Authentication Events

fido2.user.authenticated

User authenticated.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
username	string	Username used in the authentication context. A user may have multiple usernames (i.e. email, phone, etc.) associated with the same user identity.
userId	string	A unique user identifier as it known to the system (may be associated with multiple usernames and other PII).
orgId	string	Identifier of the organization associated with the event.

Optional Attributes

Attribute	Type	Description
srcAddr	string	Network address where request is originating from (IPv4 or IPv6).
responseTimeUsec	int	Request processing time in microseconds (used for tracking SLAs).
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).
deviceId	string	Identifier of the device associated with the event (can be used for extracting additional any device info from the system).
trustId	string	Trust identifier derived from public key of the corresponding web crypto record stored on client device.
passkeyId	string	An internal passkey identifier associated with the event (can be used for extracting additional any device info from the system).

---

fido2.user.authenticate.failed

Failed to authenticate user.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
orgId	string	Identifier of the organization associated with the event.
reason	string	Description of a failure reason.

Optional Attributes

Attribute	Type	Description
srcAddr	string	Network address where request is originating from (IPv4 or IPv6).
responseTimeUsec	int	Request processing time in microseconds (used for tracking SLAs).
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).
username	string	Username used in the authentication context. A user may have multiple usernames (i.e. email, phone, etc.) associated with the same user identity.
userId	string	A unique user identifier as it known to the system (may be associated with multiple usernames and other PII).
deviceId	string	Identifier of the device associated with the event (can be used for extracting additional any device info from the system).
trustId	string	Trust identifier derived from public key of the corresponding web crypto record stored on client device.

---

fido2.passkey.reg.init

Passkey registration initiated.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).
userAgent	string	Content of "User-agent" header from the request.
osName	string	OS type of the client device.
osVersion	string	OS version of the client device.
osArch	string	Hardware architecture of the client device.
clientName	string	Name of the client application (i.e. Chrome, Firefox, etc.)
clientVersion	string	Version of client application (often obfuscated by the device for privacy).
clientType	string	Type of the client application (usually "browser" or "app").
screenWidth	int	Screen widths of the client device.
screenHeight	int	Screen height of the client device.
conditionalGet	bool	ConditionalGet flag from webauth PublicKeyCredential.getClientCapabilities().
hybridTransport	bool	HybridTransport flag from webauth PublicKeyCredential.getClientCapabilities().
passkeyPlatformAuthenticator	bool	PasskeyPlatformAuthenticator flag from webauth PublicKeyCredential.getClientCapabilities().
userVerifyingPlatformAuthenticator	bool	UserVerifyingPlatformAuthenticator flag from webauth PublicKeyCredential.getClientCapabilities().
bluetoothAvailable	bool	BluetoothAvailable flag from webauth bluetooth.getAvailability().
responseTimeUsec	int	Request processing time in microseconds (used for tracking SLAs).
orgId	string	Identifier of the organization associated with the event.

Optional Attributes

Attribute	Type	Description
srcAddr	string	Network address where request is originating from (IPv4 or IPv6).
username	string	Username used in the authentication context. A user may have multiple usernames (i.e. email, phone, etc.) associated with the same user identity.
userId	string	A unique user identifier as it known to the system (may be associated with multiple usernames and other PII).
deviceId	string	Identifier of the device associated with the event (can be used for extracting additional any device info from the system).
trustId	string	Trust identifier derived from public key of the corresponding web crypto record stored on client device.

---

fido2.passkey.registered

Passkey registration completed.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).
responseTimeUsec	int	Request processing time in microseconds (used for tracking SLAs).
aaguid	string	AAGUID of the passkey authenticator from the client.
username	string	Username used in the authentication context. A user may have multiple usernames (i.e. email, phone, etc.) associated with the same user identity.
userId	string	A unique user identifier as it known to the system (may be associated with multiple usernames and other PII).
deviceId	string	Identifier of the device associated with the event (can be used for extracting additional any device info from the system).
passkeyId	string	An internal passkey identifier associated with the event (can be used for extracting additional any device info from the system).
orgId	string	Identifier of the organization associated with the event.

Optional Attributes

Attribute	Type	Description
srcAddr	string	Network address where request is originating from (IPv4 or IPv6).
trustId	string	Trust identifier derived from public key of the corresponding web crypto record stored on client device.
fido2ComplianceLevel	string	FIDO2 compliance level.

