Resources
🤖 For AI agents: The complete documentation index is available at /docs/llms.txt. A markdown version of this page is available at /docs/extend/events-and-webhooks/events/user/login/user-login-suspicious.md.

Suspicious

Edit on GitHub
View Markdown

User Login Suspicious

This feature is only available in the Enterprise plan. To learn more, see our pricing page.

version
This event has been available since 1.30.0

This event is generated when a user logs in and FusionAuth has considered them to be a potential threat.

Event type
user.login.suspicious

Event Scope

This is a tenant scoped event.

Prior to version 1.37.0 this event was sent to all webhooks, and it was a webhook's responsibility to filter on the tenantId field.

In version 1.37.0 and later, this event will only be sent to tenants for which webhooks for this event are enabled.

Transaction Compatibility

This event is transactional. The final state of the operation which caused the webhook is not persisted to FusionAuth until after the webhook finishes; learn more

Event Body

event.applicationId UUID

The unique Id of the Application for which the user has requested login. If the login request omits the applicationId or the user is not registered for the requested applicationId this value will not be returned in the event.

event.authenticationType String

The type of authentication used in the login request. The possible values are:

  • APPLE - The user was authenticated using Apple.
  • APPLICATION_TOKEN - The user was authenticated using an Application Authentication Token.
  • EpicGames - The user was authenticated using Epic Games.
  • FACEBOOK - The user was authenticated using Facebook.
  • FEDERATED_JWT - The user was authenticated using a JWT from an external source.
  • GENERIC_CONNECTOR - The user was authenticated using a generic connector.
  • GOOGLE - The user was authenticated using Google.
  • HYPR - The user was authenticated using HYPR.
  • JWT_SSO - A valid JWT associated with one application was exchanged for another JWT associated with a different application.
  • LDAP_CONNECTOR - The user was authenticated using an LDAP connector.
  • LINKEDIN - The user was authenticated using LinkedIn.
  • Nintendo - The user was authenticated using Nintendo. Available since 1.36.0
  • ONE_TIME_PASSWORD - The user was authenticated using a one-time password.
  • OPENID_CONNECT - The user was authenticated using OIDC.
  • PASSWORD - The user was authenticated using a loginId and password combination.
  • PASSWORDLESS - The user was authenticated using a passwordless login link.
  • PING - The user was authenticated using a PUT request on the Login API. This is used to record a login event without prompting for credentials, such as when the FusionAuth SSO session is used.
  • REFRESH_TOKEN - The user requested a new JWT using a refresh token.
  • REGISTRATION - The user was created using the Registration API.
  • SAMLv2 - The user was authenticated using SAMLv2.
  • SAMLv2IdpInitiated - The user was authenticated using SAMLv2 IdP Initiated login.
  • SonyPSN - The user was authenticated using Sony.
  • Steam - The user was authenticated using Steam.
  • TWITTER - The user was authenticated using Twitter.
  • Twitch - The user was authenticated using Twitch.
  • USER_CREATE - The user was created using the User API.
  • WebAuthn - The user was authenticated using a passkey. Available since 1.41.0
  • Xbox - The user was authenticated using Xbox.
event.connectorId UUID

The unique Id of the connector used to complete the login.

event.createInstant Long

The instant that the event was generated.

event.id UUID

The unique Id of the event. You may receive an event more than once based upon your transaction settings. This Id may be used to identify a duplicate event.

event.identityProviderId UUID

The unique Id of the identity provider used to complete the login. This value will be omitted from the event if an identity provider was not used.

event.identityProviderName String

The name of the identity provider used to complete the login. This value will be omitted from the event if an identity provider was not used.

event.info.data Object Available since 1.30.0

An object that can hold any information about the event that should be persisted.

event.info.deviceDescription String Available since 1.30.0

The description of the device associated with the event.

event.info.deviceName String Available since 1.30.0

The device name associated with the event.

event.info.deviceType String Available since 1.30.0

The type of device associated with the event.

event.info.ipAddress String Available since 1.27.0

The source IP address of the event.

event.info.location.city String Available since 1.30.0

The city where the event originated.

Note: To use event location data, you'll need an Enterprise plan.

event.info.location.country String Available since 1.30.0

The country where the event originated.

Note: To use event location data, you'll need an Enterprise plan.

event.info.location.latitude Double Available since 1.30.0

The latitude where the event originated.

Note: To use event location data, you'll need an Enterprise plan.

event.info.location.longitude Double Available since 1.30.0

The longitude where the event originated.

Note: To use event location data, you'll need an Enterprise plan.

event.info.location.region String Available since 1.30.0

The geographic location where the event originated.

Note: To use event location data, you'll need an Enterprise plan.

event.info.location.zipcode String Available since 1.30.0

The zip code where the event originated.

Note: To use event location data, you'll need an Enterprise plan.

event.info.os String Available since 1.30.0

The operating system associated with the event.

event.info.userAgent String Available since 1.30.0

The user agent associated with the event.

event.linkedObjectId UUID Available since 1.53.0

The Id of the user related to this event.

event.tenantId UUID

The unique tenant identifier. This value may not be returned if not applicable.

event.threatsDetected Array<String>

The types of potential threats that have been flagged for this event. For a full list of potential threats, see risk signals; FusionAuth fires this event whenever any enabled risk signal returns a HIGH value.

event.type String

The event type, this value will always be {eventType}.

event.user Object

The user that completed the login request. See the Users API for property definitions and example JSON

Example Event JSON

{
  "event": {
    "applicationId": "134f7157-0252-4100-889e-8b3084b85660",
    "authenticationType": "PASSWORD",
    "connectorId": "e3306678-a53a-4964-9040-1c96f36dda72",
    "createInstant": 1630383272048,
    "id": "0f2a3e31-d7c9-48dc-841a-b47ca4830773",
    "info": {
      "ipAddress": "42.42.42.42",
      "location": {
        "city": "Denver",
        "country": "US",
        "displayString": "Denver, CO, US",
        "latitude": 39.77777,
        "longitude": -104.9191,
        "region": "CO"
      },
      "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36"
    },
    "ipAddress": "127.0.0.1",
    "tenantId": "30663132-6464-6665-3032-326466613934",
    "threatsDetected": [
      "ImpossibleTravel"
    ],
    "type": "user.login.suspicious",
    "user": {
      "active": true,
      "birthDate": "1981-06-04",
      "connectorId": "e3306678-a53a-4964-9040-1c96f36dda72",
      "data": {
        "Company": "PiedPiper",
        "PreviousCompany": "Aviato",
        "user_type": "iconclast"
      },
      "email": "example@fusionauth.io",
      "firstName": "Erlich",
      "id": "00000000-0000-0000-0000-000000000001",
      "insertInstant": 1630083026349,
      "lastLoginInstant": 1630383233716,
      "lastName": "Bachman",
      "lastUpdateInstant": 1630083026349,
      "memberships": [],
      "passwordChangeRequired": false,
      "passwordLastUpdateInstant": 1630083026431,
      "preferredLanguages": [],
      "registrations": [],
      "tenantId": "30663132-6464-6665-3032-326466613934",
      "twoFactor": {
        "methods": [],
        "recoveryCodes": []
      },
      "usernameStatus": "ACTIVE",
      "verified": true
    }
  }
}