User Password Breach Event
On this page
User Password Breach
This feature requires at least a Starter plan.
1.15.0This event is generated when Reactor detects a user is using a vulnerable, or breached password. This event will only occur during login when the Tenant is not configured to require the user to change their password. All other breached password detections will occur during password validation and because the user will not be allowed to use the password.
Event type
user.password.breach
Event Scope
This is a tenant-scoped event.
Prior to version 1.37.0 this event was sent to all webhooks, and it was a webhook's responsibility to filter on the tenantId field.
In version 1.37.0 and later, this event will only be sent to tenants for which webhooks for this event are enabled.
Transaction Compatibility
This event is transactional. The final state of the operation which caused the webhook is not persisted to FusionAuth until after the webhook finishes; learn more
Event Body
event.createInstant The instant that the event was generated.
event.id The unique Id of the event. You may receive an event more than once based upon your transaction settings. This Id may be used to identify a duplicate event.
event.info.data An object that can hold any information about the event that should be persisted.
event.info.deviceDescription The description of the device associated with the event.
event.info.deviceName The device name associated with the event.
event.info.deviceType The type of device associated with the event.
event.info.ipAddress The source IP address of the event.
event.info.location.city The city where the event originated.
Enterprise plan To use event location data, you'll need an Enterprise plan.
event.info.location.country The country where the event originated.
Enterprise plan To use event location data, you'll need an Enterprise plan.
event.info.location.latitude The latitude where the event originated.
Enterprise plan To use event location data, you'll need an Enterprise plan.
event.info.location.longitude The longitude where the event originated.
Enterprise plan To use event location data, you'll need an Enterprise plan.
event.info.location.region The geographic location where the event originated.
Enterprise plan To use event location data, you'll need an Enterprise plan.
event.info.location.zipcode The zip code where the event originated.
Enterprise plan To use event location data, you'll need an Enterprise plan.
event.info.os The operating system associated with the event.
event.info.userAgent The user agent associated with the event.
event.linkedObjectId The Id of the user impacted by this event.
event.tenantId The unique tenant identifier. This value may not be returned if not applicable.
event.type The event type, this value will always be user.password.breach.
event.user The user that failed the login request. See the Users API for property definitions and example JSON.
{
"event": {
"createInstant": 1505762615056,
"id": "e502168a-b469-45d9-a079-fd45f83e0406",
"tenantId": "e872a880-b14f-6d62-c312-cb40f22af465",
"type": "user.password.breach",
"user": {
"active": true,
"connectorId": "e3306678-a53a-4964-9040-1c96f36dda72",
"email": "example@fusionauth.io",
"id": "00000000-0000-0001-0000-000000000000",
"breachedPasswordStatus": "ExactMatch",
"breachedPasswordLastCheckedInstant": 1505762615056,
"passwordChangeReason": "Breached",
"passwordChangeRequired": true,
"registrations": [
{
"applicationId": "10000000-0000-0002-0000-000000000001",
"id": "00000000-0000-0002-0000-000000000000",
"insertInstant": 1446064706250,
"roles": [
"user"
],
"usernameStatus": "ACTIVE"
}
],
"tenantId": "f24aca2b-ce4a-4dad-951a-c9d690e71415",
"twoFactorEnabled": false,
"usernameStatus": "ACTIVE",
"verified": true
}
}
}Related
Learn about the User Password Reset Send event.
Learn about the User Password Reset Start event.
Learn about the User Password Reset Success event.
Learn about the User Password Update event.