> ## Documentation Index > Fetch the complete documentation index at: https://docs.lumos.com/llms.txt > Use this file to discover all available pages before exploring further. # How Lumos Logs to Your SIEM ## After this article You'll know how Lumos posts event data to your SIEM integration and which Lumos events are sent to your SIEM integration. ## Log format Lumos posts events to your [SIEM integration](https://app.lumosidentity.com/settings/siem) as a JSON payload in the following format. ``` { "event_hash": str, "event_type": , "event_type_user_friendly": str, "actor": { "actor_type": , **actor data** }, "targets": [ { "target_type": , **target data** }, ... ], "event_began_at": datetime } ``` ## Event types The event types in the sections below are logged to your SIEM by Lumos. These are stored in the `event_type` field in the JSON payload. Events are organized by category below. **Access Requests** | **Event Type** | **Description** | | - | - | | `APP_STORE_ACCESS_REMOVAL_REQUEST_COMPLETED` | An access removal request was completed. | | `APP_STORE_ACCESS_REQUEST_COMPLETED` | An access request was completed. | | `APP_STORE_ACCESS_REQUEST_EXPIRED` | An access request expired before it was acted upon. | | `APP_STORE_ACCESS_REQUEST_PREAPPROVED` | An access request was preapproved by a pre-approval rule. | | `APP_STORE_APPROVE_ACCESS_REQUEST` | An approver approved an access request. | | `APP_STORE_APPROVERS_REASSIGNED` | An AppStore request was reassigned to another approver. | | `APP_STORE_ASSIGN_TO_APP_FOR_ACCESS_REQUEST` | A user was auto-provisioned to an app for an access request. | | `APP_STORE_ASSIGN_TO_ENTITLEMENT_FOR_ACCESS_REQUEST` | A user was assigned to an entitlement for an access request. | | `APP_STORE_ASSIGN_TO_GROUP_FOR_ACCESS_REQUEST` | A user was assigned to a group for an access request. | | `APP_STORE_AUTOMATIC_PROVISIONING_FOR_ACCESS_REQUEST` | A user was automatically provisioned to an app through a Lumos integration after their request was approved. | | `APP_STORE_CANCEL_ACCESS_REQUEST` | A requester canceled their access request. | | `APP_STORE_CANCEL_ACCESS_REQUEST_LUMOS_INTERVENTION` | The system canceled this access request automatically. | | `APP_STORE_COMPLETE_ACCESS_REQUEST_LUMOS_INTERVENTION` | The system completed this access request automatically. | | `APP_STORE_CREATE_ACCESS_REMOVAL_REQUEST` | An automatic access removal request was triggered. | | `APP_STORE_CREATE_ACCESS_REQUEST` | A user requested access to an application through the AppStore. | | `APP_STORE_CREATE_CUSTOM_ACCESS_REQUEST` | A custom access request was created in the AppStore. | | `APP_STORE_DENY_ACCESS_REQUEST` | An approver denied an access request. | | `APP_STORE_EDIT_ACCESS_LENGTH_ON_REQUEST` | An approver edited the access length on an access request. | | `APP_STORE_EDIT_CUSTOM_RESPONSE_ON_REQUEST` | A user edited the custom field response for an access request. | | `APP_STORE_EDIT_PERMISSIONS_ON_REQUEST` | An approver edited the permissions requested on an access request. | | `APP_STORE_EXTEND_ACCESS_TIME` | A requester's access time was extended. | | `APP_STORE_INLINE_WEBHOOK_PROVISIONING_FOR_ACCESS_REQUEST` | A provisioning webhook was triggered after an access request was approved. | | `APP_STORE_INLINE_WEBHOOK_REQUEST_VALIDATION_FOR_ACCESS_REQUEST` | A request validation webhook was triggered for an access request. | | `APP_STORE_MANUAL_CONFIRM_DEPROVISIONING_FOR_ACCESS_REQUEST` | A user confirmed they completed the manual steps to remove access granted through the AppStore. | | `APP_STORE_MANUAL_CONFIRM_PROVISIONING_FOR_ACCESS_REQUEST` | Someone completed a "Confirm Provisioning" step by confirming the account was provisioned. | | `APP_STORE_MANUAL_DENY_PROVISIONING_FOR_ACCESS_REQUEST` | Someone completed a "Confirm Provisioning" step