Track session activity

Suggest Edits

You can subscribe to session-related event notifications via Webhooks v3. See the table below for available session events and more information.

Event name	Trigger	Included values / Notes
`sessionAuthenticated`	Traditional or social login	`"amr":["pwd"]`
	2FA login	`"amr":` `["pwd","sms"]` or `["pwd","email"]`
	2FA step-up	`"amr":` `["sms"]` or `["email"]`
`sessionResumed`	SSO (any successful, non-interactive user auth)	No `"amr"` values (unless RBA is enabled)
`sessionUnbound`	Logout via button in Hosted Login UI	This trigger unbinds the current device from the session
`sessionUnbound`	Logout via `/end_session`	This trigger unbinds the current device from the session
`sessionEnded`	Global logout (via admin endpoint or `/end_session`)	This trigger destroys the AIC session

Example webhook payload: sessionAuthenticated

{
    "aud": "https://customer.com/listener-endpoint",
    "events": {
        "sessionAuthenticated": {
            "amr": ["email"],
            "captureV1": {
                "uuid": "726087ec-35df-4041-aec8-c11ecc208efa",
                "entityType": "user",
                "appID": "a1bcde2fg3h456ijk7l8mnop9q"
            },
            "client_id": "4ddd6dc1-8313-4b49-ae2a-1afe65c55a8f",
            "id": "45d0c216-13ed-4f50-8c97-ec97a3f5d4b0",
            "sid": "dbaea7af-9993-44be-8ae6-e239aa15740e",
            "subject": "urn:akamai-ic:IRL:capture:entity:MEYWEY3EMUZGMZZTNA2DKNTJNJVTO3BYNVXG64BZOEXXK43FOIXTOMRWGA4DOZLDFUZTKZDGFU2DANBRFVQWKYZYFVRTCMLFMNRTEMBYMVTGC"
        }
    },
    "iat": 1685143154,
    "iss": "https://v1.api.eu.janrain.com/da298280-40d5-40bc-8dad-77cf9e5a1ff0/webhooks",
    "jti": "14ae6657-f9a1-4d18-8489-fe2d05a6fcbd",
    "toe": 1685143154,
    "txn": "a34ecc76-d015-46d5-85b6-718d367b4d28"
}

📘
This example is a sessionAuthenticated event where "amr": ["email"]. This indicates the user completed a step-up authentication via email code verification.

Filtering session events

Notice the attributes emitted in session event payloads are a little different than the entity event payloads you may be used to. For example, in session event payloads, the application ID, entity type, and uuid are nested in an object called "captureV1".

This means filtering on these attributes will be different. For example, a filter on the application ID and entity type would look something like this:

"filter": {
  "$schema": "http://json-schema.org/draft-07/schema", 
  "properties": {
    "sessionAuthenticated": {
      "properties": {
        "captureV1": {
          "properties": {
            "appID": {"const": "a1bcde2fg3h456ijk7l8mnop9q"},
            "entityType": {"const": "user"}
          }
        }
      }
    }
  }
}

Updated about 20 hours ago