User Events

The User Event object

Standard
Hook failure
Retry failure

{
  "date": "2023-08-07T09:54:34.183123Z",
  "auth_type": "password",
  "id": "AWUTz0naD6KwGSiAAIMN",
  "type": "signup",
  "canal": "identity_first_party",
  "user_id": "550e8400-e29b-41d4-a716-446655440000",
  "profile_id": "121146661725694",
  "login_time": "2018-08-07T09:54:34.183123Z",
  "client_id": "sg48CdAYohRPeRWZ9j1H",
  "provider": "password",
  "variant": "example_variant",
  "device": "desktop",
  "origin": "www.example.fr/login",
  "ip": "127.0.0.1",
  "country": "France", (1)
  "city": "Asnières-sur-Seine", (1)
  "host": "https://example.io",
  "job_execution_id": "iKUTe3lBd1MwSSbAmUJp", (2)
  "job_type": "import", (2)
  "job_name": "Daily imports", (2)
  "login_as_profile_id" : "AWUTz0JBD6KwGSiAAIMH",
  "updated_keys" : [
    "birthdate",
    "birth_day",
    "birth_month",
    "birth_year",
    "age"
  ],
  "identifier_type": "email",
  "risk_score": 30,
  "scope": ["openid", "profile", "email"], (3)
  "user_agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Mobile/14G60"
}

1	Present on `login_matching_password` events when Risk-Based Authentication (RBA) is enabled and the user has enrolled a second factor.
2	Only present when the `canal` is `job`.
3	This field is only present for login-related events (`login`, `SuccessfulLogin`, and token refresh events). It allows auditing and debugging of the permissions granted at the time of authentication.

Webhook

{
  "date": "2023-05-07T09:54:34.183123Z",
  "auth_type": "password",
  "id": "AWUTz0..6KwGSiAAIMN",
  "type": "post_event_failure",
  "canal": "hook",
  "failed_hook_user_event_type": "signup",
  "failed_hook_key": "a_post_event_webhook",
  "failed_hook_error_code": "webhook_host_unreachable",
  "failed_hook_attempts": 3,
  "failed_hook_http_status": "404",
  "user_id": "550e8400-e29b-41d4-a716-446655440000",
  "profile_id": "121146661725694",
  "login_time": "2018-08-07T09:54:34.183123Z",
  "client_id": "sg48CdAYohRPeRWZ9j1H",
  "provider": "password",
  "device": "desktop",
  "origin": "www.example.fr/login",
  "ip": "127.0.0.1",
  "user_agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Mobile/14G60"
}

Pub/sub hook

{
  "date": "2024-01-07T09:54:34.183123Z",
  "id": "AWUTz0..6KwGSiAAIMN",
  "type": "pub_sub_event_failure",
  "canal": "hook",
  "failed_hook_project": "webhook_host_unreachable",
  "failed_hook_message_key": "NOT_FOUND",
  "failed_hook_key": "failing_event",
  "failed_hook_user_event_type": "login_matching_password",
  "failed_hook_message": "… NOT_FOUND: Resource not found (resource=blah1234).",
  "failed_hook_topic": "blah1234"
}

{
  "date": "2023-10-07T09:54:34.183123Z",
  "id": "AWUTz0..6KwGSiAAIMN",
  "user_id": "550e8400-e29b-41d4-a716-446655440000",
  "type": "email_failure",
  "canal": "message",
  "failed_message_error": "[temporarily_unavailable] [SMTP] Email sending failed: Sending the email to the following server failed : localhost:1025",
  "failed_message_provider": "smtp",
  "failed_message_template": "email_password_reset"
}

User Event Fields

Name Description

date

The date on which the event occurred.

scope

Array of strings representing the OAuth/OpenID scopes granted to the user during this login or token refresh.

This field is only present for login-related events (login, SuccessfulLogin, and token refresh events). It allows auditing and debugging of the permissions granted at the time of authentication.

{
...
 "scope": ["openid", "profile", "email"]
...
}

auth_type

The type of authentication used.

options

password
phone_number_password
magic_link
sms
external
refresh
login_as
third_party
webauthn

id

User event id.

type

User event type.

See User Event Types for more details.

canal

The channel through which the event was triggered.