by denying the account was provisioned. | | `APP_STORE_NO_ADMINS_FOUND_FOR_PROVISIONING_ACCESS_REQUEST` | An access request moved to "Confirm Provisioning" but no app admins were configured. | | `APP_STORE_OVERRIDE_APPROVAL` | Someone overrode the default approval workflow and approved an access request. | | `APP_STORE_OVERRIDE_DENY` | Someone overrode the default approval workflow and denied an access request. | | `APP_STORE_OVERRIDE_MANAGER_APPROVAL` | Manager approval was overridden and the request was approved. | | `APP_STORE_OVERRIDE_MANAGER_DENY` | Manager approval was overridden and the request was denied. | | `APP_STORE_PROVISION_NEW_USER_FOR_ACCESS_REQUEST` | A new user account was provisioned for an access request. | | `APP_STORE_REVERT_ACCESS_REQUEST` | An approver reverted a previously-approved access request. | | `APP_STORE_REVERT_REQUEST_AUTOMATIC_DEPROVISIONING` | After reverting an access request, the automated provisioning was undone. | | `APP_STORE_REVERT_REQUEST_MANUAL_ACTION_NEEDED` | A user confirmed they completed the manual steps to revert an access request. | | `APP_STORE_SEND_SLACK_MESSAGE_FOR_ACCESS_REQUEST` | A message was sent in a Slack thread for an access request. | **Access Request Notifications and Reminders** | **Event Type** | **Description** | | - | - | | `APP_STORE_REMIND_ADMINS_PROVISIONING_EMAIL` | Lumos sent an email reminder to app admins to complete their provisioning task. | | `APP_STORE_REMIND_ADMINS_PROVISIONING_SLACK` | Lumos sent a Slack reminder to app admins to complete their provisioning task. | | `APP_STORE_REMIND_APPROVERS_APPROVAL_EMAIL` | Lumos sent an email reminder to approvers to complete their approval task. | | `APP_STORE_REMIND_APPROVERS_APPROVAL_SLACK` | Lumos sent a Slack reminder to approvers to complete their approval task. | | `APP_STORE_REMIND_MANAGER_APPROVAL_EMAIL` | Lumos sent an email reminder to a manager to act on an approval request. | | `APP_STORE_REMIND_MANAGER_APPROVAL_SLACK` | Lumos sent a Slack reminder to a manager to act on an approval request. | | `CONFIRM_ACCESS_REQUEST_EMAIL_DELIVERY` | Lumos confirmed that an access request email was delivered. | | `SEND_ACCESS_REQUEST_EMAIL` | Lumos attempted to send an email notification for an access request. | | `SEND_ACCESS_REQUEST_SLACK` | Lumos attempted to send a Slack notification for an access request. | | `SEND_MANUAL_DEPROVISIONING_REQUEST_VIA_EMAIL` | Lumos attempted to send an email to an app admin about an access deprovisioning task. | | `SEND_MANUAL_DEPROVISIONING_REQUEST_VIA_SLACK` | Lumos attempted to send a Slack message to an app admin about an access deprovisioning task. | | `SEND_MANUAL_PROVISIONING_REQUEST_VIA_EMAIL` | Lumos attempted to send an email to an app admin about manual provisioning steps. | | `SEND_MANUAL_PROVISIONING_REQUEST_VIA_SLACK` | Lumos attempted to send a Slack message to an app admin about manual provisioning steps. | | `SEND_REQUEST_APPROVAL_FOR_ACCESS_REQUEST_EMAIL` | Lumos attempted to send an email to an approver about an access request. | | `SEND_REQUEST_APPROVAL_FOR_ACCESS_REQUEST_SLACK` | Lumos attempted to send a Slack message to an approver about an access request. | **Access Request Escalations** | **Event Type** | **Description** | | - | - | | `APP_STORE_CURRENT_APPROVERS_REASSIGN_ESCALATIONS_EMAIL` | Lumos emailed current approvers that their request has been escalated. | | `APP_STORE_CURRENT_APPROVERS_REASSIGN_ESCALATIONS_SLACK` | Lumos sent a Slack message to current approvers that their request has been escalated. | | `APP_STORE_NEW_APPROVERS_REASSIGN_ESCALATIONS_EMAIL` | Lumos emailed the new approvers about an escalated access request. | | `APP_STORE_NEW_APPROVERS_REASSIGN_ESCALATIONS_SLACK` | Lumos sent a Slack message to the new approvers about an escalated access