> ## Documentation Index
> Fetch the complete documentation index at: https://docs.opal.dev/llms.txt
> Use this file to discover all available pages before exploring further.
# Events
> Use Events to audit access updates and additional events in Opal.
Opal guarantees display and exports of logs up to 90 days. To indefinitely
retain and export your logs, you should set up [Events
Streaming](/docs/events-streaming).
In the **Events** section of the left sidebar, administrators can view, filter, and export all audit events. Exports can be created by downloading CSVs using the **Export** button, or with the [/events API endpoint](/api-reference/events/get-events).
Administrators can also create **Saved filters** for Events to easily access a view of events for a date range, user, event type, Object ID, or API token.
The events include all changes for configurations in Opal, all actions taken in Opal, and all access changes.
## Event types
Opal records the following events.
| Event type |
| --------------------------------------------------------------- |
| `ACCESS_REVIEWS_CREATED` |
| `ACCESS_REVIEWS_UPDATED` |
| `ACCESS_REVIEW_AUTO_ASSIGN_REVIEWER_BY_APPROVERS` |
| `ACCESS_REVIEW_AUTO_ASSIGN_REVIEWER_BY_MANAGER` |
| `ACCESS_REVIEW_AUTO_ASSIGN_REVIEWER_BY_OWNING_TEAM_ADMIN` |
| `ACCESS_REVIEW_CONNECTION_REVIEWED` |
| `ACCESS_REVIEW_CONNECTION_REVIEWERS_UPDATED` |
| `ACCESS_REVIEW_GROUP_REVIEWED` |
| `ACCESS_REVIEW_GROUP_REVIEWERS_UPDATED` |
| `ACCESS_REVIEW_RESOURCE_ACCESS_TO_GROUP_ACCEPTED` |
| `ACCESS_REVIEW_RESOURCE_ACCESS_TO_GROUP_REVOKED` |
| `ACCESS_REVIEW_RESOURCE_REVIEWED` |
| `ACCESS_REVIEW_RESOURCE_REVIEWERS_UPDATED` |
| `ACCESS_REVIEW_RESOURCE_USER_SUPPORT_TICKET_LINKED` |
| `ACCESS_REVIEW_RESOURCE_USER_SUPPORT_TICKET_UNLINKED` |
| `ACCESS_REVIEW_REVIEWER_FOR_CONNECTION_USER_SET` |
| `ACCESS_REVIEW_REVIEWER_FOR_GROUP_RESOURCE_SET` |
| `ACCESS_REVIEW_REVIEWER_FOR_GROUP_USER_SET` |
| `ACCESS_REVIEW_REVIEWER_FOR_RESOURCE_USER_SET` |
| `ACCESS_REVIEW_REVIEW_PERFORMED` |
| `ACCESS_REVIEW_TEMPLATES_CREATED` |
| `ACCESS_REVIEW_TEMPLATES_DELETED` |
| `ACCESS_REVIEW_TEMPLATES_UPDATED` |
| `ACCESS_REVIEW_USER_ACCESS_TO_CONNECTION_ACCEPTED` |
| `ACCESS_REVIEW_USER_ACCESS_TO_CONNECTION_REVOKED` |
| `ACCESS_REVIEW_USER_ACCESS_TO_GROUP_ACCEPTED` |
| `ACCESS_REVIEW_USER_ACCESS_TO_GROUP_REVOKED` |
| `ACCESS_REVIEW_USER_ACCESS_TO_GROUP_REVOKED_FROM_END_SYSTEM` |
| `ACCESS_REVIEW_USER_ACCESS_TO_RESOURCE_ACCEPTED` |
| `ACCESS_REVIEW_USER_ACCESS_TO_RESOURCE_CHANGED` |
| `ACCESS_REVIEW_USER_ACCESS_TO_RESOURCE_REVOKED` |
| `ACCESS_REVIEW_USER_ACCESS_TO_RESOURCE_REVOKED_FROM_END_SYSTEM` |
