View OAuth and OIDC Token Grant Events for a Specific Okta Application
Last Updated:
Overview
The System Log (either in the Admin Console or via the Logs API endpoint) can be used to collect data about the token grant events for a specific application. In the queries below, replace 0oa123456789 with the Okta Application ID for the target application.
This query will return ALL successful token grant events for a specific application:
actor.id eq "0oa123456789" AND (eventType sw "app.oauth2.token.grant." OR eventType sw "app.oauth2.as.token.grant." OR eventType sw "app.oauth2.authorize.implicit." OR eventType sw "app.oauth2.as.authorize.implicit.") AND outcome.result eq "SUCCESS"This query will return ALL successful Access Token grant events for a specific application:
actor.id eq "0oa123456789" AND (eventType sw "app.oauth2.token.grant.access_token" OR eventType eq "app.oauth2.as.token.grant.access_token" OR eventType eq "app.oauth2.as.authorize.implicit.access_token" OR eventType eq "app.oauth2.authorize.implicit.access_token") AND outcome.result eq "SUCCESS"Applies To
- Okta Classic Engine
- Okta Identity Engine (OIE)
- API Access Management
- OAuth 2.0/OpenID Connect applications
- System Logs
Solution
How does the System Log display OAuth and OIDC token grant events for a specific Okta application?
Okta does not have a prebuilt report to get this data, but administrators can use System Log queries to count all the token grant events for an individual application. Since multiple types of tokens can be issued within a single transaction, the exact query varies depending on whether the output should include all types of token grants, such as ID, Access, and Refresh tokens, or a specific type of token, such as just Access Tokens.
Use the following query to return all successful token grant events for a specific application, replacing 0oa123456789 with the Okta Application ID for the target application.
actor.id eq "0oa123456789" AND (eventType sw "app.oauth2.token.grant." OR eventType sw "app.oauth2.as.token.grant." OR eventType sw "app.oauth2.authorize.implicit." OR eventType sw "app.oauth2.as.authorize.implicit.") AND outcome.result eq "SUCCESS"
Use the following query to return all successful Access Token grants for a specific application, replacing 0oa123456789 with the Okta Application ID for the target application.
actor.id eq "0oa123456789" AND (eventType sw "app.oauth2.token.grant.access_token" OR eventType eq "app.oauth2.as.token.grant.access_token" OR eventType eq "app.oauth2.as.authorize.implicit.access_token" OR eventType eq "app.oauth2.authorize.implicit.access_token") AND outcome.result eq "SUCCESS"
