> ## Documentation Index
> Fetch the complete documentation index at: https://docs-staging-quickstart-revamp.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

> Lists available log filters for log streams and the logs included in each filter.

# Log Stream Filters

You can filter your log streams so only select logs and log categories are delivered. To configure a log stream's filter:

1. Go to [Dashboard > Monitoring > Streams](https://manage.auth0.com/#/log-streams).
2. Select a log stream and go to the **Settings** tab.
3. Enable or disable filters in the **Filter By Event Category** menu.
4. Click **Save**.

## Actions event filters

<table class="table">
  <thead>
    <tr>
      <th><strong>Filter</strong></th>
      <th><strong>Description</strong></th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>Action Execution - Failure</td>
      <td>Failed Action execution events</td>
    </tr>
  </tbody>
</table>

### Action Execution - Failure

<table class="table">
  <thead>
    <tr>
      <th><strong>Event Code</strong></th>
      <th><strong>Description</strong></th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>actions\_execution\_failed</code></td>
      <td>Execution of an Action failed</td>
    </tr>
  </tbody>
</table>

## Authentication event filters

<table class="table">
  <thead>
    <tr>
      <th><strong>Filter</strong></th>
      <th><strong>Description</strong></th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>Login - Failure</td>
      <td>Failed login events</td>
    </tr>

    <tr>
      <td>Login - Notification</td>
      <td>Login notification events</td>
    </tr>

    <tr>
      <td>Login - Success</td>
      <td>Successful login events</td>
    </tr>

    <tr>
      <td>Logout - Failure</td>
      <td>Failed logout events</td>
    </tr>

    <tr>
      <td>Logout - Success</td>
      <td>Successful logout events</td>
    </tr>

    <tr>
      <td>Signup - Failure</td>
      <td>Failed signup events</td>
    </tr>

    <tr>
      <td>Signup - Success</td>
      <td>Successful signup events</td>
    </tr>

    <tr>
      <td>Silent Authentication - Failure</td>
      <td>Failed silent authentication events</td>
    </tr>

    <tr>
      <td>Silent Authentication - Success</td>
      <td>Successful silent authentication events</td>
    </tr>

    <tr>
      <td>Token Exchange - Failure</td>
      <td>Failed token exchange events</td>
    </tr>

    <tr>
      <td>Token Exchange - Success</td>
      <td>Successful token exchange events</td>
    </tr>
  </tbody>
</table>

### Login - Failure

<table class="table">
  <thead>
    <tr>
      <th><strong>Event Code</strong></th>
      <th><strong>Description</strong></th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>f</code></td>
      <td>Failed login</td>
    </tr>

    <tr>
      <td><code>fc</code></td>
      <td>Failed connector login</td>
    </tr>

    <tr>
      <td><code>fco</code></td>
      <td>Origin is not in the application's Allowed Origins list</td>
    </tr>

    <tr>
      <td><code>fcoa</code></td>
      <td>Failed cross-origin authentication</td>
    </tr>

    <tr>
      <td><code>fens</code></td>
      <td>Failed native social login</td>
    </tr>

    <tr>
      <td><code>fp</code></td>
      <td>Incorrect password</td>
    </tr>

    <tr>
      <td><code>fu</code></td>
      <td>Invalid email or username</td>
    </tr>
  </tbody>
</table>

### Login - Notification

<table class="table">
  <thead>
    <tr>
      <th><strong>Event Code</strong></th>
      <th><strong>Description</strong></th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>w</code></td>
      <td>Warnings during login</td>
    </tr>
  </tbody>
</table>

### Login - Success

<table class="table">
  <thead>
    <tr>
      <th><strong>Event Code</strong></th>
      <th><strong>Description</strong></th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>s</code></td>
      <td>Successful login</td>
    </tr>

    <tr>
      <td><code>scoa</code></td>
      <td>Successful cross-origin authentication</td>
    </tr>

    <tr>
      <td><code>sens</code></td>
      <td>Successful native social login</td>
    </tr>
  </tbody>
</table>

