Reference

Event types

Every event type defined by the OpenID Shared Signals specifications, with its claims and an example SET payload. Summaries are ours; the linked specs are normative.

CAEP events

Session and access-condition changes while a user is signed in. Specification →

caep Session Revoked interop profile A session for the subject has been terminated. Receivers should end any corresponding sessions they hold.

A use case in the CAEP Interoperability Profile: Transmitters must include a non-empty reason_admin, and Receivers must handle every allowed value of this event’s fields.

https://schemas.openid.net/secevent/caep/event-type/session-revoked

Claim		Meaning
`event_timestamp`	OPTIONAL	When the event occurred (NumericDate). Optional on every CAEP event.
`initiating_entity`	OPTIONAL	Who caused the event: admin, user, policy, or system.
`reason_admin / reason_user`	OPTIONAL	Localised, human-readable explanation for an administrator or end user.

{
  "iss": "https://tr.example.com/",
  "jti": "756E69717565206964656E746966696572",
  "iat": 1760390400,
  "aud": "https://rp.example.com/",
  "txn": "8675309",
  "sub_id": {
    "format": "opaque",
    "id": "dMTlD|1600802906337.16|16008.16"
  },
  "events": {
    "https://schemas.openid.net/secevent/caep/event-type/session-revoked": {
      "event_timestamp": 1760390391
    }
  }
}

caep Token Claims Change Claims in a token previously issued for the subject have changed — for example a role or group membership — so the Receiver may want to re-evaluate access.

https://schemas.openid.net/secevent/caep/event-type/token-claims-change

Claim		Meaning
`claims`	REQUIRED	Object holding the claim names and their new values.
`event_timestamp`	OPTIONAL	When the event occurred (NumericDate). Optional on every CAEP event.
`initiating_entity`	OPTIONAL	Who caused the event: admin, user, policy, or system.
`reason_admin / reason_user`	OPTIONAL	Localised, human-readable explanation for an administrator or end user.

{
  "iss": "https://tr.example.com/",
  "jti": "756E69717565206964656E746966696572",
  "iat": 1760390400,
  "aud": "https://rp.example.com/",
  "txn": "8675309",
  "sub_id": {
    "format": "iss_sub",
    "iss": "https://idp.example.com/",
    "sub": "248289761001"
  },
  "events": {
    "https://schemas.openid.net/secevent/caep/event-type/token-claims-change": {
      "event_timestamp": 1760390391,
      "claims": {
        "role": "ro-admin"
      }
    }
  }
}

caep Credential Change interop profile A credential was created, revoked, updated or deleted — a password reset, a new passkey, a revoked certificate.

A use case in the CAEP Interoperability Profile: Transmitters must include a non-empty reason_admin, and Receivers must handle every allowed value of this event’s fields.

https://schemas.openid.net/secevent/caep/event-type/credential-change

Claim		Meaning
`credential_type`	REQUIRED	password, pin, x509, fido2-platform, fido2-roaming, fido-u2f, verifiable-credential, phone-voice, phone-sms, app, …
`change_type`	REQUIRED	create, revoke, update, or delete.
`friendly_name`	OPTIONAL	Display name of the credential.
`x509_issuer / x509_serial`	OPTIONAL	Identify an X.509 credential.
`fido2_aaguid`	OPTIONAL	Authenticator model of a FIDO2 credential.
`event_timestamp`	OPTIONAL	When the event occurred (NumericDate). Optional on every CAEP event.
`initiating_entity`	OPTIONAL	Who caused the event: admin, user, policy, or system.
`reason_admin / reason_user`	OPTIONAL	Localised, human-readable explanation for an administrator or end user.

{
  "iss": "https://tr.example.com/",
  "jti": "756E69717565206964656E746966696572",
  "iat": 1760390400,
  "aud": "https://rp.example.com/",
  "txn": "8675309",
  "sub_id": {
    "format": "email",
    "email": "alice@example.com"
  },
  "events": {
    "https://schemas.openid.net/secevent/caep/event-type/credential-change": {
      "event_timestamp": 1760390391,
      "credential_type": "fido2-roaming",
      "change_type": "create",
      "fido2_aaguid": "accced6a-63f5-490a-9eea-e59bc1896cfc",
      "friendly_name": "Security key"
    }
  }
}

caep Assurance Level Change The authentication assurance level for the subject went up or down (for example, NIST AAL or eIDAS levels).

https://schemas.openid.net/secevent/caep/event-type/assurance-level-change

Claim		Meaning
`namespace`	REQUIRED	Assurance framework: RFC8176, RFC6711, ISO-IEC-29115, NIST-IAL, NIST-AAL, NIST-FAL, or a custom value.
`current_level`	REQUIRED	The new level.
`previous_level`	OPTIONAL	The level before the change.
`change_direction`	OPTIONAL	increase or decrease.
`event_timestamp`	OPTIONAL	When the event occurred (NumericDate). Optional on every CAEP event.
`initiating_entity`	OPTIONAL	Who caused the event: admin, user, policy, or system.
`reason_admin / reason_user`	OPTIONAL	Localised, human-readable explanation for an administrator or end user.

