> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/administration-guide/reference/audit-actions-and-retention.md).

# Audit actions and retention

The complete audit action catalogue and the per-action retention properties that prune it.

## What this is, and when you need it

Two questions have no answer anywhere else in the documentation set: *what event names can I search for in the audit log*, and *how long is each of them kept*. Both are enumerable, and both are answered below.

The catalogue holds **538 actions**. Most of them declare the kind of object they act on, and that is how the groups below are organised, because the audit search offers a filter per object kind. To confirm an action name exists in your deployment, open the audit log search at `/webconsole/viewAuditLog`, pick the name under **Select an Action**, and widen the date window until an event appears. **Select an Action** is independent of every target filter, so it also works for the ninety actions that declare no target at all — see [Actions that declare no target object](#actions-that-declare-no-target-object).

{% hint style="info" %}
The `REPORT_*` actions written by the report builder (2026.10.1) are not in the catalogue below. They are listed, with who writes each and what it records, in [Operate the report service](/administration-guide/reports/operate-the-report-service.md#operate-audit-actions).
{% endhint %}

## Audit history is kept indefinitely by default

**498** properties in the `SystemAuditLog` category govern pruning: one global key and 497 per-action overrides. (The category holds 503 keys in total; the other five are covered in [Find audit evidence](/administration-guide/operations/find-audit-evidence.md#two-more-retention-related-things-in-the-systemauditlog-category).)

| Property shape                              | Meaning                                                                         |
| ------------------------------------------- | ------------------------------------------------------------------------------- |
| `org.openiam.audit.log.prune.days`          | Intended as global retention, in days, for any action without its own override. |
| `org.openiam.audit.log.prune.days.<ACTION>` | Intended as a per-action retention override, in days.                           |

Every one of the 498 ships as `-1`, which means **never prune**. Pruning is performed by the `PRUNE_AUDIT_LOGS` batch task, which also ships disabled (`ENABLED='N'`).

Read that as **unlimited retention, not absent retention**. Nothing is being discarded: the audit trail is complete back to installation, and it stays that way until somebody configures a limit. Limiting it is the deliberate change, and the property names describe the limit, not the keeping.

The 497 per-action keys are not a mirror of the 538 actions. **Seventy-five shipped actions have no key of their own** and can only ever be limited by the global key — including `CHECK_IF_PASSWORD_WAS_COMPROMISED`, `COMPLETE_CERTIFICATION_REVIEW`, `HARD_SOD_POLICY_VIOLATION_DETECTION`, all five `RECONCILE_*` actions and every `*_SOD_RULE_SET` and `*_SOD_POLICY` action. **Thirty-four keys name actions that do not exist**, so nothing ever reads them, and several of those are misspellings of an action that does — which leaves the real action with no key: `…PROVISIONING_DEPROVISING_ON_DATE` for `PROVISIONING_DEPROVISION_ON_DATE`, `…PROVISIONING_SETPASSWORD` for `PROVISIONING_SET_PASSWORD`, `…SAML_SP_GENERATE_SAMLREQUEST` for `SAML_SP_GENERATE_SAML_REQUEST`. So before planning retention for a particular action, confirm its key exists by filtering the **System Audit Log** tab on the action name; if it is not there, the global key is the only lever.

{% hint style="warning" %}
The practical consequence is capacity, not evidence loss: a long-running installation retains every audit event forever unless somebody changed both the property and the batch task, so the `auditlog` index grows without bound. Check its growth before assuming any limit is being enforced. Conversely, do not enable pruning without confirming your retention obligation — deleted audit history is not recoverable.
{% endhint %}

### Capping retention is not something this build lets you do from a screen

{% hint style="danger" %}
**All 497 of these keys are typed `Boolean`, so the Webconsole will not accept a number of days.** OpenIAM rejects any value other than `true` or `false` for a `Boolean` property. Type `30` into any prune key on **Administration → System Configuration → System Audit Log**, press **Save**, and the tab answers *"Property ''`<key>`'' has a missing or invalid value"*; the underlying failure is `PROPERTY_TYPE_INVALID`. That is the observable check and it takes a few seconds. The shipped `-1` values are in the database only because they were seeded directly, bypassing that validation. Worse, the values the type *does* accept are not numbers, and the prune task treats a non-numeric value as an error rather than as "no limit" — so saving `true` on a prune key breaks the prune run instead of configuring it.

