Okta Access
| eventType | Description | Sample | Rule |
|---|---|---|---|
| access. | Access request canceled. | N | N |
| access. | Access request condition activated. | N | N |
| access. | Access request condition created. | N | N |
| access. | Access request condition deactivated. | N | N |
| access. | Access request condition deleted. | N | N |
| access. | Access request condition invalidated. | N | N |
| access. | Access request condition updated. | Y | N |
| access. | Access request created. | Y | N |
| access. | Access request expired. | Y | N |
| access. | Access request rejected. | N | N |
| access. | Access request resolved. | Y | N |
| access. | Access request sequence created. | N | N |
| access. | Access request sequence deleted. | N | N |
| access. | Access request sequence updated. | N | N |
| access. | Access request settings updated. | N | N |
| access. | Access request updated. | Y | N |
| access. | Record a reviewer's decision on an access review item. | N | N |
| access. | Close a security access review. | N | N |
| access. | Create a Security access review. | N | N |
| access. | Fulfill an security access review action. | N | N |
| access. | Complete the data gathering for a security access review. | N | N |
| access. | Update a security access review. | N | N |
access.request.cancel
#Description
Access request canceled. Can be used to audit access to an Okta resource or to trigger downstream automation that depends on request cancellation. Okta Identity Governance API can be used to get more details about the canceled request.
References #
access.request.condition.activate
#Description
Access request condition activated. Can be used to audit access request condition to an Okta resource or to trigger downstream automation that depends on access request condition activation. Okta Identity Governance API can be used to get more details about the activated access request condition.
References #
access.request.condition.create
#Description
Access request condition created. Can be used to audit access request condition to an Okta resource or to trigger downstream automation that depends on access request condition creation. Okta Identity Governance API can be used to get more details about the created access request condition.
References #
access.request.condition.deactivate
#Description
Access request condition deactivated. Can be used to audit access request condition to an Okta resource or to trigger downstream automation that depends on access request condition deactivation. Okta Identity Governance API can be used to get more details about the deactivated access request condition.
References #
access.request.condition.delete
#Description
Access request condition deleted. Can be used to audit access request condition to an Okta resource or to trigger downstream automation that depends on access request condition deletion. Okta Identity Governance API can be used to get more details about the deleted access request condition.
References #
access.request.condition.invalidate
#Description
Access request condition invalidated. Can be used to audit access request condition to an Okta resource or to trigger downstream automation that depends on access request condition invalidation. Okta Identity Governance API can be used to get more details about the invalidated access request condition.
References #
access.request.condition.update
#Description
Access request condition updated. Can be used to audit access request condition to an Okta resource or to trigger downstream automation that depends on access request condition update. Okta Identity Governance API can be used to get more details about the updated access request condition.
Example System Log Event #
{
"published": 1784039441773,
"id": null,
"etag": null,
"kind": null,
"uuid": "00000000-0000-0000-0000-000000000002",
"actor": {
"id": "00u00000000000000002",
"type": "User",
"alternateId": "user02@dw-harness.example",
"displayName": "DW Harness 02",
"detailEntry": null
},
"client": {
"userAgent": {
"rawUserAgent": "Mozilla/5.0 (X11; Linux x86_64; rv:152.0) Gecko/20100101 Firefox/152.0",
"os": "Linux",
"browser": "FIREFOX"
},
"zone": "null",
"device": "Computer",
"id": null,
"ipAddress": "198.51.100.2",
"geographicalContext": {
"city": "Anytown",
"state": "Anystate",
"country": "Placeholderland",
"postalCode": "00000",
"geolocation": {
"lat": 0.0,
"lon": 0.0
}
}
},
"device": null,
"events": null,
"target": [
{
"id": "rco00000000000000003",
"type": "access_request_condition",
"alternateId": null,
"displayName": "DW Harness 03",
"detailEntry": null,
"changeDetails": {
"from": {
"accessScopeSettings": {
"groups": [
"00g00000000000000004"
]
},
"priority": 0
},
"to": {
"accessScopeSettings": {
"groups": [
"00g00000000000000005"
]
},
"priority": -1
}
}
}
],
"outcome": {
"result": "SUCCESS",
"reason": null
},
"request": {
"ipChain": [
{
"ip": "198.51.100.2",
"geographicalContext": {
"city": "Anytown",
"state": "Anystate",
"country": "Placeholderland",
"postalCode": "00000",
"geolocation": {
"lat": 0.0,
"lon": 0.0
}
},
"version": "V4",
"source": null,
"ipDetails": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com"
}
}
]
},
"version": "1",
"severity": "INFO",
"eventType": "access.request.condition.update",
"ipAddress": null,
"networkInfo": null,
"transaction": {
"type": "WEB",
"id": "00000000000000000000000000000002",
"detail": {
"rootApiTokenId": "0000000000000000000000000000000000000000000000000000000000000000002",
"requestApiTokenId": "0000000000000000000000000000000000000000000000000000000000000000003",
"requestApiTokenClientId": "00000000000000000000000000000000000000002"
}
},
"debugContext": {
"debugData": {
"accessRequestConditionName": "All employees, auto-approval",
"requestId": "00000000000000000000000000000002",
"origin": "https://dev-00000.okta.com",
"accessRequestConditionId": "rco00000000000000003",
"accessRequestConditionResourceId": "0oa00000000000000006",
"requestUri": "/governance/api/v2/resources/0oa00000000000000006/request-conditions/rco00000000000000003",
"url": "/governance/api/v2/resources/0oa00000000000000006/request-conditions/rco00000000000000003?"