---

fido2.passkey.reg.aaguid.blocked

Failed to register passkey - AAGUID blacklisted.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).
responseTimeUsec	int	Request processing time in microseconds (used for tracking SLAs).
aaguid	string	AAGUID of the passkey authenticator from the client.
orgId	string	Identifier of the organization associated with the event.

Optional Attributes

Attribute	Type	Description
srcAddr	string	Network address where request is originating from (IPv4 or IPv6).
username	string	Username used in the authentication context. A user may have multiple usernames (i.e. email, phone, etc.) associated with the same user identity.
userId	string	A unique user identifier as it known to the system (may be associated with multiple usernames and other PII).
deviceId	string	Identifier of the device associated with the event (can be used for extracting additional any device info from the system).
trustId	string	Trust identifier derived from public key of the corresponding web crypto record stored on client device.

---

fido2.passkey.reg.failed

Failed to register passkey.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).
responseTimeUsec	int	Request processing time in microseconds (used for tracking SLAs).
reason	string	Description of a failure reason.
orgId	string	Identifier of the organization associated with the event.

Optional Attributes

Attribute	Type	Description
srcAddr	string	Network address where request is originating from (IPv4 or IPv6).
username	string	Username used in the authentication context. A user may have multiple usernames (i.e. email, phone, etc.) associated with the same user identity.
userId	string	A unique user identifier as it known to the system (may be associated with multiple usernames and other PII).
deviceId	string	Identifier of the device associated with the event (can be used for extracting additional any device info from the system).
trustId	string	Trust identifier derived from public key of the corresponding web crypto record stored on client device.
fido2ComplianceLevel	string	FIDO2 compliance level.
aaguid	string	AAGUID of the passkey authenticator from the client.

---

fido2.passkey.auth.init

Passkey authentication initiated.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).
responseTimeUsec	int	Request processing time in microseconds (used for tracking SLAs).
userAgent	string	Content of "User-agent" header from the request.
osName	string	OS type of the client device.
osVersion	string	OS version of the client device.
osArch	string	Hardware architecture of the client device.
clientName	string	Name of the client application (i.e. Chrome, Firefox, etc.)
clientVersion	string	Version of client application (often obfuscated by the device for privacy).
clientType	string	Type of the client application (usually "browser" or "app").
screenWidth	int	Screen widths of the client device.
screenHeight	int	Screen height of the client device.
conditionalGet	bool	ConditionalGet flag from webauth PublicKeyCredential.getClientCapabilities().
hybridTransport	bool	HybridTransport flag from webauth PublicKeyCredential.getClientCapabilities().
passkeyPlatformAuthenticator	bool	PasskeyPlatformAuthenticator flag from webauth PublicKeyCredential.getClientCapabilities().
userVerifyingPlatformAuthenticator	bool	UserVerifyingPlatformAuthenticator flag from webauth PublicKeyCredential.getClientCapabilities().
bluetoothAvailable	bool	BluetoothAvailable flag from webauth bluetooth.getAvailability().
orgId	string	Identifier of the organization associated with the event.

Optional Attributes

Attribute	Type	Description
srcAddr	string	Network address where request is originating from (IPv4 or IPv6).
username	string	Username used in the authentication context. A user may have multiple usernames (i.e. email, phone, etc.) associated with the same user identity.
userId	string	A unique user identifier as it known to the system (may be associated with multiple usernames and other PII).
deviceId	string	Identifier of the device associated with the event (can be used for extracting additional any device info from the system).
trustId	string	Trust identifier derived from public key of the corresponding web crypto record stored on client device.
payload	string	Transaction payload.

---

fido2.passkey.authenticated

Passkey authentication completed.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).
responseTimeUsec	int	Request processing time in microseconds (used for tracking SLAs).
aaguid	string	AAGUID of the passkey authenticator from the client.
username	string	Username used in the authentication context. A user may have multiple usernames (i.e. email, phone, etc.) associated with the same user identity.
userId	string	A unique user identifier as it known to the system (may be associated with multiple usernames and other PII).
deviceId	string	Identifier of the device associated with the event (can be used for extracting additional any device info from the system).
passkeyId	string	An internal passkey identifier associated with the event (can be used for extracting additional any device info from the system).
orgId	string	Identifier of the organization associated with the event.

Optional Attributes

Attribute	Type	Description
srcAddr	string	Network address where request is originating from (IPv4 or IPv6).
trustId	string	Trust identifier derived from public key of the corresponding web crypto record stored on client device.
fido2ComplianceLevel	string	FIDO2 compliance level.
payload	string	Transaction payload.

