Events

The Events page allows you to see all user and admin events from your Keycloak clusters. You can search through the events, filter by type, and view detailed information about each authentication event.

Viewing Events

From the Events page, you can:

• View all authentication events across your clusters
• Toggle between user events and admin events
• Search and filter through event history
• Export events for analysis
• Monitor events in real-time with Live Tail mode

Time Range Selection

The available time ranges depend on your subscription plan:

• Trial: Last 7 days
• Developer: No access to events
• Launch: Last 7 days
• Business: Last 30 days
• Enterprise: Last 90 days with custom date ranges

Event Details

Click the eye icon next to any event to see its detailed information, including timestamps, user details, IP addresses, and event-specific data.

Event Types

User Events

Monitor user-related activities:

• Login attempts
• User registrations
• Password changes
• Role assignments
• Access events

Admin Events

Track administrative changes:

• Realm changes
• Client modifications
• User management
• Role updates
• Policy changes

Searching Events

You can search and filter events by:

• Event type
• User information
• Status

The search bar will apply a full text search to the event details.

Event Webhooks (Beta)

Send real-time Keycloak events to your applications via HTTP webhooks. This feature allows you to integrate authentication events into your own monitoring, analytics, or security systems.

Key Features

• Real-time delivery: Events are delivered within 2-3 seconds via HTTP POST
• Enriched data: Automatic enrichment with user-agent parsing and IP geolocation
• Flexible filtering: Filter by event type, realm, or cluster
• Secure delivery: Bearer token authentication for webhook endpoints
• Delivery tracking: Monitor webhook delivery status and debug failures

Webhook Payload

Webhooks receive structured JSON payloads with:

• Batch delivery: Events are sent in batches with events array and event_count
• Nested organization: Events use realm, auth, user, and session objects for clean structure
• Resource information: Admin events include structured resource field with type, path, and ID
• Geo enrichment: IP addresses enriched with country, country_code, city, and coordinates
• Event metadata: Each event includes metadata with workspace_id, cluster_id, and event_type

Getting Started

1. Navigate to the Events page and click the Webhooks tab
2. Click Create Webhook to configure your endpoint
3. Provide your HTTP endpoint URL and authentication token
4. Select which event types to receive
5. Test your webhook and start receiving events

For detailed integration instructions, see the Webhook Integration Guide.