Event Object

Learn about the post-login Action trigger’s event object, which provides contextual information about the trigger execution.

The event object for the post-login Actions trigger provides contextual information about the trigger execution.

event.authentication

event.authentication · dictionary · optional

Details about authentication signals obtained during the login flow.

Hide authentication properties

methods · array of objects

Contains the authentication methods a user has completed during their session.

Array elements can be one of the following schemas:

First Factor

name · string

The name of the first factor that was completed. Values include the following:

• federated A social or enterprise connection was used to authenticate the user as the first factor.
• pwd A password was used to authenticate a database connection user as the first factor.
• passkey A passkey was used to authenticate a database connection user as the first factor.
• sms A Passwordless SMS connection was used to authenticate the user as the first factor.
• email A Passwordless Email connection was used to authenticate the user as the first factor or verify email for password reset.
• phone_number A phone number was used for password reset.
• mock Used for internal testing.
• May also be a URL denoting a custom authentication method (as second or later factor).

timestamp · string

Multi-factor Authentication

name · string

The user completed multi-factor authentication (second or later factors).

Allowed values: mfa

timestamp · string

riskAssessment · dictionary · optional

Details about risk assessments obtained during the login or password reset flow.

Hide riskAssessment properties

assessments · object

Show assessments properties

ImpossibleTravel · object · optional

Determines if the user is logging in from a location signaling impossible travel.

Show ImpossibleTravel properties

code · string

Possible values:

• minimal_travel_from_last_login
• travel_from_last_login
• substantial_travel_from_last_login
• impossible_travel_from_last_login
• invalid_travel
• missing_geoip
• anonymous_proxy
• unknown_location
• initial_login
• location_history_not_found
• assessment_not_available

confidence · string

Allowed values: low, medium, high, neutral

NewDevice · object · optional

Determines if the user is logging in from a known device.

Show NewDevice properties

code · string

Possible values:

• initial_login
• assessment_not_available
• match
• partial_match
• no_match
• unknown_device
• no_device_history

confidence · string

Allowed values: low, medium, high, neutral

details · object · optional

Show details properties

device · string · optional

Allowed values: known, unknown

useragent · string · optional

Allowed values: known, unknown

UntrustedIP · object · optional

Shows if the IP was found in Auth0’s repository of low reputation IPs.

Show UntrustedIP properties

code · string

Allowed values: assessment_not_available, not_found_on_deny_list, found_on_deny_list, invalid_ip_address

confidence · string

Allowed values: low, medium, high, neutral

details · object · optional

Show details properties

category · string · optional

ip · string · optional

The originating IP address of the request.

matches · string · optional

source · string · optional

confidence · string

Overall risk score

Allowed values: low, medium, high, neutral

supplemental · dictionary · optional

[Early Access] Supplemental risk assessment.

Show supplemental properties

akamai · dictionary · optional

Show akamai properties

akamaiBot · object · optional

The bot detection results as forwarded by Akamai Bot Manager.

Show akamaiBot properties

type · string · optional

The type of the Akamai bot manager results.

action · string · optional

The action of the Akamai bot manager results.

botCategory · array of strings · optional

The bot category of the Akamai bot manager results.

botScore · number · optional

The bot score of the Akamai bot manager results.

botScoreResponseSegment · string · optional

The bot score response segment of the Akamai bot manager results.

botnetId · string · optional

The botnet ID of the Akamai bot manager results.

akamaiUserRisk · dictionary · optional

The user risk detection results as forwarded by Akamai Account Protector.

Show akamaiUserRisk properties

action · string · optional

The action of the Akamai user risk assessment.

allow · number · optional

The allowed status of the Akamai user risk assessment.

emailDomain · string · optional

The email domain of the user.

general · dictionary · optional

The general risk of the Akamai user risk assessment.

ouid · string · optional

The OUID of the user.

requestid · string · optional

The request ID of the user.

risk · dictionary · optional

The risk of the Akamai user risk assessment.

score · number · optional

The score of the Akamai user risk assessment.

status · number · optional

The status of the Akamai user risk assessment.

trust · dictionary · optional

The trust of the Akamai user risk assessment.

username · string · optional

The username of the user.

uuid · string · optional

The UUID of the Akamai user risk assessment.

version · string

event.authorization

event.authorization · object · optional

An object containing information describing the authorization granted to the user who is logging in.

