event object for the post-login Actions trigger provides contextual information about the trigger execution.
Event Object
{
"secrets": {},
"client": {
"client_id": "string",
"is_first_party": false,
"metadata": {},
"name": "string"
},
"connection": {
"id": "string",
"name": "string",
"strategy": "string"
},
"request": {
"body": {},
"geoip": {},
"ip": "string",
"method": "string",
"query": {}
},
"stats": {
"logins_count": 0
},
"tenant": {
"id": "string"
},
"user": {}
}
event.agent
object
optional
[Early Access] Information about the agent acting in this flow. Set when the authenticating client is linked to an agent and the tenant has agents as principals enabled;
undefined otherwise.Hide event.agent properties
Hide event.agent properties
string
[Early Access] The stable identifier for the agent, prefixed with
agt_ (for example, agt_2hVk6JxPxbRgNZDKfJQqmn).dictionary
[Early Access] Free-form key-value metadata associated with the agent. Always defined when
agent is present; an empty object when the agent has no metadata.string
[Early Access] The human-readable name of the agent.
event.authentication
object
optional
Details about authentication signals obtained during the login flow.
Hide event.authentication properties
Hide event.authentication properties
array of objects
Contains the authentication methods a user has completed during their session.
object
optional
Details about risk assessments obtained during the login or password reset flow.
Hide riskAssessment properties
Hide riskAssessment properties
object
Hide assessments properties
Hide assessments properties
object
optional
object
optional
Determines if the user is logging in from a location signaling impossible travel.
Hide ImpossibleTravel properties
Hide ImpossibleTravel properties
string
Allowed values:
minimal_travel_from_last_login, travel_from_last_login, substantial_travel_from_last_login, impossible_travel_from_last_login, invalid_travel, missing_geoip, anonymous_proxy, unknown_location, initial_login, location_history_not_found, assessment_not_availablestring
Allowed values:
low, medium, high, neutralobject
optional
Determines if the user is logging in from a known device.
Hide NewDevice properties
Hide NewDevice properties
string
Allowed values:
initial_login, assessment_not_available, match, partial_match, no_match, unknown_device, no_device_historystring
Allowed values:
low, medium, high, neutralobject
optional
Shows if the IP was found in Auth0’s repository of low reputation IPs.
Hide UntrustedIP properties
Hide UntrustedIP properties
string
Allowed values:
assessment_not_available, not_found_on_deny_list, found_on_deny_list, invalid_ip_addressstring
Allowed values:
low, medium, high, neutralstring
Overall risk scoreAllowed values:
low, medium, high, neutralobject
optional
[Early Access] Supplemental risk assessment.
Hide supplemental properties
Hide supplemental properties
dictionary
optional
Hide akamai properties
Hide akamai properties
object
optional
The bot detection results as forwarded by Akamai Bot Manager.
Hide akamaiBot properties
Hide akamaiBot properties
string
optional
The type of the Akamai bot manager results.
string
optional
The action of the Akamai bot manager results.
array of string
optional
The bot category of the Akamai bot manager results.
number
optional
The bot score of the Akamai bot manager results.
string
optional
The bot score response segment of the Akamai bot manager results.
string
optional
The botnet ID of the Akamai bot manager results.
object
optional
The user risk detection results as forwarded by Akamai Account Protector.
Hide akamaiUserRisk properties
Hide akamaiUserRisk properties
string
optional
The action of the Akamai user risk assessment.
number
optional
The allowed status of the Akamai user risk assessment.
string
optional
The email domain of the user.
dictionary
optional
The general risk of the Akamai user risk assessment.
string
optional
The OUID of the user.
string
optional
The request ID of the user.
dictionary
optional
The risk of the Akamai user risk assessment.
number
optional
The score of the Akamai user risk assessment.
number
optional
The status of the Akamai user risk assessment.
dictionary
optional
The trust of the Akamai user risk assessment.
string
optional
The username of the user.
string
optional
The UUID of the Akamai user risk assessment.
string
event.authorization
object
optional
An object containing information describing the authorization granted to the user who is logging in.
Hide event.authorization properties
Hide event.authorization properties
array of string
An array containing the names of a user’s assigned roles.
event.client
object
Information about the Client with which this login transaction was initiated.