**What you can do from the console is nothing; what you own is the decision and the request.** Decide the retention period each action needs and confirm the obligation behind it. Then the change belongs to whoever owns the deployment, by one of two routes, both outside the supported change path: a deployment-level property override named `OPENIAM_PROP_org_openiam_audit_log_prune_days_<ACTION>`, which does not pass through this validator — see the [Installation Guide](/installation/installation.md) — or a break-glass `PROPERTY_FILE_VALUES` update that also corrects `PROPERTY_TYPE` to `Integer`. The second bypasses validation and the property cache, so it does not take effect until the cache next sweeps, and nothing audits it; record it wherever you record break-glass changes. Raise the typing itself with support — until it is corrected, no retention cap is configurable through the screen that carries the keys.
{% endhint %}

Three things about the prune run itself, for whoever does end up setting a value.

**A value of `0` and a value of `-1` behave identically.** Only a positive number of days prunes anything, and an absent value counts as `0`. There is no way to express "prune immediately".

**The global key is applied first and it ignores the action.** OpenIAM deletes every event older than the global cutoff regardless of action, and only then applies the per-action cutoffs. A global `30` therefore **defeats** a per-action `3650` — the long-retention events are already gone by the time their own key is evaluated. For differentiated retention, leave the global key at `-1` and set only per-action keys.

**Deletion runs 1,000 events at a time, looping until nothing more matches.** On a large index the first enabled run is long and competes with live search. Enabling the task is [Shipped batch tasks](/administration-guide/reference/shipped-batch-tasks.md); finding the evidence that it ran, and the action it records itself under, is [Find audit evidence](/administration-guide/operations/find-audit-evidence.md#retention-what-the-shipped-state-means-for-your-search).

## Actions by target object

The audit search offers a filter per kind of target object, so this grouping matches how you will look events up. The **Action** filter is separate from all of them and always available.

