Locate Deleted Application Users in Auth0 Tenant Logs

Administrators can use tenant logs to locate deleted application users and identify the administrator who performed the deletion. When administrators delete an application user, Auth0 generates specific log entries that contain deletion details. Querying the tenant logs for these specific entries reveals whether the Auth0 Dashboard or the Management API processed the deletion, and identifies the responsible user account if applicable.

• Auth0
• Tenant Logs
• User Management

How does a log query locate deleted application users?

Deleting an application user from User Management > Users within the Auth0 Dashboard or via the Management API Delete a User endpoint creates the following two log entries.

• type: sdu
• type: sapi

The sapi log entry type contains additional information regarding the administrator who deleted the user. Search the user directly in the tenant logs by executing the following query and amending the <user_id> accordingly.

description: "Delete a User" AND details.request.path:"/api/v2/users/<user_id>"

NOTE: The channel property within the details.request object contains one of two options.

• https://manage.auth0.com/: Indicates deletion via the Auth0 Dashboard. The deletion record encodes the user who performed the deletion.
• api: Indicates deletion via the Management API. Auth0 associates no user account with the deletion because the action involves an access token acquired via client credentials, which is not user-specific.