| `API_TOKEN_CREATED` |
| `API_TOKEN_DELETED` |
| `BREAK_GLASS_USED` |
| `BREAK_GLASS_USERS_ADDED_TO_GROUPS` |
| `BREAK_GLASS_USERS_REMOVED_FROM_GROUPS` |
| `BUNDLES_CREATED` |
| `BUNDLES_DELETED` |
| `BUNDLES_UPDATED` |
| `BUNDLE_GROUPS_ADDED` |
| `BUNDLE_GROUPS_REMOVED` |
| `BUNDLE_RESOURCES_ADDED` |
| `BUNDLE_RESOURCES_REMOVED` |
| `CONNECTIONS_CREATED` |
| `CONNECTIONS_DELETED` |
| `CONNECTIONS_UPDATED` |
| `CONNECTION_USERS_UPDATED` |
| `CONNECTION_VISIBILITY_GROUPS_ADDED` |
| `CONNECTION_VISIBILITY_GROUPS_REMOVED` |
| `EVENT_MONITOR_EVENTS_DETECTED` |
| `GROUPS_ADDED_TO_FOLDERS` |
| `GROUPS_CREATED` |
| `GROUPS_DELETED` |
| `GROUPS_REMOVED_FROM_FOLDERS` |
| `GROUPS_UPDATED` |
| `GROUP_ACCESS_REQUEST_ESCALATION_PERIOD_UPDATED` |
| `GROUP_ADMIN_OWNER_UPDATED` |
| `GROUP_AUTO_APPROVAL_UPDATED` |
| `GROUP_FOLDERS_CREATED` |
| `GROUP_FOLDERS_DELETED` |
| `GROUP_FUNCTION_UPDATED` |
| `GROUP_IS_REQUESTABLE_UPDATED` |
| `GROUP_MAX_DURATION_UPDATED` |
| `GROUP_NAME_UPDATED` |
| `GROUP_RECOMMENDED_DURATION_UPDATED` |
| `GROUP_REQUEST_REQUIRE_MFA_UPDATED` |
| `GROUP_REQUIRE_MANAGER_APPROVAL_UPDATED` |
| `GROUP_REQUIRE_MFA_UPDATED` |
| `GROUP_REQUIRE_SUPPORT_TICKET_UPDATED` |
| `GROUP_REVIEWER_STAGE_CREATED` |
| `GROUP_REVIEWER_STAGE_DELETED` |
| `GROUP_REVIEWER_STAGE_UPDATED` |
| `GROUP_VISIBILITY_GROUPS_ADDED` |
| `GROUP_VISIBILITY_GROUPS_REMOVED` |
| `GROUP_VISIBILITY_UPDATED` |
| `HRIS_STATUS_ACTIVE` |
| `HRIS_STATUS_DELETED` |
| `HRIS_STATUS_DEPROVISIONED` |
| `HRIS_STATUS_INACTIVE` |
| `HRIS_STATUS_NOT_FOUND` |
| `IDP_CONNECTIONS_CREATED` |
| `IDP_CONNECTIONS_DELETED` |
| `IDP_CONNECTIONS_UPDATED` |
| `IDP_CONNECTION_USER_ATTRIBUTE_MAPPING_CREATED` |
| `IDP_CONNECTION_USER_ATTRIBUTE_MAPPING_DELETED` |
| `IDP_STATUS_ACTIVE` |
| `IDP_STATUS_DELETED` |
| `IDP_STATUS_DEPROVISIONED` |
| `IDP_STATUS_INACTIVE` |
| `IDP_STATUS_NOT_FOUND` |
| `MESSAGE_CHANNELS_ADDED_TO_GROUPS` |
| `MESSAGE_CHANNELS_ADDED_TO_RESOURCES` |
| `MESSAGE_CHANNELS_CREATED` |
| `MESSAGE_CHANNELS_DELETED` |
| `MESSAGE_CHANNELS_REMOVED_FROM_GROUPS` |
| `MESSAGE_CHANNELS_REMOVED_FROM_RESOURCES` |
| `ON_CALL_SCHEDULES_ADDED_TO_GROUPS` |
| `ON_CALL_SCHEDULES_CREATED` |
| `ON_CALL_SCHEDULES_DELETED` |
| `ON_CALL_SCHEDULES_REMOVED_FROM_GROUPS` |
| `ON_CALL_SCHEDULES_UPDATED` |
| `ON_CALL_SCHEDULES_UPDATED_FOR_GROUPS` |
| `ORG_SETTINGS_UPDATED` |
| `OWNERS_CREATED` |
| `OWNERS_DELETED` |
| `OWNERS_UPDATED` |
| `OWNER_REVIEWER_CHANNEL_REMOVED` |
| `OWNER_REVIEWER_CHANNEL_UPDATED` |
| `OWNER_SOURCE_GROUP_REMOVED` |
| `OWNER_SOURCE_GROUP_UPDATED` |
| `OWNER_USERS_ADDED` |