Possible values

identity_first_party: triggered via First-party Identity client.
identity_third_party: triggered via Third-party Identity client.
legacy: triggered via Legacy client.
management: triggered via the Management client.
Root: triggered by the root of the Purse Identity Console. This is typically Purse Identity administrators.
Console: triggered through the Purse Identity Console.
ConsoleIdentity: triggered through the First-party Identity client via the Purse Identity Console.
automatic_suspension: triggered via the IFP module.
hook: triggered via a hook such as a webhook.
message: triggered via a message such as SMS or email.
job: triggered via a job such as import or export.

job_execution_id

The ID for when a specific job was executed.

This is not the ID of the job definition itself, but rather for the execution of a particular job.

job_type

Specifies the type of job such as import or export.

job_name

The name of the job. This is a friendly string such as "Nightly imports".

user_id

The Purse Identity User ID.

profile_id

Alias for user_id.

login_time

Alias for date.

client_id

Client id used.

provider

This is an alias for auth_type.

variant

The provider variant such as emea or staging.

See provider variants for more details.

device

The user’s device.

This is taken directly the HTTP request header. See here for more on the User-Agent request header (where the device field comes from).

origin

Free text parameter describing the source of the login (for reporting purposes only). You can influence this value by using a request parameter such as <url>?origin=<origin>.

This is taken directly the HTTP request header. See here for more on the Origin request header.

ip

User IP address.

If the event is type: profile_compromised, this is considered the attacking IP. For more, see Identity Fraud Protection.

country

The country resolved from the user IP address at login time.

This field is present in login_matching_password events when Risk-Based Authentication (RBA) is enabled and the user has enrolled a second factor.

city

The city resolved from the user IP address at login time.

This field is present in login_matching_password events when Risk-Based Authentication (RBA) is enabled and the user has enrolled a second factor.

user_agent

Web user agent.

This is taken directly the HTTP request header. See here for more on the User-Agent request header. You can influence the values in the user_agent by using your software library.

Format: User-Agent: <product> / <product-version> <comment>

where product could be your app name such as TheApp and comment could hold your domain such as fr.example.

Example: User-Agent: TheApp/2.1 (fr.TheApp; build:742; iOS 14.7.1) Alamofire/4.9.1

failed_message_error

Message containing information on why an attempt to send a message failed.

failed_message_provider

Message occuring for provider failures.

possible values

adobeCampaign
dialogInsight
smtp
customEmail
splio
oracleResponsys
twilio (SMS)
customSms (SMS)

failed_message_template

Indicates the failed email or SMS template.

Email templates

email_email_verification
email_signup
email_email_update
email_email_update_notification
email_password_reset
email_password_update
email_presignup (Signup invitation email)
email_account_suspension
email_passswordless_otp
email_mfa_otp
email_mfa_registration_otp
email_double-opt-in

SMS templates

sms_phone_verification
sms_signup
sms_phone_update
sms_password_reset
sms_password_update
sms_presignup
sms_account_suspension
sms_passswordless_otp
sms_mfa_otp
sms_mfa_registration_otp
sms_doi

failed_hook_key

The unique webhook key.

failed_hook_http_status

The http status that is returned.

This is not always returned.

failed_hook_error_code

The specific error code for the failure.

possible values

webhook_host_unreachable
webhook_invalid_response
server_error

failed_hook_user_event_type

The user event for which the webhook was triggered.

failed_hook_attempts

The number of retry attempts.

failed_hook_topic

The topic ID of the pub/sub hook that failed.

failed_hook_message_key

The error message key. For example, NOT_FOUND.

failed_hook_message

The error message for the failed hook. This describes why it failed. For example, the topic ID may have not been found for pub/sub hooks or there is a duplicated external ID.

example

...
    "failed_hook_message": "{\"detail\": \"Duplicated external id\", \"code\": \"711\"}"
...

failed_hook_project

The project name of the pub/sub hook that failed.

host

The URL used to trigger the event.

identifier_type

Specifies the type of identifier user.

possible values

email
phone_number
customer_identifier

login_as_profile_id

The name of the user who is logged in as another user, using Login as. This field is present on every event generated for the rest of the session, not only on the initial login event.

If through the Purse Identity Console, the name is taken from the email of the console user.
If through the POST /users/:id/login-as endpoint, the name is taken from the name query parameter.

updated_keys

An array of strings that lists the fields that were modified for the following event types.

signup
managed_user_created
user_created
user_updated
user_updated_by_merge

Passkey changes on an existing profile are listed as webauthn_credentials. When the user’s last passkey is deleted after they have authenticated with WebAuthn, user_updated also includes auth_types. Updates to a passkey’s last-used timestamp are not included.

risk_score

Integer showing the risk score between 0 and 100 using our secure risk algorithm. This field is only present if the Risk-based Authentication feature is enabled.