---

fido2.passkey.auth.aaguid.blocked

Failed to authenticate with passkey - AAGUID blacklisted.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).
responseTimeUsec	int	Request processing time in microseconds (used for tracking SLAs).
aaguid	string	AAGUID of the passkey authenticator from the client.
orgId	string	Identifier of the organization associated with the event.

Optional Attributes

Attribute	Type	Description
srcAddr	string	Network address where request is originating from (IPv4 or IPv6).
username	string	Username used in the authentication context. A user may have multiple usernames (i.e. email, phone, etc.) associated with the same user identity.
userId	string	A unique user identifier as it known to the system (may be associated with multiple usernames and other PII).
deviceId	string	Identifier of the device associated with the event (can be used for extracting additional any device info from the system).
trustId	string	Trust identifier derived from public key of the corresponding web crypto record stored on client device.

---

fido2.passkey.auth.failed

Failed to authenticate with passkey.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).
responseTimeUsec	int	Request processing time in microseconds (used for tracking SLAs).
reason	string	Description of a failure reason.
orgId	string	Identifier of the organization associated with the event.

Optional Attributes

Attribute	Type	Description
srcAddr	string	Network address where request is originating from (IPv4 or IPv6).
deviceId	string	Identifier of the device associated with the event (can be used for extracting additional any device info from the system).
username	string	Username used in the authentication context. A user may have multiple usernames (i.e. email, phone, etc.) associated with the same user identity.
userId	string	A unique user identifier as it known to the system (may be associated with multiple usernames and other PII).
trustId	string	Trust identifier derived from public key of the corresponding web crypto record stored on client device.
fido2ComplianceLevel	string	FIDO2 compliance level.
aaguid	string	AAGUID of the passkey authenticator from the client.
payload	string	Transaction payload.

---

fido2.passkey.tx.init

Passkey transaction initiated.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).
responseTimeUsec	int	Request processing time in microseconds (used for tracking SLAs).
payload	string	Transaction payload.
orgId	string	Identifier of the organization associated with the event.
userAgent	string	Content of "User-agent" header from the request.
osName	string	OS type of the client device.
osVersion	string	OS version of the client device.
osArch	string	Hardware architecture of the client device.
clientName	string	Name of the client application (i.e. Chrome, Firefox, etc.)
clientVersion	string	Version of client application (often obfuscated by the device for privacy).
clientType	string	Type of the client application (usually "browser" or "app").
screenWidth	int	Screen widths of the client device.
screenHeight	int	Screen height of the client device.
conditionalGet	bool	ConditionalGet flag from webauth PublicKeyCredential.getClientCapabilities().
hybridTransport	bool	HybridTransport flag from webauth PublicKeyCredential.getClientCapabilities().
passkeyPlatformAuthenticator	bool	PasskeyPlatformAuthenticator flag from webauth PublicKeyCredential.getClientCapabilities().
userVerifyingPlatformAuthenticator	bool	UserVerifyingPlatformAuthenticator flag from webauth PublicKeyCredential.getClientCapabilities().
bluetoothAvailable	bool	BluetoothAvailable flag from webauth bluetooth.getAvailability().

Optional Attributes

Attribute	Type	Description
srcAddr	string	Network address where request is originating from (IPv4 or IPv6).
deviceId	string	Identifier of the device associated with the event (can be used for extracting additional any device info from the system).
username	string	Username used in the authentication context. A user may have multiple usernames (i.e. email, phone, etc.) associated with the same user identity.
userId	string	A unique user identifier as it known to the system (may be associated with multiple usernames and other PII).
trustId	string	Trust identifier derived from public key of the corresponding web crypto record stored on client device.

---

fido2.passkey.tx.completed

Passkey transaction completed.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).
responseTimeUsec	int	Request processing time in microseconds (used for tracking SLAs).
aaguid	string	AAGUID of the passkey authenticator from the client.
payload	string	Transaction ID.
passkeyId	string	An internal passkey identifier associated with the event (can be used for extracting additional any device info from the system).
deviceId	string	Identifier of the device associated with the event (can be used for extracting additional any device info from the system).
username	string	Username used in the authentication context. A user may have multiple usernames (i.e. email, phone, etc.) associated with the same user identity.
userId	string	A unique user identifier as it known to the system (may be associated with multiple usernames and other PII).
orgId	string	Identifier of the organization associated with the event.

Optional Attributes

Attribute	Type	Description
srcAddr	string	Network address where request is originating from (IPv4 or IPv6).
trustId	string	Trust identifier derived from public key of the corresponding web crypto record stored on client device.

