name%
600 %app% was added by %user%
601 %app% was updated by %user%
602 %app% was removed by %user%
700 Connector %object% was created by %user%
701 Connector %object% could not be created
702 Connector %object% %custom_message% was updated by %user%
703 Connector %object% could not be updated
704 Connector %object% %custom_message% was deleted by %user%
705 Connector %object% could not be deleted
706 %custom_message%
800 Parameter %object% was created by %user%
801 Parameter %object% could not be created
802 Parameter %object% was updated by %user%
803 Parameter %object% could not be updated
804 Parameter %object% was deleted by %user%
805 Parameter %object% could not be deleted
900 %user% successfully logged in on a trusted device
901 %user% failed to log in on a trusted device
902 %user% deleted device for onelogin desktop
903 %user% unbind user from device for onelogin desktop
904 %user% successfully logged in via onelogin desktop
905 %user% failed to login via onelogin desktop
906 %user% failed to authenticate via onelogin desktop
907 User has been provisioned to directory successfully
911 %actor_user% revoked user certificate
912 %actor_user% revoked device certificate
931 %user% enabled adaptive login for account
932 %user% disabled adaptive login for account
950 %user% denied auth via otp push request
1001 %user% challenged for otp
1002 %user% failed otp challenge
1100 %actor_user% generated temporary otp token for %user%
1101 %actor_user% revoked temporary otp token for %user%
1200 Delegated app privilege denied
1201 Delegated user privilege denied
1300 App %app% was created via api
1301 App %app% failed to create via api
1302 App %app% was updated via api
1303 App %app% failed to update via api
1304 App %app% was destroyed via api
1305 App %app% failed to destroy via api
1400 User verified otp device
1401 Api auth app create failed
1402 Api auth app updated
1403 Api auth app update failed
1404 Api auth app destroyed
1405 Api auth app destroy failed
1406 Api auth scope created
1407 Api auth scope create failed
1408 Api auth scope updated
1409 Api auth scope update failed
1410 Api auth scope destroyed
1411 Api auth scope destroy failed
1412 Api auth claim created
1413 Api auth claim create failed
1414 Api auth claim updated
1415 Api auth claim update failed
1416 Api auth claim destroyed
1417 Api auth claim destroy failed
1418 Api auth client created
1419 Api auth client create failed
1420 Api auth client updated
1421 Api auth client update failed
1422 Api auth client destroyed
1423 Api auth client destroy failed
1424 Api auth app created
1500 Sandbox %sandbox% sync initiated by %user%
1501 Failed to sync sandbox %sandbox% by %user%
1502 Sync sandbox %sandbox% by %user% completed
1503 Sandbox %sandbox% deleted by %user%
1504 Failed to delete sandbox %sandbox% by %user%
1505 Sandbox %sandbox% created by %user%
1506 Failed to create sandbox %sandbox% by %user%
1507 Sandbox %sandbox% updated by %user%
1508 Failed to update sandbox %sandbox% by %user%
1509 Sandbox %sandbox% deleted using %api_credential_name%
1510 Failed to delete sandbox %sandbox% using %api_credential_name%
1511 Sandbox %sandbox% created using %api_credential_name%
1512 Failed to create sandbox %sandbox% using %api_credential_name%
1513 Sandbox %sandbox% updated using %api_credential_name%
1514 Failed to update sandbox %sandbox% using %api_credential_name%
1600 Profile devices delete device
1601 Profile devices rename device
1602 Profile devices update default
1603 Profile settings update locale
1604 Profile settings update phone
1605 Profile settings update default tab
1606 Profile settings update profile photo
1607 Profile settings update app auto detect
1608 Profile change password
1609 Profile settings update show tabs
1700 %user% created radius attribute in %radius_config%
1701 %user% updated radius attribute in %radius_config%
1702 %user% deleted radius attribute in %radius_config%
9000 %actor_user% enabled %task_name%
9001 %actor_user% disabled %task_name%
9002 User initiated workflow
9003 %task_name% for %user% was completed by %actor_user%
9004 %actor_user% marked %task_name% complete for %user%
9005 %actor_user% marked %task_name% complete for %user%
9006 %task_name% for %user% was marked incomplete by %actor_user%
9007 %user% enabled onboarding
9008 %user% disabled onboarding
9009 %user% enabled offboarding
9010 %user% disabled offboarding
9011 %actor_user% initiated offboarding for %user%
9012 %actor_user% initiated onboarding for %user%
9013 %task_name% for %user% was completed by %actor_user%

Postman Collection

Be sure to set Postman-specific environment variables indicated by {{ }}.

Download for the Events API

Have a Question?

Have a how-to question? Seeing a weird error? Ask us about it on StackOverflow.

Found a bug? Submit a support ticket.

Have a product idea or request? Share it with us in our Ideas Portal.