The Resource Events page is an audit log of actions taken on resources managed by Akamai MFA, such as integrations, policies, users, groups, devices, bypass codes, and enrollment emails. Each entry records who performed an action, what action was performed, the affected resource, and the request details. Use Resource Events to review administrative activity, investigate configuration or account changes, and support security audits.

The Resource Events page captures actions performed through Enterprise Center, the Akamai MFA APIs, and automated processes such as user provisioning. It also captures user-initiated actions, such as device enrollment or device deletion.

View resource events

In the Enterprise Center navigation menu, select Multi-factor Authentication > Resource Events.
The Resource Events page displays a list of events, sorted by most recent.

Each event in the list shows the following columns:

Timestamp. The event date and time in your local time zone.
Resource. The resource affected by the action, including its name, a badge indicating the resource type, and the resource ID with a link when available.
Action. The action performed on the resource such as create, delete, or modify.
Actor. The user or client that performed the action.

Actor roles

The actor is the identity that performed an action. Each actor has one of the following roles:

Icon	Role	Description
	Admin	An administrator in Enterprise Center.
	Admin client	An API client that uses an administrative Akamai MFA API credential.
	Authentication client	A client performing authentication on behalf of a user, such as an integration that initiates an MFA challenge.
	Authenticator	An enrolled device or authenticator acting on its own behalf such as when syncing data.
	Custodian	An internal Akamai process that maintains MFA resources on your behalf, such as routine system maintenance and cleanup.
	Provisioning	An automated user-provisioning process, such as SCIM or EAA directory synchronization.
	User	A user managing their own account, such as enrolling or deleting devices.

View event details

To display full event details, click the resource name. The event drawer opens with the Overview and JSON tabs.

The Overview tab presents event fields in a readable layout, organized into two sections: Activity and Details. The Activity section shows the core details of the event:

Occurred at. The date and time of the event.
Event ID. The unique identifier for the event.
Resource name, Resource type, and Resource ID. Identifies the affected resource.
Action. The type of action performed.
Actor name and Actor role. Identifies the user or client that performed the action.
Request ID. The identifier of the originating request. This ID is useful when you work with Akamai support.
Path and query and HTTP method. The API request that generated the event.

The Details section includes additional resource metadata that describes the updated state of the resource.

The JSON tab presents the complete event record in JSON format. This is the raw event as recorded by the Akamai MFA service, so the exact fields can vary by resource type and action. Click Copy JSON to copy this content to your clipboard.

Filter events

Use the search bar and the date range selector to narrow the list of events.

To filter events:

Click the search bar to select one of the following categories. Depending on the category, select or enter a value:
- Action. Select an action type.
- Actor name. Enter an actor name.
- Actor role. Select an actor role.
- Event ID. Enter a specific event ID.
- Resource ID. Enter a specific resource ID.
- Resource name. Enter a resource name.
- Resource type. Select a resource type.
- Username. Enter a username to show events related to that user.
- User ID. Enter a user ID to show events related to that user.
  📘
  You can apply one filter at a time. To change your view, replace the current filter with a different one.
Filter events by time using the date range selector. Select a preset range, such as Last 24 hours, Last 7 days, This month, or Last 30 days, or set a custom start and end date and time.

📘
You can retrieve resource events from the last 30 days. The Splunk adapter can be used to retain events for longer periods of time.

Download resource events

You can use the following methods to export events for offline review or archiving:

Download a single event as JSON. In the event's row or in the event drawer, click the Download icon to save that event as a .json file.
Download the event list as CSV. To export the events that match your current filters, click the Download icon for the page to save the list as a .csv file. A large export may take a moment to prepare before your browser downloads it.