---

fido2.passkey.tx.aaguid.blocked

Failed to sign transaction with passkey - AAGUID blacklisted.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).
responseTimeUsec	int	Request processing time in microseconds (used for tracking SLAs).
aaguid	string	AAGUID of the passkey authenticator from the client.
orgId	string	Identifier of the organization associated with the event.

Optional Attributes

Attribute	Type	Description
srcAddr	string	Network address where request is originating from (IPv4 or IPv6).
deviceId	string	Identifier of the device associated with the event (can be used for extracting additional any device info from the system).
username	string	Username used in the authentication context. A user may have multiple usernames (i.e. email, phone, etc.) associated with the same user identity.
userId	string	A unique user identifier as it known to the system (may be associated with multiple usernames and other PII).
trustId	string	Trust identifier derived from public key of the corresponding web crypto record stored on client device.

---

fido2.passkey.tx.failed

Failed to sign transaction with passkey.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).
responseTimeUsec	int	Request processing time in microseconds (used for tracking SLAs).
reason	string	Description of a failure reason.
orgId	string	Identifier of the organization associated with the event.
payload	string	Transaction payload.

Optional Attributes

Attribute	Type	Description
srcAddr	string	Network address where request is originating from (IPv4 or IPv6).
deviceId	string	Identifier of the device associated with the event (can be used for extracting additional any device info from the system).
username	string	Username used in the authentication context. A user may have multiple usernames (i.e. email, phone, etc.) associated with the same user identity.
userId	string	A unique user identifier as it known to the system (may be associated with multiple usernames and other PII).
trustId	string	Trust identifier derived from public key of the corresponding web crypto record stored on client device.
aaguid	string	AAGUID of the passkey authenticator from the client.

---

fido2.mgmt.discovery.init

Passkey discovery initiated.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).
userAgent	string	Content of "User-agent" header from the request.
osName	string	OS type of the client device.
osVersion	string	OS version of the client device.
osArch	string	Hardware architecture of the client device.
clientName	string	Name of the client application (i.e. Chrome, Firefox, etc.)
clientVersion	string	Version of client application (often obfuscated by the device for privacy).
clientType	string	Type of the client application (usually "browser" or "app").
screenWidth	int	Screen widths of the client device.
screenHeight	int	Screen height of the client device.
conditionalGet	bool	ConditionalGet flag from webauth PublicKeyCredential.getClientCapabilities().
hybridTransport	bool	HybridTransport flag from webauth PublicKeyCredential.getClientCapabilities().
passkeyPlatformAuthenticator	bool	PasskeyPlatformAuthenticator flag from webauth PublicKeyCredential.getClientCapabilities().
userVerifyingPlatformAuthenticator	bool	UserVerifyingPlatformAuthenticator flag from webauth PublicKeyCredential.getClientCapabilities().
bluetoothAvailable	bool	BluetoothAvailable flag from webauth bluetooth.getAvailability().
username	string	Username used in the authentication context. A user may have multiple usernames (i.e. email, phone, etc.) associated with the same user identity.
action	string	Next action to be performed in the current workflow.
orgId	string	Identifier of the organization associated with the event.

Optional Attributes

Attribute	Type	Description
srcAddr	string	Network address where request is originating from (IPv4 or IPv6).
deviceId	string	Identifier of the device associated with the event (can be used for extracting additional any device info from the system).

---

fido2.mgmt.discovery.completed

Passkey discovery completed.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).
responseTimeUsec	int	Request processing time in microseconds (used for tracking SLAs).
username	string	Username used in the authentication context. A user may have multiple usernames (i.e. email, phone, etc.) associated with the same user identity.
action	string	Next action to be performed in the current workflow.
orgId	string	Identifier of the organization associated with the event.

Optional Attributes

Attribute	Type	Description
srcAddr	string	Network address where request is originating from (IPv4 or IPv6).
deviceId	string	Identifier of the device associated with the event (can be used for extracting additional any device info from the system).
userId	string	A unique user identifier as it known to the system (may be associated with multiple usernames and other PII).

---

fido2.mgmt.discovery.failed

Passkey discovery failed.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).
responseTimeUsec	int	Request processing time in microseconds (used for tracking SLAs).
username	string	Username used in the authentication context. A user may have multiple usernames (i.e. email, phone, etc.) associated with the same user identity.
reason	string	Description of a failure reason.
orgId	string	Identifier of the organization associated with the event.

