Audit Logs

Own Auth does not currently write events when sessions merely expire or when a rate limit rejects a request.

Each AuditEvent contains:

Use listAuditEvents. Results are returned as an array with the newest events first.

const events = await auth.listAuditEvents({
  actorUserId: currentUser.id,
});

Filter by API key:

const events = await auth.listAuditEvents({
  actorUserId: currentUser.id,
  apiKeyId,
});

Filters can be combined:

const events = await auth.listAuditEvents({
  userId,
  organisationId,
  apiKeyId,
  actorUserId: currentUser.id,
});

actorUserId is required. The available filters are userId, organisationId, and apiKeyId. A user filter matches events where that user is either the actor or the target. Without an organisation filter, users can read only their own events.

listAuditEvents does not currently support event-type filters, date ranges, limits, offsets, cursors, or total counts.

Response

const [event] = await auth.listAuditEvents({
  actorUserId: currentUser.id,
});

// event -> {
//   id: "evt_...",
//   eventType: "session.created",
//   actorUserId: "usr_...",
//   targetUserId: "usr_...",
//   organisationId: null,
//   apiKeyId: null,
//   ipAddress: "203.0.113.42",
//   userAgent: "Mozilla/5.0...",
//   metadata: { sessionId: "ses_..." },
//   createdAt: Date,
// }

Pass the signed-in user as the actor when loading organisation events:

const events = await auth.listAuditEvents({
  organisationId,
  actorUserId: currentUser.id,
});

Own Auth checks the actor's active membership and view_audit_events permission before returning organisation events.

Pass request context to auth methods when the audit trail should include an IP address and user agent:

await auth.signInEmailPassword({
  email,
  password,
  request: {
    ipAddress: req.ip,
    userAgent: req.headers["user-agent"],
  },
});

When request context is omitted, ipAddress and userAgent are stored as null.

Metadata depends on the event:

Audit events do not contain raw OAuth state, One Tap nonces, provider credentials, access or refresh tokens, session tokens, MFA challenge tokens, TOTP secrets, recovery codes, SMS codes, passkey responses, WebAuthn challenges, SAML responses, assertions, subjects, request IDs, relay state, certificates, signing keys, or raw SCIM bearer tokens. Plugin after-hooks receive secret-redacted results, and plugin audit metadata must also exclude secrets.

Audit events remain in own_auth_audit_events until they are removed. Own Auth does not delete them automatically.

Delete events older than a chosen cutoff:

const deleted = await auth.cleanupAuditLogs({
  olderThan: new Date("2025-01-01T00:00:00.000Z"),
});

cleanupAuditLogs permanently deletes every audit event created before olderThan and returns the number deleted.

Read the full Security Model to understand how the security features work together.