Event Object

Learn about the password-reset-post-challenge Action trigger’s event object, which provides contextual information about the trigger execution.

The event object for the password-reset-post-challenge Actions trigger provides contextual information about the trigger execution.

event.authentication

event.authentication · dictionary

Details about authentication obtained during the password reset flow.

Hide authentication properties

methods · array of objects

Contains the authentication methods a user has completed during their session.

Array elements can be one of the following schemas:

First Factor

name · string

The name of the first factor that was completed. Values include the following:

• federated A social or enterprise connection was used to authenticate the user as the first factor.
• pwd A password was used to authenticate a database connection user as the first factor.
• passkey A passkey was used to authenticate a database connection user as the first factor.
• sms A Passwordless SMS connection was used to authenticate the user as the first factor.
• email A Passwordless Email connection was used to authenticate the user as the first factor or verify email for password reset.
• phone_number A phone number was used for password reset.
• mock Used for internal testing.
• May also be a URL denoting a custom authentication method (as second or later factor).

timestamp · string

Multi-factor Authentication

name · string

The user completed multi-factor authentication (second or later factors).

Allowed values: mfa

timestamp · string

riskAssessment · dictionary · optional

Supplemental risk assessment. This is available only if the Akamai Integration is enabled and Akamai forwards the headers for the transaction.

Hide riskAssessment properties

supplemental · dictionary · optional

Supplemental signals sent from third party providers to assist in risk assessments.

Show supplemental properties

akamai · dictionary · optional

[Early Access] Supplemental risk assessment. This is available only if Akamai Account Protector is enabled and Akamai forwards the headers for the transaction.

Show akamai properties

akamaiBot · object · optional

The bot detection results as forwarded by Akamai Bot Manager.

Show akamaiBot properties

type · string · optional

The type of the Akamai bot manager results.

action · string · optional

The action of the Akamai bot manager results.

botCategory · array of strings · optional

The bot category of the Akamai bot manager results.

botScore · number · optional

The bot score of the Akamai bot manager results.

botScoreResponseSegment · string · optional

The bot score response segment of the Akamai bot manager results.

botnetId · string · optional

The botnet ID of the Akamai bot manager results.

akamaiUserRisk · dictionary · optional

The user risk detection results as forwarded by Akamai Account Protector.

Show akamaiUserRisk properties

action · string · optional

The action of the Akamai user risk assessment.

allow · number · optional

The allowed status of the Akamai user risk assessment.

emailDomain · string · optional

The email domain of the user.

general · dictionary · optional

The general risk of the Akamai user risk assessment.

ouid · string · optional

The OUID of the user.

requestid · string · optional

The request ID of the user.

risk · dictionary · optional

The risk of the Akamai user risk assessment.

score · number · optional

The score of the Akamai user risk assessment.

status · number · optional

The status of the Akamai user risk assessment.

trust · dictionary · optional

The trust of the Akamai user risk assessment.

username · string · optional

The username of the user.

uuid · string · optional

The UUID of the Akamai user risk assessment.

event.authorization

event.authorization · object

An object containing information describing the authorization granted to the user who is logging in.

Hide authorization properties

roles · array of strings

An array containing the names of a user’s assigned roles.

event.client

event.client · dictionary

Information about the Client with which this password reset transaction was initiated.

Hide client properties

client_id · string

The client id of the application the user is logging in to.

metadata · dictionary

An object for holding other application properties.

name · string

The name of the application (as defined in the Dashboard).

event.connection

event.connection · dictionary

Details about the Connection that was used to authenticate the user.

Hide connection properties

id · string

The connection’s unique identifier.

metadata · dictionary · optional

Metadata associated with the connection.

name · string

The name of the connection used to authenticate the user (such as twitter or some-g-suite-domain).

strategy · string

The type of connection. For social connections, event.connection.strategy === event.connection.name. For enterprise connections, the strategy is waad (Windows Azure AD), ad (Active Directory/LDAP), auth0 (database connections), and so on.

event.custom_domain

event.custom_domain · dictionary · optional

Details about the custom domain associated with the current transaction.

Hide custom_domain properties

domain · string

The custom domain name.

domain_metadata · dictionary

Custom domain metadata as key-value pairs.

event.organization

event.organization · dictionary · optional

Details about the Organization associated with the current transaction.

Hide organization properties

id · string

The Organization identifier.

display_name · string

The friendly name of the Organization.

metadata · dictionary

Metadata associated with the Organization.

name · string

The name of the Organization.

event.prompt

event.prompt · dictionary · optional

Collected data from rendered custom prompts.