Optional Attributes

Attribute	Type	Description
srcAddr	string	Network address where request is originating from (IPv4 or IPv6).
deviceId	string	Identifier of the device associated with the event (can be used for extracting additional any device info from the system).
userId	string	A unique user identifier as it known to the system (may be associated with multiple usernames and other PII).

---

fido2.mfa.begin.init

MFA begin initiated.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).
userAgent	string	Content of "User-agent" header from the request.
osName	string	OS type of the client device.
osVersion	string	OS version of the client device.
osArch	string	Hardware architecture of the client device.
clientName	string	Name of the client application (i.e. Chrome, Firefox, etc.)
clientVersion	string	Version of client application (often obfuscated by the device for privacy).
clientType	string	Type of the client application (usually "browser" or "app").
screenWidth	int	Screen widths of the client device.
screenHeight	int	Screen height of the client device.
conditionalGet	bool	ConditionalGet flag from webauth PublicKeyCredential.getClientCapabilities().
hybridTransport	bool	HybridTransport flag from webauth PublicKeyCredential.getClientCapabilities().
passkeyPlatformAuthenticator	bool	PasskeyPlatformAuthenticator flag from webauth PublicKeyCredential.getClientCapabilities().
userVerifyingPlatformAuthenticator	bool	UserVerifyingPlatformAuthenticator flag from webauth PublicKeyCredential.getClientCapabilities().
bluetoothAvailable	bool	BluetoothAvailable flag from webauth bluetooth.getAvailability().
orgId	string	Identifier of the organization associated with the event.

Optional Attributes

Attribute	Type	Description
srcAddr	string	Network address where request is originating from (IPv4 or IPv6).
payload	string	Transaction payload.
username	string	Username used in the authentication context. A user may have multiple usernames (i.e. email, phone, etc.) associated with the same user identity.
deviceId	string	Identifier of the device associated with the event (can be used for extracting additional any device info from the system).
trustId	string	Trust identifier derived from public key of the corresponding web crypto record stored on client device.
checkoutId	string	Similar to trust ID but in the merchant context.

---

fido2.mfa.begin.completed

MFA begin completed.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).
responseTimeUsec	int	Request processing time in microseconds (used for tracking SLAs).
username	string	Username used in the authentication context. A user may have multiple usernames (i.e. email, phone, etc.) associated with the same user identity.
userId	string	A unique user identifier as it known to the system (may be associated with multiple usernames and other PII).
action	string	Next action to be performed in the current workflow.
orgId	string	Identifier of the organization associated with the event.

Optional Attributes

Attribute	Type	Description
srcAddr	string	Network address where request is originating from (IPv4 or IPv6).
payload	string	Transaction payload.
deviceId	string	Identifier of the device associated with the event (can be used for extracting additional any device info from the system).
trustId	string	Trust identifier derived from public key of the corresponding web crypto record stored on client device.
checkoutId	string	Similar to trust ID but in the merchant context.

---

fido2.mfa.begin.failed

MFA begin failed.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).
responseTimeUsec	int	Request processing time in microseconds (used for tracking SLAs).
reason	string	Description of a failure reason.
action	string	Next action to be performed in the current workflow.
orgId	string	Identifier of the organization associated with the event.

Optional Attributes

Attribute	Type	Description
srcAddr	string	Network address where request is originating from (IPv4 or IPv6).
payload	string	Transaction payload.
deviceId	string	Identifier of the device associated with the event (can be used for extracting additional any device info from the system).
trustId	string	Trust identifier derived from public key of the corresponding web crypto record stored on client device.
checkoutId	string	Similar to trust ID but in the merchant context.
username	string	Username used in the authentication context. A user may have multiple usernames (i.e. email, phone, etc.) associated with the same user identity.
userId	string	A unique user identifier as it known to the system (may be associated with multiple usernames and other PII).

---

fido2.mfa.passkey.aaguid.blocked

Passkey AAGUID blacklisted.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).
responseTimeUsec	int	Request processing time in microseconds (used for tracking SLAs).
aaguid	string	AAGUID of the passkey authenticator from the client.
action	string	Next action to be performed in the current workflow.
orgId	string	Identifier of the organization associated with the event.

Optional Attributes

Attribute	Type	Description
srcAddr	string	Network address where request is originating from (IPv4 or IPv6).
username	string	Username used in the authentication context. A user may have multiple usernames (i.e. email, phone, etc.) associated with the same user identity.
userId	string	A unique user identifier as it known to the system (may be associated with multiple usernames and other PII).
deviceId	string	Identifier of the device associated with the event (can be used for extracting additional any device info from the system).
trustId	string	Trust identifier derived from public key of the corresponding web crypto record stored on client device.

