{"token_count": 5015}

# Users & Authentication Audit Events

This page lists audit events related to authenticating Teleport users and Teleport-issued certificates.

## auth

Auth Attempt Failed

Example:

```
{
  "code": "T3007W",
  "error": "ssh: principal \"fsdfdsf\" not in the set of valid principals for given certificate: [\"root\"]",
  "event": "auth",
  "success": false,
  "time": "2019-04-22T02:09:06Z",
  "uid": "036659d6-fdf7-40a4-aa80-74d6ac73b9c0",
  "user": "admin@example.com"
}

```

## auth\_preference.update

Cluster Authentication Preferences Updated

Example:

```
{
  "code": "TCAUTH001I",
  "event": "auth_preference.update",
  "time": "2020-06-05T16:24:05Z",
  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
}

```

## cert.create

Certificate Issued

Example:

```
{
  "cert_type": "user",
  "code": "TC000I",
  "event": "cert.create",
  "identity": {
    "user": "alice"
  },
  "time": "2022-02-04T19:43:23.529Z"
}

```

## cert\_auth\_override.create

Certificate Authority Override Created

Example:

```
{
  "ca_override": {
    "ca_type": "windows",
    "cluster_name": "zarquon2"
  },
  "cluster_name": "zarquon2",
  "code": "TCO01I",
  "ei": 0,
  "event": "cert_auth_override.create",
  "expires": "0001-01-01T00:00:00Z",
  "name": "windows/zarquon2",
  "success": true,
  "time": "2026-04-08T22:01:00.061Z",
  "uid": "dc718618-4e01-4044-b775-065de30dd51a",
  "updated_by": "55831da5-8898-4fd2-abe5-8c28c4741534.zarquon2",
  "user": "55831da5-8898-4fd2-abe5-8c28c4741534.zarquon2",
  "user_cluster_name": "zarquon2",
  "user_kind": 3,
  "user_roles": [
    "Admin"
  ]
}

```

## cert\_auth\_override.delete

Certificate Authority Override Deleted

Example:

```
{
  "ca_override": {
    "ca_type": "windows",
    "cluster_name": "zarquon2"
  },
  "cluster_name": "zarquon2",
  "code": "TCO04I",
  "ei": 0,
  "event": "cert_auth_override.delete",
  "expires": "0001-01-01T00:00:00Z",
  "name": "windows/zarquon2",
  "success": true,
  "time": "2026-04-08T22:04:00.061Z",
  "uid": "be0ad673-fdc6-481b-862f-a0447df63dff",
  "updated_by": "55831da5-8898-4fd2-abe5-8c28c4741534.zarquon2",
  "user": "55831da5-8898-4fd2-abe5-8c28c4741534.zarquon2",
  "user_cluster_name": "zarquon2",
  "user_kind": 3,
  "user_roles": [
    "Admin"
  ]
}

```

## cert\_auth\_override.update

Certificate Authority Override Updated

Example:

```
{
  "ca_override": {
    "ca_type": "windows",
    "certificate_overrides": [
      {
        "certificate": {
          "issuer": "CN=Llama Windows CA,OU=Llama CA,O=Llama Corp",
          "public_key_hash": "f4522365888fdddcf3c854e79e5928447fe1a2388353efb2f0d30db8ba7c81bc",
          "serial_number": "110713595887223080163032262858678558596458745620",
          "subject": "CN=zarquon2,O=zarquon2"
        }
      }
    ],
    "cluster_name": "zarquon2"
  },
  "cluster_name": "zarquon2",
  "code": "TCO02I",
  "ei": 0,
  "event": "cert_auth_override.update",
  "expires": "0001-01-01T00:00:00Z",
  "name": "windows/zarquon2",
  "success": true,
  "time": "2026-04-08T22:02:00.061Z",
  "uid": "4e789cfe-069c-46d1-8a44-ce1b2f735e37",
  "updated_by": "55831da5-8898-4fd2-abe5-8c28c4741534.zarquon2",
  "user": "55831da5-8898-4fd2-abe5-8c28c4741534.zarquon2",
  "user_cluster_name": "zarquon2",
  "user_kind": 3,
  "user_roles": [
    "Admin"
  ]
}