{
  "iss": "https://tr.example.com/",
  "jti": "756E69717565206964656E746966696572",
  "iat": 1760390400,
  "aud": "https://rp.example.com/",
  "txn": "8675309",
  "sub_id": {
    "format": "iss_sub",
    "iss": "https://idp.example.com/",
    "sub": "248289761001"
  },
  "events": {
    "https://schemas.openid.net/secevent/caep/event-type/assurance-level-change": {
      "event_timestamp": 1760390391,
      "namespace": "NIST-AAL",
      "current_level": "nist-aal2",
      "previous_level": "nist-aal1",
      "change_direction": "increase"
    }
  }
}

caep Device Compliance Change interop profile A device moved into or out of compliance with policy — typically sent by an MDM or endpoint security product.

A use case in the CAEP Interoperability Profile: Transmitters must include a non-empty reason_admin, and Receivers must handle every allowed value of this event’s fields.

https://schemas.openid.net/secevent/caep/event-type/device-compliance-change

Claim		Meaning
`current_status`	REQUIRED	compliant or not-compliant.
`previous_status`	REQUIRED	compliant or not-compliant.
`event_timestamp`	OPTIONAL	When the event occurred (NumericDate). Optional on every CAEP event.
`initiating_entity`	OPTIONAL	Who caused the event: admin, user, policy, or system.
`reason_admin / reason_user`	OPTIONAL	Localised, human-readable explanation for an administrator or end user.

{
  "iss": "https://tr.example.com/",
  "jti": "756E69717565206964656E746966696572",
  "iat": 1760390400,
  "aud": "https://rp.example.com/",
  "txn": "8675309",
  "sub_id": {
    "format": "complex",
    "device": {
      "format": "opaque",
      "id": "device-1234"
    },
    "tenant": {
      "format": "opaque",
      "id": "tenant-5678"
    }
  },
  "events": {
    "https://schemas.openid.net/secevent/caep/event-type/device-compliance-change": {
      "event_timestamp": 1760390391,
      "current_status": "not-compliant",
      "previous_status": "compliant",
      "initiating_entity": "policy"
    }
  }
}

caep Session Established A new session was established for the subject — useful for correlating sessions across products.

https://schemas.openid.net/secevent/caep/event-type/session-established

Claim		Meaning
`ips`	OPTIONAL	IP addresses of the user agent.
`fp_ua`	OPTIONAL	Fingerprint of the user agent.
`acr / amr`	OPTIONAL	Authentication context class and methods used.
`ext_id`	OPTIONAL	External session identifier.
`event_timestamp`	OPTIONAL	When the event occurred (NumericDate). Optional on every CAEP event.
`initiating_entity`	OPTIONAL	Who caused the event: admin, user, policy, or system.
`reason_admin / reason_user`	OPTIONAL	Localised, human-readable explanation for an administrator or end user.

{
  "iss": "https://tr.example.com/",
  "jti": "756E69717565206964656E746966696572",
  "iat": 1760390400,
  "aud": "https://rp.example.com/",
  "txn": "8675309",
  "sub_id": {
    "format": "email",
    "email": "alice@example.com"
  },
  "events": {
    "https://schemas.openid.net/secevent/caep/event-type/session-established": {
      "event_timestamp": 1760390391,
      "ips": [
        "192.0.2.10"
      ],
      "acr": "AAL2",
      "amr": [
        "pwd",
        "otp"
      ],
      "fp_ua": "abb0b6e7da81a42233f8f2b1a8ddb1b9a4c81611"
    }
  }
}

caep Session Presented An existing session was presented to the Transmitter — lets a Receiver see where a session is being used.

https://schemas.openid.net/secevent/caep/event-type/session-presented

Claim		Meaning
`ips`	OPTIONAL	IP addresses of the user agent.
`fp_ua`	OPTIONAL	Fingerprint of the user agent.
`ext_id`	OPTIONAL	External session identifier.
`event_timestamp`	OPTIONAL	When the event occurred (NumericDate). Optional on every CAEP event.
`initiating_entity`	OPTIONAL	Who caused the event: admin, user, policy, or system.
`reason_admin / reason_user`	OPTIONAL	Localised, human-readable explanation for an administrator or end user.

