Filter Log Events

Filter Auth0 logs by event type to surface errors, warnings, and successful operations across your tenant for monitoring and incident response.

You can filter logs for errors, warnings, and success events in the Dashboard when you click the Filter down arrow.

Error event filters

Event Code	Filter	Description
limit_wc	Block Account	IP blocked for >10 failed attempts to login to single account
limit_mu	Blocked IP Address	IP blocked for >100 failed login attempts or >50 signup attempts
pwd_leak	Breached password	Attempted login with a leaked password
fdecc	Device Confirmation Canceled by User	User did not confirm device
gd_send_pn_failure	Error sending MFA Push Notification	Push notification for MFA failed
gd_send_sms_failure	Error sending MFA SMS	SMS for MFA failed
fce	Failed Change Email	Failed to change user email
fcp	Failed Change Password	Failed to change user password
fcpr	Failed Change Password Request	Change password request failed
fcpn	Failed Change Phone Number	Failed to change user phone number
fcu	Failed Change Username	Failed to change username
fcpro	Failed Connector Provisioning	Failed to provision a AD/LDAP connector
fd	Failed Delegation	Failed to generate delegation token
fecte	Failed Exchange	Token Exchange
fens	Failed Exchange	Native Social Login
feacft	Failed Exchange	Authorization Code for Access Token
feccft	Failed Exchange	Client Credentials for Access Token
fepft	Failed Exchange	Password for Access Token
fertft	Failed Exchange	Refresh Token for Access Token
feoobft	Failed Exchange	Password and OOB Challenge for Access Token
feotpft	Failed Exchange	Password and OTP Challenge for Access Token
fercft	Failed Exchange	Password and MFA Recovery code for Access Token
fede	Failed Exchange	Device Code for Access Token
f	Failed Login	User failed to login
fu	Failed Login (invalid email/username)	User failed to login due to invalid username
fp	Failed Login (wrong password)	User failed to login due to invalid password
flo	Failed Logout	User logout failed
oidc_backchannel_logout_failed	Failed OIDC Back-Channel Logout Request	Back-Channel Logout request failed
fcph	Failed Post Change Password Hook	Post-change password hook failed
fpurh	Failed Post User Registration Hook	Post user registration hook failed
fn	Failed Sending Notification	Failed to send email notification
fs	Failed Signup	Sign up failed
fsa	Failed Silent Auth	Silent authentication failed
fdu	Failed User Deletion	User deletion failed
fv	Failed Verification Email	Failed to send verification email
fvr	Failed Verification Email Request	Failed to process verification email request
fco	Failed CORS	Origin is not in the Allowed Origins list for the specified application
fcoa	Failed cross origin authentication	Cross-origin authentication failed
fdeac	Failed device activation	Failed to activate device
fdeaz	Failed device authorization request	Device authorization request failed
gd_start_enroll_failed	MFA Enrollment start failed	Multi-factor authentication enroll failed
gd_auth_failed	OTP Auth failed	One-time password authentication failed
gd_auth_rejected	OTP Auth rejected	One-time password authentication rejected
api_limit	Rate Limit on API	Maximum number of requests to the Authentication API in given time has been reached
gd_recovery_failed	Recovery failed	Multi-factor recovery code failed
limit_delegation	Too Many Calls to /delegation	Rate limit exceeded to /delegation endpoint

Warning event filters

Event Code	Filter	Description
depnote	Deprecation Notice	Feature is deprecated
gd_otp_rate_limit_exceed	Too many failures	Multi-factor OTP has failed too many times
fui	Users import	Failed to import users
w	Warning During Login	Warnings during login

Success event filters

Event Code	Filter	Description
sapi	API Operation	API operation completed successfully
mgmt_api_read	API Read Operation	API GET operation returning secrets completed successfully
ublkdu	Account unblocked	User block setup by anomaly detection has been released
cs	Code Sent	Passwordless login code has been sent
cls	Code/Link Sent	Passwordless login code/link has been sent
gd_start_enroll	Enrollment started	Multi-factor authentication enrollment has started
gd_enrollment_complete	MFA enrollment complete	Multi-factor authentication enrollment has completed
gd_tenant_update	MFA settings update	Multi-factor tenant settings updated
gd_auth_succeed	OTP Auth Succeed	One-time password authentication success
gd_send_pn	Push notification sent	Push notification for MFA successfully sent
gd_recovery_succeed	Recovery succeed	Multi-factor recovery code succeeded authorization
gd_send_sms	SMS Sent	SMS for MFA sent successfully
gd_send_email	Second factor email sent	Email for MFA successfully sent
gd_start_auth	Second factor started	Second factor authentication event started for MFA
sce	Success Change Email	Email changed successfully
scp	Success Change Password	Password changed successfully
scpr	Success Change Password Request	Change password request succeeded
scpn	Success Change Phone Number	Phone number changed successfully
scu	Success Change Username	Username changed successfully
sd	Success Delegation	Delegation token generated successfully
seacft	Success Exchange	Authorization Code for Access Token
seccft	Success Exchange	Client Credentials for Access Token
sepft	Success Exchange	Password for Access Token
sertft	Success Exchange	Refresh Token for Access Token
secte	Success Exchange	Token Exchange
sens	Success Exchange	Native Social Login
seoobft	Success Exchange	Password and OOB Challenge for Access Token
seotpft	Success Exchange	Password and OTP Challenge for Access Token
sercft	Success Exchange	Password and MFA Recovery code for Access Token
sede	Success Exchange	Device Code for Access Token
s	Success Login	Successful Login
slo	Success Logout	User successfully logged out
oidc_backchannel_logout_succeeded	Successful OIDC Back-Channel Logout request	OIDC Back-Channel Logout request completed successfully
ss	Success Signup	Successful signup
ssa	Success Silent Auth	Successful silent authentication
sv	Success Verification Email	Successful verification email
svr	Success Verification Email Request	Successful verification email request
scoa	Success cross origin authentication	Successful cross-origin authentication
sdu	Successful User Deletion	User successfully deleted
gd_unenroll	Unenroll device account	Device used for second factor authentication has been unenrolled
gd_update_device_account	Update device account	Device used for second factor authentication has been updated
sui	Users import	Successfully imported users

Learn more

• View Logs
• Retrieve Log Logs Using the Management API
• Log Type Codes
• Log Search Query Syntax
• Log Streams