Webhook events and payloads¶

This guide details the webhook event types dispatched by WSO2 Identity Server. For each event, you'll find JSON payload examples and descriptions of their properties.

Note

In webhook event payloads, initiatorIpAddress (when present) represents the IP address of the initiator that triggered the event.

WSO2 Identity Server dispatches webhook events for both successful and failed login attempts, providing detailed context for each.

WSO2 Identity Server sends a loginSuccess event when a user successfully authenticates.

Example payload:

{
  "iss": "https://localhost:9443/t/myorg.com",
  "jti": "051f0c37-b689-44d4-b7d2-29b980ece273",
  "iat": 1751705149662,
  "rci": "05268edb-9a87-4656-87c0-0fb674dd03b1",
  "events": {
    "https://schemas.identity.wso2.org/events/login/event-type/loginSuccess": {
      "initiatorType": "USER",
      "initiatorIpAddress": "203.0.113.10",
      "user": {
        "id": "d4002616-f00c-49d5-b9b7-63b063819049",
        "claims": [
          {
            "uri": "http://wso2.org/claims/username",
            "value": "[email protected]"
          }
        ],
        "organization": {
          "id": "6f8d17ae-1ad5-441b-b9e0-c7731e739e94",
          "name": "myorg",
          "orgHandle": "myorg.com",
          "depth": 0
        },
        "ref": "https://localhost:9443/t/myorg.com/scim2/Users/d4002616-f00c-49d5-b9b7-63b063819049"
      },
      "tenant": {
        "id": "12402",
        "name": "myorg.com"
      },
      "organization": {
        "id": "6f8d17ae-1ad5-441b-b9e0-c7731e739e94",
        "name": "myorg",
        "orgHandle": "myorg.com",
        "depth": 0
      },
      "userStore": {
        "id": "UFJJTUFSWQ==",
        "name": "PRIMARY"
      },
      "application": {
        "id": "40d982e5-23be-4ee1-8540-9cb696d8c321",
        "name": "MyApp"
      },
      "action": "LOGIN",
      "authenticationMethods": [
        "BasicAuthenticator"
      ]
    }
  }
}

The events object contains the actual event data for a successful login, identified by the URI https://schemas.identity.wso2.org/events/login/event-type/loginSuccess. This URI signifies a successful login event.

The table below explains each property in the event data.

Property	Description
user	Contains information about the authenticated user along with user resident organization.
tenant	Represents the root organization (tenant) under which the login processes.
organization	Represents the organization under which the login processes.
userStore	Indicates the user store in which the user's data gets managed.
application	Contains information of the application through which the login occurred.
authenticationMethods	An array of authentication methods used for the successful login (for example `BasicAuthenticator`).
initiatorType	Indicates whether an administrator, user, or application initiated the event.
initiatorIpAddress	Indicates the IP address of the initiator that triggered the event.
action	Indicates the flow that triggered the event. The value is `LOGIN`.

WSO2 Identity Server sends a loginFailed event when a login attempt fails.

Example payload:

{
  "iss": "https://localhost:9443/t/myorg.com",
  "jti": "7ef94943-2004-4f72-b476-9baffe5623c7",
  "iat": 1751709144508,
  "rci": "05268edb-9a87-4656-87c0-0fb674dd03b1",
  "events": {
    "https://schemas.identity.wso2.org/events/login/event-type/loginFailed": {
      "initiatorType": "USER",
      "initiatorIpAddress": "203.0.113.10",
      "user": {
        "claims": [
          {
            "uri": "http://wso2.org/claims/username",
            "value": "[email protected]"
          },
          {
            "uri": "http://wso2.org/claims/emailaddress",
            "value": "[email protected]"
          },
          {
            "uri": "http://wso2.org/claims/lastname",
            "value": "Doe"
          },
          {
            "uri": "http://wso2.org/claims/givenname",
            "value": "John"
          }
        ],
        "organization": {
          "id": "6f8d17ae-1ad5-441b-b9e0-c7731e739e94",
          "name": "myorg",
          "orgHandle": "myorg.com",
          "depth": 0
        }
      },
      "tenant": {
        "id": "12402",
        "name": "myorg.com"
      },
      "organization": {
        "id": "6f8d17ae-1ad5-441b-b9e0-c7731e739e94",
        "name": "myorg",
        "orgHandle": "myorg.com",
        "depth": 0
      },
      "application": {
        "id": "63d8a96f-ff87-4f38-a1d7-4d10ee470d9a",
        "name": "Test App"
      },
      "reason": {
        "description": "User authentication failed due to invalid credentials",
        "context": {
          "failedStep": {
            "step": 1,
            "idp": "LOCAL",
            "authenticator": "BasicAuthenticator"
          }
        }
      },
      "action": "LOGIN"
    }
  }
}

The events object contains the actual event data for a failed login, identified by the URI https://schemas.identity.wso2.org/events/login/event-type/loginFailed. This URI signifies a successful login event.

The table below explains each property in the event data.

Property	Description
user	Contains information about the authenticating user.
tenant	Represents the root organization (tenant) that processes the login.
organization	Represents the organization that processes the login.
userStore	Indicates the user store that manages the user's data if applicable.
application	Contains information about the application that initiated the login.
reason	Provides context information for the failure including: description: Human-readable explanation of why the login failed (for example "User authentication failed due to invalid credentials") context: Details about the failure point in the authentication flow including: Step number where the failure occurred Identity Provider (IdP) involved (for example "LOCAL") Authenticator used (for example `BasicAuthenticator`)
initiatorType	Indicates whether an administrator, user, or application initiated the event.
initiatorIpAddress	Indicates the IP address of the initiator that triggered the event.
action	Indicates the flow that triggered the event. The value is `LOGIN`.

Registration events¶

WSO2 Identity Server dispatches webhook events for successful and failed user registrations. Each event provides detailed context.

Registration success event¶

WSO2 Identity Server sends a registrationSuccess event when a new user account gets successfully registered in a state where the user can login and access.

Example payload:

{
  "iss": "https://localhost:9443/t/myorg.com",
  "jti": "e558b025-58ae-4e29-8242-75d6bfdfcbda",
  "iat": 1751709420327,
  "rci": "05268edb-9a87-4656-87c0-0fb674dd03b1",
  "events": {
    "https://schemas.identity.wso2.org/events/registration/event-type/registrationSuccess": {
      "initiatorType": "ADMIN",
      "initiatorIpAddress": "203.0.113.10",
      "user": {
        "id": "3fae4858-4b26-4608-9df4-78ae75e3adda",
        "claims": [
          {
            "uri": "http://wso2.org/claims/username",
            "value": "[email protected]"
          },
          {
            "uri": "http://wso2.org/claims/emailaddress",
            "value": "[email protected]"
          },
          {
            "uri": "http://wso2.org/claims/lastname",
            "value": "Doe"
          },
          {
            "uri": "http://wso2.org/claims/givenname",
            "value": "John"
          }
        ],
        "organization": {
          "id": "6f8d17ae-1ad5-441b-b9e0-c7731e739e94",
          "name": "myorg",
          "orgHandle": "myorg.com",
          "depth": 0
        },
        "ref": "https://localhost:9443/t/myorg.com/scim2/Users/3fae4858-4b26-4608-9df4-78ae75e3adda"
      },
      "tenant": {
        "id": "12402",
        "name": "myorg.com"
      },
      "organization": {
        "id": "6f8d17ae-1ad5-441b-b9e0-c7731e739e94",
        "name": "myorg",
        "orgHandle": "myorg.com",
        "depth": 0
      },
      "userStore": {
        "id": "REVGQVVMVA==",
        "name": "DEFAULT"
      },
      "action": "REGISTER"
    }
  }
}

The events object contains the actual event data for a successful registration, identified by the URI https://schemas.identity.wso2.org/events/registration/event-type/registrationSuccess. This URI signifies a successful user registration event.

The table below explains each property in the event data.

Property	Description
user	Contains information about the user who registers.
tenant	Represents the root organization (tenant) that processes the user registration.
organization	Represents the organization that processes the user registration.
userStore	Indicates the user store that manages the user's data.
initiatorType	Indicates whether an administrator, user, or application initiated the registration. Refer to `initiatorType` and `action` properties for details.
initiatorIpAddress	Indicates the IP address of the initiator that triggered the event.
action	Indicates whether the registration uses direct admin registration, user self-registration, or admin invite flow. Refer to `initiatorType` and `action` properties for details.

Registration failure event¶

WSO2 Identity Server sends a registrationFailed event when a user registration attempt fails.

Example payload:

{
  "iss": "https://localhost:9443/t/myorg.com",
  "jti": "43e76a18-f3b3-400c-bf76-9761b4ec5d57",
  "iat": 1751565405544,
  "rci": "05268edb-9a87-4656-87c0-0fb674dd03b1",
  "events": {
    "https://schemas.identity.wso2.org/events/registration/event-type/registrationFailed": {
      "initiatorType": "USER",
      "initiatorIpAddress": "203.0.113.10",
      "user": {
        "claims": [
          {
            "uri": "http://wso2.org/claims/username",
            "value": "peter"
          },
          {
            "uri": "http://wso2.org/claims/emailaddress",
            "value": "[email protected]"
          },
          {
            "uri": "http://wso2.org/claims/givenname",
            "value": "Peter"
          }
        ],
        "organization": {
          "id": "6f8d17ae-1ad5-441b-b9e0-c7731e739e94",
          "name": "myorg",
          "orgHandle": "myorg.com",
          "depth": 0
        },
      },
      "tenant": {
        "id": "12402",
        "name": "myorg.com"
      },
      "organization": {
        "id": "6f8d17ae-1ad5-441b-b9e0-c7731e739e94",
        "name": "myorg",
        "orgHandle": "myorg.com",
        "depth": 0
      },
      "action": "REGISTER",
      "reason": {
        "description": "The provided username already exists in the tenant: myorg.com"
      }
    }
  }
}

The events object contains the actual event data for a failed registration, identified by the URI https://schemas.identity.wso2.org/events/registration/event-type/registrationFailed. This URI signifies a failed user registration event.