### USER: 219 actions

`ACTIVATE_USER` `ACTIVATE_USERS_BY_START_DATE` `ADD_ACCOUNT` `ADD_APPROVER_TO_SUPERVISOR` `ADD_APPROVER_TO_TARGET_USER` `ADD_APPROVER_TO_USER` `ADD_ATTRIBUTE` `ADD_NEW_DEVICE` `ADD_PRINCIPAL` `ADD_PROFILE_PICTURE_FOR_USER` `ADD_SUBORDINATE_TO_USER` `ADD_SUPERIOR_TO_USER` `ADD_USER_TO_RESOURCE` `ALLOW_SOD_VIOLATIONS` `ANSWER_CHALLENGE_RESPONSE_QUESTIONS` `ANSWER_UNLOCK_PASSWORD_QUESTIONS` `AUTHORIZE` `AUTHORIZE_PUBLIC_APPLICATION` `AUTH_PUSH_COMPLETE` `AUTH_PUSH_DECISION` `AUTOMATIC_USER_TERMINATION` `BULK_ADMIN_USER_RESET_PASSWORD` `BULK_OPERATION` `BULK_PASSWORD_RESET` `BULK_PASSWORD_RESET_CSV_FILE_ATTACHED` `BULK_PASSWORD_RESET_ON_BEHALF` `CAPTCHA_AUTHENTICATION` `CHANGE_LAST_DATE` `CHANGE_PASSWORD` `CHANGE_PASSWORD_EXTENDED` `CHANGE_PASSWORD_FORM_SUBMIT` `CHANGE_SUPERVISOR` `CHECK_EMAIL_VERIFICATION_CODE` `CHECK_PHONE_VERIFICATION_CODE` `CHECK_VERIFICATION_CODE` `CLEAR_SMS_OTP_STATUS` `CONFIRM_IT_POLICY` `CONFIRM_SMS_OTP_TOKEN` `CONTRACT_EXTENSION` `CREATE_ACCESS_REQUEST_ACCEPT` `CREATE_ACCESS_REQUEST_COMPLETE` `CREATE_ACCESS_REQUEST_INIT` `CREATE_ACCESS_REQUEST_NOTIFY` `CREATE_ACCESS_REQUEST_REJECT` `CREATE_ACCESS_REQUEST_UI` `CREATE_USER` `CREATE_USER_NO_APPROVAL_REQUEST_ACCEPT` `CREATE_USER_NO_APPROVAL_REQUEST_COMPLETE` `CREATE_USER_NO_APPROVAL_REQUEST_INIT` `CREATE_USER_NO_APPROVAL_REQUEST_NOTIFY` `CREATE_USER_NO_APPROVAL_REQUEST_REJECT` `CREATE_USER_REQUEST_ACCEPT` `CREATE_USER_REQUEST_COMPLETE` `CREATE_USER_REQUEST_INIT` `CREATE_USER_REQUEST_NOTIFY` `CREATE_USER_REQUEST_REJECT` `CUSTOMIZE_EMAIL_CONTENT` `DECLINE_IT_POLICY` `DELETE_APPROVER_FROM_SUPERVISOR` `DELETE_APPROVER_FROM_TARGET_USER` `DELETE_APPROVER_FROM_USER` `DELETE_ATTRIBUTE` `DELETE_PRINCIPAL` `DELETE_PROFILE_PICTURE_FOR_USER` `DELETE_SOD_VIOLATIONS` `DELETE_SUBORDINATE_FROM_USER` `DELETE_SUPERIOR_FROM_USER` `DELETE_SUPERVISOR` `DELETE_USER_FROM_RESOURCE` `DE_PROVISIONING` `DO_LOGIN` `DO_LOGIN_AGAINST_MANAGED_SYSTEM` `FEDERATION_NEURAL_NETWORK_STATISTIC_GET` `FORGOT_PASSWORD` `FORGOT_USERNAME` `GENERATE_DEVICE_REGISTRATION_QR_CODE` `GENERATE_TOTP_SECRET` `GET_TOKEN` `HELPDESK_UNLOCK_ATTEMPT` `IMPERSONATION` `IMPORT_USER` `INCREMENT_FAIL_AUTH_COUNT` `INITIATE_MANUAL_TASKS_FOR_TERMINATION` `LOGIN` `LOGIN_PKS12` `LOGOUT` `MODIFY_LOGIN` `MODIFY_USER` `PERFORM_USER_TYPE_CONVERSION_ACTION` `POLL_USER_VERIFICATION` `POLL_USER_VERIFICATION_STATUS` `POSITION_CHANGE_REQUEST_ACCEPTED` `POSITION_CHANGE_REQUEST_COMPLETED` `POSITION_CHANGE_REQUEST_INIT` `POSITION_CHANGE_REQUEST_NOTIFY` `POSITION_CHANGE_REQUEST_REJECTED` `PROVISIONING` `PROVISIONING_ADD` `PROVISIONING_DEACTIVATE_IDENTITY` `PROVISIONING_DELETE` `PROVISIONING_DELETE_IDENTITY` `PROVISIONING_DISABLE` `PROVISIONING_DISABLE_IDENTITY` `PROVISIONING_ENABLE` `PROVISIONING_ENABLE_IDENTITY` `PROVISIONING_IN_ORDER` `PROVISIONING_METADATA_SEARCH` `PROVISIONING_MODIFY` `PROVISIONING_RESET_PASSWORD` `PROVISIONING_RESUME` `PROVISIONING_SAVE` `PROVISIONING_SET_PASSWORD` `PROVISIONING_SUSPEND` `PROVISIONING_TEST` `PROVISIONING_USER_SEARCH` `QUESTION_AUTHENTICATION` `RECONCILE_IDM_WITH_TARGET` `RECONCILE_PART_IDM_WITH_TARGET` `RECONCILE_PART_TARGET_WITH_IDM` `RECONCILE_TARGET_WITH_IDM` `RECONCILE_USER` `RECONCILIATION` `RECONCILIATION_CONFIG_DELETED` `RECONCILIATION_CONFIG_SAVED` `RECONCILIATION_RECORD_FALSE` `REFRESH_IDENTITY` `REGISTER_DEVICE` `REGISTER_DEVICE_ENTER_PIN` `REMOVE_ACCOUNT` `REMOVE_DEVICE` `REPLACE_SUBORDINATE` `REPLACE_SUPERIOR` `RESET_IT_POLICY` `RESET_OTP_STATUS` `RESET_PASSWORD_FORM_SUBMIT` `RESET_PASSWORD_FOR_RELATED_ACCOUNT` `RESET_PASSWORD_FROM_SOURCE_SYSTEM` `RESTART_USER_VERIFICATION` `REVOKE_ACCESS_REQUEST_ACCEPT` `REVOKE_ACCESS_REQUEST_COMPLETE` `REVOKE_ACCESS_REQUEST_INIT` `REVOKE_ACCESS_REQUEST_NOTIFY` `REVOKE_ACCESS_REQUEST_REJECT` `REVOKE_OAUTH_TOKEN` `REVOKE_USER_ACCESS` `SAML_IDP_GLOBAL_LOGOUT` `SAML_IDP_INITIATED_SSO` `SAML_IDP_PROCESS_LOGOUT_REQUEST` `SAML_IDP_PROCESS_SAML_REQUEST` `SAML_SP_GENERATE_SAML_REQUEST` `SAML_SP_GENERATE_SLO_REQUEST` `SAML_SP_PROCESS_SAML_RESPONSE` `SAML_SP_PROCESS_SLO_REQUEST` `SAVE_IT_POLICY` `SAVE_PROVISION_USER` `SAVE_SECURITY_ANSWERS` `SAVE_SUPERVISOR` `SECRET_WORD_SAVED` `SELF_REG_REQUEST_ACCEPT` `SELF_REG_REQUEST_COMPLETE` `SELF_REG_REQUEST_INIT` `SELF_REG_REQUEST_NOTIFY` `SELF_REG_REQUEST_REJECT` `SEND_EMAIL_NOTIFICATION` `SEND_EMAIL_OTP_TOKEN` `SEND_EMAIL_VERIFICATION_CODE` `SEND_OTP_TOKEN` `SEND_PHONE_VERIFICATION_CODE` `SEND_PUSH_NOTIFICATION` `SEND_SINGLE_PROVISION_EVENT` `SEND_SMS_OTP_TOKEN` `SIMULATE_PROVISIONING` `START_BULK_OPERATION` `START_RECONCILIATION` `START_USER_VERIFICATION` `STOP_RECONCILIATION` `SYNCHRONIZATION` `SYNCHRONIZATION_RECORD` `SYNCHRONIZATION_THREAD` `SYNC_IDENTITY` `TERMINATE_USERS_BY_LAST_DATE` `TERMINATE_USER_REQUEST_ACCEPT` `TERMINATE_USER_REQUEST_COMPLETE` `TERMINATE_USER_REQUEST_INIT` `TERMINATE_USER_REQUEST_NOTIFY` `TERMINATE_USER_REQUEST_REJECT` `UNLOCK_PASSWORD` `UPDATE_PRINCIPAL` `UPDATE_PROFILE` `UPDATE_PROFILE_PICTURE_FOR_USER` `UPDATE_USER_TO_RESOURCE` `UPLOAD_ATTACHMENT` `UPLOAD_COMMENT` `USER_ACCOUNT_LOCKED` `USER_ACTIVATE` `USER_ACTIVE` `USER_DEACTIVATE` `USER_DECEASED` `USER_DELETE` `USER_DISABLE` `USER_ENABLE` `USER_LEAVER` `USER_LEAVE_OF_ABSENCE` `USER_LEAVE_WITH_PAY` `USER_NOTIFY` `USER_REHIRED` `USER_REMOVE` `USER_RESET_ACCOUNT` `USER_RESET_PASSWORD` `USER_RESET_PASSWORD_ON_BEHALF` `USER_RESET_SECURITY_QUESTIONS` `USER_SSH_KEY_DELETE` `USER_SSH_KEY_SAVE` `USER_TERMINATE` `USER_TYPE_CONVERSION` `USER_VERIFICATION_FINISHED` `USER_VERIFICATION_GENERATE_URL` `USE_RESET_PASSWORD_TOKEN` `VALIDATE_CURRENT_PASSWORD`