Hide authorization properties

roles · array of strings

An array containing the names of a user’s assigned roles.

event.client

event.client · dictionary

Information about the Client with which this login transaction was initiated.

Hide client properties

client_id · string

The client id of the application to which the user is logging in.

metadata · dictionary

An object for holding other application properties.

name · string

The name of the application (as defined in the Dashboard).

refresh_token · object · optional

[Early Access] An object for holding refresh token configuration properties.

Hide refresh_token properties

policies · array of objects · optional

[Early Access] A collection of policies governing multi-resource refresh token exchange (MRRT), defining how refresh tokens can be used across different resource servers

Show policies properties

audience · string · optional

[Early Access] The specific resource server (audience) to which this MRRT policy applies.

scope · array of strings · optional

The scopes of access that are authorized for the resource server (audience).

event.connection

event.connection · dictionary

Details about the Connection that was used to authenticate the user.

Hide connection properties

id · string

The connection’s unique identifier.

metadata · dictionary · optional

Metadata associated with the connection.

name · string

The name of the connection used to authenticate the user (such as twitter or some-g-suite-domain).

strategy · string

The type of connection. For social connections, event.connection.strategy === event.connection.name. For enterprise connections, the strategy is waad (Windows Azure AD), ad (Active Directory/LDAP), auth0 (database connections), and so on.

event.custom_domain

event.custom_domain · dictionary · optional

Details about the custom domain associated with the current transaction.

Hide custom_domain properties

domain · string

The custom domain name.

domain_metadata · dictionary

Custom domain metadata as key-value pairs.

event.organization

event.organization · dictionary · optional

Details about the Organization associated with the current transaction.

Hide organization properties

id · string

The Organization identifier.

display_name · string

The friendly name of the Organization.

metadata · dictionary

Metadata associated with the Organization.

name · string

The name of the Organization.

event.prompt

event.prompt · dictionary · optional

Collected data from rendered custom prompts.

Hide prompt properties

id · string

The prompt ID.

fields · dictionary · optional

Fields and hidden fields data.

vars · dictionary · optional

Shared variables data.

event.refresh_token

event.refresh_token · dictionary · optional

[Enterprise Customers] The current refresh token.

Hide refresh_token properties

id · string

[Enterprise Customers] The ID of the refresh token.

client_id · string · optional

[Enterprise Customers] The ID of the client associated with the refresh token.

created_at · string

[Enterprise Customers] Timestamp of when the refresh token was created.

device · object · optional

Hide device properties

initial_asn · string · optional

[Enterprise Customers] First autonomous system number associated with this refresh token.

initial_ip · string · optional

[Enterprise Customers] First IP address associated with this refresh token.

initial_user_agent · string · optional

[Enterprise Customers] First user agent of the device associated with this refresh token.

last_asn · string · optional

[Enterprise Customers] Last autonomous system number from which this refresh token was last exchanged.

last_ip · string · optional

[Enterprise Customers] Last IP address from which this refresh token was last exchanged.

last_user_agent · string · optional

[Enterprise Customers] Last user agent of the device from which this refresh token was last exchanged.

expires_at · string · optional

[Enterprise Customers] Timestamp of when the refresh token will absolutely expire.

idle_expires_at · string · optional

[Enterprise Customers] Timestamp of when the refresh token will idle expire.

last_exchanged_at · string · optional

[Enterprise Customers] Timestamp of when the refresh token was last successfully exchanged.

metadata · dictionary · optional

Refresh Token Metadata

resource_servers · array of objects · optional

Hide resource_servers properties

audience · string

[Enterprise Customers] The audience of the refresh token.

scopes · string

[Enterprise Customers] Scopes of the refresh token.

rotating · boolean · optional

[Enterprise Customers] If the refresh token is a rotating refresh token.

session_id · string · optional

[Enterprise Customers] The ID of the session bound to the refresh token.

session_transfer · object · optional

[Enterprise Customers] This object is defined when the session is created from a session transfer token (Native to Web SSO), undefined otherwise.