The table below explains each property in the event data.

Property	Description
user	Contains information about the user attempting registration, including provided claims.
tenant	Represents the root organization (tenant) that processed the registration attempt.
organization	Represents the organization that processed the registration attempt.
initiatorType	Indicates whether an administrator, user, or application initiated the registration. Refer to `initiatorType` and `action` properties for details.
initiatorIpAddress	Indicates the IP address of the initiator that triggered the event.
action	Indicates whether the registration uses direct admin registration, user self-registration, or admin invite flow. Refer to `initiatorType` and `action` properties for details.
reason	Provides context information explaining the registration failure.

`initiatorType` and `action` properties for registration events¶

The initiatorType and the action property together show which flow triggers a user registration.

The table below explains how these properties differ based on each flow.

Flow	Value of `initiatorType`	Value of `action`	Description
Admin initiated direct user registration	ADMIN	REGISTER	Occurs when an administrator directly registers a user via console or SCIM 2.0 Users API.
Admin initiated user invite to register	ADMIN	INVITE	Occurs when an administrator invites a user to register via console or SCIM 2.0 Users API.
User self registration	USER	REGISTER	Occurs when a user registers by clicking the 'Register' link in the login page or via self registration APIs.
Application initiated user registration	APPLICATION	REGISTER	Occurs when an application with appropriate permissions automatically registers a user. This happens during automated user provisioning or integration with external identity management systems via SCIM 2.0 Users API.

Token events¶

WSO2 Identity Server dispatches webhook events for both token issuance and revocation. Each event provides detailed context.

Access token issued event¶

WSO2 Identity Server sends an accessTokenIssued event when an access token gets successfully issued to a client application.

Example payload:

{
  "iss": "https://localhost:9443/t/myorg.com",
  "jti": "f30f6807-192a-40b0-99b9-b176d3b94a94",
  "iat": 1755541962092,
  "rci": "05268edb-9a87-4656-87c0-0fb674dd03b1",
  "events": {
    "https://schemas.identity.wso2.org/events/token/event-type/accessTokenIssued": {
      "initiatorType": "USER",
      "initiatorIpAddress": "203.0.113.10",
      "user": {
        "id": "1801d35e-1339-4c16-9c53-61321cf37fb9",
        "claims": [
          {
            "uri": "http://wso2.org/claims/username",
            "value": "peter"
          },
          {
            "uri": "http://wso2.org/claims/emailaddress",
            "value": "[email protected]"
          }
        ],
        "organization": {
          "id": "10084a8d-113f-4211-a0d5-efe36b082211",
          "name": "myorg",
          "orgHandle": "myorg.com",
          "depth": 0
        },
        "ref": "https://localhost:9443/t/myorg.com/scim2/Users/1801d35e-1339-4c16-9c53-61321cf37fb9"
      },
      "tenant": {
        "id": "12402",
        "name": "myorg.com"
      },
      "organization": {
        "id": "10084a8d-113f-4211-a0d5-efe36b082211",
        "name": "myorg",
        "orgHandle": "myorg.com",
        "depth": 0
      },
      "userStore": {
        "id": "UFJJTUFSWQ==",
        "name": "PRIMARY"
      },
      "application": {
        "name": "Test App",
        "consumerKey": "eaSbhGeDL7ek2ypVrb0h4ZYMSN0a"
      },
      "accessToken": {
        "tokenType": "Opaque",
        "iat": "1755541962069",
        "grantType": "authorization_code"
      },
      "action": "TOKEN_ISSUE"
    }
  }
}

The events object contains the actual event data for a successful token issuance, identified by the URI https://schemas.identity.wso2.org/events/token/event-type/accessTokenIssued. This URI signifies a successful access token issuance event.

The table below explains each property in the event data.

Property	Description
user	Contains information about the user for whom the token gets issued along with user resident organization.
tenant	Represents the root organization (tenant) under which the token issuance processes.
organization	Represents the organization under which the token issuance processes.
userStore	Indicates the user store that manages the user's data.
application	Contains information about the application that requested the token.
accessToken	Contains details about the issued token including: tokenType: Token type (for example "Opaque" or "jwt") iat: Token issued at timestamp grantType: OAuth2 grant type used for token issuance (for example "authorization_code")
initiatorType	Indicates whether an administrator, user, or application initiated the event.
initiatorIpAddress	Indicates the IP address of the initiator that triggered the event.
action	Indicates the flow that triggered the event. The value is `TOKEN_ISSUE`.

Access token revoked event¶

WSO2 Identity Server sends an accessTokenRevoked event when an access token gets revoked.

Example payload:

{
  "iss": "https://localhost:9443/t/myorg.com",
  "jti": "d801a275-e64b-4998-90d9-2ed1601a0d19",
  "iat": 1755541966592,
  "rci": "48eaeb32-76c0-4af8-b04e-9ce0c00cb61f",
  "events": {
    "https://schemas.identity.wso2.org/events/token/event-type/accessTokenRevoked": {
      "initiatorType": "USER",
      "initiatorIpAddress": "203.0.113.10",
      "user": {
        "id": "1801d35e-1339-4c16-9c53-61321cf37fb9",
        "claims": [
          {
            "uri": "http://wso2.org/claims/emailaddress",
            "value": "[email protected]"
          },
          {
            "uri": "http://wso2.org/claims/username",
            "value": "peter"
          }
        ],
        "organization": {
          "id": "10084a8d-113f-4211-a0d5-efe36b082211",
          "name": "myorg",
          "orgHandle": "myorg.com",
          "depth": 0
        },
        "ref": "https://localhost:9443/t/myorg.com/scim2/Users/1801d35e-1339-4c16-9c53-61321cf37fb9"
      },
      "tenant": {
        "id": "12402",
        "name": "myorg.com"
      },
      "organization": {
        "id": "10084a8d-113f-4211-a0d5-efe36b082211",
        "name": "myorg",
        "orgHandle": "myorg.com",
        "depth": 0
      },
      "userStore": {
        "id": "UFJJTUFSWQ==",
        "name": "PRIMARY"
      },
      "applications": [
        {
          "id": "eb395ddd-1280-46e9-98fb-810948c1dab4",
          "name": "Test App",
          "consumerKey": "eaSbhGeDL7ek2ypVrb0h4ZYMSN0a"
        }
      ],
      "action": "TOKEN_REVOKE"
    }
  }
}

The events object contains the actual event data for a token revocation, identified by the URI https://schemas.identity.wso2.org/events/token/event-type/accessTokenRevoked. This URI signifies an access token revocation event.

The table below explains each property in the event data.

Property	Description
user	Contains information about the user whose token gets revoked.
tenant	Represents the root organization (tenant) that processes the token revocation.
organization	Represents the organization that processes the token revocation.
userStore	Indicates the user store that manages the user's data.
applications	Contains information about applications associated with the revoked token. This appears as an array because token revocation can affect multiple applications.
initiatorType	Indicates whether an administrator, user, or application initiated the event.
initiatorIpAddress	Indicates the IP address of the initiator that triggered the event.
action	Indicates the flow that triggered the event. The value is `TOKEN_REVOKE`.

Session events¶

WSO2 Identity Server dispatches webhook events for session establishment, presentation, and revocation. Each event provides detailed context about user sessions and associated applications.

Session established event¶

WSO2 Identity Server sends a sessionEstablished event when a user logs in for the first time and creates a new session.

This event triggers for every new session creation during the login process. It helps you track when users establish new sessions in your system.

Example payload:

{
  "iss": "https://localhost:9443/t/myorg.com",
  "jti": "1a9b7a5f-42f3-4f87-a03d-6962b32a219b",
  "iat": 1755541960053,
  "rci": "b8b6ccbd-69b0-47d3-b0ae-b2b0df085f7c",
  "events": {
    "https://schemas.identity.wso2.org/events/session/event-type/sessionEstablished": {
      "initiatorType": "USER",
      "initiatorIpAddress": "203.0.113.10",
      "user": {
        "id": "1801d35e-1339-4c16-9c53-61321cf37fb9",
        "claims": [
          {
            "uri": "http://wso2.org/claims/username",
            "value": "peter"
          }
        ],
        "organization": {
          "id": "10084a8d-113f-4211-a0d5-efe36b082211",
          "name": "myorg",
          "orgHandle": "myorg.com",
          "depth": 0
        },
        "ref": "https://localhost:9443/t/myorg.com/scim2/Users/1801d35e-1339-4c16-9c53-61321cf37fb9"
      },
      "tenant": {
        "id": "12402",
        "name": "myorg.com"
      },
      "organization": {
        "id": "10084a8d-113f-4211-a0d5-efe36b082211",
        "name": "myorg",
        "orgHandle": "myorg.com",
        "depth": 0
      },
      "userStore": {
        "id": "UFJJTUFSWQ==",
        "name": "PRIMARY"
      },
      "application": {
        "id": "eb395ddd-1280-46e9-98fb-810948c1dab4",
        "name": "Test App"
      },
      "session": {
        "id": "68d1f2861461c69d8e821d91839bbf8e23ef04fb96c1ac655f452d94d1fd6e4d",
        "loginTime": 1755541960025,
        "applications": [
          {
            "id": "eb395ddd-1280-46e9-98fb-810948c1dab4",
            "name": "Test App"
          }
        ]
      },
      "action": "LOGIN"
    }
  }
}

The events object contains the actual event data for a session establishment, identified by the URI https://schemas.identity.wso2.org/events/session/event-type/sessionEstablished. This URI signifies a new session establishment event.

The table below explains each property in the event data.

