Audit Logs

Audit log availability depends on the CIAM provider. AUMS surfaces the events the provider exposes — no additional storage is required.

Provider support

Provider	Support	Notes
Auth0	✅ Full	Filter by user, event type, date range. Full event metadata.
Firebase	⚠️ Basic	Requires Google Cloud Logging integration. Limited filtering.
Cognito	❌ Not available	Use AWS CloudTrail externally.

Auth0 audit logs

With Auth0, audit logs are available at /users/[userId] (per-user activity) and at the organization level.

Filters available:

• Event type — login, logout, password reset, MFA, rate limit, etc.
• User — filter by specific user
• Date range — filter by start and end date

Each event shows:

Field	Description
Type	Event code (e.g. s = success login, f = failed login)
Date / time	UTC timestamp
IP address	Client IP
User agent	Browser or application
Client	Auth0 application that triggered the event

Firebase audit logs

Note

Firebase Authentication does not expose a built-in audit log API. To surface events in AUMS, enable Google Cloud Audit Logs for your Firebase project and configure the integration in your AUMS instance.

When Cloud Logging is configured, AUMS displays:

• User creation and deletion events
• Password and email change events
• Sign-in events

Cognito

AWS Cognito does not expose user-level audit events via the Management API. To monitor activity:

1. Enable AWS CloudTrail in your account.
2. Filter for cognito-idp.amazonaws.com as the event source.
3. Use CloudWatch Logs Insights or a SIEM tool to query events.

AUMS does not display Cognito events in the dashboard.