---

fido2.mfa.passkey.reg.failed

Failed to register passkey.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).
responseTimeUsec	int	Request processing time in microseconds (used for tracking SLAs).
reason	string	Description of a failure reason.
action	string	Next action to be performed in the current workflow.
orgId	string	Identifier of the organization associated with the event.

Optional Attributes

Attribute	Type	Description
srcAddr	string	Network address where request is originating from (IPv4 or IPv6).
username	string	Username used in the authentication context. A user may have multiple usernames (i.e. email, phone, etc.) associated with the same user identity.
userId	string	A unique user identifier as it known to the system (may be associated with multiple usernames and other PII).
deviceId	string	Identifier of the device associated with the event (can be used for extracting additional any device info from the system).
trustId	string	Trust identifier derived from public key of the corresponding web crypto record stored on client device.
aaguid	string	AAGUID of the passkey authenticator from the client.

---

fido2.mfa.passkey.registered

Passkey registration completed.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).
responseTimeUsec	int	Request processing time in microseconds (used for tracking SLAs).
aaguid	string	AAGUID of the passkey authenticator from the client.
username	string	Username used in the authentication context. A user may have multiple usernames (i.e. email, phone, etc.) associated with the same user identity.
userId	string	A unique user identifier as it known to the system (may be associated with multiple usernames and other PII).
deviceId	string	Identifier of the device associated with the event (can be used for extracting additional any device info from the system).
passkeyId	string	An internal passkey identifier associated with the event (can be used for extracting additional any device info from the system).
action	string	Next action to be performed in the current workflow.
orgId	string	Identifier of the organization associated with the event.

Optional Attributes

Attribute	Type	Description
srcAddr	string	Network address where request is originating from (IPv4 or IPv6).
trustId	string	Trust identifier derived from public key of the corresponding web crypto record stored on client device.
subType	string	Subtype of the event.

---

fido2.mfa.passkey.auth.failed

Failed to authenticate with passkey.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).
responseTimeUsec	int	Request processing time in microseconds (used for tracking SLAs).
reason	string	Description of a failure reason.
action	string	Next action to be performed in the current workflow.
orgId	string	Identifier of the organization associated with the event.

Optional Attributes

Attribute	Type	Description
srcAddr	string	Network address where request is originating from (IPv4 or IPv6).
deviceId	string	Identifier of the device associated with the event (can be used for extracting additional any device info from the system).
username	string	Username used in the authentication context. A user may have multiple usernames (i.e. email, phone, etc.) associated with the same user identity.
userId	string	A unique user identifier as it known to the system (may be associated with multiple usernames and other PII).
trustId	string	Trust identifier derived from public key of the corresponding web crypto record stored on client device.
aaguid	string	AAGUID of the passkey authenticator from the client.

---

fido2.mfa.passkey.authenticated

Passkey authentication completed.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).
responseTimeUsec	int	Request processing time in microseconds (used for tracking SLAs).
aaguid	string	AAGUID of the passkey authenticator from the client.
username	string	Username used in the authentication context. A user may have multiple usernames (i.e. email, phone, etc.) associated with the same user identity.
userId	string	A unique user identifier as it known to the system (may be associated with multiple usernames and other PII).
deviceId	string	Identifier of the device associated with the event (can be used for extracting additional any device info from the system).
passkeyId	string	An internal passkey identifier associated with the event (can be used for extracting additional any device info from the system).
action	string	Next action to be performed in the current workflow.
orgId	string	Identifier of the organization associated with the event.

Optional Attributes

Attribute	Type	Description
srcAddr	string	Network address where request is originating from (IPv4 or IPv6).
trustId	string	Trust identifier derived from public key of the corresponding web crypto record stored on client device.
subType	string	Subtype of the event.

---

fido2.mfa.passkey.tx.failed

Failed to sign transaction with passkey.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).
responseTimeUsec	int	Request processing time in microseconds (used for tracking SLAs).
reason	string	Description of a failure reason.
action	string	Next action to be performed in the current workflow.
orgId	string	Identifier of the organization associated with the event.