Property	Description
user	Contains information about the user who established the session.
tenant	Represents the root organization (tenant) under which the session gets established.
organization	Represents the organization under which the session gets established.
userStore	Indicates the user store that manages the user's data.
application	Contains information about the application through which the session gets established.
session	Contains details about the established session including: id: Unique identifier for the session loginTime: Timestamp when the session gets created applications: Array of applications associated with this session
initiatorType	Indicates whether an administrator, user, or application initiated the event.
initiatorIpAddress	Indicates the IP address of the initiator that triggered the event.
action	Indicates the flow that triggered the event. The value is `LOGIN`.

Session presented event¶

WSO2 Identity Server sends a sessionPresented event when an existing session gets used for authentication.

Example payload:

{
  "iss": "https://localhost:9443/t/myorg.com",
  "jti": "2837280b-5229-462a-afb6-dc84e97ca152",
  "iat": 1755541961796,
  "rci": "60f7dd4f-a791-4135-94d6-d26795629361",
  "events": {
    "https://schemas.identity.wso2.org/events/session/event-type/sessionPresented": {
      "initiatorType": "USER",
      "initiatorIpAddress": "203.0.113.10",
      "user": {
        "id": "1801d35e-1339-4c16-9c53-61321cf37fb9",
        "claims": [
          {
            "uri": "http://wso2.org/claims/username",
            "value": "peter"
          }
        ],
        "organization": {
          "id": "10084a8d-113f-4211-a0d5-efe36b082211",
          "name": "myorg",
          "orgHandle": "myorg.com",
          "depth": 0
        },
        "ref": "https://localhost:9443/t/myorg.com/scim2/Users/1801d35e-1339-4c16-9c53-61321cf37fb9"
      },
      "tenant": {
        "id": "12402",
        "name": "myorg.com"
      },
      "organization": {
        "id": "10084a8d-113f-4211-a0d5-efe36b082211",
        "name": "myorg",
        "orgHandle": "myorg.com",
        "depth": 0
      },
      "userStore": {
        "id": "UFJJTUFSWQ==",
        "name": "PRIMARY"
      },
      "application": {
        "id": "eb395ddd-1280-46e9-98fb-810948c1dab4",
        "name": "Test App"
      },
      "session": {
        "id": "68d1f2861461c69d8e821d91839bbf8e23ef04fb96c1ac655f452d94d1fd6e4d",
        "loginTime": 1755541961792,
        "applications": [
          {
            "id": "eb395ddd-1280-46e9-98fb-810948c1dab4",
            "name": "Test App"
          }
        ]
      },
      "action": "LOGIN"
    }
  }
}

The events object contains the actual event data for a session presentation, identified by the URI https://schemas.identity.wso2.org/events/session/event-type/sessionPresented. This URI signifies a session presentation event.

The table below explains each property in the event data.

Property	Description
user	Contains information about the user whose session gets presented.
tenant	Represents the root organization (tenant) under which the session gets presented.
organization	Represents the organization under which the session gets presented.
userStore	Indicates the user store that manages the user's data.
application	Contains information about the application that requested the session presentation.
session	Contains details about the presented session including: id: Unique identifier for the session loginTime: Timestamp when the session originally started applications: Array of applications associated with this session
initiatorType	Indicates whether an administrator, user, or application initiated the event.
initiatorIpAddress	Indicates the IP address of the initiator that triggered the event.
action	Indicates the flow that triggered the event. The value is `LOGIN`.

Session revoked event¶

WSO2 Identity Server sends a sessionRevoked event when one or more user sessions get revoked.

Example payload:

{
  "iss": "https://localhost:9443/t/myorg.com",
  "jti": "61503199-bdf7-4f44-8f50-60c78bf419ad",
  "iat": 1755541966644,
  "rci": "48eaeb32-76c0-4af8-b04e-9ce0c00cb61f",
  "events": {
    "https://schemas.identity.wso2.org/events/session/event-type/sessionRevoked": {
      "initiatorType": "USER",
      "initiatorIpAddress": "203.0.113.10",
      "user": {
        "id": "1801d35e-1339-4c16-9c53-61321cf37fb9",
        "claims": [
          {
            "uri": "http://wso2.org/claims/username",
            "value": "peter"
          }
        ],
        "organization": {
          "id": "10084a8d-113f-4211-a0d5-efe36b082211",
          "name": "myorg",
          "orgHandle": "myorg.com",
          "depth": 0
        },
        "ref": "https://localhost:9443/t/myorg.com/scim2/Users/1801d35e-1339-4c16-9c53-61321cf37fb9"
      },
      "tenant": {
        "id": "12402",
        "name": "myorg.com"
      },
      "organization": {
        "id": "10084a8d-113f-4211-a0d5-efe36b082211",
        "name": "myorg",
        "orgHandle": "myorg.com",
        "depth": 0
      },
      "userStore": {
        "id": "UFJJTUFSWQ==",
        "name": "PRIMARY"
      },
      "sessions": [
        {
          "id": "68d1f2861461c69d8e821d91839bbf8e23ef04fb96c1ac655f452d94d1fd6e4d",
          "loginTime": 1755541961792,
          "applications": [
            {
              "id": "eb395ddd-1280-46e9-98fb-810948c1dab4",
              "name": "Test App"
            }
          ]
        }
      ],
      "action": "LOGOUT"
    }
  }
}

The events object contains the actual event data for a session revocation, identified by the URI https://schemas.identity.wso2.org/events/session/event-type/sessionRevoked. This URI signifies a session revocation event.

The table below explains each property in the event data.

Property	Description
user	Contains information about the user whose sessions get revoked.
tenant	Represents the root organization (tenant) that processes the session revocation.
organization	Represents the organization that processes the session revocation.
userStore	Indicates the user store that manages the user's data.
sessions	Array of revoked sessions. Each session contains: id: Unique identifier for the revoked session loginTime: Timestamp when the session originally started applications: Array of applications that lost access due to session revocation

Credential update events¶

WSO2 Identity Server sends a credentialUpdated event when a user successfully updates credential information. This event currently triggers only for password updates.

Example payload:

{
  "iss": "https://localhost:9443/t/myorg.com",
  "jti": "24fc890a-41c5-4397-9cc9-b9f48102384e",
  "iat": 1751566637663,
  "rci": "05268edb-9a87-4656-87c0-0fb674dd03b1",
  "events": {
    "https://schemas.identity.wso2.org/events/credential/event-type/credentialUpdated": {
      "initiatorType": "ADMIN",
      "initiatorIpAddress": "203.0.113.10",
      "user": {
        "id": "85071750-3d1f-4ba4-b58f-991532e2742b",
        "claims": [
          {
            "uri": "http://wso2.org/claims/emailaddress",
            "value": "[email protected]"
          }
        ],
        "organization": {
          "id": "6f8d17ae-1ad5-441b-b9e0-c7731e739e94",
          "name": "myorg",
          "orgHandle": "myorg.com",
          "depth": 0
        },
        "ref": "https://localhost:9443/t/myorg.com/scim2/Users/85071750-3d1f-4ba4-b58f-991532e2742b"
      },
      "tenant": {
        "id": "12402",
        "name": "myorg.com"
      },
      "organization": {
        "id": "6f8d17ae-1ad5-441b-b9e0-c7731e739e94",
        "name": "myorg",
        "orgHandle": "myorg.com",
        "depth": 0
      },
      "userStore": {
        "id": "UFJJTUFSWQ==",
        "name": "PRIMARY"
      },
      "credentialType": "PASSWORD",
      "action": "UPDATE"
    }
  }
}

The events object contains the actual event data for a credential update, identified by the URI https://schemas.identity.wso2.org/events/credential/event-type/credentialUpdated. This URI signifies a successful credential update event.

The table below explains each property in the event data.

Property	Description
user	Contains information about the user whose credential updated.
tenant	Represents the root organization (tenant) that processed the credential update.
organization	Represents the organization that processed the credential update.
userStore	Indicates the user store that manages the user's data.
credentialType	Shows which credential the user updates. Currently shows "PASSWORD" as events trigger only for password updates.
initiatorType	Indicates whether an administrator, user, or application initiated the password update. Refer to `initiatorType` and `action` properties for details.
initiatorIpAddress	Indicates the IP address of the initiator that triggered the event.
action	Indicates whether the password update uses a reset flow, update flow, or invite flow. Refer to `initiatorType` and `action` properties for details.

`initiatorType` and `action` properties for credential update events¶

The initiatorType and the action property together show which flow triggers a password update.

The table below explains how these properties differ based on each flow.

Flow	Value of initiatorType	Value of action	Description
User initiated password update	USER	UPDATE	Occurs when a user updates their password through profile settings in My Account app or via SCIM 2.0 Me API .
User initiated password reset	USER	RESET	Occurs when a user forgets their password and initiates a reset flow to regain account access.
Admin initiated password update	ADMIN	UPDATE	Occurs when an administrator updates a user's password directly via console or SCIM 2.0 Users API.
Admin initiated password reset	ADMIN	RESET	Occurs when an administrator initiates a forced password reset and the user resets the password via that request.
Admin initiated user invite to set password	ADMIN	INVITE	Occurs when an administrator invites a new user to join the system. The user then sets their password.
Application initiated password update	APPLICATION	UPDATE	Occurs when an application with appropriate permissions automatically updates a user's password. This happens during automated user provisioning or integration with external identity management systems via SCIM 2.0 Users API.

User account management events¶

WSO2 Identity Server dispatches webhook events for changes to user profiles and account statuses. These events provide detailed context for each action, helping you synchronize external systems with user data and manage user lifecycle within your applications.

User created event¶

WSO2 Identity Server sends a userCreated event when a new user account gets created in the system.

This event triggers when administrators, applications, or users create accounts through various flows like direct registration, invitations, or automated provisioning.

