---
title: "Audit Logs: User Access and Security"
slug: "audit-logs-user-access-and-security"
tags: ["reference-guides"]
status: "new"
updated: 2026-09-11T18:56:18Z
published: 2026-09-15T20:03:55Z
canonical: "docs.unqork.io/audit-logs-user-access-and-security"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.unqork.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit Logs: User Access and Security

Payload schemas for user access and security audit log events. Each table lists the attributes returned in the `object.attributes` field of the event payload for the given `eventAction`. For the full list of `eventAction` values, see [Audit Logs](/unqorkai/docs/audit-logs-overview).

## Creator Roles

### `add-designer-role`

| Attribute | Description | Type |
| --- | --- | --- |
| `context.type` | The administration type where the role was created. | String |
| `context.id` | The unique identifier associated with the administration type. | String |
| `permissions.applications` | Application permissions set at creation. | String |
| `permissions.managedAssets` | Asset permissions set at creation. | String |
| `permissions.documentTemplates` | Document template permissions set at creation. | String |
| `permissions.dataCollections` | Data collection permissions set at creation. | String |
| `permissions.services` | Services permissions set at creation. | String |
| `permissions.styles` | Style permissions set at creation. | String |

### `modify-designer-role`

| Attribute | Description | Type |
| --- | --- | --- |
| `context.type` | The administration type after changes were made. | String |
| `context.id` | The unique identifier associated with the administration type. | String |
| `permissions.applications` | Application permissions after changes were made. | String |
| `permissions.managedAssets` | Asset permissions after changes were made. | String |
| `permissions.documentTemplates` | Document template permissions after changes were made. | String |
| `permissions.dataCollections` | Data collection permissions after changes were made. | String |
| `permissions.services` | Services permissions after changes were made. | String |
| `permissions.styles` | Style permissions after changes were made. | String |

### `delete-designer-role`

| Attribute | Description | Type |
| --- | --- | --- |
| `context.type` | The administration type where the role was deleted. | String |
| `context.id` | The unique identifier associated with the administration type. | String |

### `modify-designer-user-roles`

| Attribute | Description | Type |
| --- | --- | --- |
| `userId` | The unique identifier of the Creator whose roles were changed. | String |
| `newRoles` | The roles assigned to the Creator. | String |
| `removedRoles` | The roles removed from the Creator. | String |

## Creator Users

### `add-designer-user`

| Attribute | Description | Type |
| --- | --- | --- |
| `email` | The email address of the Creator account that was created. | String |

### `modify-designer-user`

| Attribute | Description | Type |
| --- | --- | --- |
| `userId` | The unique identifier of the Creator account that was changed. | String |

### `delete-designer-user`

| Attribute | Description | Type |
| --- | --- | --- |
| `userId` | The unique identifier of the Creator account that was deleted. | String |
| `deletedSuccess` | Whether the account was deleted successfully. | Boolean |

### `designer-user-login`

| Attribute | Description | Type |
| --- | --- | --- |
| `email` | The email address of the Creator who logged in. | String |

### `designer-user-logout`

| Attribute | Description | Type |
| --- | --- | --- |
| `email` | The email address of the Creator who logged out. | String |

### `designer-user-lockout`

| Attribute | Description | Type |
| --- | --- | --- |
| `email` | The email address of the Creator account that was locked out. | String |

### `designer-user-password-change`

| Attribute | Description | Type |
| --- | --- | --- |
| `userId` | The unique identifier of the Creator whose password was changed. | String |

## Express Users

### `add-express-user`

| Attribute | Description | Type |
| --- | --- | --- |
| `userId` | The unique identifier of the Express user that was created. | String |
| `email` | The email address of the Express user. | String |

### `modify-express-user`

| Attribute | Description | Type |
| --- | --- | --- |
| `userId` | The unique identifier of the Express user that was changed. | String |

### `delete-express-user`

| Attribute | Description | Type |
| --- | --- | --- |
| `userId` | The unique identifier of the Express user that was deleted. | String |
| `deletedSuccess` | Whether the account was deleted successfully. | Boolean |

### `express-login`

| Attribute | Description | Type |
| --- | --- | --- |
| `userId` | The unique identifier of the Express user who logged in. | String |