```

## cert\_auth\_override.upsert

Certificate Authority Override Upserted

Example:

```
{
  "ca_override": {
    "ca_type": "windows",
    "certificate_overrides": [
      {
        "certificate": {
          "issuer": "CN=Llama Windows CA,OU=Llama CA,O=Llama Corp",
          "public_key_hash": "f4522365888fdddcf3c854e79e5928447fe1a2388353efb2f0d30db8ba7c81bc",
          "serial_number": "110713595887223080163032262858678558596458745620",
          "subject": "CN=zarquon2,O=zarquon2"
        }
      }
    ],
    "cluster_name": "zarquon2"
  },
  "cluster_name": "zarquon2",
  "code": "TCO03I",
  "ei": 0,
  "event": "cert_auth_override.upsert",
  "expires": "0001-01-01T00:00:00Z",
  "name": "windows/zarquon2",
  "success": true,
  "time": "2026-04-08T22:03:00.061Z",
  "uid": "77dcc08b-04e3-4908-b1c8-7836c7b1f057",
  "updated_by": "55831da5-8898-4fd2-abe5-8c28c4741534.zarquon2",
  "user": "55831da5-8898-4fd2-abe5-8c28c4741534.zarquon2",
  "user_cluster_name": "zarquon2",
  "user_kind": 3,
  "user_roles": [
    "Admin"
  ]
}

```

## login\_rule.create

Login Rule Created

Example:

```
{
  "cluster_name": "im-a-cluster-name",
  "code": "TLR00I",
  "ei": 0,
  "event": "login_rule.create",
  "expires": "0001-01-01T00:00:00Z",
  "name": "test_rule",
  "time": "2023-01-25T19:21:36.144Z",
  "uid": "266e8563-729e-412f-ba26-1050fbec0cd6",
  "user": "nic"
}

```

## login\_rule.delete

Login Rule Deleted

Example:

```
{
  "cluster_name": "im-a-cluster-name",
  "code": "TLR01I",
  "ei": 0,
  "event": "login_rule.delete",
  "expires": "0001-01-01T00:00:00Z",
  "name": "test_rule",
  "time": "2023-01-25T19:21:36.144Z",
  "uid": "266e8563-729e-412f-ba26-1050fbec0cd6",
  "user": "nic"
}

```

## mfa.add

MFA Device Added

Example:

```
{
  "cluster_name": "localhost",
  "code": "T1006I",
  "mfa_device_name": "usb-c",
  "mfa_device_type": "U2F",
  "mfa_device_uuid": "7a6fbf23-d75c-4c62-8215-e962d0f2a1f3",
  "ei": 0,
  "event": "mfa.add",
  "time": "2021-03-03T22:58:34.737Z",
  "uid": "9be91d9e-79ec-422b-b6ae-ccf7235476d4",
  "user": "awly"
}

```

## mfa.delete

MFA Device Deleted

Example:

```
{
  "cluster_name": "localhost",
  "code": "T1007I",
  "mfa_device_name": "usb-c",
  "mfa_device_type": "U2F",
  "mfa_device_uuid": "7a6fbf23-d75c-4c62-8215-e962d0f2a1f3",
  "ei": 0,
  "event": "mfa.delete",
  "time": "2021-03-03T22:58:44.737Z",
  "uid": "c6afe861-d53c-42ce-837c-7920d2398b44",
  "user": "awly"
}

```

## mfa\_auth\_challenge.create

MFA Authentication Attempt

Example:

```
{
  "challenge_allow_reuse": false,
  "challenge_scope": "CHALLENGE_SCOPE_LOGIN",
  "cluster_name": "zarq",
  "code": "T1015I",
  "ei": 0,
  "event": "mfa_auth_challenge.create",
  "time": "2024-04-16T21:46:59.317Z",
  "uid": "815bbcf4-fb05-4e08-917c-7259e9332d69",
  "user": "llama",
  "user_kind": 1
}

```

## mfa\_auth\_challenge.validate

There are multiple events with the `mfa_auth_challenge.validate` type.

### T1016I

MFA Authentication Success

Example:

```
{
  "code": "T1016I",
  "event": "mfa_auth_challenge.validate",
  "time": "2020-06-05T16:24:05Z",
  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
}

```

### T1016W

MFA Authentication Failure

Example:

```
{
  "code": "T1016W",
  "event": "mfa_auth_challenge.validate",
  "time": "2020-06-05T16:24:05Z",
  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
}

```

## privilege\_token.create

Privilege Token Created

Example:

```
{
  "cluster_name": "im-a-cluster-name",
  "code": "T6002I",
  "ei": 0,
  "event": "privilege_token.create",
  "expires": "2021-11-01T22:29:47.989984Z",
  "name": "user@example.com",
  "time": "2021-11-01T22:24:47.99Z",
  "ttl": "5m0s",
  "uid": "6a9d5ac1-08c5-5c1e-9ebd-086d34155b08",
  "user": "user@example.com"
}

```

## recovery\_code.generated

Recovery Codes Generated

Example:

```
{
  "cluster_name": "im-a-cluster-name",
  "code": "T1008I",
  "ei": 0,
  "event": "recovery_code.generated",
  "time": "2021-08-05T21:16:17.13Z",
  "uid": "ed0f6962-e34d-5fa4-bd41-7961cf2c51bb",
  "user": "user@example.com"
}

```

## recovery\_code.used

There are multiple events with the `recovery_code.used` type.

