Auth Apps delivers audit events to developer-owned HTTPS endpoints in real time. Configure webhook URLs, subscribed events, and retrieve your signing_secret in the Cliodot portal — there is no webhook management API in this reference.
Limits: Up to 10 webhooks per Auth App. Deliveries are queued with automatic retries.
Signature verification#
Deliveries include:
X-Cliodot-Signature: t=<unix_timestamp>,v1=<hmac_hex>
Compute HMAC-SHA256 over {timestamp}.{raw_request_body} using your signing_secret (YOUR_WEBHOOK_SIGNING_SECRET). Compare the v1 value using constant-time comparison.
Event types#
| Event type | Label | Description |
|---|---|---|
auth.app.created |
App created | Auth app was created in the portal |
auth.app.updated |
App updated | Auth app settings were updated |
auth.app.disabled |
App disabled | Auth app was disabled |
auth.app.deleted |
App deleted | Auth app was deleted |
auth.credentials.rotated |
Credentials rotated | App secret and API key were regenerated |
auth.user.upserted |
User upserted | An end user record was created or updated |
auth.enroll.started |
Enrollment started | MFA enrollment was started for a user |
auth.enroll.confirmed |
Enrollment confirmed | MFA enrollment was confirmed for a user |
auth.enroll.expired |
Enrollment expired | A pending MFA enrollment expired |
auth.verify.succeeded |
Verification succeeded | An MFA verification succeeded |
auth.verify.failed |
Verification failed | An MFA verification failed |
auth.mfa.disabled |
MFA disabled | MFA was disabled for a user |
auth.mfa.enabled |
MFA enabled | MFA was enabled for a user |
auth.mfa.reset |
MFA reset | MFA was reset for a user |
auth.user.deleted |
User deleted | An end user was deleted from the auth app |
auth.recovery_codes.generated |
Recovery codes generated | New recovery codes were generated |
auth.recovery_code.used |
Recovery code used | A recovery code was used for verification |
auth.user.locked |
User locked | A user was locked after failed verifications |
auth.user.unlocked |
User unlocked | A locked user was unlocked |
auth.otp.sent |
OTP sent | An email or SMS OTP was sent |
auth.otp.resend |
OTP resend requested | An OTP resend was requested |
auth.otp.queued |
OTP queued | An OTP send was queued for later delivery |
auth.otp.queue_cancelled |
OTP queue cancelled | A queued OTP send was cancelled |
auth.otp.delivery_failed |
OTP delivery failed | OTP delivery through a connector failed |
auth.magic_link.sent |
Magic link sent | A magic link was sent via email or SMS |
auth.magic_link.resend |
Magic link resend requested | A magic link resend was requested |
auth.magic_link.delivery_failed |
Magic link delivery failed | Magic link delivery through a connector failed |
Delivery payload#
{
"id": "auth_audit_507f1f77bcf86cd799439015",
"type": "auth.verify.succeeded",
"created_at": "2026-07-10T09:00:00.000Z",
"auth_app_id": "auth_app_507f1f77bcf86cd799439011",
"auth_user_id": "auth_user_507f1f77bcf86cd799439012",
"enrollment_id": "auth_enr_507f1f77bcf86cd799439013",
"actor": {
"type": "end_user",
"email": "user@example.com",
"external_user_id": "user_123"
},
"metadata": {
"method": "email_otp"
}
}