### Logout - Failure

<table class="table">
  <thead>
    <tr>
      <th><strong>Event Code</strong></th>
      <th><strong>Description</strong></th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>flo</code></td>
      <td>User logout failed</td>
    </tr>

    <tr>
      <td><code>oidc\_backchannel\_logout\_failed</code></td>
      <td>Failed OIDC back-channel logout request</td>
    </tr>
  </tbody>
</table>

### Logout - Success

<table class="table">
  <thead>
    <tr>
      <th><strong>Event Code</strong></th>
      <th><strong>Description</strong></th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>oidc\_backchannel\_logout\_succeeded</code></td>
      <td>Successful OIDC back-channel logout request</td>
    </tr>

    <tr>
      <td><code>slo</code></td>
      <td>User successfully logged out</td>
    </tr>
  </tbody>
</table>

### Signup - Failure

<table class="table">
  <thead>
    <tr>
      <th><strong>Event Code</strong></th>
      <th><strong>Description</strong></th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>fs</code></td>
      <td>User signup failed</td>
    </tr>
  </tbody>
</table>

### Signup - Success

<table class="table">
  <thead>
    <tr>
      <th><strong>Event Code</strong></th>
      <th><strong>Description</strong></th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>ss</code></td>
      <td>Successful user signup</td>
    </tr>
  </tbody>
</table>

### Silent Authentication - Failure

<table class="table">
  <thead>
    <tr>
      <th><strong>Event Code</strong></th>
      <th><strong>Description</strong></th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>fsa</code></td>
      <td>Failed silent authentication</td>
    </tr>
  </tbody>
</table>

### Silent Authentication - Success

<table class="table">
  <thead>
    <tr>
      <th><strong>Event Code</strong></th>
      <th><strong>Description</strong></th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>ssa</code></td>
      <td>Successful silent authentication</td>
    </tr>
  </tbody>
</table>

### Token Exchange - Failure

<table class="table">
  <thead>
    <tr>
      <th><strong>Event Code</strong></th>
      <th><strong>Description</strong></th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>feacft</code></td>
      <td>Failed exchange of Authorization Code for Access Token</td>
    </tr>

    <tr>
      <td><code>feccft</code></td>
      <td>Failed exchange of Access Token for a Client Credentials Grant</td>
    </tr>

    <tr>
      <td><code>fede</code></td>
      <td>Failed exchange of Device Code for Access Token</td>
    </tr>

    <tr>
      <td><code>feoobft</code></td>
      <td>Failed exchange of Password and OOB Challenge for Access Token</td>
    </tr>

    <tr>
      <td><code>feotpft</code></td>
      <td>Failed exchange of Password and OTP Challenge for Access Token</td>
    </tr>

    <tr>
      <td><code>fepft</code></td>
      <td>Failed exchange of Password for Access Token</td>
    </tr>

    <tr>
      <td><code>fepotpft</code></td>
      <td>Failed exchange of Passwordless OTP for Access Token</td>
    </tr>

    <tr>
      <td><code>fercft</code></td>
      <td>Failed exchange of Password and MFA Recovery code for Access Token</td>
    </tr>

    <tr>
      <td><code>ferrt</code></td>
      <td>Failed exchange of Rotating Refresh Token</td>
    </tr>

    <tr>
      <td><code>fertft</code></td>
      <td>Failed exchange of Refresh Token for Access Token</td>
    </tr>
  </tbody>
</table>

### Token Exchange - Success

<table class="table">
  <thead>
    <tr>
      <th><strong>Event Code</strong></th>
      <th><strong>Description</strong></th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>seacft</code></td>
      <td>Successful exchange of Authorization Code for Access Token</td>
    </tr>

    <tr>
      <td><code>seccft</code></td>
      <td>Successful exchange of Access Token for a Client Credentials Grant</td>
    </tr>

    <tr>
      <td><code>sede</code></td>
      <td>Successful exchange of Device Code for Access Token</td>
    </tr>

    <tr>
      <td><code>seoobft</code></td>
      <td>Successful exchange of Password and OOB Challenge for Access Token</td>
    </tr>

    <tr>
      <td><code>seotpft</code></td>
      <td>Successful exchange of Password and OTP Challenge for Access Token</td>
    </tr>