### T1009I

Recovery Code Used

Example:

```
{
  "cluster_name": "im-a-cluster-name",
  "code": "T1009I",
  "ei": 0,
  "event": "recovery_code.used",
  "success": true,
  "time": "2021-08-05T21:22:46.042Z",
  "uid": "4bb44dfe-70dc-5820-8c65-0baf40f62d13",
  "user": "user@example.com"
}

```

### T1009W

Recovery Code Use Failed

Example:

```
{
  "cluster_name": "localhost",
  "code": "T1009W",
  "ei": 0,
  "error": "recovery code did not match",
  "event": "recovery_code.used",
  "message": "recovery code did not match",
  "success": false,
  "time": "2021-08-05T23:32:41.273Z",
  "uid": "714625ab-48d5-51d0-ab1f-c4b267881594",
  "user": "user@example.com"
}

```

## recovery\_token.create

Recovery Token Created

Example:

```
{
  "cluster_name": "im-a-cluster-name",
  "code": "T6001I",
  "ei": 0,
  "event": "recovery_token.create",
  "expires": "2021-08-05T21:56:14.935267Z",
  "name": "user@example.com",
  "time": "2021-08-05T21:41:14.935Z",
  "ttl": "15m0s",
  "uid": "29cd2ad5-f1cd-54d2-85fc-4910fbfc9bfa",
  "user": "user@example.com"
}

```

## reset\_password\_token.create

Reset Password Token Created

Example:

```
{
  "code": "T6000I",
  "name": "hello",
  "event": "reset_password_token.create",
  "time": "2020-06-05T16:24:22Z",
  "ttl": "8h0m0s",
  "uid": "85fef5df-6dca-475e-a049-393f4cf1d6a3",
  "user": "b331fb6c-85f9-4cb0-b308-3452420bf81e.one"
}

```

## user.create

User Created

Example:

```
{
  "code": "T1002I",
  "connector": "local",
  "name": "hello",
  "event": "user.create",
  "expires": "0001-01-01T00:00:00Z",
  "roles": [
    "admin"
  ],
  "time": "2020-06-05T16:24:05Z",
  "uid": "22a273678c-ee78-5ffc-a298-68a841555c98",
  "user": "b331fb6c-85f9-4cb0-b308-3452420bf81e.one"
}

```

## user.delete

User Deleted

Example:

```
{
  "code": "T1004I",
  "uid": "b121fc4c-e419-56a2-a760-19cd746c0650",
  "time": "2020-06-05T16:24:05Z",
  "event": "user.delete",
  "name": "bob",
  "user": "benarent"
}

```

## user.login

There are multiple events with the `user.login` type.

### T1000I

Local Login

Example:

```
{
  "code": "T1000I",
  "event": "user.login",
  "method": "local",
  "success": true,
  "time": "2019-04-22T00:49:03Z",
  "uid": "173d6b6e-d613-44be-8ff6-f9f893791ef2",
  "user": "admin@example.com"
}

```

### T1000W

Local Login Failed

Example:

```
{
  "code": "T1000W",
  "error": "user(name=\"fsdfsdf\") not found",
  "event": "user.login",
  "method": "local",
  "success": false,
  "time": "2019-04-22T18:06:32Z",
  "uid": "597bf08b-75b2-4dda-a578-e387c5ce9b76",
  "user": "fsdfsdf"
}

```

### T1010I

SSO Test Flow Login

Example:

```
{
  "attributes": {
    "amr": [
      "pwd"
    ],
    "at_hash": "7_foQ_0QRVU5dIq_B72_zw",
    "aud": "0oa17kaknnntGFKiJ0h8",
    "auth_time": 1653294514,
    "email": "ops@gravitational.io",
    "email_verified": true,
    "exp": 1653298115,
    "groups": [
      "Everyone",
      "okta-admin",
      "okta-dev"
    ],
    "iat": 1653294515,
    "idp": "00oafg105f5D4gv5Y0h7",
    "iss": "https://dev-813354.oktapreview.com",
    "jti": "ID.e_EKsCvMELMLa-Gx0aciOazUvPEFdZSxhTj42zccz3g",
    "sub": "00uafg106hK16pwqE0h7",
    "ver": 1
  },
  "cluster_name": "boson.tener.io",
  "code": "T1010I",
  "ei": 0,
  "event": "user.login",
  "method": "oidc",
  "success": true,
  "time": "2022-05-23T08:28:37.067Z",
  "uid": "7d440ee1-15f6-4b56-9391-344e8984fd97",
  "user": "ops@gravitational.io"
}