| `OWNER_USERS_REMOVED` |
| `OWNER_USERS_UPDATED` |
| `REQUESTS_ADMIN_APPROVED` |
| `REQUESTS_ADMIN_DENIED` |
| `REQUESTS_APPROVED` |
| `REQUESTS_CANCELED` |
| `REQUESTS_CREATED` |
| `REQUESTS_DENIED` |
| `REQUEST_COMMENT_ADDED` |
| `REQUEST_GROUP_REQUESTED` |
| `REQUEST_RESOURCE_REQUESTED` |
| `REQUEST_REVIEWERS_ADDED_TO_REQUESTS` |
| `REQUEST_REVIEWERS_APPROVED` |
| `REQUEST_REVIEWERS_DENIED` |
| `REQUEST_SKIP_MANAGER_ADDED_TO_REQUESTS` |
| `REQUEST_SUPPORT_TICKET_ADDED` |
| `RESOURCES_ADDED_TO_FOLDERS` |
| `RESOURCES_CREATED` |
| `RESOURCES_DELETED` |
| `RESOURCES_REMOVED_FROM_FOLDERS` |
| `RESOURCES_UPDATED` |
| `RESOURCE_ADMIN_OWNER_UPDATED` |
| `RESOURCE_APPROVE_REQUIRE_MFA_UPDATED` |
| `RESOURCE_AUTO_APPROVAL_UPDATED` |
| `RESOURCE_CONNECT_REQUIRE_MFA_UPDATED` |
| `RESOURCE_FOLDERS_CREATED` |
| `RESOURCE_FOLDERS_DELETED` |
| `RESOURCE_IS_REQUESTABLE_UPDATED` |
| `RESOURCE_MAX_DURATION_UPDATED` |
| `RESOURCE_NAME_UPDATED` |
| `RESOURCE_RECOMMENDED_DURATION_UPDATED` |
| `RESOURCE_REQUEST_REQUIRE_MFA_UPDATED` |
| `RESOURCE_REQUIRE_MANAGER_APPROVAL_UPDATED` |
| `RESOURCE_REQUIRE_SUPPORT_TICKET_UPDATED` |
| `RESOURCE_REVIEWER_STAGE_CREATED` |
| `RESOURCE_REVIEWER_STAGE_DELETED` |
| `RESOURCE_REVIEWER_STAGE_UPDATED` |
| `RESOURCE_VISIBILITY_GROUPS_ADDED` |
| `RESOURCE_VISIBILITY_GROUPS_REMOVED` |
| `RESOURCE_VISIBILITY_UPDATED` |
| `REVIEWERS_ADDED_TO_GROUPS` |
| `REVIEWERS_ADDED_TO_RESOURCES` |
| `REVIEWERS_ESCALATED` |
| `REVIEWERS_REMINDED` |
| `REVIEWERS_REMOVED_FROM_GROUPS` |
| `REVIEWERS_REMOVED_FROM_RESOURCES` |
| `ROLE_ASSIGNMENTS_CREATED` |
| `ROLE_ASSIGNMENTS_DELETED` |
| `ROLE_ASSIGNMENTS_DELETED` |
| `SESSIONS_CREATED_FOR_RESOURCES` |
| `THIRD_PARTY_INTEGRATION_CREATED` |
| `THIRD_PARTY_INTEGRATION_DELETED` |
| `TOXIC_SET_VIOLATIONS_CREATED` |
| `TOXIC_SET_VIOLATIONS_REMEDIATED` |
| `TOXIC_SET_VIOLATIONS_UPDATED` |
| `USERS_ADDED_TO_CONNECTIONS` |
| `USERS_CREATED` |
| `USERS_DELETED` |
| `USERS_REMOVED_FROM_CONNECTIONS` |
| `USERS_UPDATED` |
| `USER_EMAIL_UPDATED` |
| `USER_LOGGED_IN_OAUTH` |
| `USER_LOGGED_IN_SAML` |
| `USER_MANAGER_UPDATED` |
| `USER_MERGED` |
| `USER_NAME_UPDATED` |
| `USER_NOTIFIED` |
| `USER_NOTIFICATION_FAILED` |
| `USER_NOT_NOTIFIED` |
| `USER_POSITION_UPDATED` |
| `USER_REMOTE_ID_UPDATED` |
| `USER_TEAM_ATTR_UPDATED` |
### Propagation events
| Event type |
| ------------------------------------------------- |
| `PROPAGATED_ADD_RESOURCE_TO_GROUP` |
| `PROPAGATED_ADD_USER_TO_GROUP` |
| `PROPAGATED_ADD_USER_TO_RESOURCE` |
| `PROPAGATED_REMOVE_RESOURCE_FROM_GROUP` |
| `PROPAGATED_REMOVE_USER_FROM_CONNECTION` |
