Authentication audit events
Automation orchestrator emits audit events for authentication, session lifecycle, and account management operations. These events are written to pod standard output and, when configured, forwarded to an external OTLP-compatible observability backend.
The following authentication event types are emitted:
| Event type | Trigger | Severity |
|---|---|---|
| Login attempt | Failed login (unknown user, bad password, inactive account, local login disabled) | Warning |
| User login | Successful authentication (records authentication method) | Info |
| OIDC flow | OIDC authorization flow stages | Info |
| Session lifecycle | Session creation and revocation | Info |
| Session revocation | Admin-initiated session revocation (per-user, per-IdP, global) | Critical |
| Global revocation | Global token version increment | Critical |
| Authorization denied | Request denied due to insufficient permissions (403) | Warning |
| Disabled user rejection | Request rejected from a disabled user account | Warning |
| Stale token detection | Outdated token version detected (60s per-user dedup) | Info |
| Password changed | User password changed through the REST API | Warning |
| Account status changed | User account enabled or disabled through the REST API | Warning |
| Group membership changed | User added to or removed from a group through the admin API, OIDC auto-provisioning, or identity provider group sync | Warning |
For structured data fields included in each event type, see Audit event reference.