### Actions that declare no target object

**Ninety actions — one in six of the catalogue — declare no target object at all**, so no amount of filtering by user, role, group, resource, organization or managed system will ever return one of them. They have their subject in common rather than their absence: each records an operation on OpenIAM's own configuration or on a whole subsystem rather than on one governed object. SoD policies and rule sets, certification administration, Groovy script import and export, `MODIFY_SYSTEM_PROPERTIES`, `VIEW_SECRET_PROPERTY_VALUE`, `REINDEX`, `SETUP_CONTENT_PROVIDER`, the risk sweep and score evaluation, report generation, the synchronization and reconciliation configuration events, and the placeholders `NOT_SPECIFIED` and `OTHER_LOG_EVENT1` to `OTHER_LOG_EVENT10`.

**Search for these by name, not by object.** Put the constant into **Select an Action** on the audit log search at `/webconsole/viewAuditLog` and narrow with **From Date** / **To Date** and **Requestor** — those four filters are independent of the target filters. Narrowing by action is also what makes the search fast, so this route is no slower than any other; see [Find audit evidence](/administration-guide/operations/find-audit-evidence.md#what-the-search-screen-can-and-cannot-filter-on). For a change to configuration the requester is usually the fact you actually want, and it is recorded on every one of these events.

`ACTIVATE_SOD_RULE_SET` `ADD_CART_ITEM` `BATCH_TASK_EXECUTE` `CERTIFICATION_AUTO_REPORTING` `CHECK_IF_PASSWORD_WAS_COMPROMISED` `CREATE_CERTIFICATION` `CREATE_COUNTER` `CREATE_SOD_POLICY` `CREATE_SOD_RULE_SET` `CSP_REPORT` `DEACTIVATE_SOD_RULE_SET` `DELETE_AUTH_RULE` `DELETE_CAMPAIGN_REQUESTS_IN_BULK` `DELETE_CART_ITEM` `DELETE_CERTIFICATION` `DELETE_CERTIFICATION_CAMPAIGN` `DELETE_CERTIFICATION_REQUESTS_IN_BULK` `DELETE_COUNTER` `DELETE_QUESTIONNAIRE` `DELETE_REPORT_SUB_CRITERIA_PARAM` `DELETE_SOD_POLICY` `DELETE_SOD_RULE_SET` `DEPROVISION_MEMBERSHIP_ON_END_DATE` `ENFORCE_SOD_RULE_SET` `EXECUTE_CERTIFICATION` `EXECUTE_CERTIFICATION_BATCH` `EXPORT_GROOVY_SCRIPTS` `EXTEND_CERTIFICATION_CAMPAIGN` `FORCE_EXPIRE_CERTIFICATION_CAMPAIGN` `GENERATE_CURRENT_STATE_CERTIFICATION_REPORT` `GENERATE_RESULT_CERTIFICATION_REPORT` `GENERATE_SCOPE_CERTIFICATION_REPORT` `GENERATE_SOD_REPORT` `GET_CLIENT_ID_FOR_TEAMS_BOT` `HARD_SOD_POLICY_VIOLATION_DETECTION` `IMPORT_GROOVY_SCRIPTS` `IMPORT_SOD_RULES` `KEY_MANAGEMENT_INITIALIZATION` `MAKE_ACCESS_REVIEW_ITEM_DECISION` `MIGRATE_GROOVY_SCRIPTS` `MODIFY_APPROVER_ASSOCIATIONS` `MODIFY_CERTIFICATION` `MODIFY_SYSTEM_PROPERTIES` `NOTHING_TO_CERTIFY` `NOT_SPECIFIED` `OTHER_LOG_EVENT1` `OTHER_LOG_EVENT10` `OTHER_LOG_EVENT2` `OTHER_LOG_EVENT3` `OTHER_LOG_EVENT4` `OTHER_LOG_EVENT5` `OTHER_LOG_EVENT6` `OTHER_LOG_EVENT7` `OTHER_LOG_EVENT8` `OTHER_LOG_EVENT9` `PBAC_REQUEST` `PROVISIONING_DEPROVISION_ON_DATE` `PROVISION_MEMBERSHIP_ON_START_DATE` `REGISTER_APPLICATION` `REINDEX` `RESYNC_SOD_RULE_SET` `RETRY_PROVISIONING` `RISK_NIGHTLY_SWEEP` `RISK_SCORE_EVALUATION` `RUN_SOD_DIGEST` `SAVE_ALTERNATE_CONTACT` `SAVE_AUTH_RULE` `SAVE_GROOVY` `SAVE_QUESTIONNAIRE` `SAVE_REPORT_SUB_CRITERIA_PARAM` `SAVE_RISK_SCORE_FACTOR` `SAVE_SOD_DIGEST_CONFIG` `SAVE_USER_IN_DB` `SEND_CERTIFICATION_NOTIFICATIONS` `SEND_REPORT_OF_FAILED_PROVISION_REQUESTS` `SETUP_CONTENT_PROVIDER` `SOAP_REQUEST` `SOFT_SOD_POLICY_VIOLATION_DETECTION` `SOURCE_ADAPTER_CALL` `SSL_CERT_REQUEST` `SUBMIT_BULK_ACCESS_REVIEWS` `SYNCHRONIZATION_CONFIG_DELETED` `SYNCHRONIZATION_CONFIG_SAVED` `SYNCHRONIZATION_CONNECTOR_RESPONSE_PROCESSOR` `SYNCHRONIZATION_CSV_FILE_ATTACHED` `UPDATE_CAMPAIGN_MANAGERS` `UPDATE_SOD_POLICY` `UPDATE_SOD_RULE_SET` `UPLOAD_FILE` `VIEW_SECRET_PROPERTY_VALUE`