request. | | `APP_STORE_REASSIGN_REMINDER_ESCALATIONS_EMAIL` | Lumos emailed the original approver that their approval is being escalated. | | `APP_STORE_REASSIGN_REMINDER_ESCALATIONS_SLACK` | Lumos sent a Slack message to the original approver that their approval is being escalated. | | `APP_STORE_REASSIGN_SET_APPROVERS_ACTION` | Lumos set new approvers for an escalated access request. | | `APP_STORE_LUMOS_DENY_ACCESS_REQUEST` | Lumos automatically denied an access request. | **Access Reviews** | **Event Type** | **Description** | | - | - | | `ACCESS_REVIEW_CREATED` | A new access review was created. | | `ACCESS_REVIEW_DETAILS_UPDATED` | An access review's details were edited. | | `ACCESS_REVIEW_DELETED` | An access review was deleted. | | `ACCESS_REVIEW_COMPLETED` | An access review was completed. | | `ACCESS_REVIEW_APPS_ADDED` | New apps were added to an access review. | | `ACCESS_REVIEW_APPS_REMOVED` | Apps were removed from an access review. | | `ACCESS_REVIEW_DOMAIN_APP_ADDED` | An application was added to an access review. | | `ACCESS_REVIEW_DOMAIN_APP_REMOVED` | An application was removed from an access review. | | `ACCESS_REVIEW_DOMAIN_APP_ADMIN_ASSIGNED` | A user was assigned as the admin for an app review. | | `ACCESS_REVIEW_DOMAIN_APP_REVIEW_TYPE_SELECTED` | The review type was selected for an app review. | | `ACCESS_REVIEW_DOMAIN_APP_SCOPED` | Scopes were applied to an access review app. | | `ACCESS_REVIEW_DOMAIN_APP_COMPLETED` | The review was completed for an access review app. | | `ACCESS_REVIEW_ACCOUNT_REVIEWER_ASSIGNED` | An access review account was assigned to a reviewer. | | `ACCESS_REVIEW_ACCOUNT_REVIEWER_NOTIFIED` | The reviewer for an access review account was notified about the assignment. | | `ACCESS_REVIEW_ACCOUNT_REMOVER_ASSIGNED` | An account was delegated to a user for removal. | | `ACCESS_REVIEW_ACCOUNT_ACCESS_APPROVED` | The reviewer marked an account as accepted. | | `ACCESS_REVIEW_ACCOUNT_ACCESS_REJECTED` | The reviewer marked an account as rejected. | | `ACCESS_REVIEW_ACCOUNT_ACCESS_NEEDS_MODIFICATION` | The reviewer marked an account as needing modification. | | `ACCESS_REVIEW_ACCOUNT_REVIEW_DECISION_REMOVED` | The decision was removed for an access review account. | | `ACCESS_REVIEW_ACCOUNT_REMOVED` | An access review account was marked as removed. | | `ACCESS_REVIEW_ACCOUNT_MANUALLY_REMOVED` | An account was manually removed during an access review. | | `ACCESS_REVIEW_ACCOUNT_REMOVAL_FAILED` | There was an error removing account access. | | `ACCESS_REVIEW_ACCOUNT_NOTES_ADDED` | A user added notes to an account review. | | `ACCESS_REVIEW_ACCOUNT_EVIDENCE_UPLOADED` | A user uploaded evidence related to an account review. | | `ACCESS_REVIEW_ACCOUNT_ENTITLEMENT_REVIEWER_ASSIGNED` | A permission review was delegated to a reviewer. | | `ACCESS_REVIEW_ACCOUNT_ENTITLEMENT_REVIEWER_NOTIFIED` | A reviewer was notified about their permission review assignment. | | `ACCESS_REVIEW_ACCOUNT_ENTITLEMENT_REMOVER_ASSIGNED` | A permission was delegated to a user for removal. | | `ACCESS_REVIEW_ACCOUNT_ENTITLEMENT_ACCESS_APPROVED` | A permission was marked as accepted. | | `ACCESS_REVIEW_ACCOUNT_ENTITLEMENT_ACCESS_REJECTED` | A permission was marked as rejected. | | `ACCESS_REVIEW_ACCOUNT_ENTITLEMENT_ACCESS_NEEDS_MODIFICATION` | A permission was marked as needing modification. | | `ACCESS_REVIEW_ACCOUNT_ENTITLEMENT_REVIEW_DECISION_REMOVED` | The decision was removed for a permission review. | | `ACCESS_REVIEW_ACCOUNT_ENTITLEMENT_REMOVED` | A permission was marked as removed. | | `ACCESS_REVIEW_ACCOUNT_ENTITLEMENT_MANUALLY_REMOVED` | A permission was manually removed during an access review. | | `ACCESS_REVIEW_ACCOUNT_ENTITLEMENT_REMOVAL_FAILED` | There was an error removing a permission. | | `ACCESS_REVIEW_ACCOUNT_ENTITLEMENT_NOTES_ADDED` | A