Hide event.client properties
Hide event.client properties
string
The client id of the application to which the user is logging in.
boolean
Indicates whether the client application is first-party (true) or third-party (false). First-party applications are owned and operated by your organization, while third-party applications are owned by an external party. To learn more, read First-Party and Third-Party Applications.
dictionary
An object for holding other application properties.
string
The name of the application (as defined in the Dashboard).
object
optional
[Early Access] An object for holding refresh token configuration properties.
Hide refresh_token properties
Hide refresh_token properties
array of objects
optional
[Early Access] A collection of policies governing multi-resource refresh token exchange (MRRT), defining how refresh tokens can be used across different resource servers
event.connection
object
Details about the Connection that was used to authenticate the user.
Hide event.connection properties
Hide event.connection properties
string
The connection’s unique identifier.
dictionary
optional
Metadata associated with the connection.
string
The name of the connection used to authenticate the user (such as
twitter or some-g-suite-domain).string
The type of connection. For social connections,
event.connection.strategy === event.connection.name. For enterprise connections, the strategy is waad (Windows Azure AD), ad (Active Directory/LDAP), auth0 (database connections), and so on.event.custom_domain
object
optional
event.organization
dictionary
optional
event.prompt
object
optional
event.refresh_token
object
optional
[Enterprise Customers] The current refresh token.
Hide event.refresh_token properties
Hide event.refresh_token properties
string
[Enterprise Customers] The ID of the refresh token.
string
optional
[Enterprise Customers] The ID of the client associated with the refresh token.
string
[Enterprise Customers] Timestamp of when the refresh token was created.
object
optional
Hide device properties
Hide device properties
string
optional
[Enterprise Customers] First autonomous system number associated with this refresh token.
string
optional
[Enterprise Customers] First IP address associated with this refresh token.
string
optional
[Enterprise Customers] First user agent of the device associated with this refresh token.
string
optional
[Enterprise Customers] Last autonomous system number from which this refresh token was last exchanged.
string
optional
[Enterprise Customers] Last IP address from which this refresh token was last exchanged.
string
optional
[Enterprise Customers] Last user agent of the device from which this refresh token was last exchanged.
string
optional
[Enterprise Customers] Timestamp of when the refresh token will absolutely expire.
string
optional
[Enterprise Customers] Timestamp of when the refresh token will idle expire.
string
optional
[Enterprise Customers] Timestamp of when the refresh token was last successfully exchanged.
dictionary
optional
Refresh Token Metadata
array of objects
optional
boolean
optional
[Enterprise Customers] If the refresh token is a rotating refresh token.
string
optional
[Enterprise Customers] The ID of the session bound to the refresh token.
object
optional
[Enterprise Customers] This object is defined when the session is created from a session transfer token (Native to Web SSO), undefined otherwise.
Hide session_transfer properties
Hide session_transfer properties
object
optional
[Enterprise Customers] This object is defined when the refresh token is created from a session initiated as a result of session transfer (Native to Web SSO), undefined otherwise.
Hide parent_refresh_token properties
Hide parent_refresh_token properties
string
optional
[Enterprise Customers] The ID of the parent refresh token from which this session/refresh token was created as a result of a session transfer (Native to Web SSO).
string
optional
[Enterprise Customers] The ID of the user bound to the refresh token.
event.request
object
Details about the request that initiated the transaction.
Hide event.request properties
Hide event.request properties
string
optional
The ASN (autonomous system number) of the user-agent making the request.
dictionary
The body of the POST request. This data will only be available during refresh token and Client Credential Exchange flows and Post Login Action.
dictionary
string
optional
The hostname that is being used for the authentication flow.
string
The originating IP address of the request.
string
optional
The language requested by the browser.
string
The HTTP method used for the request
dictionary
The query string parameters sent to the authorization request.
string
optional
The value of the
User-Agent header received when initiating the transaction.event.resource_server
object
optional
Details about the resource server to which the access is being requested.
Hide event.resource_server properties
Hide event.resource_server properties
string
The identifier of the resource server. For example:
https://your-api.example.com.event.secrets
secrets
Secret values securely associated with this Action.
event.security_context
object
optional
An object containing fingerprint signatures. This will be available only if the client is using cloudflare. The JA3/JA4 fingerprint can be null or empty in some cases. The most common case is for HTTP requests because JA3 and JA4 are calculated in TLS. It can also be empty due to the Worker sending requests within the same zone or to a zone that is not proxied (or a third party).
event.session
object
optional
The current login session.