Optional Attributes

Attribute	Type	Description
srcAddr	string	Network address where request is originating from (IPv4 or IPv6).
deviceId	string	Identifier of the device associated with the event (can be used for extracting additional any device info from the system).
username	string	Username used in the authentication context. A user may have multiple usernames (i.e. email, phone, etc.) associated with the same user identity.
userId	string	A unique user identifier as it known to the system (may be associated with multiple usernames and other PII).
trustId	string	Trust identifier derived from public key of the corresponding web crypto record stored on client device.
aaguid	string	AAGUID of the passkey authenticator from the client.

---

fido2.mfa.passkey.tx.completed

Passkey transaction completed.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).
responseTimeUsec	int	Request processing time in microseconds (used for tracking SLAs).
aaguid	string	AAGUID of the passkey authenticator from the client.
payload	string	Transaction payload.
passkeyId	string	An internal passkey identifier associated with the event (can be used for extracting additional any device info from the system).
deviceId	string	Identifier of the device associated with the event (can be used for extracting additional any device info from the system).
username	string	Username used in the authentication context. A user may have multiple usernames (i.e. email, phone, etc.) associated with the same user identity.
userId	string	A unique user identifier as it known to the system (may be associated with multiple usernames and other PII).
action	string	Next action to be performed in the current workflow.
orgId	string	Identifier of the organization associated with the event.

Optional Attributes

Attribute	Type	Description
srcAddr	string	Network address where request is originating from (IPv4 or IPv6).
trustId	string	Trust identifier derived from public key of the corresponding web crypto record stored on client device.
subType	string	Subtype of the event.

---

fido2.mfa.external.auth.completed

External authentication completed.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).
responseTimeUsec	int	Request processing time in microseconds (used for tracking SLAs).
action	string	Next action to be performed in the current workflow.
orgId	string	Identifier of the organization associated with the event.

Optional Attributes

Attribute	Type	Description
srcAddr	string	Network address where request is originating from (IPv4 or IPv6).

---

fido2.mfa.external.auth.failed

External authentication failed.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).
responseTimeUsec	int	Request processing time in microseconds (used for tracking SLAs).
reason	string	Description of a failure reason.
action	string	Next action to be performed in the current workflow.
orgId	string	Identifier of the organization associated with the event.

Optional Attributes

Attribute	Type	Description
srcAddr	string	Network address where request is originating from (IPv4 or IPv6).

---

fido2.mfa.passkey.nocapability

Passkey capability not supported.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).
responseTimeUsec	int	Request processing time in microseconds (used for tracking SLAs).
reason	string	Description of a failure reason.
action	string	Next action to be performed in the current workflow.
orgId	string	Identifier of the organization associated with the event.

Optional Attributes

Attribute	Type	Description
srcAddr	string	Network address where request is originating from (IPv4 or IPv6).

---

fido2.passkey.deleted

Passkey deleted.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
username	string	Username used in the authentication context. A user may have multiple usernames (i.e. email, phone, etc.) associated with the same user identity.
userId	string	A unique user identifier as it known to the system (may be associated with multiple usernames and other PII).
passkeyId	string	An internal passkey identifier associated with the event (can be used for extracting additional any device info from the system).
orgId	string	Identifier of the organization associated with the event.

Optional Attributes

Attribute	Type	Description
srcAddr	string	Network address where request is originating from (IPv4 or IPv6).

---

fido2.passkey.delete.failed

Failed to delete passkey.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
username	string	Username used in the authentication context. A user may have multiple usernames (i.e. email, phone, etc.) associated with the same user identity.
passkeyId	string	An internal passkey identifier associated with the event (can be used for extracting additional any device info from the system).
reason	string	Description of a failure reason.
orgId	string	Identifier of the organization associated with the event.

Optional Attributes

Attribute	Type	Description
srcAddr	string	Network address where request is originating from (IPv4 or IPv6).
userId	string	A unique user identifier as it known to the system (may be associated with multiple usernames and other PII).

---

fido2.client.error

Client error.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
reason	string	Description of a failure reason.

Optional Attributes

Attribute	Type	Description
srcAddr	string	Network address where request is originating from (IPv4 or IPv6).
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).
userId	string	A unique user identifier as it known to the system (may be associated with multiple usernames and other PII).
username	string	Username used in the authentication context. A user may have multiple usernames (i.e. email, phone, etc.) associated with the same user identity.
passkeyId	string	An internal passkey identifier associated with the event (can be used for extracting additional any device info from the system).
deviceId	string	Identifier of the device associated with the event (can be used for extracting additional any device info from the system).
subType	string	Subtype of the event.
orgId	string	Identifier of the organization associated with the event.