### WORKFLOW: 61 actions

`ACTIVITI_GROOVY_SCRIPT` `ADD_USER_AND_INVITE` `APPROVE_USER_INVITE_APPROVE` `CANCEL_EXPIRED_CERTIFICATION_REQUEST` `CANCEL_TASK` `CERTIFICATION` `CERTIFICATION_ACTIVITI_PROCESSING` `CLAIM_REQUEST` `CLAIM_TASK` `COMPLETE_CERTIFICATION_REVIEW` `COMPLETE_WORKFLOW` `CREATE_GENERIC_REQUEST_ACCEPT` `CREATE_GENERIC_REQUEST_COMPLETE` `CREATE_GENERIC_REQUEST_INIT` `CREATE_GENERIC_REQUEST_NOTIFY` `CREATE_GENERIC_REQUEST_REJECT` `CREATE_REQUEST_POST_ACTION` `CREATE_USER_REQUEST_APPROVERS` `CREATE_USER_REQUEST_STEP_2` `DELEGATE_TASK` `DELEGATE_TO_ALTERNATE_REQUEST` `DELEGATE_TO_ALTERNATE_REQUEST_RETRY` `DELEGATE_TO_DEFAULT_APPROVER` `DELETE_ALL_USER_TASKS` `DELETE_TASK` `ENTITLEMENTS_DELEGATE` `ESCALATE_EXPIRED_STEP` `ESCALATE_REQUESTS_PROCEDURE` `EXPIRING_ACCESS_PROCEDURE` `INITIATE_ACCESS_REQUEST_BASED_ON_BR` `INITIATE_ACCESS_REQUEST_FROM_MAKE_DECISION` `INITIATE_CANCELING_OF_EXPIRED_REQUEST` `INITIATE_CERTIFICATION_WORKFLOW` `INITIATE_CLONE_GROUP_REQUEST` `INITIATE_ESCALATION_OF_EXPIRED_STEP` `INITIATE_INVITE_USER_TO_GROUP_WORKFLOW` `INITIATE_REVOKE_ACCESS_BASED_ON_BR` `MAKE_ACCESS_REVIEW_DECISION` `MAKE_DECISION` `MAKE_DECISION_FROM_EMAIL` `MAKE_DECISION_LIST_ACCEPT` `MAKE_DECISION_LIST_REJECT` `MANUAL_TASK` `MODIFY_USER_WORKFLOW` `NEW_USER_WORKFLOW` `NOTIFY_REQUEST_APPROVERS` `POSITION_CHANGE_WORKFLOW` `PRUNE_AUDIT_LOGS` `SEND_REMINDERS_TO_APPROVERS_PROCEDURE` `SEND_REMINDER_ABOUT_EXPIRING_ACCESS` `SEND_REMINDER_TO_APPROVER` `SEND_REMINDER_TO_CERTIFICATION_REVIEWER` `SERVICE_TASK` `TASK_LISTENER` `TERMINATED_WORKFLOW` `TERMINATE_USER_WORKFLOW` `TICKET_SYSTEM_INTEGRATION` `UNCLAIM_TASK` `UPDATE_WORKFLOW` `USER_ACCEPTED_INVITE` `WORKFLOW_NOTIFICATION`

