Audit Logs

The Audit Logs page has two tabs:

• Provider events: authentication and account events from the CIAM provider’s own log API. Availability and depth depend on the provider (see below); AUMS does not store them.
• Admin actions: every change made through AUMS (user create, update, block, delete, session revocation, organization and invitation changes, provider settings), recorded by AUMS in its own database with the acting admin, target, outcome, IP and user agent. Available with every provider. Passwords and other secrets are never recorded, only the names of the changed fields.

Instance admins see all admin actions; organization members see those made within their active organization.

Provider support

Provider	Support	Notes
Auth0	✅ Full	Filter by user, event type, date range. Full event metadata.
Firebase	⚠️ Basic	Requires Google Cloud Logging integration. Limited filtering.
Cognito	❌ Not available	Use AWS CloudTrail externally.

Auth0 audit logs

With Auth0, audit logs are available at /users/[userId] (per-user activity) and at the organization level.

Filters available:

• Event type — login, logout, password reset, MFA, rate limit, etc.
• User — filter by specific user
• Date range — filter by start and end date

Each event shows:

Field	Description
Type	Event code (e.g. s = success login, f = failed login)
Date / time	UTC timestamp
IP address	Client IP
User agent	Browser or application
Client	Auth0 application that triggered the event

Firebase audit logs

Note

Firebase Authentication does not expose a built-in audit log API. To surface events in AUMS, enable Google Cloud Audit Logs for your Firebase project and configure the integration in your AUMS instance.

When Cloud Logging is configured, AUMS displays:

• User creation and deletion events
• Password and email change events
• Sign-in events

Cognito

AWS Cognito does not expose user-level audit events via the Management API. To monitor activity:

1. Enable AWS CloudTrail in your account.
2. Filter for cognito-idp.amazonaws.com as the event source.
3. Use CloudWatch Logs Insights or a SIEM tool to query events.

AUMS does not display Cognito events in the dashboard.