The current default risk_score threshold is 30. Anything above the configured risk score threshold is considered risky and triggers certain RBA actions like email and SMS notifications.

lockout_end_date

Specifies the date and time when a user lockout ends.

If the date is in the future, the user is locked out.
If the date is in the past, the lockout is over and the user is not locked out.
If the user has never been locked out, the field is empty.

entitlements

An array of strings denoting the access token entitlements that were added to a user profile.

For more on this topic, see Access control: Entitlements.

User Event Types

The table below describes the types of events that occur under the type parameter in the User Event object.

Name Description

login

Emitted after a successful authentication.

logout

Emitted after a user logs out.

signup

Emitted after a successful signup.

managed_user_created

Emitted after a new user is successfully created through the Management API.

unlink

Emitted after a successful unlink identity.

email_updated

Emitted after a successful email update.

phone_number_updated

Emitted after a successful phone number update.

password_reset_requested

Emitted after a successful password reset request.

If applicable, contains origin information.

password_changed

Emitted after a successful password change.

password_deleted

Emitted after a password is removed from a profile.

password_reset

Emitted after a successful password reset process.

profile_compromised

Emitted when the IFP module detects a compromised profile.

otp_sent

Emitted after a one-time password (otp) is successfully sent (via sms or email) for verification.

This includes otps for Two-factor authentication (2FA) flows.

login_not_matching_password

Emitted after an unsuccessful login attempt due to the password not matching.

login_matching_password

Emitted after a successful login via the /password/login call.

When Risk-Based Authentication (RBA) is enabled and the user has enrolled a second factor, this event can include country and city resolved from the login IP address.

user_updated

Emitted after a successful user update.

user_deleted

Emitted after a successful user deletion.

We retain the user_deleted event type for a certain period of time after a user profile is deleted.

user_updated_by_merge

Emitted after a successful merge (for the updated user).

Includes updated_keys for the fields that changed on the surviving profile.

user_deleted_by_merge

Emitted after a successful merge (for the deleted user).

email_verified

Emitted after a successful email verification.

phone_number_verified

Emitted after a successful mobile number verification.

user_created

Emitted after successfully creating a new Lite profile.

authorization_refused

Emitted after an unsuccessful authorization attempt.

authorization_deleted

Emitted after authorization was deleted.

authorization_granted

Emitted after authorization was successfully granted.

lite_merged_into_managed

Emitted after a lite profile was succesfully merged into a managed profile.

login_2nd_step

Emitted after the user has successfully logged in using the Two-factor authentication (2FA) flow.

leaked_credentials_usage

Emitted after a user uses credentials that are marked as leaked.

This applies to users signing up, logging in, or updating a password.

leaked_credentials_delete

Emitted when credentials have the "leaked" mark removed.

This means that the user no longer uses credentials known to be leaked.

ACCOUNT PROTECTION

user_suspended

Emitted after a successful user account suspension.

user_unsuspended

Emitted after a successful user account unsuspension.

login_successful_suspended_account

Emitted after an unsuccessful login attempt on a suspended account with the correct credentials.

login_unverified_identifier

Emitted when a user attempts to log in with an unverified identifier.

This event is only emitted if the Block unverified login attempts feature is enabled.

signup_compromised

Emitted when a user profile is created with a suspicious IP.

risky_login_notification

Emitted when a risky login notification was sent to the user.

risk_threshold_exceeded

Emitted when the risk_score threshold was exceeded.

WEBHOOK FAILURES

pre_event_failure

Emitted when a failure occurred in a pre-event webhook.

Currently, you can only set up PubSub hooks to trigger based on this event. It’s not possible on standard pre/post event webhooks.

post_event_failure

Emitted when a failure occurred in a post-event webhook.

Currently, you can only set up PubSub hooks to trigger based on this event. It’s not possible on standard pre/post event webhooks.

pub_sub_event_failure

Emitted when a failure occurred in a Pub/sub hook.

RETRY FAILURE EVENTS

email_failure

Emitted if there is an error while sending an email. Occurs after the provider responds with an error after the 3rd attempt.

sms_failure

Emitted if there is an error while sending an sms. Occurs after the provider responds with an error after the 3rd attempt.

