User Risk Detected
Run a flow when Okta detects that a user is associated with risk activity or context.
Output
| Field | Definition | Type |
|---|---|---|
|
Date and Time |
The date and time when the event was triggered in Okta API. |
Text |
|
Message |
Message details about the event. |
Text |
|
Event ID |
The event's unique identifier key. |
Text |
|
Event Type |
The type of event that was published. user.risk.detect |
Text |
|
Event Time |
The time stamp when the notification was delivered to the service. |
Text |
|
Version |
Versioning indicator. |
Text |
|
Severity |
The event's severity level. |
Text |
|
Risk |
||
|
Level |
The user entity's risk level.
|
Text |
|
Previous Level |
The previous risk level of the user entity. |
Text |
|
Detection Name |
The risks that Okta monitors. |
Text |
|
Reasons |
The reasons that contributed to the risk level. |
Text |
|
Issuer |
The source of the risk detection. See Detections. |
Text |
|
Admin |
||
|
ID |
The ID of the Okta admin that initiated the risk detection. |
Text |
|
Alternate ID |
The Okta admin's email address. |
Text |
|
Display Name |
The Okta admin's display name. |
Text |
|
Type |
The type of data returned. |
Text |
|
Detail Entry |
Additional details about the entity. |
Object |
|
Okta User |
||
|
ID |
The ID of the Okta user with a new risk detection. |
Text |
|
Alternate ID |
The Okta user's email address. |
Text |
|
Display Name |
The Okta user's display name. |
Text |
|
Type |
The type of target object. Typically User. |
Text |
|
Detail Entry |
Additional details about the entity. |
Object |
|
UUID |
The webhook event's universal unique identifier. |
Text |
|
Event Details |
The raw JSON payload returned from the Okta API for this particular event. |
Object |
|
Headers |
An object representing the headers for the response. Each key of the header is parsed into a header string as "key: value" (Content-Type: text/plain). |
Object |
|
Source |
The source of user-specific data. |
Text |
|
Debug Context |
||
|
Debug Data |
Information on the triggered event used for debugging. For example, returned data can include a URI, risk information, or trace ID. |
Object |
Related topics
Okta ITP connector
Cards in flows