Hide prompt properties

id · string

The prompt ID.

fields · dictionary · optional

Fields and hidden fields data.

vars · dictionary · optional

Shared variables data.

event.request

event.request · dictionary

Details about the request that initiated the transaction.

Hide request properties

body · dictionary

The body of the POST request. This data will only be available during refresh token and Client Credential Exchange flows and Post Login Action.

geoip · dictionary

Hide geoip properties

cityName · string · optional

continentCode · string · optional

countryCode · string · optional

countryCode3 · string · optional

countryName · string · optional

latitude · number · optional

longitude · number · optional

subdivisionCode · string · optional

subdivisionName · string · optional

timeZone · string · optional

hostname · string · optional

The hostname that is being used for the authentication flow.

ip · string

The originating IP address of the request.

language · string · optional

The language requested by the browser.

method · string

The HTTP method used for the request

query · dictionary

The query string parameters sent to the authorization request.

user_agent · string · optional

The value of the User-Agent header received when initiating the transaction.

event.secrets

event.secrets · secrets

Secret values securely associated with this Action.

event.stats

event.stats · object

Login statistics for the current user.

Hide stats properties

logins_count · number

The number of times this user has logged in.

event.tenant

event.tenant · object

Details about the Tenant associated with the current transaction.

Hide tenant properties

id · string

The name of the tenant.

event.transaction

event.transaction · dictionary

Details about the current transaction.

Hide transaction properties

correlation_id · string · optional

Correlation ID can be provided in the initial authentication request when the application redirects to Universal Login. You can use value to correlate logs and requests from your Action code with the user flow.

locale · string

The locale to be used for this transaction as determined by comparing the browser’s requested languages to the tenant’s language settings.

login_hint · string · optional

Hint to the Authorization Server about the login identifier the End-User might use to log in (if necessary).

state · string · optional

An opaque arbitrary alphanumeric string your app adds to the initial request that Auth0 includes when redirecting back to your application.

ui_locales · array of strings

The ui_locales provided in the original authentication request.

event.user

event.user · dictionary

An object describing the user on whose behalf the current transaction was initiated.

Hide user properties

app_metadata · dictionary

Custom fields that store info about a user that influences the user’s access, such as support plan, security roles, or access control groups.

created_at · string

Timestamp indicating when the user profile was first created.

email · string · optional

(unique) User’s email address.

email_verified · boolean

Indicates whether the user has verified their email address.

family_name · string · optional

User’s family name.

given_name · string · optional

User’s given name.

last_password_reset · string · optional

Timestamp indicating the last time the user’s password was reset/changed. At user creation, this field does not exist. This property is only available for Database connections.

name · string · optional

User’s full name.

nickname · string · optional

User’s nickname.

phone_number · string · optional

User’s phone number.

phone_verified · boolean · optional

Indicates whether the user has verified their phone number.

picture · string · optional

URL pointing to the user’s profile picture.

updated_at · string

Timestamp indicating when the user’s profile was last updated/modified.

user_id · string

(unique) User’s unique identifier.

user_metadata · dictionary

Custom fields that store info about a user that does not impact what they can or cannot access, such as work address, home address, or user preferences.

username · string · optional

(unique) User’s username.

enrolledFactors · array of objects · optional

An array of authentication factors that the user has enrolled. Empty array means the user has no enrolled factors. If enrolledFactors is undefined, the system was unable fetch the information, the user may or may not have enrolled factors.

Hide enrolledFactors properties

type · string

The type of authentication factor such as push-notification, phone, email, otp, webauthn-roaming and webauthn-platform.

options · dictionary · optional

Additional options describing this instance of the enrolled factor.

identities · array of objects

Contains info retrieved from the identity provider with which the user originally authenticated. Users may also link their profile to multiple identity providers; those identities will then also appear in this array. The contents of an individual identity provider object varies by provider.

Hide identities element properties

connection · string · optional

Name of the Auth0 connection used to authenticate the user.

isSocial · boolean · optional

Indicates whether the connection is a social one.

profileData · dictionary · optional

User information associated with the connection. When profiles are linked, it is populated with the associated user info for secondary accounts.

provider · string · optional

Name of the entity that is authenticating the user, such as Facebook, Google, SAML, or your own provider.

user_id · string · optional

User’s unique identifier for this connection/provider.