Example payload:

{
  "iss": "https://localhost:9443/t/myorg.com",
  "jti": "b6148a40-9e3c-45c4-b57d-85c7da482ad5",
  "iat": 1755618921154,
  "rci": "dca8d1d5-5a8f-4141-aac6-2abcb27fd168",
  "events": {
    "https://schemas.identity.wso2.org/events/user/event-type/userCreated": {
      "initiatorType": "ADMIN",
      "initiatorIpAddress": "203.0.113.10",
      "user": {
        "id": "3987d74e-8432-4f4d-b1a8-cad463af843d",
        "claims": [
          {
            "uri": "http://wso2.org/claims/username",
            "value": "[email protected]"
          },
          {
            "uri": "http://wso2.org/claims/emailaddress",
            "value": "[email protected]"
          },
          {
            "uri": "http://wso2.org/claims/lastname",
            "value": "Doe"
          },
          {
            "uri": "http://wso2.org/claims/givenname",
            "value": "John"
          }
        ],
        "organization": {
          "id": "10084a8d-113f-4211-a0d5-efe36b082211",
          "name": "myorg",
          "orgHandle": "myorg.com",
          "depth": 0
        },
        "ref": "https://localhost:9443/t/myorg.com/scim2/Users/3987d74e-8432-4f4d-b1a8-cad463af843d"
      },
      "tenant": {
        "id": "12402",
        "name": "myorg.com"
      },
      "organization": {
        "id": "10084a8d-113f-4211-a0d5-efe36b082211",
        "name": "myorg",
        "orgHandle": "myorg.com",
        "depth": 0
      },
      "userStore": {
        "id": "UFJJTUFSWQ==",
        "name": "PRIMARY"
      },
      "action": "REGISTER"
    }
  }
}

The events object contains the actual event data for a user creation, identified by the URI https://schemas.identity.wso2.org/events/user/event-type/userCreated. This URI signifies a successful user creation event.

The table below explains each property in the event data.

Property	Description
user	Contains information about the newly created user including user claims and organization details.
tenant	Represents the root organization (tenant) that processed the user creation.
organization	Represents the organization that processed the user creation.
userStore	Indicates the user store that manages the user's data.
initiatorType	Indicates whether an administrator, user, or application initiated the user creation.
initiatorIpAddress	Indicates the IP address of the initiator that triggered the event.
action	Shows the user creation flow type. Can have values like `REGISTER` for direct registration or `INVITE` for invitation-based creation.

User profile updated event¶

WSO2 Identity Server sends a userProfileUpdated event when a user updates profile information.

Example payload:

{
  "iss": "https://localhost:9443/t/myorg.com",
  "jti": "2371a91d-66e8-400b-a8de-6e8ee2b8175e",
  "iat": 1751569642578,
  "rci": "05268edb-9a87-4656-87c0-0fb674dd03b1",
  "events": {
    "https://schemas.identity.wso2.org/events/user/event-type/userProfileUpdated": {
      "initiatorType": "ADMIN",
      "initiatorIpAddress": "203.0.113.10",
      "user": {
        "id": "85071750-3d1f-4ba4-b58f-991532e2742b",
        "organization": {
          "id": "6f8d17ae-1ad5-441b-b9e0-c7731e739e94",
          "name": "myorg",
          "orgHandle": "myorg.com",
          "depth": 0
        },
        "ref": "https://localhost:9443/t/myorg.com/scim2/Users/85071750-3d1f-4ba4-b58f-991532e2742b",
        "addedClaims": [
          {
            "uri": "http://wso2.org/claims/organization",
            "value": "myorg"
          }
        ],
        "updatedClaims": [
          {
            "uri": "http://wso2.org/claims/emailAddresses",
            "value": "[email protected]"
          }
        ]
      },
      "tenant": {
        "id": "12402",
        "name": "myorg.com"
      },
      "organization": {
        "id": "6f8d17ae-1ad5-441b-b9e0-c7731e739e94",
        "name": "myorg",
        "orgHandle": "myorg.com",
        "depth": 0
      },
      "userStore": {
        "id": "UFJJTUFSWQ==",
        "name": "PRIMARY"
      },
      "action": "UPDATE"
    }
  }
}

The events object contains the actual event data for a user profile update, identified by the URI https://schemas.identity.wso2.org/events/user/event-type/userProfileUpdated. This URI signifies a successful user profile update event.

The table below explains each property in the event data.

Property	Description
user	Contains information about the user whose profile updated. This includes: addedClaims: Array of claims (attributes) newly added to the user's profile during the update updatedClaims: Array of claims (attributes) that the update process changes in the user's profile removedClaims: Array of claims (attributes) that the update process removes from the user's profile
tenant	Represents the root organization (tenant) that processed the profile update.
organization	Represents the organization that processed the profile update.
userStore	Indicates the user store that manages the user's data.
initiatorType	Indicates whether an administrator, user, or application initiated the profile update.
initiatorIpAddress	Indicates the IP address of the initiator that triggered the event.
action	Shows the profile update flow type. Currently has the value `UPDATE`, indicating a standard profile update flow.

User disabled event¶

WSO2 Identity Server sends a userDisabled event when a user account gets disabled.

Example payload:

{
  "iss": "https://localhost:9443/t/myorg.com",
  "jti": "d32b6be7-1675-4e7d-b118-7346ad53c046",
  "iat": 1751570468806,
  "rci": "05268edb-9a87-4656-87c0-0fb674dd03b1",
  "events": {
    "https://schemas.identity.wso2.org/events/user/event-type/userDisabled": {
      "initiatorType": "ADMIN",
      "initiatorIpAddress": "203.0.113.10",
      "user": {
        "id": "85071750-3d1f-4ba4-b58f-991532e2742b",
        "claims": [
          {
            "uri": "http://wso2.org/claims/emailaddress",
            "value": "[email protected]"
          }
        ],
        "organization": {
          "id": "6f8d17ae-1ad5-441b-b9e0-c7731e739e94",
          "name": "myorg",
          "orgHandle": "myorg.com",
          "depth": 0
        },
        "ref": "https://localhost:9443/t/myorg.com/scim2/Users/85071750-3d1f-4ba4-b58f-991532e2742b"
      },
      "tenant": {
        "id": "12402",
        "name": "myorg.com"
      },
      "organization": {
        "id": "6f8d17ae-1ad5-441b-b9e0-c7731e739e94",
        "name": "myorg",
        "orgHandle": "myorg.com",
        "depth": 0
      },
      "userStore": {
        "id": "UFJJTUFSWQ==",
        "name": "PRIMARY"
      },
      "action": "USER_ACCOUNT_DISABLE"
    }
  }
}

The events object contains the actual event data for a user disabled event, identified by the URI https://schemas.identity.wso2.org/events/user/event-type/userDisabled. This URI signifies a successful user account disablement.

The table below explains each property in the event data.

Property	Description
user	Contains information about the user.
tenant	Represents the root organization (tenant) that processed the user disablement.
organization	Represents the organization that processed the user disablement.
userStore	Indicates the user store that manages the user's data.
initiatorType	Indicates whether an administrator or application initiated the user disablement.
initiatorIpAddress	Indicates the IP address of the initiator that triggered the event.
action	Indicates the flow that triggered the event. The value is `USER_ACCOUNT_DISABLE`.

User enabled event¶

WSO2 Identity Server sends a userEnabled event when a user account gets enabled. This event signifies that a previously disabled user account becomes reactivated.

Example payload:

{
  "iss": "https://localhost:9443/t/myorg.com",
  "jti": "285a876f-ea57-47b6-9a9d-fc452a04413a",
  "iat": 1751570713348,
  "rci": "05268edb-9a87-4656-87c0-0fb674dd03b1",
  "events": {
    "https://schemas.identity.wso2.org/events/user/event-type/userEnabled": {
      "initiatorType": "ADMIN",
      "initiatorIpAddress": "203.0.113.10",
      "user": {
        "id": "85071750-3d1f-4ba4-b58f-991532e2742b",
        "claims": [
          {
            "uri": "http://wso2.org/claims/emailaddress",
            "value": "[email protected]"
          }
        ],
        "organization": {
          "id": "6f8d17ae-1ad5-441b-b9e0-c7731e739e94",
          "name": "myorg",
          "orgHandle": "myorg.com",
          "depth": 0
        },
        "ref": "https://localhost:9443/t/myorg.com/scim2/Users/85071750-3d1f-4ba4-b58f-991532e2742b"
      },
      "tenant": {
        "id": "12402",
        "name": "myorg.com"
      },
      "organization": {
        "id": "6f8d17ae-1ad5-441b-b9e0-c7731e739e94",
        "name": "myorg",
        "orgHandle": "myorg.com",
        "depth": 0
      },
      "userStore": {
        "id": "UFJJTUFSWQ==",
        "name": "PRIMARY"
      },
      "action": "USER_ACCOUNT_ENABLE"
    }
  }
}

The events object contains the actual event data for a user enabled event, identified by the URI https://schemas.identity.wso2.org/events/user/event-type/userEnabled. This URI signifies a successful user account enablement.

The table below explains each property in the event data.

Property	Description
user	Contains information about the user whose account enabled.
tenant	Represents the root organization (tenant) that processed the user enablement.
organization	Represents the organization that processed the user enablement.
userStore	Indicates the user store that manages the user's data.
initiatorType	Indicates whether an administrator or application initiated the user enablement.
initiatorIpAddress	Indicates the IP address of the initiator that triggered the event.
action	Indicates the flow that triggered the event. The value is `USER_ACCOUNT_ENABLE`.

User account locked event¶

WSO2 Identity Server sends a userAccountLocked event when a user account gets locked.

This event triggers when accounts get locked due to failed login attempts, administrative action, or security policies. Locked accounts prevent users from authenticating until unlocked.