user added notes to a permission review. | | `ACCESS_REVIEW_ACCOUNT_ENTITLEMENT_EVIDENCE_UPLOADED` | Evidence was uploaded for a reviewed permission. | **Access Review Escalations** | **Event Type** | **Description** | | - | - | | `ACCESS_REVIEW_REVIEWER_REMINDER_SENT` | A reviewer was notified to review their assigned subjects. | | `ACCESS_REVIEW_ACCOUNT_REASSIGNMENT_REMINDER_ESCALATIONS` | A reviewer was notified that their review will be escalated based on company policies. | | `ACCESS_REVIEW_NEW_APPROVER_ACCOUNT_REASSIGNMENT_ESCALATIONS` | A new reviewer was notified about assignments escalated to them. | | `ACCESS_REVIEW_CURRENT_APPROVER_ACCOUNT_REASSIGNMENT_ESCALATIONS` | The current reviewer was notified their review was escalated. | | `ACCESS_REVIEW_ACCOUNT_REVIEWERS_REASSIGN_ACTION_ESCALATIONS` | An account review was escalated based on company policies. | | `ACCESS_REVIEW_ACCOUNT_ENTITLEMENT_REASSIGNMENT_REMINDER_ESCALATIONS` | A permission reviewer was notified their review will be escalated. | | `ACCESS_REVIEW_NEW_APPROVER_ACCOUNT_ENTITLEMENT_REASSIGNMENT_ESCALATIONS` | A new permission reviewer was notified about assignments escalated to them. | | `ACCESS_REVIEW_ACCOUNT_ENTITLEMENT_REVIEWERS_REASSIGN_ACTION_ESCALATIONS` | A permission review was escalated based on company policies. | **Account Actions via Integration** | **Event Type** | **Description** | | - | - | | `ACCOUNT_ACTIVATED_VIA_INTEGRATION` | An account was activated via an integration. | | `ACCOUNT_ARCHIVED_VIA_INTEGRATION` | Lumos attempted to archive a user's app account through an integration. | | `ACCOUNT_ASSIGNED_TO_GROUP_VIA_INTEGRATION` | A user was added to an application (IdP) group via an integration. | | `ACCOUNT_CREATED_VIA_INTEGRATION` | Lumos attempted to create a user account via an integration. | | `ACCOUNT_DATA_TRANSFERED_VIA_INTEGRATION` | Lumos attempted to transfer a user's data via an integration. | | `ACCOUNT_DEACTIVATED_VIA_INTEGRATION` | An account was deactivated via an integration. | | `ACCOUNT_DELETED_VIA_INTEGRATION` | An account was deleted via an integration. | | `ACCOUNT_DEPROVISIONED_VIA_INTEGRATION` | Lumos attempted to deprovision a user's app account through an integration. | | `ACCOUNT_DEPROVISIONED_VIA_WEBHOOK` | Lumos attempted to deprovision an account via a webhook. | | `ACCOUNT_DOWNGRADED_VIA_INTEGRATION` | Lumos attempted to downgrade a user's app account through an integration. | | `ACCOUNT_EMAIL_REROUTED_VIA_INTEGRATION` | Lumos attempted to reroute a user's email via an integration. | | `ACCOUNT_LICENSE_REMOVED_VIA_INTEGRATION` | Lumos attempted to remove the license for an account via an integration. | | `ACCOUNT_ORGANIZATION_UNIT_CHANGED_VIA_INTEGRATION` | Lumos attempted to change an account's organization unit via an integration. | | `ACCOUNT_RESOURCES_RELEASED_VIA_INTEGRATION` | Lumos attempted to release an account's resources via an integration. | | `ACCOUNT_SUSPENDED_VIA_INTEGRATION` | Lumos attempted to suspend a user's app account via an integration. | | `ACCOUNT_UNASSIGNED_FROM_APP_VIA_INTEGRATION` | Lumos attempted to unassign a user from an app via an integration. | | `ACCOUNT_UNASSIGNED_FROM_GROUP_VIA_INTEGRATION` | A user was removed from an application (IdP) group via an integration. | | `ACCOUNT_UPDATED_VIA_INTEGRATION` | An account was updated via an integration. | **Entitlement Actions via Integration** | **Event Type** | **Description** | | - | - | | `ENTITLEMENT_ASSIGNED_VIA_INTEGRATION` | An entitlement was assigned to an account via an integration. | | `ENTITLEMENT_UNASSIGNED_VIA_INTEGRATION` | An entitlement was unassigned from an account via an integration. | **Admin Configuration** | **Event Type** | **Description** | | - | - | | `ADMIN_ADDED_APP_TO_APPSTORE` | An admin added an app to the