### GROUP: 29 actions

`ADD_APPROVER_TO_GROUP` `ADD_ATTRIBUTE_TO_GROUP` `ADD_CHILD_GROUP` `ADD_GROUP_TO_RESOURCE` `ADD_USER_TO_GROUP` `CREATE_GROUP` `CREATE_GROUP_REQUEST_ACCEPT` `CREATE_GROUP_REQUEST_COMPLETE` `CREATE_GROUP_REQUEST_INIT` `CREATE_GROUP_REQUEST_NOTIFY` `CREATE_GROUP_REQUEST_REJECT` `DELETE_APPROVER_FROM_GROUP` `DELETE_CHILD_GROUP` `DELETE_GROUP` `DELETE_GROUP_ATTRIBUTE` `DELETE_GROUP_FROM_RESOURCE` `DELETE_PARENT_GROUP` `DELETE_USER_FROM_GROUP` `GROUP_PROVISIONING` `IMPORT_GROUP` `MODIFY_GROUP` `MODIFY_GROUP_IDENTITY` `MODIFY_GROUP_REQUEST_ACCEPT` `MODIFY_GROUP_REQUEST_COMPLETE` `MODIFY_GROUP_REQUEST_INIT` `MODIFY_GROUP_REQUEST_NOTIFY` `MODIFY_GROUP_REQUEST_REJECT` `PROVISIONING_GROUP_SEARCH` `UPDATE_GROUP_TO_RESOURCE`

### ROLE: 20 actions

`ADD_APPROVER_TO_ROLE` `ADD_CHILD_ROLE` `ADD_GROUP_TO_ROLE` `ADD_PARENT_ROLE` `ADD_ROLE_TO_GROUP` `ADD_ROLE_TO_RESOURCE` `ADD_USER_TO_ROLE` `CLONE_ROLE` `COMPARE_ROLE_ACCESS` `CREATE_ROLE` `DELETE_APPROVER_FROM_ROLE` `DELETE_CHILD_ROLE` `DELETE_GROUP_FROM_ROLE` `DELETE_ROLE` `DELETE_ROLE_FROM_GROUP` `DELETE_ROLE_FROM_RESOURCE` `DELETE_USER_FROM_ROLE` `ENTITLEMENT_BULK_OPERATION` `IMPORT_ROLE` `MODIFY_ROLE`

### RESOURCE: 13 actions

`ADD_APPROVER_TO_RESOURCE` `ADD_CHILD_RESOURCE` `ADD_RESOURCE_TO_ORGANIZATION` `CREATE_RESOURCE` `CREATE_RESOURCE_TYPE` `DELETE_APPROVER_FROM_RESOURCE` `DELETE_CHILD_RESOURCE` `DELETE_RESOURCE` `DELETE_RESOURCE_FROM_ORGANIZATION` `DELETE_RESOURCE_TYPE` `IMPORT_RESOURCE` `MODIFY_RESOURCE` `MODIFY_RESOURCE_TYPE`

### MANAGED\_SYS: 12 actions

`APPLY_SIMULATION_REQ` `CLONE_MANAGED_SYSTEM` `CREATE_MANAGED_SYSTEM` `DELETE_MANAGED_SYSTEM` `DELETE_MANAGED_SYSTEM_POLICY` `DELETE_MANAGED_SYSTEM_POLICY_MAP` `DELETE_SIMULATION_REQ` `DELETE_SIMULATION_REQ_OPERATION` `DISPATCH_SIMULATION_REQ` `IMPORT_MANAGED_SYSTEM` `MODIFY_MANAGED_SYSTEM` `MODIFY_MANAGED_SYSTEM_POLICY`

### POLICY: 11 actions

`ATTRIBUTE_POLICY_ADD` `ATTRIBUTE_POLICY_DELETE` `AUTHENTICATION_POLICY_ADD` `AUTHENTICATION_POLICY_DELETE` `CREATE_PASSWORD_POLICY` `DELETE_PASSWORD_POLICY` `IMPORT_POLICY` `MODIFY_ATTRIBUTE_POLICY` `MODIFY_AUTHENTICATION_POLICY` `MODIFY_PASSWORD_POLICY` `SAVE_PASSWORD_DICTIONARY`

### CONNECTOR: 10 actions

`CONNECTOR_RESPONSE` `DELETE_CONNECTOR` `DELETE_CONNECTOR_RESPONSE` `DISABLE_CONNECTOR_RESPONSE` `ENABLE_CONNECTOR_RESPONSE` `RESET_PASSWORD_CONNECTOR_RESPONSE` `SAVE_CONNECTOR` `SAVE_CONNECTOR_RESPONSE` `SAVE_GROUP_CONNECTOR_RESPONSE` `SEARCH_CONNECTOR_RESPONSE`

### AUTH\_PROVIDER: 8 actions

`CREATE_OAUTH_PROVIDER` `INITIATE_NEW_HIRE_WORKFLOW` `INITIATE_SELF_REGISTRATION_WORKFLOW` `LOGIN_VIA_SOCIAL` `LOGIN_VIA_TARGET` `MODIFY_OAUTH_PROVIDER` `SELF_REGISTRATION` `SELF_REGISTRATION_VIA_SOCIAL`