}
},
"displayMessage": "Access Request Condition updated",
"gatewayContext": null,
"legacyEventType": null,
"resourceDetails": null,
"securityContext": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com",
"isProxy": false,
"ipDetails": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com"
}
},
"authenticationContext": {
"authenticationProvider": null,
"credentialProvider": null,
"credentialType": null,
"issuer": null,
"interface": null,
"authenticationStep": 0,
"rootSessionId": "trs00000000000000007",
"externalSessionId": "trs00000000000000008"
}
}
References #
access.request.create
#Description
Access request created. Can be used to audit access to an Okta resource or to trigger downstream automation that depends on request creation. Okta Identity Governance API can be used to get more details about the created request.
Example System Log Event #
{
"published": 1785258308008,
"id": null,
"etag": null,
"kind": null,
"uuid": "00000000-0000-0000-0000-000000000004",
"actor": {
"id": "00u00000000000000009",
"type": "User",
"alternateId": "user03@dw-harness.example",
"displayName": "DW Harness 04",
"detailEntry": {
"realmId": "guo00000000000000010"
}
},
"client": {
"userAgent": null,
"zone": null,
"device": null,
"id": null,
"ipAddress": null,
"geographicalContext": null
},
"device": null,
"events": null,
"target": [
{
"id": "req00000000000000011",
"type": "access_request_request",
"alternateId": "user04@dw-harness.example",
"displayName": "DW Harness 05",
"detailEntry": null
}
],
"outcome": {
"result": "SUCCESS",
"reason": null
},
"request": {
"ipChain": []
},
"version": "1",
"severity": "INFO",
"eventType": "access.request.create",
"ipAddress": null,
"networkInfo": null,
"transaction": {
"type": "JOB",
"id": "rtj00000000000000012",
"detail": {
"rootApiTokenId": "0000000000000000000000000000000000000000000000000000000000000000004"
}
},
"debugContext": {
"debugData": {
"permalinkId": "265",
"requesterId": "00u00000000000000009",
"accessScopeId": "00g00000000000000005",
"accessRequestSubject": "Example App (90 days)",
"ruleConflictDetails": [],
"accessRequestApprovalSequenceId": "68700000000000000013",
"accessRequestId": "req00000000000000011",
"accessRequestMatchedConditionId": "rco00000000000000003",
"canceledAt": "2026-07-28T17:05:08.000Z",
"requestedResourceType": "APP",
"accessScopeType": "GROUP",
"requestedResourceId": "0oa00000000000000006",
"requestedForId": "00u00000000000000009",
"riskSettingsRequestSubmissionType": "ALLOWED_WITH_NO_OVERRIDES"
}
},
"displayMessage": "A request for access has been created",
"gatewayContext": null,
"legacyEventType": null,
"resourceDetails": null,
"securityContext": {
"asNumber": null,
"asOrg": null,
"isp": null,
"domain": null,
"isProxy": null
},
"authenticationContext": {
"authenticationProvider": null,
"credentialProvider": null,
"credentialType": null,
"issuer": null,
"interface": null,
"authenticationStep": 0,
"rootSessionId": "trs00000000000000014",
"externalSessionId": "trs00000000000000015"
}
}
References #
access.request.expire
#Description
Access request expired. Can be used to audit access to an Okta resource or to trigger downstream automation that depends on request expiration. Okta Identity Governance API can be used to get more details about the expired request.