AppStore. | | `ADMIN_ADDED_PERMISSION_TO_APP` | An admin added a permission to an app. | | `ADMIN_CONNECTS_INTEGRATION` | An admin attempted to connect a new integration. | | `ADMIN_CREATED_APP_MATCHING_RULE` | An admin created a matching rule for matching accounts to identities for an app. | | `ADMIN_DEACTIVATED_APP_MATCHING_RULE` | An admin deactivated a matching rule for an app. | | `ADMIN_REMOVED_APP_FROM_APPSTORE` | An admin removed an app from the AppStore. | | `ADMIN_UPDATED_APP_ADMINS` | An admin updated an app's admins. | | `ADMIN_UPDATED_APP_ALLOWED_GROUPS` | An admin updated an app's allowed groups. | | `ADMIN_UPDATED_APP_ALLOW_REQUEST_FOR_MULTIPLE_PERMISSIONS` | An admin updated the "allow request for multiple permissions" setting for an app. | | `ADMIN_UPDATED_APP_APPROVAL_WORKFLOW_TEMPLATE` | An admin updated an app's approval workflow template. | | `ADMIN_UPDATED_APP_APPROVERS` | An admin updated an app's approvers. | | `ADMIN_UPDATED_APP_CATEGORY` | An admin updated an app's category. | | `ADMIN_UPDATED_APP_CUSTOM_APPROVAL_MESSAGE` | An admin updated an app's custom approval message. | | `ADMIN_UPDATED_APP_DEFAULT_PERMISSION` | An admin updated an app's default permission. | | `ADMIN_UPDATED_APP_DEPROVISIONING_STEPS` | An admin updated an app's deprovisioning steps. | | `ADMIN_UPDATED_APP_DESCRIPTION` | An admin updated an app's description. | | `ADMIN_UPDATED_APP_DISCOVERABILITY` | An admin updated an app's discoverability settings. | | `ADMIN_UPDATED_APP_INSTRUCTIONS` | An admin updated an app's instructions. | | `ADMIN_UPDATED_APP_LOGO` | An admin updated an app's logo. | | `ADMIN_UPDATED_APP_MANAGER_APPROVAL` | An admin updated an app's manager approval setting. | | `ADMIN_UPDATED_APP_MATCHING_RULE` | An admin updated a matching rule for an app. | | `ADMIN_UPDATED_APP_NAME` | An admin updated an app's name. | | `ADMIN_UPDATED_APP_PERMISSION_ALLOWED_GROUPS` | An admin updated a permission's allowed groups. | | `ADMIN_UPDATED_APP_PERMISSION_LABEL` | An admin updated a permission's label. | | `ADMIN_UPDATED_APP_PERMISSION_VISIBILITY` | An admin updated a permission's visibility. | | `ADMIN_UPDATED_APP_PROVISIONING_INSTRUCTIONS` | An admin updated an app's provisioning instructions. | | `ADMIN_UPDATED_APP_PROVISIONING_METHOD` | An admin updated an app's provisioning method. | | `ADMIN_UPDATED_APP_PROVISIONING_STEPS` | An admin updated an app's provisioning steps. | | `ADMIN_UPDATED_APP_PROVISIONING_STEPS_V2` | An admin updated an app's provisioning steps (v2). | | `ADMIN_UPDATED_APP_WEBSITE_LINK` | An admin updated an app's website link. | | `ADMIN_UPDATED_PERMISSION_APPROVAL_WORKFLOW_TEMPLATE` | An admin updated a permission's approval workflow template. | | `ADMIN_UPDATED_PERMISSION_APPROVERS` | An admin updated a permission's approvers. | | `ADMIN_UPDATED_PERMISSION_DEPROVISIONING_STEPS` | An admin updated a permission's deprovisioning steps. | | `ADMIN_UPDATED_PERMISSION_MANAGER_APPROVAL` | An admin updated a permission's manager approval setting. | | `ADMIN_UPDATED_PERMISSION_PROVISIONING_STEPS` | An admin updated a permission's provisioning steps. | | `ADMIN_UPDATED_PERMISSION_PROVISIONING_STEPS_V2` | An admin updated a permission's provisioning steps (v2). | | `ADMIN_UPDATED_USERS_LUMOS_USER_ROLE` | A Lumos user's access level was updated by an admin. | | `ADMIN_UPDATES_INTEGRATION` | An admin attempted to update an already-connected integration. | **Admin Account Status Updates** | **Event Type** | **Description** | | - | - | | `ADMIN_UPDATES_APP_USER_ACCOUNT_STATUS_TO_ACCESS_CREATED` | An admin updated a user's account status to "Access Created". | | `ADMIN_UPDATES_APP_USER_ACCOUNT_STATUS_TO_ACCESS_REMOVED` | An admin updated a user's account status to "Access Removed". | | `ADMIN_UPDATES_APP_USER_ACCOUNT_STATUS_TO_ACTIVE` | An admin updated