Example payload:

{
  "iss": "https://localhost:9443/t/myorg.com",
  "jti": "5ab9d903-a718-4e71-9a16-314203f02778",
  "iat": 1755619049121,
  "rci": "24b22c09-ae39-4942-896f-5c14fd18b4e0",
  "events": {
    "https://schemas.identity.wso2.org/events/user/event-type/userAccountLocked": {
      "initiatorType": "ADMIN",
      "initiatorIpAddress": "203.0.113.10",
      "user": {
        "id": "3987d74e-8432-4f4d-b1a8-cad463af843d",
        "claims": [
          {
            "uri": "http://wso2.org/claims/emailaddress",
            "value": "[email protected]"
          }
        ],
        "organization": {
          "id": "10084a8d-113f-4211-a0d5-efe36b082211",
          "name": "myorg",
          "orgHandle": "myorg.com",
          "depth": 0
        },
        "ref": "https://localhost:9443/t/myorg.com/scim2/Users/3987d74e-8432-4f4d-b1a8-cad463af843d"
      },
      "tenant": {
        "id": "12402",
        "name": "myorg.com"
      },
      "organization": {
        "id": "10084a8d-113f-4211-a0d5-efe36b082211",
        "name": "myorg",
        "orgHandle": "myorg.com",
        "depth": 0
      },
      "userStore": {
        "id": "UFJJTUFSWQ==",
        "name": "PRIMARY"
      },
      "action": "USER_ACCOUNT_LOCK"
    }
  }
}

The events object contains the actual event data for a user account locked event, identified by the URI https://schemas.identity.wso2.org/events/user/event-type/userAccountLocked. This URI signifies a user account lock event.

The table below explains each property in the event data.

Property	Description
user	Contains information about the user whose account got locked.
tenant	Represents the root organization (tenant) that processed the account locking.
organization	Represents the organization that processed the account locking.
userStore	Indicates the user store that manages the user's data.
initiatorType	Indicates whether an administrator, user, or application initiated the event.
initiatorIpAddress	Indicates the IP address of the initiator that triggered the event.
action	Indicates the flow that triggered the event. The value is `USER_ACCOUNT_LOCK`.

User account unlocked event¶

WSO2 Identity Server sends a userAccountUnlocked event when a user account gets unlocked.

This event triggers when locked accounts get restored to normal status through administrative action or automatic timeout policies. Unlocked accounts allow users to authenticate again.

Example payload:

{
  "iss": "https://localhost:9443/t/myorg.com",
  "jti": "7bf8f4ce-816e-46a2-8964-99682ece9084",
  "iat": 1755619053135,
  "rci": "e26aade5-ad74-4e5f-a98b-762bd218197e",
  "events": {
    "https://schemas.identity.wso2.org/events/user/event-type/userAccountUnlocked": {
      "initiatorType": "ADMIN",
      "initiatorIpAddress": "203.0.113.10",
      "user": {
        "id": "3987d74e-8432-4f4d-b1a8-cad463af843d",
        "claims": [
          {
            "uri": "http://wso2.org/claims/emailaddress",
            "value": "[email protected]"
          }
        ],
        "organization": {
          "id": "10084a8d-113f-4211-a0d5-efe36b082211",
          "name": "myorg",
          "orgHandle": "myorg.com",
          "depth": 0
        },
        "ref": "https://localhost:9443/t/myorg.com/scim2/Users/3987d74e-8432-4f4d-b1a8-cad463af843d"
      },
      "tenant": {
        "id": "12402",
        "name": "myorg.com"
      },
      "organization": {
        "id": "10084a8d-113f-4211-a0d5-efe36b082211",
        "name": "myorg",
        "orgHandle": "myorg.com",
        "depth": 0
      },
      "userStore": {
        "id": "UFJJTUFSWQ==",
        "name": "PRIMARY"
      },
      "action": "USER_ACCOUNT_UNLOCK"
    }
  }
}

The events object contains the actual event data for a user account unlocked event, identified by the URI https://schemas.identity.wso2.org/events/user/event-type/userAccountUnlocked. This URI signifies a user account unlock event.

The table below explains each property in the event data.

Property	Description
user	Contains information about the user whose account got unlocked.
tenant	Represents the root organization (tenant) that processed the account unlocking.
organization	Represents the organization that processed the account unlocking.
userStore	Indicates the user store that manages the user's data.
initiatorType	Indicates whether an administrator, user, or application initiated the event.
initiatorIpAddress	Indicates the IP address of the initiator that triggered the event.
action	Indicates the flow that triggered the event. The value is `USER_ACCOUNT_UNLOCK`.

User deleted event¶

WSO2 Identity Server sends a userDeleted event when a user account gets deleted.

Example Payload:

{
  "iss": "https://localhost:9443/t/myorg.com",
  "jti": "21f03016-632d-4266-9e8b-8863001109f2",
  "iat": 1751571143534,
  "rci": "05268edb-9a87-4656-87c0-0fb674dd03b1",
  "events": {
    "https://schemas.identity.wso2.org/events/user/event-type/userDeleted": {
      "initiatorType": "ADMIN",
      "initiatorIpAddress": "203.0.113.10",
      "user": {
        "id": "0bd61ecd-e974-41e6-a962-8b712090240f",
        "claims": [
          {
            "uri": "http://wso2.org/claims/username",
            "value": "[email protected]"
          }
        ],
        "organization": {
          "id": "6f8d17ae-1ad5-441b-b9e0-c7731e739e94",
          "name": "myorg",
          "orgHandle": "myorg.com",
          "depth": 0
        },
        "ref": "https://localhost:9443/t/myorg.com/scim2/Users/0bd61ecd-e974-41e6-a962-8b712090240f"
      },
      "tenant": {
        "id": "12402",
        "name": "myorg.com"
      },
      "organization": {
        "id": "6f8d17ae-1ad5-441b-b9e0-c7731e739e94",
        "name": "myorg",
        "orgHandle": "myorg.com",
        "depth": 0
      },
      "userStore": {
        "id": "UFJJTUFSWQ==",
        "name": "PRIMARY"
      },
      "action": "USER_ACCOUNT_DELETE"
    }
  }
}

The events object contains the actual event data for a user deleted event, identified by the URI https://schemas.identity.wso2.org/events/user/event-type/userDeleted. This URI signifies a user account deletion.

The table below explains each property in the event data.

Property	Description
user	Contains information about the user whose account got deleted.
tenant	Represents the root organization (tenant) that processed the user deletion.
organization	Represents the organization that processed the user deletion.
userStore	Indicates the user store that managed the user's data.
initiatorType	Indicates whether an administrator or application initiated the user deletion.
initiatorIpAddress	Indicates the IP address of the initiator that triggered the event.
action	Indicates the flow that triggered the event. The value is `USER_ACCOUNT_DELETE`.

Role management events¶

WSO2 Identity Server dispatches webhook events for role lifecycle changes and role assignment updates. Each event provides detailed context, helping you keep external systems in sync with your role definitions, memberships, and permissions.

Role created event¶

WSO2 Identity Server sends a roleCreated event when a new role gets created.

Example payload:

{
  "iss": "https://localhost:9443/t/myorg.com",
  "jti": "9befa02f-6977-472a-8450-09c391b6ba45",
  "iat": 1783322160021,
  "rci": "accdbb61-d005-41ab-8760-58fd7a539bf9",
  "events": {
    "https://schemas.identity.wso2.org/events/role/event-type/roleCreated": {
      "initiatorType": "ADMIN",
      "initiatorIpAddress": "127.0.0.1",
      "tenant": {
        "id": "12402",
        "name": "myorg.com"
      },
      "organization": {
        "id": "10084a8d-113f-4211-a0d5-efe36b082211",
        "name": "myorg",
        "orgHandle": "myorg.com",
        "depth": 0
      },
      "action": "ROLE_CREATE",
      "role": {
        "id": "1fad5996-3418-4883-925d-a319e3bb8e72",
        "name": "ROLE",
        "audience": {
          "type": "application",
          "value": "6db0975b-9f7c-42d1-a8b4-895a77d23cff",
          "display": "Sample Application"
        },
        "ref": "https://localhost:9443/scim2/v2/Roles/1fad5996-3418-4883-925d-a319e3bb8e72",
        "users": [
          {
            "id": "6c7f23d9-8083-4bf7-ab2c-885aa9faa186",
            "userStoreDomain": "PRIMARY",
            "claims": [
              {
                "uri": "http://wso2.org/claims/username",
                "value": "abcuser"
              }
            ]
          }
        ],
        "groups": [
          {
            "id": "da2aeb94-aebf-4846-b611-1865cf85aea5",
            "groupName": "sales",
            "userStoreDomain": "PRIMARY"
          }
        ],
        "permissions": [
          "internal_session_view"
        ]
      }
    }
  }
}

The events object contains the actual event data for a role creation, identified by the URI https://schemas.identity.wso2.org/events/role/event-type/roleCreated. This URI signifies a successful role creation event.

The table below explains each property in the event data.

Property	Description
role	Contains details about the created role including: id: Unique identifier of the role name: Display name of the role audience: The audience the role is scoped to. Contains `type`, `value`, and `display`, where `type` is either `organization` or `application`. For an organization-scoped role, `value` is the organization id and `display` is the organization name. For an application-scoped role, `value` is the application id and `display` is the application name. ref: SCIM v2 reference URL for the role users: Array of users assigned to the role at creation. Present only when the role is created with users. Each entry contains the user `id`, `userStoreDomain`, and `claims`. groups: Array of local groups assigned to the role at creation. Present only when the role is created with groups. Each entry contains the group `id`, `groupName`, and `userStoreDomain`. permissions: Array of permission names granted to the role at creation. Present only when the role is created with permissions.
tenant	Represents the root organization (tenant) under which the role gets created.
organization	Represents the organization under which the role gets created.
initiatorType	Indicates whether an administrator or application initiated the role creation.
initiatorIpAddress	Indicates the IP address of the initiator that triggered the event.
action	Indicates the flow that triggered the event. The value is `ROLE_CREATE` for a role creation.