Example System Log Event #
{
"published": 1782788422428,
"id": null,
"etag": null,
"kind": null,
"uuid": "00000000-0000-0000-0000-000000000005",
"actor": {
"id": "00000000-0000-0000-0000-000000000006",
"type": "SystemPrincipal",
"alternateId": "system@okta.com",
"displayName": "Okta System",
"detailEntry": null
},
"client": {
"userAgent": null,
"zone": null,
"device": null,
"id": null,
"ipAddress": null,
"geographicalContext": null
},
"device": null,
"events": null,
"target": [
{
"id": "69f00000000000000016",
"type": "ACCESS_REQUEST",
"alternateId": "user05@dw-harness.example",
"displayName": "DW Harness 06",
"detailEntry": null
}
],
"outcome": {
"result": "SUCCESS",
"reason": null
},
"request": {
"ipChain": []
},
"version": "0",
"severity": "INFO",
"eventType": "access.request.expire",
"ipAddress": null,
"networkInfo": null,
"transaction": {
"type": "SERVICE",
"id": "69f00000000000000016",
"detail": {}
},
"debugContext": {
"debugData": {
"expiredAt": "2026-06-30T03:00:21.021Z",
"permalinkId": "85",
"requesterId": "00u00000000000000017",
"accessRequestId": "69f00000000000000016",
"requestTypeId": "69f00000000000000018",
"teamId": "69f00000000000000019",
"accessRequestStatus": "EXPIRED",
"accessRequestSubject": "John Bob is requesting Access to AWS Kiro",
"accessRequestSource": "WEB",
"ownerId": "00u00000000000000020"
}
},
"displayMessage": "A request for access to an Okta resource (e.g. an application or a group) has been expired.",
"gatewayContext": null,
"legacyEventType": null,
"resourceDetails": null,
"securityContext": null,
"authenticationContext": null
}
References #
access.request.reject
#Description
Access request rejected. Can be used to audit access to an Okta resource or to trigger downstream automation that depends on request rejection. Okta Identity Governance API can be used to get more details about the rejected request.
References #
access.request.resolve
#Description
Access request resolved. Can be used to audit access to an Okta resource or to trigger downstream automation that depends on request resolution. Okta Identity Governance API can be used to get more details about the resolved request.
Example System Log Event #
{
"published": 1785258309346,
"id": null,
"etag": null,
"kind": null,
"uuid": "00000000-0000-0000-0000-000000000007",
"actor": {
"id": "00000000000000000000000000000000000000003",
"type": "PublicClientAppEntity",
"alternateId": "user06@dw-harness.example",
"displayName": "DW Harness 07",
"detailEntry": null
},
"client": {
"userAgent": null,
"zone": null,
"device": null,
"id": null,
"ipAddress": null,
"geographicalContext": null
},
"device": null,
"events": null,
"target": [
{
"id": "req00000000000000011",
"type": "access_request_request",
"alternateId": "user04@dw-harness.example",
"displayName": "DW Harness 08",
"detailEntry": null
}
],
"outcome": {
"result": "SUCCESS",
"reason": null
},
"request": {
"ipChain": []
},
"version": "1",
"severity": "INFO",
"eventType": "access.request.resolve",
"ipAddress": null,
"networkInfo": null,
"transaction": {
"type": "JOB",
"id": "rrj00000000000000021",
"detail": {
"rootApiTokenId": "0000000000000000000000000000000000000000000002"
}
},
"debugContext": {
"debugData": {
"permalinkId": "265",
"requesterId": "00u00000000000000009",
"accessScopeId": "00g00000000000000005",
"accessRequestSubject": "Example App",
"ruleConflictDetails": [],
"accessRequestApprovalSequenceId": "68700000000000000013",
"accessRequestId": "req00000000000000011",
"accessRequestMatchedConditionId": "rco00000000000000003",
"canceledAt": "2026-07-28T17:05:09.000Z",
"requestedResourceType": "APP",
"accessScopeType": "GROUP",
"requestedResourceId": "0oa00000000000000006",
"requestedForId": "00u00000000000000009",
"riskSettingsRequestSubmissionType": "ALLOWED_WITH_NO_OVERRIDES",
"lastResolvedAt": "2026-07-28T17:05:09.000Z"
}
},
"displayMessage": "A request for access has been resolved",
"gatewayContext": null,
"legacyEventType": null,
"resourceDetails": null,
"securityContext": {
"asNumber": null,
"asOrg": null,
"isp": null,
"domain": null,
"isProxy": null
},
"authenticationContext": {
"authenticationProvider": null,
"credentialProvider": null,
"credentialType": null,
"issuer": null,
"interface": null,
"authenticationStep": 0,
"rootSessionId": "trs00000000000000022",
"externalSessionId": "trs00000000000000023"
}
}
References #
access.request.sequence.create
#Description
Access request sequence created. Can be used to audit the approval sequence and when it was created and what was defined within the sequence to verify the approvals required. Okta Identity Governance API can be used to get more details about the created access request sequence.
