> ## Documentation Index > Fetch the complete documentation index at: https://auth0.com/llms.txt > Use this file to discover all available pages before exploring further. > Reference the full list of Auth0 log event type codes and what each means to filter tenant logs and trigger alerts on specific events. # Log Type Codes The following table lists the codes associated with each tenant log. If you want to learn more about log event schemas, you can reference our [GitHub repo](https://github.com/auth0/auth0-log-schemas). | Event Code | Event | Event Description | | -------------------------------------------- | ------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `acls_summary` | Network ACLs Summary | Shows the summary of the network ACLs matches for a period of time | | `actions_execution_failed` | Actions Execution Failed | Execution of an Action failed | | `acul_sdk_notice` | ACUL SDK Notice | ACUL SDK notification | | `api_limit` | Rate Limit on the Authentication or Management APIs | The maximum number of requests to the Authentication or Management APIs in a given time has been reached. | | `api_limit_warning` | Rate Limit Warning on the Authentication or Management APIs | The limit of requests to the Authentication or Management APIs in given time is about to be reached. | | `appi` | Notice for API Peak Performance initiated | Increases the Elevated Public Authentication API Limits by the 100 RPS multiple purchased by the customer for up to 48 hours per month. For more information, see [Public performance rate limit policy](/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#public-performance). | | `ciba_exchange_failed` | Failed CIBA Exchange | Failed to exchange AuthReqId for Access Token | | `ciba_exchange_succeeded` | Successful CIBA Exchange | Successful exchange of AuthReqId for Access Token | | `ciba_start_failed` | Failed CIBA Start | Client-Initiated Backchannel Authentication Flow failed to be initiated. | | `ciba_start_succeeded` | Successful CIBA Start | Client-Initiated Backchannel Authentication Flow has been successfully initiated. | | `cls` | Code/Link Sent | Passwordless login code/link has been sent | | `connected_accounts_connection_failed` | Failed Connected Account Connection | User failed to connect a third-party account | | `connected_accounts_connection_succeeded` | Successful Connected Account Connection | User successfully connected a third-party account | | `connected_accounts_delete_failed` | Failed Connected Account Delete | User failed to delete a connected third-party account | | `connected_accounts_delete_succeeded` | Successful Connected Account Delete | User successfully deleted a connected third-party account | | `cs` | Code Sent | Passwordless login code has been sent | | `custom_domain_verification_failed` | Custom Domain Verification Failed | Unable to verify a custom domain | | `depnote` | Deprecation Notice | | | `directory_sync_completed` | Inbound Directory Sync Completed | | | `directory_sync_failed` | Inbound Directory Sync Failed | | | `directory_sync_started` | Inbound Directory Sync Started | | | `f` | Failed Login | | | `failed_on_behalf_of_token_exchange` | Failed Exchange | Failed Exchange via On-Behalf-Of Token Exchange | | `fc` | Failed by Connector | | | `fce` | Failed Change Email | Failed to change user email | | `fco` | Failed by CORS | Origin is not in the Allowed Origins list for the specified application | | `fcoa` | Failed cross-origin authentication | | | `fcp` | Failed Change Password | | | `fcph` | Failed Post Change Password Hook | | | `fcpn` | Failed Change Phone Number | | | `fcpr` | Failed Change Password Request | | | `fcpro` | Failed Connector Provisioning | Failed to provision an AD/LDAP connector | | `fcu` | Failed Change Username | Failed to change username | | `fd` | Failed Delegation | Failed to generate delegation token | | `fdeac` | Failed Device Activation | Failed to activate device. | | `fdeaz` | Failed Device Authorization Request | Device authorization request failed. | | `fdecc` | User Canceled Device Confirmation | User did not confirm device. | | `fdu` | Failed User Deletion | | | `feacft` | Failed Exchange | Failed to exchange authorization