{
  "iss": "https://tr.example.com/",
  "jti": "756E69717565206964656E746966696572",
  "iat": 1760390400,
  "aud": "https://rp.example.com/",
  "txn": "8675309",
  "sub_id": {
    "format": "email",
    "email": "alice@example.com"
  },
  "events": {
    "https://schemas.openid.net/secevent/caep/event-type/session-presented": {
      "event_timestamp": 1760390391,
      "ips": [
        "198.51.100.7"
      ],
      "fp_ua": "abb0b6e7da81a42233f8f2b1a8ddb1b9a4c81611",
      "ext_id": "12345"
    }
  }
}

caep Risk Level Change interop profile The Transmitter’s assessed risk level for a user, device, session or other principal changed.

A use case in the CAEP Interoperability Profile: Transmitters must include a non-empty reason_admin, and Receivers must handle every allowed value of this event’s fields.

https://schemas.openid.net/secevent/caep/event-type/risk-level-change

Claim		Meaning
`principal`	REQUIRED	What the risk is about: USER, DEVICE, SESSION, TENANT, ORG_UNIT, GROUP, …
`current_level`	REQUIRED	LOW, MEDIUM, or HIGH.
`previous_level`	OPTIONAL	LOW, MEDIUM, or HIGH; absent means unknown.
`risk_reason`	RECOMMENDED	Why the risk changed.
`event_timestamp`	OPTIONAL	When the event occurred (NumericDate). Optional on every CAEP event.
`initiating_entity`	OPTIONAL	Who caused the event: admin, user, policy, or system.
`reason_admin / reason_user`	OPTIONAL	Localised, human-readable explanation for an administrator or end user.

{
  "iss": "https://tr.example.com/",
  "jti": "756E69717565206964656E746966696572",
  "iat": 1760390400,
  "aud": "https://rp.example.com/",
  "txn": "8675309",
  "sub_id": {
    "format": "email",
    "email": "alice@example.com"
  },
  "events": {
    "https://schemas.openid.net/secevent/caep/event-type/risk-level-change": {
      "event_timestamp": 1760390391,
      "principal": "USER",
      "current_level": "HIGH",
      "previous_level": "LOW",
      "risk_reason": "PASSWORD_FOUND_IN_DATA_BREACH"
    }
  }
}

RISC events

Account-level changes: compromise, lifecycle, recovery. Specification →

risc Account Credential Change Required The account needs a credential change, for example because a password may have been exposed.

https://schemas.openid.net/secevent/risc/event-type/account-credential-change-required

No event-specific claims.

{
  "iss": "https://tr.example.com/",
  "jti": "756E69717565206964656E746966696572",
  "iat": 1760390400,
  "aud": "https://rp.example.com/",
  "txn": "8675309",
  "sub_id": {
    "format": "email",
    "email": "alice@example.com"
  },
  "events": {
    "https://schemas.openid.net/secevent/risc/event-type/account-credential-change-required": {}
  }
}

risc Account Purged The account has been permanently deleted.

https://schemas.openid.net/secevent/risc/event-type/account-purged

No event-specific claims.

risc Account Disabled The account has been disabled and can no longer be used.

https://schemas.openid.net/secevent/risc/event-type/account-disabled

Claim		Meaning
`reason`	OPTIONAL	hijacking or bulk-account.

{
  "iss": "https://tr.example.com/",
  "jti": "756E69717565206964656E746966696572",
  "iat": 1760390400,
  "aud": "https://rp.example.com/",
  "txn": "8675309",
  "sub_id": {
    "format": "iss_sub",
    "iss": "https://idp.example.com/",
    "sub": "248289761001"
  },
  "events": {
    "https://schemas.openid.net/secevent/risc/event-type/account-disabled": {
      "reason": "hijacking"
    }
  }
}

risc Account Enabled A previously disabled account has been re-enabled.

https://schemas.openid.net/secevent/risc/event-type/account-enabled

No event-specific claims.

risc Identifier Changed The subject’s identifier (e.g. email or phone) changed. The SET is about the old identifier.

https://schemas.openid.net/secevent/risc/event-type/identifier-changed

Claim		Meaning
`new-value`	OPTIONAL	The new identifier value.

