System Log Lists Specific User as Actor for Events Completed through API
Last Updated:
Overview
When reviewing the system log (Syslog) for changes that were made through the Okta API, an Admin may notice that the Actor is listed as a specific user even if that user did not make the changes.
Applies To
- System Log
- API
Cause
Syslog will log the name of the user who created the API token that was used to make the changes through the API.
Solution
This is expected behavior. However, to avoid confusion or possible disruptions, Okta recommends using a Service Account when creating the API token. In this matter, the name of the service account will appear in the logs when an API call is made, and confusion with any user activity or disruptions in case of user deactivation is avoided.
Please consult the Related References section of this article for more details about API Tokens and their management.