a user's account status to "Active". | | `ADMIN_UPDATES_APP_USER_ACCOUNT_STATUS_TO_DEPROVISIONED` | An admin updated a user's account status to "Deprovisioned". | | `ADMIN_UPDATES_APP_USER_ACCOUNT_STATUS_TO_DISCOVERED` | An admin updated a user's account status to "Discovered". | | `ADMIN_UPDATES_APP_USER_ACCOUNT_STATUS_TO_MANUALLY_REMOVED` | An admin updated a user's account status to "Manually Removed". | | `ADMIN_UPDATES_APP_USER_ACCOUNT_STATUS_TO_NON_CORPORATE_ACCOUNT` | An admin updated a user's account status to "Non Corporate Account". | | `ADMIN_UPDATES_APP_USER_ACCOUNT_STATUS_TO_STAGED` | An admin updated a user's account status to "Staged". | | `ADMIN_UPDATES_APP_USER_ACCOUNT_STATUS_TO_SUSPENDED` | An admin updated a user's account status to "Suspended". | | `ADMIN_UPDATES_APP_USER_ACCOUNT_STATUS_TO_WAITING_MANUAL_REMOVAL` | An admin updated a user's account status to "Waiting Manual Removal". | **AppStore Webhooks** | **Event Type** | **Description** | | - | - | | `APPSTORE_WEBHOOK_OPTIONS_UPDATED` | A user updated the webhook options for a permission or app. | | `APPSTORE_WEBHOOK_UPDATED_FOR_APP` | A user updated a webhook for an app. | | `APPSTORE_WEBHOOK_UPDATED_FOR_PERMISSION` | A user updated a permission webhook for an app. | **Pre-Approval Rules** | **Event Type** | **Description** | | - | - | | `USER_ADDS_APP_STORE_PRE_APPROVAL_RULE` | A pre-approval rule was added to an application. | | `USER_EDITS_APP_STORE_PRE_APPROVAL_RULE` | A pre-approval rule was edited for an application. | | `USER_REMOVES_APP_STORE_PRE_APPROVAL_RULE` | A pre-approval rule was removed from an application. | **Time-Based Access** | **Event Type** | **Description** | | - | - | | `TIME_BASED_ACCESS_EXPIRED` | A time-based access request expired. | | `TIME_BASED_ACCESS_EXPIRED_REQUEST_AUTOMATIC_DEPROVISIONING` | A user was deprovisioned from an app via time-based access expiration. | | `TIME_BASED_ACCESS_EXPIRED_REQUEST_AUTOMATIC_SUSPEND` | A user was suspended from an app via time-based access expiration. | | `TIME_BASED_ACCESS_EXPIRED_REQUEST_AUTOMATIC_UNASSIGN_FROM_GROUP` | A user was unassigned from an app (IdP) group via time-based access expiration. | | `TIME_BASED_ACCESS_EXPIRED_REQUEST_DEPROVISION_INLINE_WEBHOOK` | A deprovisioning webhook was triggered when a user's time-based access expired. | **Inactivity Workflows** | **Event Type** | **Description** | | - | - | | `INACTIVITY_WORKFLOW_CREATED` | An inactivity workflow was created. | | `INACTIVITY_WORKFLOW_ENABLED` | An inactivity workflow was enabled. | | `INACTIVITY_WORKFLOW_DISABLED` | An inactivity workflow was disabled. | | `INACTIVITY_WORKFLOW_REMOVED` | An inactivity workflow was removed. | | `INACTIVITY_WORKFLOW_TRIGGERED_FOR_ACCOUNT` | An inactivity workflow triggered on an inactive account. | | `INACTIVITY_WORKFLOW_ASKED_ACCOUNT_OWNER_FOR_APPROVAL` | An inactivity workflow notified the account owner to confirm removal of their account. | | `INACTIVITY_WORKFLOW_ASKED_REVIEWER_FOR_APPROVAL` | An inactivity workflow notified the reviewer to confirm removal of an inactive account. | | `INACTIVITY_WORKFLOW_NOTIFICATION_ACCEPTED` | A user approved an inactivity workflow notification. | | `INACTIVITY_WORKFLOW_NOTIFICATION_REJECTED` | A user rejected an inactivity workflow notification. | | `INACTIVITY_WORKFLOW_NOTIFICATION_IGNORED` | A user ignored an inactivity workflow notification. | **ITSM Tickets** | **Event Type** | **Description** | | - | - | | `ITSM_TICKET_CREATED_FOR_ACCESS_REQUEST` | Lumos created a ticket in an ITSM for an access request. | | `ITSM_TICKET_CREATED_FOR_ACCESS_REMOVAL` | Lumos created a ticket in an ITSM for an access removal. | | `ITSM_TICKET_LINKED_TO_ACCESS_REQUEST` | Lumos linked an existing ITSM ticket to an access request. | | `ITSM_TICKET_STATUS_UPDATED` | An ITSM