Okta Certification
| eventType | Description | Sample | Rule |
|---|---|---|---|
| certification. | Triggered when a campaign is closed. | N | N |
| certification. | Triggered when the customizable context settings are updated at org level. | N | N |
| certification. | Triggered when a new campaign is created. | Y | N |
| certification. | Triggered when a campaign is deleted. | N | N |
| certification. | Triggered when a decision on the access to a resource is made. | N | N |
| certification. | Triggered when the remediation is performed on the campaign item. | N | N |
| certification. | Triggered when a campaign is launched. | N | N |
| certification. | Triggered when a campaign is updated. | N | N |
| certification. | Triggered when the remediation state is open. | N | N |
certification.campaign.close
#Description
Triggered when a campaign is closed. This event can be used by admins to audit Access Certification Review activity to understand when a Campaign Instance has transitioned into the closed state. This event is triggered when a Campaign is closed either by an admin or on the configured campaign end date.
References #
certification.campaign.context.update
#Description
Triggered when the customizable context settings are updated at org level. Can be used to audit customizable context settings changes in the system log as well as reports. This is triggered when the customizable context settings are updated at the org level.
References #
certification.campaign.create
#Description
Triggered when a new campaign is created. Can be used to audit campaign activity in the system log as well as reports. This is triggered by creating a new campaign.
Example System Log Event #
{
"published": 1782836221734,
"id": null,
"etag": null,
"kind": null,
"uuid": "00000000-0000-0000-0000-000000000065",
"actor": {
"id": "00u00000000000000153",
"type": "User",
"alternateId": "user08@dw-harness.example",
"displayName": "DW Harness 10",
"detailEntry": null
},
"client": {
"userAgent": {
"rawUserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0",
"os": "Windows 10",
"browser": "FIREFOX"
},
"zone": "null",
"device": "Computer",
"id": null,
"ipAddress": "192.0.2.22",
"geographicalContext": {
"city": "Anytown",
"state": "Anystate",
"country": "Placeholderland",
"postalCode": "00000",
"geolocation": {
"lat": 0.0,
"lon": 0.0
}
}
},
"device": null,
"events": null,
"target": [
{
"id": "ici00000000000000243",
"type": "campaign_template",
"alternateId": null,
"displayName": "DW Harness 78",
"detailEntry": null
}
],
"outcome": {
"result": "SUCCESS",
"reason": null
},
"request": {
"ipChain": [
{
"ip": "192.0.2.22",
"geographicalContext": {
"city": "Anytown",
"state": "Anystate",
"country": "Placeholderland",
"postalCode": "00000",
"geolocation": {
"lat": 0.0,
"lon": 0.0
}
},
"version": "V4",
"source": null,
"ipDetails": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com"
}
}
]
},
"version": "1",
"severity": "INFO",
"eventType": "certification.campaign.create",
"ipAddress": null,
"networkInfo": null,
"transaction": {
"type": "WEB",
"id": "00000000000000000000000000000033",
"detail": {
"rootApiTokenId": "0000000000000000000000000000000000000000000000000000000000000000005",
"requestApiTokenId": "0000000000000000000000000000000000000000000000000000000000000000005",
"requestApiTokenClientId": "00000000000000000000000000000000000000009"
}
},
"debugContext": {
"debugData": {
"requestId": "00000000000000000000000000000033",
"campaignTemplateId": "ici00000000000000243",
"origin": "https://app.example.com",
"campaignTemplateName": "Okta Administrator Review - 06/30/2026",
"requestUri": "/api/v1/governance/campaigns/preconfigured",
"url": "/api/v1/governance/campaigns/preconfigured?"
}
},
"displayMessage": "Campaign created",
"gatewayContext": null,
"legacyEventType": null,
"resourceDetails": null,
"securityContext": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com",
"isProxy": false,
"ipDetails": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com"
}
},
"authenticationContext": {
"authenticationProvider": null,
"credentialProvider": null,
"credentialType": null,
"issuer": null,
"interface": null,
"authenticationStep": 0,
"rootSessionId": "trs00000000000000244",
"externalSessionId": "trs00000000000000244"
}
}
References #
certification.campaign.delete
#Description
Triggered when a campaign is deleted. Can be used to audit campaign activity in the system log as well as reports. This is triggered by deleting a campaign.
References #
certification.campaign.item.decide
#Description
Triggered when a decision on the access to a resource is made. Can be used to audit the decision activity related to an item in a certification campaign, such as the access of a user to an application. The outcome.result field will be SUCCESS for a decision to approve or revoke and will be SKIPPED for a decision to delegate. This is triggered when a reviewer makes a decision on a campaign item, or at the end of a campaign if an item has not been reviewed. The result of the decision is included in the debugData (APPROVE, REVOKE, DELEGATE, NORESPONSE).
References #
certification.campaign.item.remediate
#Description
Triggered when the remediation is performed on the campaign item. Can be used to audit remediation activity in the system log as well as reports. This is triggered when the remediation is acted upon by reviewer.
References #
certification.campaign.launch
#Description
Triggered when a campaign is launched. This event can be used by admins to audit Access Certification Review activity to understand when a Campaign Instance has transitioned into the Active state. This event is triggered when a Campaign starts and moves from scheduled to active.
References #
certification.campaign.update
#Description
Triggered when a campaign is updated. Can be used to audit campaign activity in the system log as well as reports. This is triggered by updating a campaign.