{
  "iss": "https://tr.example.com/",
  "jti": "756E69717565206964656E746966696572",
  "iat": 1760390400,
  "aud": "https://rp.example.com/",
  "txn": "8675309",
  "sub_id": {
    "format": "email",
    "email": "alice@example.com"
  },
  "events": {
    "https://schemas.openid.net/secevent/risc/event-type/identifier-changed": {
      "new-value": "alice.smith@example.com"
    }
  }
}

risc Identifier Recycled The identifier now belongs to a different person — e.g. a reissued email address or phone number.

https://schemas.openid.net/secevent/risc/event-type/identifier-recycled

No event-specific claims.

risc Credential Compromise A credential for the subject was found to be compromised.

https://schemas.openid.net/secevent/risc/event-type/credential-compromise

Claim		Meaning
`credential_type`	REQUIRED	Same values as CAEP Credential Change.
`event_timestamp`	OPTIONAL	When the compromise was detected.
`reason_admin / reason_user`	OPTIONAL	Human-readable explanations.

{
  "iss": "https://tr.example.com/",
  "jti": "756E69717565206964656E746966696572",
  "iat": 1760390400,
  "aud": "https://rp.example.com/",
  "txn": "8675309",
  "sub_id": {
    "format": "email",
    "email": "alice@example.com"
  },
  "events": {
    "https://schemas.openid.net/secevent/risc/event-type/credential-compromise": {
      "credential_type": "password",
      "event_timestamp": 1760390391
    }
  }
}

risc Opt In The account owner opted in to RISC event exchange.

https://schemas.openid.net/secevent/risc/event-type/opt-in

No event-specific claims.

risc Opt Out Initiated The account owner started opting out; it takes effect after a grace period.

https://schemas.openid.net/secevent/risc/event-type/opt-out-initiated

No event-specific claims.

risc Opt Out Cancelled A pending opt-out was cancelled.

https://schemas.openid.net/secevent/risc/event-type/opt-out-cancelled

No event-specific claims.

risc Opt Out Effective The opt-out is now in effect; no further events about this subject will be sent.

https://schemas.openid.net/secevent/risc/event-type/opt-out-effective

No event-specific claims.

risc Recovery Activated Account recovery was started for the subject.

https://schemas.openid.net/secevent/risc/event-type/recovery-activated

No event-specific claims.

risc Recovery Information Changed Recovery information (backup email, phone, etc.) was changed.

https://schemas.openid.net/secevent/risc/event-type/recovery-information-changed

No event-specific claims.

risc Sessions Revoked deprecated All sessions for the account were revoked.

Deprecated — new implementations MUST use CAEP Session Revoked.

https://schemas.openid.net/secevent/risc/event-type/sessions-revoked

No event-specific claims.

SSF stream events

Housekeeping events about the stream itself, defined by the framework. Specification →

ssf Verification Sent by the Transmitter when a Receiver asks it to verify a stream end-to-end; echoes back the Receiver-supplied state.

https://schemas.openid.net/secevent/ssf/event-type/verification

Claim		Meaning
`state`	OPTIONAL	Opaque value the Receiver passed in the verification request.

{
  "iss": "https://tr.example.com/",
  "jti": "123456",
  "iat": 1760390400,
  "aud": "https://rp.example.com/",
  "sub_id": {
    "format": "opaque",
    "id": "f67e39a0a4d34d56b3aa1bc4cff0069f"
  },
  "events": {
    "https://schemas.openid.net/secevent/ssf/event-type/verification": {
      "state": "VGhpcyBpcyBhbiBleGFtcGxlIHN0YXRlIHZhbHVlLgo="
    }
  }
}

ssf Stream Updated The Transmitter changed the stream’s status (enabled, paused, disabled) on its own initiative.

https://schemas.openid.net/secevent/ssf/event-type/stream-updated

Claim		Meaning
`status`	REQUIRED	enabled, paused, or disabled.
`reason`	OPTIONAL	Why the status changed.

{
  "iss": "https://tr.example.com/",
  "jti": "123456",
  "iat": 1760390400,
  "aud": "https://rp.example.com/",
  "sub_id": {
    "format": "opaque",
    "id": "f67e39a0a4d34d56b3aa1bc4cff0069f"
  },
  "events": {
    "https://schemas.openid.net/secevent/ssf/event-type/stream-updated": {
      "status": "paused",
      "reason": "License is not valid"
    }
  }
}