Authentication audit events

Automation orchestrator emits audit events for authentication, session lifecycle, and account management operations. These events are written to pod standard output and, when configured, forwarded to an external OTLP-compatible observability backend.

Authentication event types
Copy link

The following 12 authentication event types are emitted at GA 2026-8. All events use the security_event category unless noted otherwise. All security_event records are stored in the platform database and are visible in the Audit UI.

Event type event_action value Trigger Severity Key structured data fields
Login attempt login_attempt Failed login — triggered by unknown user, bad password, inactive account, or local login disabled Warning auth_method, failure_reason
User login user_login Successful authentication; records the authentication method used Info auth_method
OIDC flow oidc_flow OpenID Connect authorization flow stages (authorize and callback) Info idp_id, flow_stage
Session created session_created Session created after successful authentication Info session_id
Session revocation session_revoked Admin-initiated session revocation (per-user, per-IdP, or global scope) Critical sessions_revoked, revocation_scope
Global revocation global_token_revoked Global token version increment that invalidates all sessions issued before the revocation timestamp Critical new_token_version
Authorization denied authorization_denied Request denied due to insufficient permissions (HTTP 403) Warning resource_urn, required_permission
Disabled user rejection disabled_user_rejected Request rejected from a disabled user account Warning actor_id
Stale token detection stale_token_detected Outdated token version detected; deduplicated per user within a 60-second window Info token_version, current_version
Password changed password_changed User password changed through the REST API Warning actor_id, target_user_id
Account status changed account_status_changed User account enabled or disabled through the REST API Warning actor_id, target_user_id, new_status
Group membership changed group_membership_changed User added to or removed from a group through the admin API, OIDC auto-provisioning, or identity provider group sync Warning group_id, member_id, change_type

For common event fields shared across all audit event types, see Audit event reference.

Note

Authorization denied events (authorization_denied) are classified as security_event and appear in this reference alongside authentication events. Role assignment and role lifecycle events appear in the authorization audit events reference.

 Note

Session refresh operations do not produce a distinct audit event at GA release. The session_created event fires only on initial session creation. The session_revoked event fires at Critical severity when an admin revokes sessions explicitly. To monitor session refresh activity, use the stale_token_detected event, which fires when a refreshed token version does not match the current platform version.

Failure scenario event types
Copy link

The following failure scenarios map to Warning or Critical severity events:

  • Bad password — produces a login_attempt event at Warning severity. The event records the authentication method but not the submitted credential.
  • Inactive or disabled account — produces a login_attempt event at Warning severity when the account cannot authenticate, and a disabled_user_rejected event at Warning severity when a disabled account presents a valid token.
  • Stale token — produces a stale_token_detected event at Info severity. The token_version and current_version fields indicate which version was presented and which is required.
  • Admin-initiated session revocation — produces a session_revoked event at Critical severity. The sessions_revoked field indicates the count of sessions invalidated.
  • Global token revocation — produces a global_token_revoked event at Critical severity. All tokens issued before the revocation timestamp become invalid.

Filter examples
Copy link

To filter authentication events in pod logs:

$ oc logs deployment/orchestrator-deployment-name -n namespace | \
    jq 'select(.event_category == "security_event")'

To isolate failed login attempts:

$ oc logs deployment/orchestrator-deployment-name -n namespace | \
    jq 'select(.event_action == "login_attempt" and .event_severity == "warning")'

To isolate session revocation events:

$ oc logs deployment/orchestrator-deployment-name -n namespace | \
    jq 'select(.event_action == "session_revoked")'

To isolate Critical-severity security events (session revocations, global token resets):

$ oc logs deployment/orchestrator-deployment-name -n namespace | \
    jq 'select(.event_category == "security_event" and .event_severity == "critical")'

If you have configured OTLP forwarding, query your observability backend for events where event_category = security_event.