The Okta System Log records system events that are related to your organization in order to provide an audit trail that can be used to understand platform activity and to diagnose problems.
The Okta System Log API provides near real-time, read-only access to your organization's system log and is the programmatic counterpart of the System Log UI.
The terms "event" and "log event" are often used interchangeably. In the context of this API, an "event" is an occurrence of interest within the system, and a "log" or "log event" is the recorded fact.
The System Log API supports these primary use cases:
Note: Some of the curl code examples on this page include SSWS API token authentication. However, Okta recommends using scoped OAuth 2.0 and OIDC access tokens to authenticate with Okta management APIs. OAuth 2.0 and OIDC access tokens provide fine-grain control over the bearer's actions on specific endpoints. See Okta API authentication methods.
okta.logs.read
Lists all System Log Events
since | string <ISO 8601 compliant timestamp> Default: "7 days prior to until" Filters the lower time bound of the log events |
until | string <ISO 8601 compliant timestamp> Default: "current time" Filters the upper time bound of the log events |
after | string <Opaque token> Retrieves the next page of results. Okta returns a link in the HTTP Header ( |
filter | string <SCIM Filter expression> Filter expression that filters the results. All operators except [ ] are supported. See Filter. |
q | string <URL encoded string. Max length is 40 characters per keyword, with a maximum of 10 keyword filters per query (before encoding)> Filters log events results by one or more case insensitive keywords. |
limit | integer <Integer between 0 and 1000> Default: 100 Sets the number of results that are returned in the response |
sortOrder | string Default: "ASCENDING" The order of the returned events that are sorted by the |
Success
Forbidden
Too Many Requests
[- {
- "actor": {
- "id": "00uttidj01jqL21aM1d6",
- "type": "User",
- "alternateId": "john.doe@example.com",
- "displayName": "John Doe",
- "detailEntry": null
}, - "client": {
- "userAgent": {
- "rawUserAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36",
- "os": "Mac OS X",
- "browser": "CHROME"
}, - "zone": null,
- "device": "Computer",
- "id": null,
- "ipAddress": "10.0.0.1",
- "geographicalContext": {
- "city": "New York",
- "state": "New York",
- "country": "United States",
- "postalCode": 10013,
- "geolocation": {
- "lat": 40.3157,
- "lon": -74.01
}
}
}, - "device": {
- "id": "guofdhyjex1feOgbN1d9",
- "name": "Mac15,6",
- "os_platform": "OSX",
- "os_version": "14.6.0",
- "managed": false,
- "registered": true,
- "device_integrator": null,
- "disk_encryption_type": "ALL_INTERNAL_VOLUMES",
- "screen_lock_type": "BIOMETRIC",
- "jailbreak": null,
- "secure_hardware_present": true
}, - "authenticationContext": {
- "authenticationProvider": null,
- "credentialProvider": null,
- "credentialType": null,
- "issuer": null,
- "interface": null,
- "authenticationStep": 0,
- "rootSessionId": "idxBager62CSveUkTxvgRtonA",
- "externalSessionId": "idxBager62CSveUkTxvgRtonA"
}, - "displayMessage": "User login to Okta",
- "eventType": "user.session.start",
- "outcome": {
- "result": "SUCCESS",
- "reason": null
}, - "published": "2024-08-13T15:58:20.353Z",
- "securityContext": {
- "asNumber": 394089,
- "asOrg": "ASN 0000",
- "isp": "google",
- "domain": null,
- "isProxy": false
}, - "severity": "INFO",
- "debugContext": {
- "debugData": {
- "requestId": "ab609228fe84ce59cdcbfa690bcce016",
- "requestUri": "/idp/idx/authenticators/poll",
- "url": "/idp/idx/authenticators/poll"
}
}, - "legacyEventType": "core.user_auth.login_success",
- "transaction": {
- "type": "WEB",
- "id": "ab609228fe84ce59cdcbfa690bgce016",
- "detail": null
}, - "uuid": "dc9fd3c0-598c-11ef-8478-2b7584bf8d5a",
- "version": 0,
- "request": {
- "ipChain": [
- {
- "ip": "10.0.0.1",
- "geographicalContext": {
- "city": "New York",
- "state": "New York",
- "country": "United States",
- "postalCode": 10013,
- "geolocation": {
- "lat": 40.3157,
- "lon": -74.01
}
}, - "version": "V4",
- "source": null
}
]
}, - "target": [
- {
- "id": "pfdfdhyjf0HMbkP2e1d7",
- "type": "AuthenticatorEnrollment",
- "alternateId": "unknown",
- "displayName": "Okta Verify",
- "detailEntry": null
}, - {
- "id": "0oatxlef9sQvvqInq5d6",
- "type": "AppInstance",
- "alternateId": "Okta Admin Console",
- "displayName": "Okta Admin Console",
- "detailEntry": null
}
]
}
]