    <tr>
      <td><code>sepft</code></td>
      <td>Successful exchange of Password for Access Token</td>
    </tr>

    <tr>
      <td><code>sercft</code></td>
      <td>Successful exchange of Password and MFA Recovery code for Access Token</td>
    </tr>

    <tr>
      <td><code>sertft</code></td>
      <td>Successful exchange of Refresh Token for Access Token</td>
    </tr>
  </tbody>
</table>

## Management API event filters

<table class="table">
  <thead>
    <tr>
      <th><strong>Filter</strong></th>
      <th><strong>Description</strong></th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>Management API - Failure</td>
      <td>Failed Management API events</td>
    </tr>

    <tr>
      <td>Management API - Success</td>
      <td>Successful Management API events</td>
    </tr>
  </tbody>
</table>

### Management API - Success

<table class="table">
  <thead>
    <tr>
      <th><strong>Event Code</strong></th>
      <th><strong>Description</strong></th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>sapi</code></td>
      <td>Successful Management API operation</td>
    </tr>

    <tr>
      <td><code>mgmt\_api\_read</code></td>
      <td>API GET operation returning secrets completed successfully</td>
    </tr>
  </tbody>
</table>

## System event filters

<table class="table">
  <thead>
    <tr>
      <th><strong>Filter</strong></th>
      <th><strong>Description</strong></th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>System - Notification</td>
      <td>System notification events</td>
    </tr>
  </tbody>
</table>

### System - Notification

<table class="table">
  <thead>
    <tr>
      <th><strong>Event Code</strong></th>
      <th><strong>Description</strong></th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>admin\_update\_launch</code></td>
      <td>Auth0 Update Launched</td>
    </tr>

    <tr>
      <td><code>api\_limit</code></td>
      <td>The maximum number of requests to the Authentication or Management APIs in given time has reached</td>
    </tr>

    <tr>
      <td><code>coff</code></td>
      <td>AD/LDAP Connector is offline</td>
    </tr>

    <tr>
      <td><code>con</code></td>
      <td>AD/LDAP Connector is online and working</td>
    </tr>

    <tr>
      <td><code>depnote</code></td>
      <td>Deprecation Notice</td>
    </tr>

    <tr>
      <td><code>fcpro</code></td>
      <td>Failed to provision a AD/LDAP connector</td>
    </tr>

    <tr>
      <td><code>fui</code></td>
      <td>Failed to import users</td>
    </tr>

    <tr>
      <td><code>limit\_delegation</code></td>
      <td>Rate limit exceeded to <code>/delegation</code> endpoint</td>
    </tr>

    <tr>
      <td><code>limit\_mu</code></td>
      <td>An IP address is blocked with 100 failed login attempts using different usernames, all with incorrect passwords in 24 hours, or 50 sign-up attempts per minute from the same IP address</td>
    </tr>

    <tr>
      <td><code>limit\_wc</code></td>
      <td>An IP address is blocked with 10 failed login attempts into a single account from the same IP address</td>
    </tr>

    <tr>
      <td><code>sys\_os\_update\_start</code></td>
      <td>Auth0 OS Update Started</td>
    </tr>

    <tr>
      <td><code>sys\_os\_update\_end</code></td>
      <td>Auth0 OS Update Ended</td>
    </tr>

    <tr>
      <td><code>sys\_update\_start</code></td>
      <td>Auth0 Update Started</td>
    </tr>

    <tr>
      <td><code>sys\_update\_end</code></td>
      <td>Auth0 Update Ended</td>
    </tr>
  </tbody>
</table>

## User/Behavioral event filters

<table class="table">
  <thead>
    <tr>
      <th><strong>Filter</strong></th>
      <th><strong>Description</strong></th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>User/Behavioral - Failure</td>
      <td>Failed user/behavioral events</td>
    </tr>

    <tr>
      <td>User/Behavioral - Notification</td>
      <td>User/behavioral notification events</td>
    </tr>

    <tr>
      <td>User/Behavioral - Success</td>
      <td>Successful user/behavioral events</td>
    </tr>
  </tbody>
</table>