Hide session_transfer properties

parent_refresh_token · object · optional

[Enterprise Customers] This object is defined when the refresh token is created from a session initiated as a result of session transfer (Native to Web SSO), undefined otherwise.

Show parent_refresh_token properties

id · string · optional

[Enterprise Customers] The ID of the parent refresh token from which this session/refresh token was created as a result of a session transfer (Native to Web SSO).

user_id · string · optional

[Enterprise Customers] The ID of the user bound to the refresh token.

event.request

event.request · dictionary

Details about the request that initiated the transaction.

Hide request properties

asn · string · optional

The ASN (autonomous system number) of the user-agent making the request.

body · dictionary

The body of the POST request. This data will only be available during refresh token and Client Credential Exchange flows and Post Login Action.

geoip · dictionary

Hide geoip properties

cityName · string · optional

continentCode · string · optional

countryCode · string · optional

countryCode3 · string · optional

countryName · string · optional

latitude · number · optional

longitude · number · optional

subdivisionCode · string · optional

subdivisionName · string · optional

timeZone · string · optional

hostname · string · optional

The hostname that is being used for the authentication flow.

ip · string

The originating IP address of the request.

language · string · optional

The language requested by the browser.

method · string

The HTTP method used for the request

query · dictionary

The query string parameters sent to the authorization request.

user_agent · string · optional

The value of the User-Agent header received when initiating the transaction.

event.resource_server

event.resource_server · object · optional

Details about the resource server to which the access is being requested.

Hide resource_server properties

identifier · string

The identifier of the resource server. For example: https://your-api.example.com.

event.secrets

event.secrets · secrets

Secret values securely associated with this Action.

event.security_context

event.security_context · object · optional

An object containing fingerprint signatures. This will be available only if the client is using cloudflare. The JA3/JA4 fingerprint can be null or empty in some cases. The most common case is for HTTP requests because JA3 and JA4 are calculated in TLS. It can also be empty due to the Worker sending requests within the same zone or to a zone that is not proxied (or a third party).

Hide security_context properties

ja3 · string · optional

JA3 fingerprint signature. This will be available only if the client is using a TLS connection.

ja4 · string · optional

JA4 fingerprint signature. This will be available only if the client is using a TLS connection.

event.session

event.session · dictionary · optional

The current login session.

Hide session properties

id · string

The ID of the current session.

authenticated_at · string · optional

[Enterprise Customers] The date and time when the session was last authenticated.

clients · array of objects · optional

[Enterprise Customers] List of client details for the session.

Hide clients properties

client_id · string

[Enterprise Customers] ID of client for the session.

cookie · object · optional

[Enterprise Customers] Cookie configuration for the session, which determines how the session cookie is handled by the User Agent.

Hide cookie properties

mode · string

[Enterprise Customers] The persistence mode of the session cookie. When set to ‘non-persistent’ (ephemeral), the cookie will be deleted when the browser is closed. When set to ‘persistent’, the cookie will be stored until it expires or is deleted by the user.

Allowed values: persistent, non-persistent

created_at · string · optional

[Enterprise Customers] The date and time when the session was created.

device · object · optional

[Enterprise Customers] Metadata related to the device used in the session.

Hide device properties

initial_asn · string · optional

[Enterprise Customers] First autonomous system number associated with this session.

initial_ip · string · optional

[Enterprise Customers] First IP address associated with this session.

initial_user_agent · string · optional

[Enterprise Customers] First user agent of the device associated with this session.

last_asn · string · optional

[Enterprise Customers] Last autonomous system number from which this user logged in.

last_ip · string · optional

[Enterprise Customers] Last IP address from which this user logged in.

last_user_agent · string · optional

[Enterprise Customers] Last user agent of the device from which this user logged in.

expires_at · string · optional

[Enterprise Customers] The date and time when the session will expire.

idle_expires_at · string · optional

[Enterprise Customers] The date and time when the session will expire if idle.

last_interacted_at · string · optional

[Enterprise Customers] The date and time when the session was last successfully interacted with.

metadata · dictionary · optional

[Enterprise Customers] [Early Access] Session Metadata

session_transfer · dictionary · optional

[Enterprise Customers] [Early Access] This object is defined when the session is created from a session transfer token (Native to Web SSO), undefined otherwise.