ticket's status was updated via an integration. | | `ITSM_TICKET_COULD_NOT_BE_UPDATED` | An ITSM ticket's status could not be updated via an integration. | **Onboarding and Offboarding** | **Event Type** | **Description** | | - | - | | `ONBOARDING_RULE_CREATED` | An access policy (onboarding rule) was created. | | `ONBOARDING_RULE_UPDATED` | An access policy (onboarding rule) was updated. | | `ONBOARDING_RULE_DELETED` | An access policy (onboarding rule) was deleted. | | `USER_ONBOARDING_TRIGGERED` | A user onboarding was triggered. | | `USER_ONBOARDING_SCHEDULED` | A user onboarding was scheduled. | | `USER_ONBOARDING_STARTED` | A user onboarding was started. | | `USER_ONBOARDING_CANCELLED` | A user onboarding was cancelled. | | `USER_ONBOARDING_RESCHEDULED` | A user onboarding was rescheduled. | | `USER_ONBOARDING_ACCESS_POLICIES_EVALUATED` | Access policies were evaluated for a user onboarding. | | `USER_OFFBOARDING_TRIGGERED` | A user offboarding parent workflow was triggered. | | `USER_OFFBOARDING_SCHEDULED` | A user offboarding was scheduled. | | `USER_OFFBOARDING_STARTED` | Account offboarding workflows have started for a user. | | `USER_OFFBOARDING_COMPLETE` | A user offboarding was completed. | | `USER_OFFBOARDING_CANCELLED` | A user offboarding was cancelled. | | `USER_OFFBOARDING_RESCHEDULED` | A user offboarding was rescheduled. | | `OFFBOARDING_MANUAL_TASK_COMPLETED` | A user completed an offboarding manual task. | | `OFFBOARDING_MANUAL_TASK_DISMISSED` | A user dismissed an offboarding manual task. | | `OFFBOARDING_MANUAL_TASK_REASSIGNED` | A user reassigned an offboarding account removal task. | **Lifecycle Management Settings** | **Event Type** | **Description** | | - | - | | `LCM_DOMAIN_SETTING_UPDATED_AUTOMATIC_MOVERS` | Automatic movers settings were updated. | | `LCM_DOMAIN_SETTING_UPDATED_AUTOMATIC_OFFBOARDING` | Automatic offboarding settings were updated. | | `LCM_DOMAIN_SETTING_UPDATED_AUTOMATIC_OFFBOARDING_SELECTED_DOMAIN_APPS` | Selected apps for automatic offboarding were updated. | | `LCM_DOMAIN_SETTING_UPDATED_AUTOMATIC_ONBOARDING` | Automatic onboarding settings were updated. | | `LCM_DOMAIN_SETTING_UPDATED_AUTOMATIC_ONBOARDING_EXCLUSION_GROUPS` | Exclusion groups for automatic onboarding were updated. | **Error Tasks** | **Event Type** | **Description** | | - | - | | `ERROR_TASK_CREATED` | An error task was created. | | `ERROR_TASK_RETRIED` | A user retried an error task. | | `ERROR_TASK_MARKED_AS_DONE` | A user marked an error task as done. | | `ERROR_TASK_REASSIGNED` | A user reassigned an error task. | | `ERROR_TASK_CANCELED` | A user cancelled an error task. | **Manual Tasks** | **Event Type** | **Description** | | - | - | | `MANUAL_TASK_CREATED` | A manual task was created. | | `MANUAL_TASK_EXPIRED` | A manual task has expired. | **Vendor Agreements** | **Event Type** | **Description** | | - | - | | `NEW_VENDOR_AGREEMENT_CREATED` | A new vendor agreement was created. | | `VENDOR_AGREEMENT_CREATED_FROM_FOUND_DOCUMENTS` | A vendor agreement was created from discovered documents. | | `VENDOR_AGREEMENT_RENEWED` | A vendor agreement was renewed. | **Workflows** | **Event Type** | **Description** | | - | - | | `WORKFLOW_EXECUTION_CANCELLED` | An admin cancelled a workflow execution. | | `WORKFLOW_STEP_FAILED` | A workflow step failed. | **Other** | **Event Type** | **Description** | | - | - | | `ACCOUNT_MARKED_AS_IGNORED` | An account was marked as ignored. | | `ACCOUNT_REMOVAL_APPROVED` | A user approved an account removal. | | `ACCOUNT_REMOVAL_DISMISSED` | A user dismissed an account removal. | | `ACCOUNT_REMOVAL_REASSIGNED` | A user reassigned an account removal. | | `CUSTOM_APP_ACCOUNTS_UPDATE` | A user updated custom app accounts. | | `CUSTOM_CAPABILITY_EXECUTED_VIA_INTEGRATION` | A custom capability was executed via