### User/Behavioral - Failure

<table class="table">
  <thead>
    <tr>
      <th><strong>Event Code</strong></th>
      <th><strong>Description</strong></th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>fce</code></td>
      <td>Failed to change user email</td>
    </tr>

    <tr>
      <td><code>fcp</code></td>
      <td>Failed to change password</td>
    </tr>

    <tr>
      <td><code>fcpn</code></td>
      <td>Failed to change phone number</td>
    </tr>

    <tr>
      <td><code>fcpr</code></td>
      <td>Failed change password request</td>
    </tr>

    <tr>
      <td><code>fcu</code></td>
      <td>Failed to change username</td>
    </tr>

    <tr>
      <td><code>fd</code></td>
      <td>Failed to generate delegation token</td>
    </tr>

    <tr>
      <td><code>fdeaz</code></td>
      <td>Device authorization request failed</td>
    </tr>

    <tr>
      <td><code>fdecc</code></td>
      <td>User did not confirm device</td>
    </tr>

    <tr>
      <td><code>fdu</code></td>
      <td>Failed user deletion</td>
    </tr>

    <tr>
      <td><code>fn</code></td>
      <td>Failed to send email notification</td>
    </tr>

    <tr>
      <td><code>fv</code></td>
      <td>Failed to send verification email</td>
    </tr>

    <tr>
      <td><code>fvr</code></td>
      <td>Failed to process verification email request</td>
    </tr>
  </tbody>
</table>

### User/Behavioral - Notification

<table class="table">
  <thead>
    <tr>
      <th><strong>Event Code</strong></th>
      <th><strong>Description</strong></th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>cs</code></td>
      <td>Passwordless login code has been sent</td>
    </tr>

    <tr>
      <td><code>gd\_enrollment\_complete</code></td>
      <td>A first time MFA user has successfully enrolled using one of the factors</td>
    </tr>

    <tr>
      <td><code>gd\_start\_enroll</code></td>
      <td>Multi-factor authentication enroll has started</td>
    </tr>

    <tr>
      <td><code>gd\_unenroll</code></td>
      <td>Device used for second factor authentication has been unenrolled</td>
    </tr>

    <tr>
      <td><code>gd\_update\_device\_account</code></td>
      <td>Device used for second factor authentication has been updated</td>
    </tr>

    <tr>
      <td><code>ublkdu</code></td>
      <td>User block setup by anomaly detection has been released</td>
    </tr>
  </tbody>
</table>

### User/Behavioral - Success

<table class="table">
  <thead>
    <tr>
      <th><strong>Event Code</strong></th>
      <th><strong>Description</strong></th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>sce</code></td>
      <td>Successfully changed user email</td>
    </tr>

    <tr>
      <td><code>scp</code></td>
      <td>Successfully changed password</td>
    </tr>

    <tr>
      <td><code>scpn</code></td>
      <td>Successfully changed phone number</td>
    </tr>

    <tr>
      <td><code>scpr</code></td>
      <td>Successful change password request</td>
    </tr>

    <tr>
      <td><code>scu</code></td>
      <td>Successfully changed username</td>
    </tr>

    <tr>
      <td><code>sdu</code></td>
      <td>User successfully deleted</td>
    </tr>

    <tr>
      <td><code>srrt</code></td>
      <td>Successfully revoked a Refresh Token</td>
    </tr>

    <tr>
      <td><code>sui</code></td>
      <td>Successfully imported users</td>
    </tr>

    <tr>
      <td><code>sv</code></td>
      <td>Successfully consumed email verification link</td>
    </tr>

    <tr>
      <td><code>svr</code></td>
      <td>Successfully called verification email endpoint, verification email in queue.</td>
    </tr>
  </tbody>
</table>

## Other

### SCIM Events

<table class="table">
  <thead>
    <tr>
      <th><strong>Event Code</strong></th>
      <th><strong>Description</strong></th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>sscim</code></td>
      <td>Successful SCIM operation</td>
    </tr>

    <tr>
      <td><code>fscim</code></td>
      <td>Failed SCIM operation</td>
    </tr>
  </tbody>
</table>

### Other Events

This category contains unclassified events.