Hide session_transfer properties

parent_refresh_token · dictionary · optional

[Enterprise Customers] This object is defined when the refresh token is created from a session initiated as a result of session transfer (Native to Web SSO), undefined otherwise.

Show parent_refresh_token properties

id · string · optional

[Enterprise Customers] The ID of the parent refresh token from which this session/refresh token was created as a result of a session transfer (Native to Web SSO).

metadata · dictionary · optional

[Enterprise Customers] The metadata of the parent refresh token from which this session/refresh token was created as a result of a session transfer (Native to Web SSO).

updated_at · string · optional

[Enterprise Customers] The date and time when the session was last updated.

user_id · string · optional

[Enterprise Customers] ID of the user which can be used when interacting with other APIs.

event.session_transfer_token

event.session_transfer_token · dictionary · optional

[Early Access] Details of the current session transfer token being used to establish Single Sign-On (SSO) from a native application to a web application.

Hide session_transfer_token properties

client_id · string

[Early Access] The client identifier of the application that issued the token.

request · dictionary

[Early Access] Details about the request that issued the token.

Hide request properties

asn · string · optional

[Early Access] The Autonomous System Number (ASN) associated with the request that issued the token.

geoip · dictionary · optional

Show geoip properties

cityName · string · optional

continentCode · string · optional

countryCode · string · optional

countryCode3 · string · optional

countryName · string · optional

latitude · number · optional

longitude · number · optional

subdivisionCode · string · optional

subdivisionName · string · optional

timeZone · string · optional

ip · string

[Early Access] The IP address associated with the request that issued the token.

user_agent · string · optional

[Early Access] The User-Agent string of the device that issued the token.

scope · array of strings

[Early Access] The scopes requested when the token was issued.

event.stats

event.stats · object

Login statistics for the current user.

Hide stats properties

logins_count · number

The number of times this user has logged in.

event.tenant

event.tenant · object

Details about the Tenant associated with the current transaction.

Hide tenant properties

id · string

The name of the tenant.

event.transaction

event.transaction · dictionary · optional

Details about the current transaction.

Hide transaction properties

id · string · optional

Unique identifier for the transaction. Populated for all browser-based login flows.

acr_values · array of strings · optional

Any acr_values provided in the original authentication request.

linking_id · string · optional

Dynamic Linking ID that allows developers to reference this transaction.

locale · string · optional

The locale to be used for this transaction as determined by comparing the browser’s requested languages to the tenant’s language settings.

login_hint · string · optional

Hint to the Authorization Server about the login identifier the End-User might use to log in (if necessary).

prompt · array of strings · optional

List of instructions indicating whether the user may be prompted for re-authentication and consent.

protocol · string · optional

Possible values:

• oidc-basic-profile
• oidc-ciba
• oidc-ciba-web-link
• oidc-implicit-profile
• oauth2-device-code
• oauth2-resource-owner
• oauth2-resource-owner-jwt-bearer
• oauth2-password
• oauth2-webauthn
• oauth2-access-token
• oauth2-refresh-token
• oauth2-token-exchange
• oidc-hybrid-profile
• samlp
• wsfed
• wstrust-usernamemixed

redirect_uri · string · optional

The URL to which Auth0 will redirect the browser after the transaction is completed.

requested_authorization_details · array of objects · optional

The details of a rich authorization request per Section 2 of the Rich Authorization Requests spec at https://datatracker.ietf.org/doc/html/draft-ietf-oauth-rar#section-2.

Hide requested_authorization_details properties

type · string

The type of authorization details as a string. The value of the type field determines the allowable contents of the object which contains it.

requested_scopes · array of strings · optional

The scopes requested (if any) when starting this authentication flow.

response_mode · string · optional

Informs the Authorization Server of the mechanism to be used for returning parameters from the Authorization Endpoint.