| `PROPAGATED_REMOVE_USER_FROM_GROUP` |
| `PROPAGATED_REMOVE_USER_FROM_RESOURCE` |
| `PROPAGATION_FAILURE_ADD_RESOURCE_TO_GROUP` |
| `PROPAGATION_FAILURE_ADD_USER_TO_GROUP` |
| `PROPAGATION_FAILURE_ADD_USER_TO_RESOURCE` |
| `PROPAGATION_FAILURE_REMOVE_RESOURCE_FROM_GROUP` |
| `PROPAGATION_FAILURE_REMOVE_USER_FROM_CONNECTION` |
| `PROPAGATION_FAILURE_REMOVE_USER_FROM_GROUP` |
| `PROPAGATION_FAILURE_REMOVE_USER_FROM_RESOURCE` |
| `PROPAGATION_MANUAL_ADD_USER_TO_RESOURCE` |
| `PROPAGATION_MANUAL_REMOVE_USER_FROM_RESOURCE` |
| `PROPAGATION_SUCCESS_ADD_RESOURCE_TO_GROUP` |
| `PROPAGATION_SUCCESS_ADD_USER_TO_GROUP` |
| `PROPAGATION_SUCCESS_ADD_USER_TO_RESOURCE` |
| `PROPAGATION_SUCCESS_REMOVE_RESOURCE_FROM_GROUP` |
| `PROPAGATION_SUCCESS_REMOVE_USER_FROM_CONNECTION` |
| `PROPAGATION_SUCCESS_REMOVE_USER_FROM_GROUP` |
| `PROPAGATION_SUCCESS_REMOVE_USER_FROM_RESOURCE` |
| `PROPAGATION_TICKET_UPDATED_REMOTELY` |
| `PROPAGATION_TIMED_OUT` |
Deprecated
events
`GROUP_RESOURCE` events were updated in self-hosted version 1.990.0,
`GROUP_USERS` events in version 1.1016.0, and `RESOURCE_USER` events in
version 1.970.0.
The following table lists events that have been migrated and now map to `ROLE_ASSIGNMENTS_*` events.
| Deprecated events | New event |
| -------------------------------------------------------------------------------------------------------------------------- | -------------------------- |
| `GROUPS_ADDED_TO_GROUPS`, `USERS_ADDED_TO_GROUPS`, `RESOURCES_ADDED_TO_GROUPS`, `USERS_ADDED_TO_RESOURCES` | `ROLE_ASSIGNMENTS_CREATED` |
| `GROUPS_REMOVED_FROM_GROUPS`, `USERS_REMOVED_FROM_GROUPS`, `RESOURCES_REMOVED_FROM_GROUPS`, `USERS_REMOVED_FROM_RESOURCES` | `ROLE_ASSIGNMENTS_DELETED` |
| `GROUP_GROUPS_UPDATED`, `GROUP_USERS_UPDATED`, `GROUP_RESOURCES_UPDATED`, `RESOURCE_USERS_UPDATED` | `ROLE_ASSIGNMENTS_UPDATED` |
### Remote events
Remote events are accessible from the **Usage** tab on Okta apps, AWS IAM roles, and resources within custom connectors. They are not included in CSV exports nor returned from the `/events` API.
| Event type |
| ------------------------------------------ |
| `REMOTE_EVENT_GROUP_ADDED_TO_RESOURCE` |
| `REMOTE_EVENT_GROUP_REMOVED_FROM_RESOURCE` |
| `REMOTE_EVENT_GROUP_USED` |
| `REMOTE_EVENT_GROUPS_CREATED` |
| `REMOTE_EVENT_GROUPS_DELETED` |
| `REMOTE_EVENT_LOGIN_SUCCESS` |
| `REMOTE_EVENT_RESOURCE_READ` |
| `REMOTE_EVENT_RESOURCES_CREATED` |
| `REMOTE_EVENT_RESOURCES_DELETED` |
| `REMOTE_EVENT_USER_ADDED_TO_GROUP` |
| `REMOTE_EVENT_USER_ADDED_TO_RESOURCE` |
| `REMOTE_EVENT_USER_REMOVED_FROM_GROUP` |
| `REMOTE_EVENT_USER_REMOVED_FROM_RESOURCE` |