challenge.log_created

Records granular challenge lifecycle events such as OTPs being sent, verified, expired, or rate-limited. Pair with action.log_created for a full audit trail. These webhooks are asynchronous and delivered in batches of up to 500 events, after your tenant’s challenge token duration (typically 15 minutes). Delivery is at-least-once, so de-duplicate using the envelope id. Configure the webhook URL for log events in tenant settings.

Payload

string

required

The ID of the tenant that the event occurred within.

string

required

The ID of the user that the action was triggered by.

string

required

The action being evaluated (e.g. login, withdrawal).

string

required

Unique per action instance.

string

required

When this challenge event occurred.

string

required

The event type. See Challenge event types below for the full list.

string

The verification method involved (e.g. EMAIL_OTP, SMS, PASSKEY).

string

Email address involved in the event (for email-channel events).

string

Phone number involved in the event (for SMS/WhatsApp-channel events).

string

Human-readable error summary for *_FAILED events.

string

Upstream HTTP status code for downstream-delivery failure events.

object

Additional structured fields. Omitted if empty.

Challenge event types

A non-exhaustive list of the most commonly seen event types. Email OTP: EMAIL_OTP_SENT, EMAIL_OTP_CODE_VALID, EMAIL_OTP_INVALID_OR_EXPIRED, EMAIL_OTP_MAX_ATTEMPTS_EXCEEDED, EMAIL_OTP_RATE_LIMIT_EXCEEDED, EMAIL_OTP_SEND_DOWNSTREAM_FAILED Email magic link: EMAIL_MAGIC_LINK_SENT, EMAIL_MAGIC_LINK_INVALID_OR_EXPIRED, EMAIL_MAGIC_LINK_RATE_LIMIT_EXCEEDED, EMAIL_MAGIC_LINK_SEND_DOWNSTREAM_FAILED SMS: SMS_SENT, SMS_DELIVERED, SMS_NOT_DELIVERED, SMS_CODE_VALID, SMS_CODE_INVALID_OR_EXPIRED, SMS_MAX_ATTEMPTS_EXCEEDED, SMS_RATE_LIMIT_EXCEEDED, SMS_SEND_DOWNSTREAM_FAILED WhatsApp: WHATSAPP_SENT, WHATSAPP_CODE_VALID, WHATSAPP_CODE_INVALID_OR_EXPIRED, WHATSAPP_MAX_ATTEMPTS_EXCEEDED, WHATSAPP_RATE_LIMIT_EXCEEDED, WHATSAPP_SEND_DOWNSTREAM_FAILED TOTP / authenticator app: TOTP_CODE_VALID, TOTP_CODE_INVALID_OR_EXPIRED, TOTP_MAX_ATTEMPTS_EXCEEDED Push: PUSH_SENT

{
  "version": 1,
  "id": "ffffffff-ffff-ffff-ffff-ffffffffffff",
  "source": "https://authsignal.com",
  "time": "2026-04-22T01:10:20.939Z",
  "tenantId": "dddddddd-dddd-dddd-dddd-dddddddddddd",
  "type": "challenge.log_created",
  "record": {
    "tenantId": "dddddddd-dddd-dddd-dddd-dddddddddddd",
    "userId": "user_abc",
    "actionCode": "login",
    "idempotencyKey": "bb51e6b9-a7f8-4f03-8044-2940ae574236",
    "createdAt": "2026-04-22T01:10:20.939Z",
    "type": "EMAIL_OTP_SENT",
    "verificationMethod": "EMAIL_OTP",
    "email": "alice@example.com"
  }
}

Webhooks

Authenticator challenge events

Authenticator events

Action verification events

Log events

challenge.log_created

Payload

Challenge event types

​Payload

​Challenge event types

Payload

Challenge event types