Skip to main content

AuthAuditEventType

Package: @nauth-toolkit/core Type: Enum

Complete enumeration of all authentication and security events recorded in the audit trail.

import { AuthAuditEventType } from '@nauth-toolkit/nestjs';

Login Events​

ValueDescription
LOGIN_ATTEMPTLogin attempt initiated (credentials validated, risk assessed)
LOGIN_SUCCESSUser successfully authenticated
LOGIN_FAILEDLogin attempt failed (invalid credentials, account locked)
LOGIN_BLOCKEDLogin attempt blocked (account locked, IP blocked)

Session Events​

ValueDescription
SESSION_CREATEDNew session created (after successful authentication)
SESSION_REVOKEDSession revoked (logout, security violation, admin action)
GLOBAL_SIGNOUTAll sessions revoked (global sign-out)

Password Events​

ValueDescription
PASSWORD_CHANGEDUser changed their password
PASSWORD_RESET_REQUESTEDPassword reset requested (email/SMS sent)
PASSWORD_RESET_COMPLETEDPassword reset completed successfully
PASSWORD_FORCE_CHANGE_SETForce password change requirement set (by admin or policy)
PASSWORD_FORCE_CHANGE_COMPLETEDForce password change completed
ADMIN_PASSWORD_RESET_INITIATEDAdmin-initiated password reset started
ADMIN_PASSWORD_RESET_COMPLETEDAdmin-initiated password reset completed
ADMIN_PASSWORD_RESET_FAILEDAdmin-initiated password reset failed

Multi-Factor Authentication (MFA) Events​

ValueDescription
MFA_ENABLEDMFA enabled for user account
MFA_DISABLEDMFA disabled for user account
MFA_DEVICE_ADDEDNew MFA device registered (TOTP, SMS, Passkey)
MFA_DEVICE_REMOVEDMFA device removed from account
MFA_DEVICE_UPDATEDMFA device updated (name changed, primary flag changed)
MFA_VERIFICATION_SUCCESSMFA verification succeeded
MFA_VERIFICATION_FAILEDMFA verification failed (invalid code, expired)
MFA_EXEMPTION_GRANTEDMFA exemption granted (admin action)
MFA_EXEMPTION_REVOKEDMFA exemption revoked (admin action)
MFA_BACKUP_CODES_GENERATEDBackup codes generated for MFA recovery
MFA_BACKUP_CODE_USEDBackup code used for MFA verification
MFA_PREFERRED_METHOD_UPDATEDUser's preferred MFA method updated
DEVICE_TRUSTEDDevice trusted by user (remember device feature)
DEVICE_UNTRUSTEDTrusted device revoked (user untrusted device or device expired)

Adaptive MFA Events (Risk-Based)​

ValueDescription
ADAPTIVE_MFA_RISK_ASSESSEDRisk assessment completed (for future adaptive MFA implementation)
ADAPTIVE_MFA_TRIGGEREDAdaptive MFA triggered due to risk factors (for future implementation)
ADAPTIVE_MFA_BYPASSEDAdaptive MFA bypassed due to low risk (for future implementation)

Verification Events​

ValueDescription
EMAIL_VERIFIEDEmail address verified successfully
EMAIL_VERIFICATION_REQUESTEDEmail verification code/link requested
EMAIL_VERIFICATION_FAILEDEmail verification failed (invalid code, expired)
PHONE_VERIFIEDPhone number verified successfully
PHONE_VERIFICATION_REQUESTEDPhone verification code requested
PHONE_VERIFICATION_FAILEDPhone verification failed (invalid code, expired)

Account Management Events​

ValueDescription
ACCOUNT_CREATEDNew user account created (signup)
ACCOUNT_DISABLEDUser account disabled by admin (permanent lock)
ACCOUNT_ENABLEDUser account enabled by admin (unlock)
ACCOUNT_DELETEDUser account deleted

Profile Update Events​

ValueDescription
PROFILE_UPDATEDUser profile updated (general update)
EMAIL_CHANGEDUser email address changed
PHONE_CHANGEDUser phone number changed
USERNAME_CHANGEDUser username changed
EMAIL_VERIFICATION_STATUS_UPDATEDEmail verification status manually updated (admin action)
PHONE_VERIFICATION_STATUS_UPDATEDPhone verification status manually updated (admin action)

Social Authentication Events​

ValueDescription
SOCIAL_LOGINUser authenticated via social provider (Google, Apple, Facebook)
SOCIAL_ACCOUNT_LINKEDSocial account linked to user account
SOCIAL_ACCOUNT_UNLINKEDSocial account unlinked from user account

Challenge Flow Events​

ValueDescription
CHALLENGE_CREATEDChallenge session created (email verification, phone verification, MFA setup)
CHALLENGE_COMPLETEDChallenge completed successfully
CHALLENGE_ATTEMPT_FAILEDChallenge attempt failed (max attempts exceeded)

Security Events​

ValueDescription
SUSPICIOUS_ACTIVITYSuspicious activity detected (token reuse, impossible travel)
AUTHORIZATION_DENIEDA privileged operation was refused by the configured authorization provider. Metadata carries the attempted action, the acting user and the target

API Key Events​

ValueDescription
API_KEY_CREATEDAPI key created (by the owning user or an administrator)
API_KEY_UPDATEDAPI key updated (name or IP restrictions changed)
API_KEY_USEDAPI key used to authenticate a request (throttled)
API_KEY_REVOKEDAPI key revoked (soft-disabled)
API_KEY_DELETEDAPI key permanently deleted
API_KEY_AUTH_FAILEDAPI key authentication failed (invalid, expired, revoked, or IP)

OpenID Connect Provider Events​

Recorded when another application signs a user in through your OpenID Connect provider. Only present when @nauth-toolkit/oidc-provider is installed and audit logs are enabled.

ValueDescription
OIDC_ACCESS_DENIEDRefused because the account may not be vouched for (disabled or locked)
OIDC_CONSENT_DENIEDThe user refused a relying party's request
OIDC_CONSENT_GRANTEDThe user approved a relying party's request
OIDC_LOGIN_COMPLETEDA completed login was released to a relying party

Each carries authMethod: 'oidc' and a metadata object identifying the application:

{
  "clientId": "partner",
  "interactionUid": "kPz3Q8sLm2",
  "requestedScopes": ["openid", "email", "profile"],
  "grantedScopes": ["openid", "email"]
}

grantedScopes appears on OIDC_CONSENT_GRANTED; reason appears on OIDC_ACCESS_DENIED. IP address, geolocation, device and user agent are captured automatically, as for any other event.

The user's own sign-in is recorded separately

Signing in produces the ordinary LOGIN_SUCCESS first — at that point no application is known, because the authorization request is still parked. OIDC_LOGIN_COMPLETED is the record of which application the user was then released to.

Last updated on