### ORG: 8 actions

`ADD_APPROVER_TO_ORGANIZATION` `ADD_USER_TO_ORG` `CREATE_ORG` `DELETE_APPROVER_FROM_ORGANIZATION` `DELETE_ORG` `DELETE_USER_FROM_ORG` `IMPORT_ORGANIZATION` `MODIFY_ORG`

### BUSINESS\_RULE\_MANAGER: 7 actions

`BUSINESS_RULE_ACTION_DELETE` `BUSINESS_RULE_ACTION_SAVE` `BUSINESS_RULE_DELETE` `BUSINESS_RULE_RECALCULATE` `BUSINESS_RULE_SAVE` `BUSINESS_RULE_TARGET_DELETE` `BUSINESS_RULE_TARGET_SAVE`

### IT\_POLICY: 6 actions

`IT_POLICY_ADD` `IT_POLICY_DELETE` `IT_POLICY_MODIFY` `IT_POLICY_RESET_BY_USER` `IT_POLICY_SUBMIT` `USER_IT_POLICY_HISTORY_RESET`

### MAILBOX\_CONFIGURATION: 6 actions

`ADD_MAILBOX_CONFIGURATION` `ADD_MAILBOX_CONFIGURATION_TEMPLATE` `DELETE_MAILBOX_CONFIGURATION` `DELETE_MAILBOX_CONFIGURATION_TEMPLATE` `UPDATE_MAILBOX_CONFIGURATION` `UPDATE_MAILBOX_CONFIGURATION_TEMPLATE`

### SELF\_REGISTRATION\_CONFIG: 6 actions

`ADD_SELF_REGISTRATION_STEP` `ADD_SELF_REGISTRATION_WORKFLOW` `DELETE_SELF_REGISTRATION_STEP` `DELETE_SELF_REGISTRATION_WORKFLOW` `UPDATE_SELF_REGISTRATION_STEP` `UPDATE_SELF_REGISTRATION_WORKFLOW`

### ORPHAN: 5 actions

`CREATE_NEW_USER_FROM_ORPHAN` `LINK_ORPHAN` `REMOVE_ORPHAN` `SYNCHRONIZATION_ORPHAN` `UNLINK_IDENTITY_TO_ORPHAN`

### UI\_THEME: 5 actions

`CREATE_UI_THEME` `DELETE_CLIENT_RESOURCE` `DELETE_UI_THEME` `MODIFY_UI_THEME` `UPLOAD_CLIENT_RESOURCE`

### ACCESS\_RIGHTS: 3 actions

`CREATE_ACCESS_RIGHTS` `DELETE_ACCESS_RIGHTS` `MODIFY_ACCESS_RIGHTS`

### ANALYTICS\_DASHBOARD: 3 actions

`ANALYTICS_DASHBOARD_TILE_ADD` `ANALYTICS_DASHBOARD_TILE_DELETE` `ANALYTICS_DASHBOARD_TILE_MODIFY`

### METADATA\_ELEMENT: 3 actions

`CREATE_METADATA_ELEMENT` `DELETE_METADATA_ELEMENT` `MODIFY_METADATA_ELEMENT`

### METADATA\_TYPE: 3 actions

`CREATE_METADATA_TYPE` `DELETE_METADATA_TYPE` `MODIFY_METADATA_TYPE`

### OTP\_PROVIDER: 3 actions

`ADD_OTP_PROVIDER` `DELETE_OTP_PROVIDER` `UPDATE_OTP_PROVIDER`

### SOD\_MITIGATING\_CONTROL: 3 actions

`CREATE_SOD_MITIGATING_CONTROL` `DELETE_SOD_MITIGATING_CONTROL` `UPDATE_SOD_MITIGATING_CONTROL`

### USER\_VERIFICATION\_PROVIDER: 2 actions

`DELETE_USER_VERIFICATION_PROVIDER` `SAVE_USER_VERIFICATION_PROVIDER`

### EMAIL\_MANAGER: 1 action

`ANSWER_TO_USER_EMAIL`

### GEO\_IP: 1 action

`UPLOAD_IP_GEO_DB`

*Applies to OpenIAM 2026.8.1. Last reviewed 14 September 2026.*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.openiam.com/administration-guide/reference/audit-actions-and-retention.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.