an integration. | | `DOMAIN_APP_IGNORED` | An app instance was ignored. | | `DOMAIN_APP_MERGED` | Two app instances were merged. | | `DOMAIN_APP_UNIGNORED` | An app instance was unignored. | | `INTEGRATION_CREDENTIAL_AUTHORIZATION` | An integration credential was authorized. | | `LUMOS_ADDED_SYNCED_PERMISSION_TO_APP` | A synced permission was added to an app. | | `USER_LOGS_IN` | A user logged in to Lumos. | ## Actor types In the event payload, Lumos tells you what type of actor initiated the event in the `actor_type` field and sends a payload of data about them as part of the `actor` data. | **Actor Type** | **Description** | **Payload** | | - | - | - | | `ANONYMOUS` | The action was performed by an unauthenticated user. | N/A | | `LUMOS_USER` | The Lumos User that performed the action. | `{ "email": str, "given_name": str, "family_name": str }` | | `LUMOS_SYSTEM` | An automated or asynchronous event initiated by the Lumos application. | N/A | ## Target types For every event, there are one-to-many targets that were acted upon by that event. The type of target is specified in the `target_type` field and information about the targets is stored in a list as part of the `targets` field.
Target Type Description Payload
`APP` Provides information about the application. `{ "app_id": str, "name": str }`
`APP_INSTANCE` Provides information about this specific instance of an application. `{ "app_id": str, "instance_id": str, "user_friendly_label": str }`
`LUMOS_USER` The Lumos User on which the action (e.g., provisioning) was performed. `{ "email": str, "given_name": str, "family_name": str }`
`USER_APP_RELATIONSHIP` The relationship between a Lumos User and an App. `{ "user": { "email": str, "given_name": str, "family_name": str }, "app": { "app_id": str, "instance_id": str, "user_friendly_label": str } }`
`ACCOUNT` A user's account in a specific application. `{ "identifier": str, "email": str, "given_name": str, "family_name": str, "username": str, "user": { "email": str, "given_name": str, "family_name": str }, "app": { "app_id": str, "instance_id": str, "user_friendly_label": str } }`
`ACCESS_REQUEST` A request for access created from the AppStore. `{ "target_user": { "email": str, "given_name": str, "family_name": str }, "requester_user": { "email": str, "given_name": str, "family_name": str }, "app": { "app_id": str, "instance_id": str, "user_friendly_label": str }, "access_length": str, "permissions": { "label": str, "value": str, "type": GROUP | PERMISSION, "source": OKTA | ONELOGIN | ... }, "business_justification": str }`
`ACCESS_REVIEW` An access review. `{ "name": str }`
`ACCESS_REVIEW_DOMAIN_APP` An app within the access review. `{ "status": IN_PREPARATION | ASSIGNING_REVIEWERS | ..., "review_type": ACCOUNTS | ENTITLEMENTS }`
`ACCESS_REVIEW_ACCOUNT` An account in an access review app. `{ "email": str }`
`ACCESS_REVIEW_ACCOUNT_ENTITLEMENT` A permission being reviewed for an account in an access review. `{ "type": str, "label": str }`
`LUMOS_GROUP` A group associated with an application (email provider, IdP). `{ "name": str, "external_id": str }`
`PRE_APPROVAL_RULE` A pre-approval rule for an AppStore app. `{ "justification": str, "app": { "app_id": str, "instance_id": str, "user_friendly_label": str } }`
`APP_GROUP_REQUEST_CONFIG` The configuration for a specific app Permission in the AppStore. `{ "label": str, "value": str, "type": GROUP | PERMISSION, "source": OKTA | ONELOGIN | GSUITE | ... }`
`INLINE_WEBHOOK` An inline webhook. `{ "hook_type": PROVISION | DEPROVISION | PRE_APPROVAL | REQUEST_VALIDATION, "name": str, "description": str }`
`ONBOARDING_RULE` An onboarding or access policy rule. `{ "targets": str, "owner_id": int, "business_justification": str }`
`ESCALATION_POLICY` An AppStore or Access Reviews escalation policy. `{ "name": str }`