USER LOCKOUT EVENTS

profile_lockout

Emitted each time a user profile is locked.

MFA EVENTS

mfa_phone_number_deleted

Emitted after an MFA credential (phone number) is deleted.

mfa_email_deleted

Emitted after an MFA credential (email) is deleted.

mfa_email_start_registration

Emitted after an email is used to start the MFA registration process.

mfa_email_verify_registration

Emitted after an email has been verified as an MFA credential.

mfa_phone_number_start_registration

Emitted after a phone number is used to start the MFA registration process.

mfa_phone_number_verify_registration

Emitted after a phone number has been verified as an MFA credential.

mfa_trusted_device_added

Emitted after a device has been added as a trusted device .

mfa_trusted_device_deleted

Emitted after a device has been removed as a trusted device .

CONSENT EVENTS

consent.granted

Emitted after a consent was successfully granted.

consent.waiting

Emitted after a DOI consent was moved to the waiting status. This means the consent is awaiting follow-up action from the user.

consent.denied

Emitted after a consent was officially rejected (denied).

PASSKEY EVENTS

webauthn_credential_created

Emitted after a passkey was successfully created.

When a passkey is added to an existing account, a user_updated event is also emitted with webauthn_credentials in updated_keys. Signing up with a passkey emits signup instead of user_updated.

webauthn_credential_deleted

Emitted after a passkey was successfully deleted.

A user_updated event is also emitted with webauthn_credentials in updated_keys. If this was the user’s last passkey and they had previously authenticated with WebAuthn, updated_keys also includes auth_types.

SESSION DEVICE EVENTS

session_device_added

Emitted after a session device was successfully created.

session_device_deleted

Emitted after a session device was successfully deleted.

session_device_updated

Emitted after a session device was successfully updated.

ACCOUNT SYNCHRONIZATION EVENTS

profile_created_from_synchronization

Emitted when a user profile is created on a target account.

profile_updated_from_synchronization

Emitted when a user profile is updated on a target account.

profile_deleted_from_synchronization

Emitted when a user profile is deleted on a target account.

account_synchronization_conflict

Emitted when the synchronization attempt failed due to a duplicate identifier (unverified across accounts).

Includes details such as:

Date
Synchronization ID
Source User ID
Type (account_synchronization_conflict)
Error
Error Message
Target user ID

Example

{
  "date": "2026-10-07T09:54:34.183123Z",
  "synchronization_id": "660e8400-e29b-41d4-a716-446655440000",
  "source_user_id": "550e8400-e29b-41d4-a716-446655440000",
  "type": "account_synchronization_conflict",
  "failed_sync_error": "error.Profile.timestampOutdated",
  "failed_sync_message": "Can't synchronize because the target profile has already updated since synchronization attempt",
  "target_user_id": ["250e8401-e29c-41d3-a726-146655440001"]
}

account_synchronization_error

Emitted when a technical error occurs during a synchronization attempt.

Includes details such as:

Date
Synchronization ID
Source User ID
Type (account_synchronization_error)
Error
Error Message
Target user ID

Example

{
  "date": "2026-10-07T09:54:34.183123Z",
  "synchronization_id": "660e8400-e29b-41d4-a716-446655440000",
  "source_user_id": "550e8400-e29b-41d4-a716-446655440000",
  "type": "account_synchronization_error",
  "failed_sync_error": "error.profile.identifiersNotVerified",
  "failed_sync_message": "Can't synchronize because the identifier of the `target` profile isn't verified", (1)
  "target_user_id": ["250e8401-e29c-41d3-a726-146655440001"]
}

1	`<target>` is used in this example, but it can be caused by either the target or source not being verified.

ACCESS CONTROL EVENTS

entitlements_provided

Emitted when entitlements are successfully generated and added to the user’s token.

GUEST EVENTS

login_invalid_identifier_format

Emitted after an unsuccessful login due to the identifier format.

login_unknown_identifier

Emitted after an unsuccessful login attempt due to an unknown identifier.

signup_invalid_email_format

Emitted after an unsuccessful signup attempt due to an invalid email format.

signup_not_compliant_password

Emitted after an unsuccessful signup attempt because the password was not compliant.

User Events

The User Event object

User Event Fields

User Event Types

Confirm Deletion