Role metadata updated event¶

WSO2 Identity Server sends a roleMetaUpdated event when role metadata (for example the role name) gets updated.

Example payload:

{
  "iss": "https://localhost:9443/t/myorg.com",
  "jti": "cead6c7f-a38c-4752-9485-56af37c1db5f",
  "iat": 1783322212811,
  "rci": "ad969f38-830c-41e7-b4c1-6f5544544921",
  "events": {
    "https://schemas.identity.wso2.org/events/role/event-type/roleMetaUpdated": {
      "initiatorType": "ADMIN",
      "initiatorIpAddress": "127.0.0.1",
      "tenant": {
        "id": "12402",
        "name": "myorg.com"
      },
      "organization": {
        "id": "10084a8d-113f-4211-a0d5-efe36b082211",
        "name": "myorg",
        "orgHandle": "myorg.com",
        "depth": 0
      },
      "action": "ROLE_UPDATE",
      "role": {
        "id": "1fad5996-3418-4883-925d-a319e3bb8e72",
        "name": "ROLE-updated",
        "audience": {
          "type": "application",
          "value": "6db0975b-9f7c-42d1-a8b4-895a77d23cff",
          "display": "Sample Application"
        },
        "ref": "https://localhost:9443/scim2/v2/Roles/1fad5996-3418-4883-925d-a319e3bb8e72"
      }
    }
  }
}

The events object contains the actual event data for a role metadata update, identified by the URI https://schemas.identity.wso2.org/events/role/event-type/roleMetaUpdated. This URI signifies a role metadata update event.

The table below explains each property in the event data.

Property	Description
role	Contains details about the updated role including: id: Unique identifier of the role name: Current display name of the role after the update audience: The audience the role is scoped to (`type`, `value`, `display`). ref: SCIM v2 reference URL for the role
tenant	Represents the root organization (tenant) that processed the role metadata update.
organization	Represents the organization that processed the role metadata update.
initiatorType	Indicates whether an administrator or application initiated the role metadata update.
initiatorIpAddress	Indicates the IP address of the initiator that triggered the event.
action	Indicates the flow that triggered the event. The value is `ROLE_UPDATE` for a role update.

Role deleted event¶

WSO2 Identity Server sends a roleDeleted event when a role gets deleted.

Example payload:

{
  "iss": "https://localhost:9443/t/myorg.com",
  "jti": "361f4c4c-e35e-43bb-a52d-864a4b659f2f",
  "iat": 1783322224574,
  "rci": "90b7008c-50f5-411e-b2fe-f67b1b632d77",
  "events": {
    "https://schemas.identity.wso2.org/events/role/event-type/roleDeleted": {
      "initiatorType": "ADMIN",
      "initiatorIpAddress": "127.0.0.1",
      "tenant": {
        "id": "12402",
        "name": "myorg.com"
      },
      "organization": {
        "id": "10084a8d-113f-4211-a0d5-efe36b082211",
        "name": "myorg",
        "orgHandle": "myorg.com",
        "depth": 0
      },
      "action": "APPLICATION_UPDATE",
      "role": {
        "id": "1fad5996-3418-4883-925d-a319e3bb8e72",
        "name": "ROLE",
        "audience": {
          "type": "application",
          "value": "6db0975b-9f7c-42d1-a8b4-895a77d23cff",
          "display": "Sample Application"
        }
      }
    }
  }
}

The events object contains the actual event data for a role deletion, identified by the URI https://schemas.identity.wso2.org/events/role/event-type/roleDeleted. This URI signifies a role deletion event.

The table below explains each property in the event data.

Property	Description
role	Contains details about the deleted role including: id: Unique identifier of the deleted role name: Display name of the deleted role audience: The audience the role is scoped to (`type`, `value`, `display`).
tenant	Represents the root organization (tenant) that processed the role deletion.
organization	Represents the organization that processed the role deletion.
initiatorType	Indicates whether an administrator or application initiated the role deletion.
initiatorIpAddress	Indicates the IP address of the initiator that triggered the event.
action	Indicates what triggered the role deletion. The value is `ROLE_DELETE` when an administrator deletes a role directly, `APPLICATION_UPDATE` when a role is removed from an application's Roles section, and `APPLICATION_DELETE` when the role is deleted as part of application deletion. Refer to `initiatorType` and `action` properties for details.

Role users updated event¶

WSO2 Identity Server sends a roleUsersUpdated event when users get assigned to or unassigned from a role.

Example payload:

{
  "iss": "https://localhost:9443/t/myorg.com",
  "jti": "09a24bef-04f2-407a-a061-e851d0a8d581",
  "iat": 1783322202677,
  "rci": "1bab73e8-d1fe-4469-89fc-41488aa718fb",
  "events": {
    "https://schemas.identity.wso2.org/events/role/event-type/roleUsersUpdated": {
      "initiatorType": "ADMIN",
      "initiatorIpAddress": "127.0.0.1",
      "tenant": {
        "id": "12402",
        "name": "myorg.com"
      },
      "organization": {
        "id": "10084a8d-113f-4211-a0d5-efe36b082211",
        "name": "myorg",
        "orgHandle": "myorg.com",
        "depth": 0
      },
      "action": "ROLE_UPDATE",
      "role": {
        "id": "1fad5996-3418-4883-925d-a319e3bb8e72",
        "name": "ROLE",
        "audience": {
          "type": "application",
          "value": "6db0975b-9f7c-42d1-a8b4-895a77d23cff",
          "display": "Sample Application"
        },
        "ref": "https://localhost:9443/scim2/v2/Roles/1fad5996-3418-4883-925d-a319e3bb8e72",
        "removedUsers": [
          {
            "id": "6c7f23d9-8083-4bf7-ab2c-885aa9faa186",
            "userStoreDomain": "PRIMARY",
            "claims": [
              {
                "uri": "http://wso2.org/claims/username",
                "value": "abcuser"
              }
            ]
          }
        ],
        "addedUsers": [
          {
            "id": "311b60cf-da6f-4378-8cd1-31e3e7026f4d",
            "userStoreDomain": "AGENT",
            "claims": [
              {
                "uri": "http://wso2.org/claims/username",
                "value": "311b60cf-da6f-4378-8cd1-31e3e7026f4d"
              },
              {
                "uri": "http://wso2.org/claims/agent/Name",
                "value": "NewAgent"
              }
            ]
          }
        ]
      }
    }
  }
}

The events object contains the actual event data for a role user assignment update, identified by the URI https://schemas.identity.wso2.org/events/role/event-type/roleUsersUpdated. This URI signifies a role user assignment update event.

The table below explains each property in the event data.

Property	Description
role	Contains details about the role whose user assignments got updated, including: id: Unique identifier of the role name: Display name of the role audience: The audience the role is scoped to (`type`, `value`, `display`). ref: SCIM v2 reference URL for the role addedUsers: Array of users assigned to the role in this update. Each entry contains the user `id`, `userStoreDomain`, and `claims`. removedUsers: Array of users unassigned from the role in this update. Each entry contains the user `id`, `userStoreDomain`, and `claims`.
tenant	Represents the root organization (tenant) that processed the role user assignment update.
organization	Represents the organization that processed the role user assignment update.
initiatorType	Indicates whether an administrator or application initiated the role user assignment update.
initiatorIpAddress	Indicates the IP address of the initiator that triggered the event.
action	Indicates the flow that triggered the event. The value is `ROLE_UPDATE` for a role update.

Role groups updated event¶

WSO2 Identity Server sends a roleGroupsUpdated event when local groups get assigned to or unassigned from a role.

Example payload:

{
  "iss": "https://localhost:9443/t/myorg.com",
  "jti": "be85978e-5ac6-48a1-ae54-24c292f1f3c3",
  "iat": 1783322195097,
  "rci": "fd338a56-569b-4b1f-a9e3-9bffade3b481",
  "events": {
    "https://schemas.identity.wso2.org/events/role/event-type/roleGroupsUpdated": {
      "initiatorType": "ADMIN",
      "initiatorIpAddress": "127.0.0.1",
      "tenant": {
        "id": "12402",
        "name": "myorg.com"
      },
      "organization": {
        "id": "10084a8d-113f-4211-a0d5-efe36b082211",
        "name": "myorg",
        "orgHandle": "myorg.com",
        "depth": 0
      },
      "action": "ROLE_UPDATE",
      "role": {
        "id": "1fad5996-3418-4883-925d-a319e3bb8e72",
        "name": "ROLE",
        "audience": {
          "type": "application",
          "value": "6db0975b-9f7c-42d1-a8b4-895a77d23cff",
          "display": "Sample Application"
        },
        "ref": "https://localhost:9443/scim2/v2/Roles/1fad5996-3418-4883-925d-a319e3bb8e72",
        "removedGroups": [
          {
            "id": "da2aeb94-aebf-4846-b611-1865cf85aea5",
            "groupName": "sales",
            "userStoreDomain": "PRIMARY"
          }
        ],
        "addedGroups": [
          {
            "id": "da2aeb94-aebf-4846-b611-1865cf85aea5",
            "groupName": "sales",
            "userStoreDomain": "PRIMARY"
          }
        ]
      }
    }
  }
}

The events object contains the actual event data for a role group assignment update, identified by the URI https://schemas.identity.wso2.org/events/role/event-type/roleGroupsUpdated. This URI signifies a role group assignment update event.

The table below explains each property in the event data.