code for Access Token | | `feccft` | Failed Exchange | Failed exchange of Access Token for a Client Credentials Grant | | `fecte` | Failed Exchange | Failed Exchange via Custom Token Exchange | | `fede` | Failed Exchange | Failed to exchange Device Code for Access Token | | `federated_logout_failed` | Failed Federated Logout | Failed to logout of the upstream Identity Provider | | `fens` | Failed Exchange | Failed exchange for Native Social Login | | `feoobft` | Failed Exchange | Failed exchange of Password and OOB Challenge for Access Token | | `feotpft` | Failed Exchange | Failed exchange of Password and OTP Challenge for Access Token | | `fepft` | Failed Exchange | Failed exchange of Password for Access Token | | `fepotpft` | Failed Exchange | Failed exchange of Passwordless OTP for Access Token | | `fercft` | Failed Exchange | Failed Exchange of Password and MFA Recovery code for Access Token | | `ferrt` | Failed Exchange | Failed Exchange of Rotating Refresh Token. This could occur when reuse is detected. | | `fertft` | Failed Exchange | Failed Exchange of Refresh Token for Access Token. This could occur if the refresh token is revoked or expired. | | `feta` | Failed Exchange | Failed token exchange at Token Vault | | `fi` | Failed invite accept | Failed to accept a user invitation. This could happen if the user accepts an invitation using a different email address than provided in the invitation, or due to a system failure while provisioning the invitation. | | `flo` | Failed Logout | User logout failed | | `flows_execution_completed` | Flows Execution Completed | | | `flows_execution_failed` | Flows Execution Failed | | | `fn` | Failed Sending Notification | Failed to send notification | | `forms_submission_failed` | Forms Submission Failed | | | `forms_submission_succeeded` | Forms Submission Succeeded | | | `fp` | Failed Login (Incorrect Password) | | | `fpar` | Failed Pushed Authorization Request | | | `fpurh` | Failed Post User Registration Hook | | | `fs` | Failed Signup | | | `fsa` | Failed Silent Auth | | | `fu` | Failed Login (Invalid Email/Username) | | | `fui` | Failed users import | Failed to import users | | `fv` | Failed Verification Email | Failed to send verification email | | `fvr` | Failed Verification Email Request | Failed to process verification email request | | `gd_auth_email_verification` | Email Verification Confirmed | Email verification completed successfully | | `gd_auth_fail_email_verification` | Email Verification Failed | Email verification failed. | | `gd_auth_failed` | MFA Auth failed | Multi-factor authentication failed. This could happen due to a wrong code entered for SMS/Voice/Email/TOTP factors, or a system failure. | | `gd_auth_rejected` | MFA Auth rejected | A user rejected a Multi-factor authentication request via push-notification. | | `gd_auth_succeed` | MFA Auth success | Multi-factor authentication success. | | `gd_enrollment_complete` | MFA enrollment complete | A first time MFA user has successfully enrolled using one of the factors. | | `gd_otp_rate_limit_exceed` | Too many MFA failures | A user sends more than 10 requests to their device within one hour. Note that the request limit does not reset upon a successful login event. | | `gd_recovery_failed` | Recovery failed | A user enters a wrong recovery code when attempting to authenticate. | | `gd_recovery_rate_limit_exceed` | Multi-factor recovery code has failed too many times | A user has entered a wrong recovery code too many times. | | `gd_recovery_succeed` | MFA recovery success | A user successfully authenticates with a recovery code. | | `gd_send_email` | MFA Email Sent | Email for MFA successfully sent. | | `gd_send_email_verification` | Email Verification Sent | Verification email sent successfully. | | `gd_send_email_verification_failure` | Email Verification Failed | Email verification failed. | | `gd_send_pn` | Push notification sent | Push notification for MFA successfully sent. | | `gd_send_pn_failure` | Error Sending MFA Push Notification | Push notification for MFA failed. | | `gd_send_sms` | MFA SMS Sent | SMS for MFA successfully sent. | | `gd_send_sms_failure` | Error Sending MFA SMS | Attempt to send SMS for MFA