Using Session and Request ID Fields in the System Log Skip to main content
How satisfied are you with the Okta Help Center?
Thank you for your feedback!
How satisfied are you with the Okta Help Center?
Very Dissatisfied
Very satisfied
Enter content less than 200 characters.
Using Session and Request ID Fields in the System Log
Published: Jan 10, 2015   -   Updated: Jun 22, 2018

Please note: this page is no longer being updated and may not show current information.

In the system log the fields sessionId and requestId are used to identify events. 

  • The sessionId ties a series of requests to a single authentication.
  • The requestId ties a series of events to a single request.

Note: A single request can contain more than one event. 

For each authenticated session, there is one authentication event and any number of requests. Each request can contain one or more events, as shown in the following diagram.


Accessing the System Log

You can access the system log on the Reports page in Okta. You can also access the system log with the Okta API.

Reports Page

These fields are visible in the system logs on the Reports page. To view these fields, select System Log and then select the arrow to expand the entry, as shown below.


The log detail for the event displays, as shown in the example below. For more information on the Reports page, see Using the Okta Reports Page

Okta API

These fields are also accessible through the Okta API in the event model. For JSON responses and definitions for these attributes, see the Events section on the Okta Developer site.

Example – Multiple Requests in One Session

The following entries from the system log show a single session where there are two requests. Each request contains two events.

Request 1 – A user is created and activated.
Request 2 – A second user is created and activated.

This example shows one session, two requests, and four events.

By inspecting the log visually or accessing it programmatically, you can see the events that were processed by session and determine how they were bundled into requests.

System Log Expanded