References #
access.request.sequence.delete
#Description
Access request sequence deleted. Can be used to audit the approval sequence and when it was deleted and what was defined within the sequence to verify the approvals required. Okta Identity Governance API can be used to get more details about the deleted access request sequence.
References #
access.request.sequence.update
#Description
Access request sequence updated. Can be used to audit the approval sequence and when it was updated and what was defined within the sequence to verify the approvals required. Okta Identity Governance API can be used to get more details about the updated access request sequence.
References #
access.request.settings.update
#Description
Access request settings updated. Can be used to audit access request settings to an Okta resource or to trigger downstream automation that depends on access request settings update. Okta Identity Governance API can be used to get more details about the updated access request settings.
References #
access.request.update
#Description
Access request updated. Can be used to audit access to an Okta resource or to trigger downstream automation that depends on request update, which can include changes to the request task(s). Okta Identity Governance API can be used to get more details about the updated request.
Example System Log Event #
{
"published": 1783347795549,
"id": null,
"etag": null,
"kind": null,
"uuid": "00000000-0000-0000-0000-000000000008",
"actor": {
"id": "00000000-0000-0000-0000-000000000006",
"type": "SystemPrincipal",
"alternateId": "system@okta.com",
"displayName": "Okta System",
"detailEntry": null
},
"client": {
"userAgent": null,
"zone": null,
"device": null,
"id": null,
"ipAddress": null,
"geographicalContext": null
},
"device": null,
"events": null,
"target": [
{
"id": "6a400000000000000024",
"type": "ACCESS_REQUEST",
"alternateId": "user07@dw-harness.example",
"displayName": "DW Harness 09",
"detailEntry": null
}
],
"outcome": {
"result": "SUCCESS",
"reason": null
},
"request": {
"ipChain": []
},
"version": "0",
"severity": "INFO",
"eventType": "access.request.update",
"ipAddress": null,
"networkInfo": null,
"transaction": {
"type": "SERVICE",
"id": "6a400000000000000024",
"detail": {}
},
"debugContext": {
"debugData": {
"permalinkId": "161",
"requesterId": "00u00000000000000025",
"accessRequestId": "6a400000000000000024",
"teamId": "69f00000000000000019",
"accessRequestStatus": "OPEN",
"accessRequestSubject": "Bob Jones is requesting Access to AWS Kiro",
"accessRequestSource": "WEB",
"ownerId": "00u00000000000000020",
"updatedAt": "2026-07-06T14:23:14.604Z"
}
},
"displayMessage": "A request for access to an Okta resource (e.g. an application or a group) has been updated.",
"gatewayContext": null,
"resourceDetails": null,
"securityContext": null,
"authenticationContext": null
}
References #
access.review.action
#Description
Record a reviewer's decision on an access review item. Audit specific access decisions (e.g., approve, revoke) made during a review. This event records the intended action. The access.review.remediate event indicates fulfillment of the action.
References #
access.review.close
#Description
Close a security access review. Identify when a review is closed and whether the closure was manual or automatic based on its end date. This event occurs when a security access review is closed.
References #
access.review.create
#Description
Create a Security access review. Audit the initiation of security access review for a specific user. This event is often triggered by a risk detection event, such as user.risk.detect, but can be triggered by other mechanisms.
References #
access.review.remediate
#Description
Fulfill an security access review action. Confirm the outcome of applying a reviewer's specified action. This event records the terminal state of an action indicated in access.review.action.
References #
access.review.start
#Description
Complete the data gathering for a security access review. Confirm the outcome of the background process that collects user access data in preparation for the review. This event fires once the asynchronous data gathering process is complete and the review is ready.