Property	Description
role	Contains details about the role whose group assignments got updated, including: id: Unique identifier of the role name: Display name of the role audience: The audience the role is scoped to (`type`, `value`, `display`). ref: SCIM v2 reference URL for the role addedGroups: Array of local groups assigned to the role in this update. Each entry contains the group `id`, `groupName`, and `userStoreDomain`. removedGroups: Array of local groups unassigned from the role in this update. Each entry contains the group `id`, `groupName`, and `userStoreDomain`.
tenant	Represents the root organization (tenant) that processed the role group assignment update.
organization	Represents the organization that processed the role group assignment update.
initiatorType	Indicates whether an administrator or application initiated the role group assignment update.
initiatorIpAddress	Indicates the IP address of the initiator that triggered the event.
action	Indicates the flow that triggered the event. The value is `ROLE_UPDATE` for a role update.

Role IdP groups updated event¶

WSO2 Identity Server sends a roleIdpGroupsUpdated event when federated identity provider (IdP) groups get assigned to or unassigned from a role.

Example payload:

{
  "iss": "https://localhost:9443/t/myorg.com",
  "jti": "d443cbd9-82c5-4397-8d2d-b1b143f13905",
  "iat": 1783322195104,
  "rci": "fd338a56-569b-4b1f-a9e3-9bffade3b481",
  "events": {
    "https://schemas.identity.wso2.org/events/role/event-type/roleIdpGroupsUpdated": {
      "initiatorType": "ADMIN",
      "initiatorIpAddress": "127.0.0.1",
      "tenant": {
        "id": "12402",
        "name": "myorg.com"
      },
      "organization": {
        "id": "10084a8d-113f-4211-a0d5-efe36b082211",
        "name": "myorg",
        "orgHandle": "myorg.com",
        "depth": 0
      },
      "action": "ROLE_UPDATE",
      "role": {
        "id": "1fad5996-3418-4883-925d-a319e3bb8e72",
        "name": "ROLE",
        "audience": {
          "type": "application",
          "value": "6db0975b-9f7c-42d1-a8b4-895a77d23cff",
          "display": "Sample Application"
        },
        "ref": "https://localhost:9443/scim2/v2/Roles/1fad5996-3418-4883-925d-a319e3bb8e72",
        "addedIdpGroups": [
          {
            "groupId": "7ae41d10-e4a1-4ed8-adc2-8644872b8783",
            "groupName": "idpgroup1",
            "idpId": "8ef35e33-b4dc-444f-8d71-3ff32e44cca9",
            "idpName": "IDP"
          }
        ]
      }
    }
  }
}

The events object contains the actual event data for a role IdP group assignment update, identified by the URI https://schemas.identity.wso2.org/events/role/event-type/roleIdpGroupsUpdated. This URI signifies a role IdP group assignment update event.

The table below explains each property in the event data.

Property	Description
role	Contains details about the role whose IdP group assignments got updated, including: id: Unique identifier of the role name: Display name of the role audience: The audience the role is scoped to (`type`, `value`, `display`). ref: SCIM v2 reference URL for the role addedIdpGroups: Array of federated IdP groups assigned to the role. Each entry contains `groupId`, `groupName`, `idpId`, and `idpName`. removedIdpGroups: Array of federated IdP groups unassigned from the role. Each entry contains `groupId`, `groupName`, `idpId`, and `idpName`.
tenant	Represents the root organization (tenant) that processed the role IdP group assignment update.
organization	Represents the organization that processed the role IdP group assignment update.
initiatorType	Indicates whether an administrator or application initiated the role IdP group assignment update.
initiatorIpAddress	Indicates the IP address of the initiator that triggered the event.
action	Indicates the flow that triggered the event. The value is `ROLE_UPDATE` for a role update.

Role permissions updated event¶

WSO2 Identity Server sends a rolePermissionsUpdated event when permissions get granted to or revoked from a role.

Example payload:

{
  "iss": "https://localhost:9443/t/myorg.com",
  "jti": "99ea2226-328e-4b60-bc8d-4d72028267e8",
  "iat": 1783322187274,
  "rci": "c607ec61-8bcc-4f2c-8b21-064f3774fdd4",
  "events": {
    "https://schemas.identity.wso2.org/events/role/event-type/rolePermissionsUpdated": {
      "initiatorType": "ADMIN",
      "initiatorIpAddress": "127.0.0.1",
      "tenant": {
        "id": "12402",
        "name": "myorg.com"
      },
      "organization": {
        "id": "10084a8d-113f-4211-a0d5-efe36b082211",
        "name": "myorg",
        "orgHandle": "myorg.com",
        "depth": 0
      },
      "action": "ROLE_UPDATE",
      "role": {
        "id": "1fad5996-3418-4883-925d-a319e3bb8e72",
        "name": "ROLE",
        "audience": {
          "type": "application",
          "value": "6db0975b-9f7c-42d1-a8b4-895a77d23cff",
          "display": "Sample Application"
        },
        "ref": "https://localhost:9443/scim2/v2/Roles/1fad5996-3418-4883-925d-a319e3bb8e72",
        "addedPermissions": [
          "internal_session_delete"
        ],
        "removedPermissions": [
          "internal_session_view"
        ]
      }
    }
  }
}

The events object contains the actual event data for a role permission update, identified by the URI https://schemas.identity.wso2.org/events/role/event-type/rolePermissionsUpdated. This URI signifies a role permission update event.

The table below explains each property in the event data.

Property	Description
role	Contains details about the role whose permissions got updated, including: id: Unique identifier of the role name: Display name of the role audience: The audience the role is scoped to (`type`, `value`, `display`). ref: SCIM v2 reference URL for the role addedPermissions: Array of permission names granted to the role in this update. removedPermissions: Array of permission names revoked from the role in this update.
tenant	Represents the root organization (tenant) that processed the role permission update.
organization	Represents the organization that processed the role permission update.
initiatorType	Indicates whether an administrator or application initiated the role permission update.
initiatorIpAddress	Indicates the IP address of the initiator that triggered the event.
action	Indicates the flow that triggered the event. The value is `ROLE_UPDATE` for a role update.

`initiatorType` and `action` properties for role management events¶

The initiatorType and the action property together show which flow triggered a role management event.

The table below explains how these properties differ based on each flow.

Webhook event	Flow	Value of `initiatorType`	Value of `action`	Description
Role created	Admin initiated role creation	ADMIN	ROLE_CREATE	Occurs when an administrator creates a role via the console or SCIM 2.0 Roles API.
Role created	Application initiated role creation	APPLICATION	ROLE_CREATE	Occurs when an application with appropriate permissions creates a role via the SCIM 2.0 Roles API.
Role metadata updated	Admin initiated role metadata update	ADMIN	ROLE_UPDATE	Occurs when an administrator updates a role's metadata via the console or SCIM 2.0 Roles API.
Role metadata updated	Application initiated role metadata update	APPLICATION	ROLE_UPDATE	Occurs when an application with appropriate permissions updates a role's metadata via the SCIM 2.0 Roles API.
Role users updated	Admin initiated user assignment update	ADMIN	ROLE_UPDATE	Occurs when an administrator assigns users to or unassigns users from a role via the console or SCIM 2.0 Roles API.
	Application initiated user assignment update	APPLICATION	ROLE_UPDATE	Occurs when an application with appropriate permissions updates a role's user assignments via the SCIM 2.0 Roles API.
	User assignment via an adaptive authentication script	USER	LOGIN	Occurs when an adaptive authentication script updates a user's role assignments during the login flow.
	User assignment during self-registration	USER	REGISTER	Occurs when a user's role assignments change during the self-registration flow.
Role groups updated	Admin initiated group assignment update	ADMIN	ROLE_UPDATE	Occurs when an administrator assigns groups to or unassigns groups from a role via the console or SCIM 2.0 Roles API.
Role groups updated	Application initiated group assignment update	APPLICATION	ROLE_UPDATE	Occurs when an application with appropriate permissions updates a role's group assignments via the SCIM 2.0 Roles API.
Role IdP groups updated	Admin initiated IdP group assignment update	ADMIN	ROLE_UPDATE	Occurs when an administrator assigns federated IdP groups to or unassigns them from a role via the console or SCIM 2.0 Roles API.
Role IdP groups updated	Application initiated IdP group assignment update	APPLICATION	ROLE_UPDATE	Occurs when an application with appropriate permissions updates a role's federated IdP group assignments via the SCIM 2.0 Roles API.
Role permissions updated	Admin initiated permission update	ADMIN	ROLE_UPDATE	Occurs when an administrator grants permissions to or revokes permissions from a role via the console or SCIM 2.0 Roles API.
Role permissions updated	Application initiated permission update	APPLICATION	ROLE_UPDATE	Occurs when an application with appropriate permissions updates a role's permissions via the SCIM 2.0 Roles API.
Role deleted	Direct role deletion	ADMIN	ROLE_DELETE	Occurs when an administrator deletes a role directly via the console or SCIM 2.0 Roles API.
	Role removed from an application	ADMIN	APPLICATION_UPDATE	Occurs when a role is removed from an application's Roles section.
	Role deleted with its application	ADMIN	APPLICATION_DELETE	Occurs when a role is deleted as part of application deletion.

WSO2 Identity Server dispatches webhook events when users add or revoke consents for purposes. These events allow third-party providers (TPPs) and downstream systems to react to consent state changes in real time.

WSO2 Identity Server sends a consentAdded event when a user approves a consent for a purpose. This can occur during user registration or during the login flow.