Hide event.session properties
Hide event.session properties
string
The ID of the current session.
dictionary
optional
The actor for sessions established using Session transfer tokens from Custom Token Exchange. Contains a required ‘sub’ property and up to 5 additional properties set via the Custom Token Exchange action. The actor will be defined for delegated sessions only.
Hide actor properties
Hide actor properties
string
The subject identifier of the actor. A unique identifier for the entity acting in this role.
string
optional
[Enterprise Customers] The date and time when the session was last authenticated.
array of objects
optional
[Enterprise Customers] List of client details for the session.
object
optional
[Enterprise Customers] Cookie configuration for the session, which determines how the session cookie is handled by the User Agent.
Hide cookie properties
Hide cookie properties
string
[Enterprise Customers] The persistence mode of the session cookie. When set to ‘non-persistent’ (ephemeral), the cookie will be deleted when the browser is closed. When set to ‘persistent’, the cookie will be stored until it expires or is deleted by the user.Allowed values:
persistent, non-persistentstring
optional
[Enterprise Customers] The date and time when the session was created.
object
optional
[Enterprise Customers] Metadata related to the device used in the session.
Hide device properties
Hide device properties
string
optional
[Enterprise Customers] First autonomous system number associated with this session.
string
optional
[Enterprise Customers] First IP address associated with this session.
string
optional
[Enterprise Customers] First user agent of the device associated with this session.
string
optional
[Enterprise Customers] Last autonomous system number from which this user logged in.
string
optional
[Enterprise Customers] Last IP address from which this user logged in.
string
optional
[Enterprise Customers] Last user agent of the device from which this user logged in.
string
optional
[Enterprise Customers] The date and time when the session will expire.
string
optional
[Enterprise Customers] The date and time when the session will expire if idle.
string
optional
[Enterprise Customers] The date and time when the session was last successfully interacted with.
dictionary
optional
[Enterprise Customers] [Early Access] Session Metadata
object
optional
[Enterprise Customers] [Early Access] This object is defined when the session is created from a session transfer token (Native to Web SSO), undefined otherwise.
Hide session_transfer properties
Hide session_transfer properties
object
optional
[Enterprise Customers] This object is defined when the refresh token is created from a session initiated as a result of session transfer (Native to Web SSO), undefined otherwise.
Hide parent_refresh_token properties
Hide parent_refresh_token properties
string
optional
[Enterprise Customers] The ID of the parent refresh token from which this session/refresh token was created as a result of a session transfer (Native to Web SSO).
dictionary
optional
[Enterprise Customers] The metadata of the parent refresh token from which this session/refresh token was created as a result of a session transfer (Native to Web SSO).
string
optional
[Enterprise Customers] The date and time when the session was last updated.
string
optional
[Enterprise Customers] ID of the user which can be used when interacting with other APIs.
event.session_transfer_token
object
optional
[Early Access] Details of the current session transfer token being used to establish Single Sign-On (SSO) from a native application to a web application.
Hide event.session_transfer_token properties
Hide event.session_transfer_token properties
string
[Early Access] The client identifier of the application that issued the token.
object
[Early Access] Details about the request that issued the token.
Hide request properties
Hide request properties
string
optional
[Early Access] The Autonomous System Number (ASN) associated with the request that issued the token.
dictionary
optional
string
[Early Access] The IP address associated with the request that issued the token.
string
optional
[Early Access] The User-Agent string of the device that issued the token.
array of string
[Early Access] The scopes requested when the token was issued.
event.stats
object
Login statistics for the current user.
Hide event.stats properties
Hide event.stats properties
number
The number of times this user has logged in.
event.tenant
object
Details about the Tenant associated with the current transaction.
Hide event.tenant properties
Hide event.tenant properties
string
The name of the tenant.
event.transaction
dictionary
optional
Details about the current transaction.