Allowed values: query, fragment, form_post, web_message

response_type · array of strings · optional

Denotes the kind of credential that Auth0 will return.

state · string · optional

An opaque arbitrary alphanumeric string your app adds to the initial request that Auth0 includes when redirecting back to your application.

ui_locales · array of strings · optional

The ui_locales provided in the original authentication request.

actor · dictionary · optional

The actor in a token exchange request.

Hide actor properties

act · dictionary · optional

The next actor in the delegation chain, representing that this actor is making the request on behalf of another principal.

Show act properties

act · dictionary · optional

The next actor in the delegation chain, representing that this actor is making the request on behalf of another principal.

Show act properties

act · dictionary · optional

The next actor in the delegation chain, representing that this actor is making the request on behalf of another principal.

Show act properties

act · dictionary · optional

The next actor in the delegation chain, representing that this actor is making the request on behalf of another principal.

Show act properties

act · undefined · optional

sub · string

The subject identifier of the actor. A unique identifier for the entity acting in this role.

sub · string

The subject identifier of the actor. A unique identifier for the entity acting in this role.

sub · string

The subject identifier of the actor. A unique identifier for the entity acting in this role.

sub · string

The subject identifier of the actor. A unique identifier for the entity acting in this role.

sub · string

The subject identifier of the actor. A unique identifier for the entity acting in this role.

actor_token_type · string · optional

The type of the actor token in a token exchange request.

correlation_id · string · optional

Correlation ID can be provided in the initial authentication request when the application redirects to Universal Login. You can use value to correlate logs and requests from your Action code with the user flow.

metadata · dictionary

An object containing shared data across custom Actions for the duration of a transaction.

subject_token_type · string · optional

The type of the subject token in a token exchange request.

event.user

event.user · dictionary

An object describing the user on whose behalf the current transaction was initiated.

Hide user properties

app_metadata · dictionary

Custom fields that store info about a user that influences the user’s access, such as support plan, security roles, or access control groups.

created_at · string

Timestamp indicating when the user profile was first created.

email · string · optional

(unique) User’s email address.

email_verified · boolean

Indicates whether the user has verified their email address.

family_name · string · optional

User’s family name.

given_name · string · optional

User’s given name.

last_password_reset · string · optional

Timestamp indicating the last time the user’s password was reset/changed. At user creation, this field does not exist. This property is only available for Database connections.

name · string · optional

User’s full name.

nickname · string · optional

User’s nickname.

phone_number · string · optional

User’s phone number.

phone_verified · boolean · optional

Indicates whether the user has verified their phone number.

picture · string · optional

URL pointing to the user’s profile picture.

updated_at · string

Timestamp indicating when the user’s profile was last updated/modified.

user_id · string

(unique) User’s unique identifier.

user_metadata · dictionary

Custom fields that store info about a user that does not impact what they can or cannot access, such as work address, home address, or user preferences.

username · string · optional

(unique) User’s username.

enrolledFactors · array of objects · optional

An an array of authentication factors that the user has enrolled.

Hide enrolledFactors properties

type · string

The type of authentication factor such as push-notification, phone, email, otp, webauthn-roaming and webauthn-platform.

options · dictionary · optional

Additional options describing this instance of the enrolled factor.

multifactor · array of strings · optional

List of multi-factor authentication (MFA) providers with which the user is enrolled. This array is updated when the user enrolls in MFA and when an administrator resets a user’s MFA enrollments.

identities · array of objects

Contains info retrieved from the identity provider with which the user originally authenticates. Users may also link their profile to multiple identity providers; those identities will then also appear in this array. The contents of an individual identity provider object varies by provider.

Hide identities element properties

connection · string · optional

Name of the Auth0 connection used to authenticate the user.

isSocial · boolean · optional

Indicates whether the connection is a social one.

profileData · dictionary · optional

User information associated with the connection. When profiles are linked, it is populated with the associated user info for secondary accounts.

provider · string · optional

Name of the entity that is authenticating the user, such as Facebook, Google, SAML, or your own provider.

user_id · string · optional

User’s unique identifier for this connection/provider.