---

fido2.webhook.created

Webhook created.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
orgId	string	Identifier of the organization associated with the event.
userId	string	A unique user identifier as it known to the system (may be associated with multiple usernames and other PII).
webhookUrl	string	The destination URL of the webhook.

Optional Attributes

Attribute	Type	Description
username	string	Username used in the authentication context. A user may have multiple usernames (i.e. email, phone, etc.) associated with the same user identity.
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).

---

fido2.webhook.create.failed

Failed to create webhook.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
orgId	string	Identifier of the organization associated with the event.
userId	string	A unique user identifier as it known to the system (may be associated with multiple usernames and other PII).
webhookUrl	string	The destination URL of the webhook.
reason	string	Description of a failure reason.

Optional Attributes

Attribute	Type	Description
username	string	Username used in the authentication context. A user may have multiple usernames (i.e. email, phone, etc.) associated with the same user identity.
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).

---

fido2.webhook.deleted

Webhook deleted.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
orgId	string	Identifier of the organization associated with the event.
userId	string	A unique user identifier as it known to the system (may be associated with multiple usernames and other PII).

Optional Attributes

Attribute	Type	Description
username	string	Username used in the authentication context. A user may have multiple usernames (i.e. email, phone, etc.) associated with the same user identity.
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).
webhookUrl	string	The destination URL of the webhook.

---

fido2.webhook.delete.failed

Failed to delete webhook.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
orgId	string	Identifier of the organization associated with the event.
userId	string	A unique user identifier as it known to the system (may be associated with multiple usernames and other PII).
reason	string	Description of a failure reason.

Optional Attributes

Attribute	Type	Description
username	string	Username used in the authentication context. A user may have multiple usernames (i.e. email, phone, etc.) associated with the same user identity.
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).
webhookUrl	string	The destination URL of the webhook.

---

fido2.webhook.complete

Webhook request completed.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
orgId	string	Identifier of the organization associated with the event.
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).
userId	string	A unique user identifier as it known to the system (may be associated with multiple usernames and other PII).
webhookUrl	string	The destination URL of the webhook.
responseTimeUsec	int	Request processing time in microseconds (used for tracking SLAs).
webhookStatusCode	int	HTTP status code returned by the webhook endpoint.
webhookEventType	string	Type of event that triggered the webhook (e.g., user.authenticated, passkey.registered).

Optional Attributes

Attribute	Type	Description
username	string	Username used in the authentication context. A user may have multiple usernames (i.e. email, phone, etc.) associated with the same user identity.
webhookIdentityProvider	string	Identity provider associated with the webhook request, when applicable (e.g. Prove, Mitek, Clear, etc.).

---

fido2.webhook.failed

Webhook request failed.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
orgId	string	Identifier of the organization associated with the event.
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).
userId	string	A unique user identifier as it known to the system (may be associated with multiple usernames and other PII).
webhookUrl	string	The destination URL of the webhook.
responseTimeUsec	int	Request processing time in microseconds (used for tracking SLAs).
webhookStatusCode	int	HTTP status code returned by the webhook endpoint.
webhookEventType	string	Type of event that triggered the webhook (e.g., user.authenticated, passkey.registered).
reason	string	Description of a failure reason.

Optional Attributes

Attribute	Type	Description
username	string	Username used in the authentication context. A user may have multiple usernames (i.e. email, phone, etc.) associated with the same user identity.
webhookIdentityProvider	string	Identity provider associated with the webhook request, when applicable (e.g. Prove, Mitek, Clear, etc.).

---

fido2.apiKey.created

API key created.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
orgId	string	Identifier of the organization associated with the event.
keyId	string	Identifier of the API key associated with the event.

Optional Attributes

Attribute	Type	Description
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).

---

fido2.apiKey.create.failed

Failed to create API key.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
orgId	string	Identifier of the organization associated with the event.
reason	string	Description of a failure reason.

Optional Attributes

Attribute	Type	Description
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).

---

fido2.apiKey.deleted

API key deleted.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
orgId	string	Identifier of the organization associated with the event.
keyId	string	Identifier of the API key associated with the event.

Optional Attributes

Attribute	Type	Description
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).

---

fido2.apiKey.delete.failed

Failed to delete API key.

Mandatory Attributes

Attribute	Type	Description
appId	string	Identifier of the application associated with the event.
orgId	string	Identifier of the organization associated with the event.
keyId	string	Identifier of the API key associated with the event.
reason	string	Description of a failure reason.

Optional Attributes

Attribute	Type	Description
traceId	string	Any trace identifier included with the request (can used for tracing events across multiple systems).