failed. | | `gd_send_voice` | MFA voice call success | Voice call for MFA successfully made. | | `gd_send_voice_failure` | MFA voice call failed | Attempt to make Voice call for MFA failed. | | `gd_start_auth` | Second factor started | Second factor authentication event started for MFA. | | `gd_start_enroll` | MFA Enroll started | Multi-factor authentication enroll has started. | | `gd_start_enroll_failed` | MFA Enrollment Failed | Push to start enrollement failed. | | `gd_tenant_update` | Guardian tenant update | | | `gd_unenroll` | Unenroll device account | Device used for second factor authentication has been unenrolled. | | `gd_update_device_account` | Update device account | Device used for second factor authentication has been updated. | | `gd_webauthn_challenge_failed` | WebAuthn browser error | User failed to verify Webauthn factor. | | `gd_webauthn_enrollment_failed` | WebAuthn browser error | WebAuthn browser enrollment failed. | | `idjag_exchange_failed` | Failed Exchange | Failed Exchange of Identity Assertion Authorization Grant JWT for Access Token | | `idjag_exchange_succeeded` | Success Exchange | Successful Exchange of Identity Assertion Authorization Grant JWT for Access Token | | `jwt_bearer_exchange_failed` | Failed Exchange | Failed Exchange of JWT Bearer Assertion for Access Token | | `kms_key_management_failure` | Failed KMS API Operation | KMS operation failed | | `kms_key_management_success` | Success KMS API Operation | KMS operation completed successfully | | `kms_key_state_changed` | KMS Key State Change | KMS key state changed | | `limit_delegation` | Too Many Calls to /delegation | Rate limit exceeded to `/delegation` endpoint | | `limit_mu` | Blocked IP Address | An IP address is blocked because it attempted too many failed logins without a successful login. Or an IP address is blocked because it attempted too many sign-ups, whether successful or failed. For more information, see [Attack Protection](/docs/secure/attack-protection). | | `limit_sul` | Blocked Account | A user is temporarily prevented from logging in because they reached the maximum logins per time period from the same IP address. For more information, see [Attack Protection](/docs/secure/attack-protection). | | `limit_wc` | Blocked Account | An IP address is blocked because it reached the maximum failed login attempts into a single account. | | `mfar` | MFA Required | A user has been prompted for multi-factor authentication (MFA). When using Adaptive MFA, Auth0 includes details about the risk assessment. Available in only the [Resource Owner Password Flow](/docs/get-started/authentication-and-authorization-flow/resource-owner-password-flow). | | `mgmt_api_read` | Management API read Operation | API GET operation returning secrets completed successfully | | `my_account_authentication_method_failed` | Failed authentication method operation in My Account API | Failed to complete authentication method operation in My Account API | | `my_account_authentication_method_succeeded` | Successful authentication method operation in My Account API | Successfully completed authentication method operation in My Account API | | `oidc_backchannel_logout_failed` | Failed OIDC Back-Channel Logout request | Failed OIDC Back-Channel Logout request | | `oidc_backchannel_logout_succeeded` | Successful OIDC Back-Channel Logout request | Successful OIDC Back-Channel Logout request | | `organization_member_added` | Organization Member Added | Successfully added member to organization | | `passkey_challenge_failed` | Passkey Challenge Failed | Native passkey challenge failed | | `passkey_challenge_started` | Passkey Challenge Started | Native passkey challenge was successfully initiated | | `pla` | Pre-login assessment | This log is generated before a login and helps in monitoring the behavior of bot detection without having to enable it. | | `pwd_leak` | Breached password | Someone behind the IP address `ip` attempted to login with a leaked password. The `pwd_leak` tenant log is emitted once per hour per IP address. | | `reset_pwd_leak` | Breached Password on Reset | Someone behind the IP address `ip` attempted to reset with a leaked password. | | `resource_cleanup` | Success