Example payload:

{
  "iss": "https://localhost:9443/t/myorg.com",
  "jti": "8c695b00-d165-466d-ab20-770aa43ec4da",
  "iat": 1782900901608,
  "rci": "8cccc58f-ecb1-46da-a825-707f6740b8ea",
  "events": {
    "https://schemas.identity.wso2.org/events/consent/event-type/consentAdded": {
      "initiatorType": "USER",
      "initiatorIpAddress": "127.0.0.1",
      "user": {
        "id": "60ed468b-a357-405c-aad2-2ce6960ec2aa",
        "claims": [
          {
            "uri": "http://wso2.org/claims/emailaddress",
            "value": "[email protected]"
          }
        ],
        "ref": "https://localhost:9443/t/myorg.com/scim2/Users/60ed468b-a357-405c-aad2-2ce6960ec2aa"
      },
      "tenant": {
        "id": "12402",
        "name": "myorg.com"
      },
      "organization": {
        "id": "10084a8d-113f-4211-a0d5-efe36b082211",
        "name": "myorg",
        "orgHandle": "myorg.com",
        "depth": 0
      },
      "userStore": {
        "id": "UFJJTUFSWQ==",
        "name": "PRIMARY"
      },
      "action": "REGISTER",
      "consent": {
        "id": "501a6ba7-0b15-4ae6-9642-03b5267ab996",
        "subjectId": "peter",
        "state": "APPROVED",
        "serviceId": "Resident IDP",
        "purpose": {
          "id": "909eea3e-5bf1-4106-a5b8-44580fc4ae74",
          "name": "Marketing Consent",
          "version": "12a53d28-4536-4201-939e-5e5c00eadf7b",
          "elements": [
            {
              "name": "Policy"
            }
          ]
        }
      }
    }
  }
}

The events object contains the actual event data for a consent addition, identified by the URI https://schemas.identity.wso2.org/events/consent/event-type/consentAdded. This URI signifies a user consent approval event.

The table below explains each property in the event data.

Property	Description
initiatorType	Indicates whether a user or an administrator initiated the consent approval.
initiatorIpAddress	The IP address of the client that triggered the consent approval.
user	Contains information about the user who approved the consent.
tenant	Represents the root organization (tenant) under which the consent gets approved.
organization	Represents the organization under which the consent gets approved.
userStore	Indicates the user store that manages the user's data.
action	Indicates the flow that triggered the consent approval. Refer to initiatorType and action properties for details.
consent	Contains details about the approved consent including: id: Unique identifier for the consent record subjectId: Username of the user to whom the consent applies state: Current state of the consent (for example `APPROVED`) serviceId: The service or application for which the consent is granted purpose: Details of the consent purpose including: id: Unique identifier of the consent purpose name: Human-readable name of the consent purpose version: The UUID of the specific purpose version the user consented to elements: Array of PII categories covered by the consent, each with a name

WSO2 Identity Server sends a consentRevoked event when a user revokes an approved consent for a purpose.

Example payload:

{
  "iss": "https://localhost:9443/t/myorg.com",
  "jti": "6d43b40a-18f6-48ee-8592-d85d9f005452",
  "iat": 1782901275789,
  "rci": "7dadc7c2-9584-48e1-92e5-afa64a2630a6",
  "events": {
    "https://schemas.identity.wso2.org/events/consent/event-type/consentRevoked": {
      "initiatorType": "USER",
      "initiatorIpAddress": "127.0.0.1",
      "user": {
        "id": "60ed468b-a357-405c-aad2-2ce6960ec2aa",
        "claims": [
          {
            "uri": "http://wso2.org/claims/emailaddress",
            "value": "[email protected]"
          }
        ],
        "ref": "https://localhost:9443/t/myorg.com/scim2/Users/60ed468b-a357-405c-aad2-2ce6960ec2aa"
      },
      "tenant": {
        "id": "12402",
        "name": "myorg.com"
      },
      "organization": {
        "id": "10084a8d-113f-4211-a0d5-efe36b082211",
        "name": "myorg",
        "orgHandle": "myorg.com",
        "depth": 0
      },
      "userStore": {
        "id": "UFJJTUFSWQ==",
        "name": "PRIMARY"
      },
      "action": "CONSENT_REVOKE",
      "consent": {
        "id": "501a6ba7-0b15-4ae6-9642-03b5267ab996",
        "subjectId": "peter",
        "state": "REVOKED",
        "serviceId": "Resident IDP",
        "purpose": {
          "id": "909eea3e-5bf1-4106-a5b8-44580fc4ae74",
          "name": "Marketing Consent",
          "version": "12a53d28-4536-4201-939e-5e5c00eadf7b",
          "elements": [
            {
              "name": "Policy"
            }
          ]
        }
      }
    }
  }
}

The events object contains the actual event data for a consent revocation, identified by the URI https://schemas.identity.wso2.org/events/consent/event-type/consentRevoked. This URI signifies a user consent revocation event.

The table below explains each property in the event data.

Property	Description
initiatorType	Indicates whether a user or an administrator initiated the consent revocation.
initiatorIpAddress	The IP address of the client that triggered the consent revocation.
user	Contains information about the user whose consent gets revoked.
tenant	Represents the root organization (tenant) under which the consent gets revoked.
organization	Represents the organization under which the consent gets revoked.
userStore	Indicates the user store that manages the user's data.
action	Indicates the flow that triggered the consent revocation. Refer to initiatorType and action properties for details.
consent	Contains details about the revoked consent including: id: Unique identifier for the consent record subjectId: Username of the user to whom the consent applies state: Current state of the consent (for example `REVOKED`) serviceId: The service or application for which the consent was granted purpose: Details of the consent purpose including: id: Unique identifier of the consent purpose name: Human-readable name of the consent purpose version: The UUID of the specific purpose version the user had consented to elements: Array of PII categories covered by the consent, each with a name

`initiatorType` and `action` properties¶

The initiatorType and action properties together identify the flow that triggered a consent event.

Webhook event	Flow	Value of `initiatorType`	Value of `action`	Description
Consent added	Self-registration flow	USER	REGISTER	Occurs when a user approves a consent purpose during the self-registration flow.
	Login flow	USER	LOGIN	Occurs when a user approves a consent purpose during the login flow (for example, when a new consent version requires re-approval at login).
	User consent via Consent API	USER	CONSENT_GRANT	Occurs when a user grants or authorizes a consent directly through the Consent API.
	Administrator consent creation via Consent API	ADMIN	CONSENT_CREATE	Occurs when an administrator creates a consent on behalf of a user through the Consent API.
Consent revoked	User consent revocation via Consent API	USER	CONSENT_REVOKE	Occurs when a user revokes their own consent through the Consent API (for example, from the My Account portal).
Consent revoked	Administrator consent revocation via Consent API	ADMIN	CONSENT_REVOKE	Occurs when an administrator revokes a consent on behalf of a user through the Consent API.

WSO2 Identity Server dispatches webhook events when a new version gets added to an existing consent purpose. These events let you notify users who have already approved a purpose that they need to review and re-approve the updated version.

Purpose version added event¶

WSO2 Identity Server sends a purposeVersionAdded event when an administrator adds a new version to an existing consent purpose.

Example payload:

{
  "iss": "https://localhost:9443/t/myorg.com",
  "jti": "8745b363-ed05-4c24-a202-3d2c062bec6b",
  "iat": 1782900735216,
  "rci": "5e62a3ec-96ac-472b-824c-3def154c5edc",
  "events": {
    "https://schemas.identity.wso2.org/events/consent-purpose/event-type/purposeVersionAdded": {
      "initiatorType": "ADMIN",
      "initiatorIpAddress": "127.0.0.1",
      "tenant": {
        "id": "12402",
        "name": "myorg.com"
      },
      "organization": {
        "id": "10084a8d-113f-4211-a0d5-efe36b082211",
        "name": "myorg",
        "orgHandle": "myorg.com",
        "depth": 0
      },
      "action": "PURPOSE_UPDATE",
      "purpose": {
        "id": "909eea3e-5bf1-4106-a5b8-44580fc4ae74",
        "name": "Marketing Consent",
        "version": {
          "version": "2",
          "setAsLatest": true,
          "elements": [
            {
              "name": "Policy",
              "mandatory": false
            }
          ]
        }
      }
    }
  }
}

The events object contains the actual event data for a purpose version addition, identified by the URI https://schemas.identity.wso2.org/events/consent-purpose/event-type/purposeVersionAdded. This URI signifies that a new version has been added to a consent purpose.

The table below explains each property in the event data.

Property	Description
tenant	Represents the root organization (tenant) under which the purpose update occurs.
organization	Represents the organization under which the purpose update occurs.
initiatorType	Indicates who initiated the purpose update. Currently `ADMIN` for purpose version additions.
initiatorIpAddress	The IP address of the administrator client that triggered the purpose update.
action	The action that triggered the event. Value is `PURPOSE_UPDATE` for purpose version additions.
purpose	Contains details about the updated consent purpose including: id: Unique identifier for the consent purpose name: Human-readable name of the consent purpose version: Details of the newly added version including: version: The version number of the new version setAsLatest: Whether this version becomes the active version for new consents elements: Array of attributes (elements) included in this version, each with a name and mandatory flag

Webhook events and payloads¶

Login events¶

Login success event¶

Login failed event¶

Registration events¶

Registration success event¶

Registration failure event¶

initiatorType and action properties for registration events¶

Token events¶

Access token issued event¶

Access token revoked event¶

Session events¶

Session established event¶

Session presented event¶

Session revoked event¶

Credential update events¶

initiatorType and action properties for credential update events¶

User account management events¶

User created event¶

User profile updated event¶

User disabled event¶

User enabled event¶

User account locked event¶

User account unlocked event¶

User deleted event¶

Role management events¶

Role created event¶

Role metadata updated event¶

Role deleted event¶

Role users updated event¶

Role groups updated event¶

Role IdP groups updated event¶

Role permissions updated event¶

initiatorType and action properties for role management events¶

Consent events¶

Consent added event¶

Consent revoked event¶

initiatorType and action properties¶

Consent purpose events¶

Purpose version added event¶

`initiatorType` and `action` properties for registration events¶

`initiatorType` and `action` properties for credential update events¶

`initiatorType` and `action` properties for role management events¶

`initiatorType` and `action` properties¶