
EricL.78638 (Customer) asked a question.
We have used an inline password hook since August last year successfully. We think our users are mostly migrated by now and we want to check who is still calling us. Using the Admin console, System Log filtering by `eventType eq "inline_hook.executed"` we are seeing calls where the Actor is `Okta System (SystemPrincipal)` while others, the Actor is the user actually invoking the hook.
Why the difference? All our users use the same web application to authenticate

Hello @EricL.78638 (Customer) , thank you for contacting Okta Community!
I've reviewed our documentation for something relevant. It looks like your question is more appropriate for our dedicated Okta Developer Forum. I advise reaching out via devforum.okta.com as they will have more insight into this topic.
In the meantime, you can reference this general guide from Okta Developer:
Inline Hooks
While we'll do our best to answer your questions here, this medium is more inclined towards Okta's core products and features (non-developer work).
Regards.
--
Help others in the community by liking or hitting Select as Best if this response helped you.
Collect them all. Learn a new skill and earn a new Okta Learning badge.