```

### T1011W

SSO Test Flow Login Failed

Example:

```
{
  "attributes": {
    "amr": [
      "pwd"
    ],
    "at_hash": "Xz4ibHjouHuIIBOSgWm07w",
    "aud": "0oa17kaknnntGFKiJ0h8",
    "auth_time": 1653294514,
    "email": "ops@gravitational.io",
    "email_verified": true,
    "exp": 1653298153,
    "groups": [
      "Everyone",
      "okta-admin",
      "okta-dev"
    ],
    "iat": 1653294553,
    "idp": "00oafg105f5D4gv5Y0h7",
    "iss": "https://dev-813354.oktapreview.com",
    "jti": "ID.h0qtjVPXttmNEHb-yHOvziD20Mru4qiw8L3i74se8YA",
    "sub": "00uafg106hK16pwqE0h7",
    "ver": 1
  },
  "cluster_name": "boson.tener.io",
  "code": "T1011W",
  "ei": 0,
  "error": "No roles mapped from claims. The mappings may contain typos.",
  "event": "user.login",
  "message": "Failed to calculate user attributes.\n\tNo roles mapped from claims. The mappings may contain typos.",
  "method": "oidc",
  "success": false,
  "time": "2022-05-23T08:29:14.126Z",
  "uid": "6fa08495-170a-4de9-884f-9931fbdb5982"
}

```

### T1012I

Headless Login Requested

Example:

```
{
  "addr.remote": "1.1.1.1:42",
  "code": "T1012I",
  "cluster_name": "root.cluster",
  "event": "user.login",
  "method": "headless",
  "ei": 0,
  "success": false,
  "time": "2019-04-22T00:49:03Z",
  "uid": "173d6b6e-d613-44be-8ff6-f9f893791ef4",
  "user": "admin@example.com"
}

```

### T1013I

Headless Login Approved

Example:

```
{
  "addr.remote": "2.2.2.2:42",
  "code": "T1013I",
  "cluster_name": "root.cluster",
  "event": "user.login",
  "method": "headless",
  "ei": 0,
  "success": true,
  "time": "2019-04-22T00:49:03Z",
  "uid": "173d6b6e-d613-44be-8ff6-f9f893791ef5",
  "user": "admin@example.com",
  "message": "Headless login was requested from the address 1.1.1.1:42"
}

```

### T1013W

Headless Login Failed

Example:

```
{
  "addr.remote": "2.2.2.2:42",
  "code": "T1013W",
  "error": "user(name=\"fsdfsdf\") not found",
  "cluster_name": "root.cluster",
  "event": "user.login",
  "method": "headless",
  "ei": 0,
  "success": false,
  "time": "2019-04-22T00:49:03Z",
  "uid": "173d6b6e-d613-44be-8ff6-f9f893791ef5",
  "user": "admin@example.com",
  "message": "Headless login was requested from the address 1.1.1.1:42"
}

```

### T1014W

Headless Login Rejected

Example:

```
{
  "addr.remote": "2.2.2.2:42",
  "code": "T1014W",
  "cluster_name": "root.cluster",
  "event": "user.login",
  "method": "headless",
  "ei": 0,
  "success": false,
  "time": "2019-04-22T00:49:03Z",
  "uid": "173d6b6e-d613-44be-8ff6-f9f893791ef6",
  "user": "admin@example.com",
  "message": "Headless login was requested from the address 1.1.1.1:42"
}

```

### T1001I

SSO Login

Example:

```
{
  "code": "T1001I",
  "event": "user.login",
  "time": "2020-06-05T16:24:05Z",
  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
}

```

### T1001W

SSO Login Failed

Example:

```
{
  "code": "T1001W",
  "event": "user.login",
  "time": "2020-06-05T16:24:05Z",
  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
}

```

## user.password\_change

User Password Updated

Example:

```
{
  "code": "T1005I",
  "event": "user.password_change",
  "time": "2020-06-05T19:26:53Z",
  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0",
  "user": "Ivan_Jordan"
}

```

## user.update

User Updated

Example:

```
{
  "code": "T1003I",
  "event": "user.update",
  "name": "bob",
  "time": "2020-06-05T16:24:05Z",
  "uid": "3a8cd55b5-bce9-5a4c-882d-8e0a5ae10008",
  "expires": 111111,
  "roles": [
    "root"
  ]
}

```

## user\_login.invalid\_access\_list

Access list skipped.

Example:

```
{
  "code": "TAL009W",
  "event": "user_login.invalid_access_list",
  "time": "2020-06-05T16:24:05Z",
  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
}

```