Resource Cleanup | Emitted when resources exceeding defined limits were removed. | | `rich_consents_access_error` | Rich Consents Access Error | Error fetching a Rich Consent record | | `s` | Success Login | Successful login event. | | `sapi` | Success API Operation | Successful management API write event. | | `sce` | Success Change Email | | | `scoa` | Success cross-origin authentication | | | `scp` | Success Change Password | | | `scpn` | Success Change Phone Number | | | `scpr` | Success Change Password Request | | | `scu` | Success Change Username | | | `scv` | Success Credential Validation | Successful credential validation event. | | `sd` | Success Delegation | | | `sdu` | Success User Deletion | User successfully deleted | | `seacft` | Success Exchange | Successful exchange of authorization code for Access Token | | `seccft` | Success Exchange | Successful exchange of Access Token for a Client Credentials Grant | | `secte` | Success Exchange | Succesful Exchange via Custom Token Exchange | | `sede` | Success Exchange | Successful exchange of device code for Access Token | | `sens` | Success Exchange | Native Social Login | | `seoobft` | Success Exchange | Successful exchange of Password and OOB Challenge for Access Token | | `seotpft` | Success Exchange | Successful exchange of Password and OTP Challenge for Access Token | | `sepft` | Success Exchange | Successful exchange of Password for Access Token | | `sepkoobft` | Success Exchange | Successful exchange of Passkey and OOB Challenge for Access Token | | `sepkotpft` | Success Exchange | Successful exchange of Passkey and OTP Challenge for Access Token | | `sepkrcft` | Success Exchange | Successful exchange of Passkey and MFA Recovery Code for Access Token | | `sercft` | Success Exchange | Successful exchange of Password and MFA Recovery code for Access Token | | `sertft` | Success Exchange | Successful exchange of Refresh Token for Access Token | | `seta` | Success Exchange | Successful token exchange at Token Vault | | `si` | Successfully accepted a user invite | Successfully accepted a user invitation | | `signup_pwd_leak` | Breached Password on Signup | Someone behind the IP address `ip` attempted to signup with a leaked password. | | `slo` | Success Logout | User successfully logged out | | `srrt` | Successfully revoked a refresh token | | | `ss` | Success Signup | | | `ss_sso_failure` | Failed SS-SSO Operation | Self-Service operation failed | | `ss_sso_info` | Information from an SS-SSO Operation | Try-connection flow started/completed | | `ss_sso_success` | Success SS-SSO Operation | Self-Service operation completed successfully | | `ssa` | Success Silent Auth | | | `sscim` | Successful SCIM Operation | SCIM operation succeeded | | `success_on_behalf_of_token_exchange` | Success Exchange | Successful Exchange via On-Behalf-Of Token Exchange | | `sui` | Successfully imported users | Successfully imported users | | `sv` | Success Verification Email | Successfully consumed email verification link | | `svr` | Success Verification Email Request | Successfully called verification email endpoint. Verification email in queue to send. | | `too_many_records` | Max Amount of Authenticators | User has created the maximum amount of authenticators | | `ublkdu` | User login block released | User block setup by anomaly detection has been released | | `universal_logout_failed` | Failed Universal Logout request | Failed Universal Logout request | | `universal_logout_succeeded` | Successful Universal Logout request | Successful Universal Logout request | | `w` | Warning During Login | Filters for logs of type `warning` during login | | `wn` | Warning Sending Notification | Warnings that have occurred during notification sending. | | `wum` | Warning User Management | Filters for logs of type `warning` during user management operations | ## Learn more * [View Logs](/docs/deploy-monitor/logs/view-log-events) * [Log Search Query Syntax](/docs/deploy-monitor/logs/log-search-query-syntax) * [Filter Log Events](/docs/deploy-monitor/logs/log-event-filters) * [Retrieve Log Logs Using the Management API](/docs/deploy-monitor/logs/retrieve-log-events-using-mgmt-api) * [Log Streams](/docs/customize/log-streams)