How to Find which Identity Deleted or Reauthorized a Connector/Connection from Workflows Console
Jan 30, 2026
Workflows
Overview
Applies To
- Okta Workflows
- Okta System Logs
Solution
In System Log:
- To find a Connection that was created/updated/deleted, use the following query, and it will return multiple action types against Workflow Connections:
eventType co "workflows.user.connection"
- To find a Connection that was reauthorized, use the following query:
eventType eq "workflows.user.connection.reauthorize"- NOTE: This shows the user who was logged in and attempted to reauthorize the Connection and does not show the Credentials used for the connection. Some connections (such as Okta) can try to retrieve this information. For more information, see How To See What User (Account) A Workflows Connection Is Using / Authorized With.
- To find a Connection that was deleted, use the following query:
eventType eq "workflows.user.connection.delete"- Example result: the AlternateId shows the Connection name, and the DisplayName shows the nickname that was set for the Connection.
Related References
- For further details on the EventTypes above, as well as other user activity logged in System Log with Workflows EventTypes, see Event Types (search Workflows)
- How To See What User (Account) A Workflows Connection Is Using / Authorized With