Hide event.transaction properties
Hide event.transaction properties
string
optional
Unique identifier for the transaction. Populated for all browser-based login flows.
array of string
optional
Any acr_values provided in the original authentication request.
string
optional
Dynamic Linking ID that allows developers to reference this transaction.
string
optional
The locale to be used for this transaction as determined by comparing the browser’s requested languages to the tenant’s language settings.
string
optional
Hint to the Authorization Server about the login identifier the End-User might use to log in (if necessary).
array of string
optional
List of instructions indicating whether the user may be prompted for re-authentication and consent.
string
optional
Allowed values:
oidc-basic-profile, oidc-ciba, oidc-ciba-web-link, oidc-implicit-profile, oauth2-device-code, oauth2-resource-owner, oauth2-resource-owner-jwt-bearer, oauth2-password, oauth2-webauthn, oauth2-access-token, oauth2-refresh-token, oauth2-token-exchange, oidc-hybrid-profile, samlp, wsfed, wstrust-usernamemixedstring
optional
The URL to which Auth0 will redirect the browser after the transaction is completed.
array of objects
optional
The details of a rich authorization request per Section 2 of the Rich Authorization Requests spec at https://datatracker.ietf.org/doc/html/draft-ietf-oauth-rar#section-2.
array of string
optional
The scopes requested (if any) when starting this authentication flow.
string
optional
Informs the Authorization Server of the mechanism to be used for returning parameters from the Authorization Endpoint.Allowed values:
query, fragment, form_post, web_messagearray of string
optional
Denotes the kind of credential that Auth0 will return.
string
optional
An opaque arbitrary alphanumeric string your app adds to the initial request that Auth0 includes when redirecting back to your application.
array of string
optional
The ui_locales provided in the original authentication request.
dictionary
optional
The actor in a token exchange request.
Hide actor properties
Hide actor properties
dictionary
optional
The next actor in the delegation chain, representing that this actor is making the request on behalf of another principal.
Hide act properties
Hide act properties
dictionary
optional
The next actor in the delegation chain, representing that this actor is making the request on behalf of another principal.
Hide act properties
Hide act properties
dictionary
optional
The next actor in the delegation chain, representing that this actor is making the request on behalf of another principal.
string
The subject identifier of the actor. A unique identifier for the entity acting in this role.
string
The subject identifier of the actor. A unique identifier for the entity acting in this role.
string
The subject identifier of the actor. A unique identifier for the entity acting in this role.
string
optional
The type of the actor token in a token exchange request.
string
optional
Correlation ID can be provided in the initial authentication request when the application redirects to Universal Login. You can use value to correlate logs and requests from your Action code with the user flow.
dictionary
An object containing shared data across custom Actions for the duration of a transaction.
string
optional
The type of the subject token in a token exchange request.
array of string
optional
The live target scope set for the transaction. Initialized from the requested scopes and immediately updated by api.transaction target scope methods across current and subsequent Actions. After all Actions complete, these scopes are filtered by the transaction’s applicable authorization policies, including App Access Permissions and RBAC. Unauthorized scopes are silently dropped. When explicit user consent is required, all scopes remaining after filtering are included in the consent prompt.
event.user
dictionary
An object describing the user on whose behalf the current transaction was initiated.
Hide event.user properties
Hide event.user properties
dictionary
Custom fields that store info about a user that influences the user’s access, such as support plan, security roles, or access control groups.
string
Timestamp indicating when the user profile was first created.
string
optional
(unique) User’s email address.
boolean
Indicates whether the user has verified their email address.
string
optional
User’s family name.
string
optional
User’s given name.
string
optional
Timestamp indicating the last time the user’s password was reset/changed. At user creation, this field does not exist. This property is only available for Database connections.
string
optional
User’s full name.
string
optional
User’s nickname.
string
optional
User’s phone number.
boolean
optional
Indicates whether the user has verified their phone number.
string
optional
URL pointing to the user’s profile picture.
string
Timestamp indicating when the user’s profile was last updated/modified.
string
(unique) User’s unique identifier.
dictionary
Custom fields that store info about a user that does not impact what they can or cannot access, such as work address, home address, or user preferences.
string
optional
(unique) User’s username.
array of objects
optional
An an array of authentication factors that the user has enrolled.
array of string
optional
List of multi-factor authentication (MFA) providers with which the user is enrolled. This array is updated when the user enrolls in MFA and when an administrator resets a user’s MFA enrollments.
array of objects
Contains info retrieved from the identity provider with which the user originally authenticates. Users may also link their profile to multiple identity providers; those identities will then also appear in this array. The contents of an individual identity provider object varies by provider.