### `express-logout`

| Attribute | Description | Type |
| --- | --- | --- |
| `userId` | The unique identifier of the Express user who logged out. | String |

### `express-user-lockout`

| Attribute | Description | Type |
| --- | --- | --- |
| `userId` | The unique identifier of the Express user account that was locked out. | String |

## Express Groups

### `add-express-group`

| Attribute | Description | Type |
| --- | --- | --- |
| `groupName` | The name of the Express group that was created. | String |

### `modify-express-group`

| Attribute | Description | Type |
| --- | --- | --- |
| `groupName` | The name of the Express group after changes were made. | String |

### `delete-express-group`

| Attribute | Description | Type |
| --- | --- | --- |
| `groupName` | The name of the Express group that was deleted. | String |
| `deletedSuccess` | Whether the group was deleted successfully. | Boolean |

## Express Roles

### `add-express-roles`

| Attribute | Description | Type |
| --- | --- | --- |
| `roleName` | The name of the Express role that was created. | String |

### `modify-express-roles`

| Attribute | Description | Type |
| --- | --- | --- |
| `roleName` | The name of the Express role after changes were made. | String |

### `delete-express-roles`

| Attribute | Description | Type |
| --- | --- | --- |
| `roleName` | The name of the Express role that was deleted. | String |
| `deletedSuccess` | Whether the role was deleted successfully. | Boolean |

## Single Sign-On (SSO)

### `add-oidc-configuration`

| Attribute | Description | Type |
| --- | --- | --- |
| `providerName` | The name of the OIDC provider. | String |
| `clientId` | The client ID for the OIDC configuration. | String |

### `modify-oidc-configuration`

| Attribute | Description | Type |
| --- | --- | --- |
| `providerName` | The name of the OIDC provider after changes were made. | String |

### `delete-oidc-configuration`

| Attribute | Description | Type |
| --- | --- | --- |
| `providerName` | The name of the OIDC provider that was deleted. | String |
| `deletedSuccess` | Whether the configuration was deleted successfully. | Boolean |

### `add-saml-configuration`

| Attribute | Description | Type |
| --- | --- | --- |
| `providerName` | The name of the SAML provider. | String |

### `modify-saml-configuration`

| Attribute | Description | Type |
| --- | --- | --- |
| `providerName` | The name of the SAML provider after changes were made. | String |

### `delete-saml-configuration`

| Attribute | Description | Type |
| --- | --- | --- |
| `providerName` | The name of the SAML provider that was deleted. | String |
| `deletedSuccess` | Whether the configuration was deleted successfully. | Boolean |

### `preview-designer-sso`

| Attribute | Description | Type |
| --- | --- | --- |
| `providerName` | The name of the SSO provider that was previewed. | String |

### `preview-express-sso`

| Attribute | Description | Type |
| --- | --- | --- |
| `providerName` | The name of the SSO provider that was previewed. | String |

> [!NOTE]
> An audit log also generates for Express SSO users when the **Disable User Creation** setting is enabled in SSO Management Administration. Because user creation, SSO attribute validation, and Express user deletion occur in sequence during the same process, all three events appear as a group in the audit log.

---

**Changelog**

| Date | Change |
| --- | --- |
| 2026-09-11 | Initial publication (EN-8100). |

An API payload is the data that is sent or received between a client and a server during an API request or response. It contains the information needed to perform actions or get resources.

In Unqork an application is a program used to perform specific tasks. An application can be one of two types: workflow or module.

Also known as Unqork Users, or Designer Users; is anyone who is inside the Unqork platform.

The Boolean data type accepts one of two values: true, or, false.

The Unqork front-end application framework that delivers Creator-built applications to end-users. Express is the layer end-users interact with—the published forms, screens, and navigation built in the Module Builder. Express is distinct from Express View, which is a Creator-facing preview tool in the IDE.

OIDC (OpenID Connect) is an identity authentication protocol that lets two applications share user information without exposing user credentials.

Security Assertion Markup Language (SAML) is a protocol that allows an identity provider (IdP) to send a user's credentials to a service provider (SP) to verify their identity and grant them access to a service.

Single Sign-On is an authentication scheme that enables users to use one set of login credentials across multiple services.