Configure audit logging to track all authentication activities and security events.

Event Types

const auditEvents = [
  'auth.login',
  'auth.logout',
  'auth.failed_login',
  'user.created',
  'user.deleted',
  'password.reset',
  'mfa.enabled',
  'permission.changed'
];

Log Structure

{
  "timestamp": "2024-01-10T15:30:00Z",
  "event": "auth.login",
  "actor": {
    "id": "user_123",
    "ip": "192.168.1.1",
    "userAgent": "Mozilla/5.0..."
  },
  "resource": {
    "type": "user",
    "id": "user_123"
  },
  "metadata": {
    "mfaUsed": true,
    "provider": "password"
  }
}

Retention Policy

auditLogs:
  retention:
    default: 365 # days
    securityEvents: 730
    compliance: 2555 # 7 years

Query API

const logs = await auth.audit.query({
  event: 'auth.login',
  actor: 'user_123',
  dateRange: {
    start: '2024-01-01',
    end: '2024-01-31'
  }
});

For compliance reporting and advanced analytics, see our enterprise documentation.