Search Unblock User Events in Auth0 Tenant Logs

This article describes how to search for unblocked user events in tenant logs after a user/identifier is blocked by Brute Force Protection, which is helpful for auditing which tenant admin unblocked the user.

• Brute Force Protection
• Unblock User
• Tenant Logs

After a user/identifier is blocked by the Auth0 Brute Force Protection feature, there are three ways to unblock the user.

1. Self-service unblock: The user can unblock themselves by clicking the unblock link in the "Account Blocked" email they received. This unblock method generates a ublkdu event with the description "Your account has been unblocked." in the tenant logs. Here is an example:

{
  "date": "2026-02-28T03:59:42.177Z",
  "type": "ublkdu",
  "description": "Your account has been unblocked.",
  "connection": "Username-Password-Authentication",
  ...
  "details": {
    "title": "Account Unblocked",
    "body": {
      "ticket": "*****"
    },
    "query": {
      "email": "<redacted>",
      "source_ip": "<redacted>",
      "blocked_key": "<redacted>",
      ...
    }
  },
 "user_name": "<redacted>",
  ...

}

2. Unblock by the "Unblock by identifier" endpoint (`DELETE  /v2/user-blocks`) of the management API. This method generates a sapi event with description "Unblock by identifier" in the tenant logs.
   Here is an example:

{
  "date": "2026-02-16T01:58:02.676Z",
  "type": "sapi",
  "description": "Unblock by identifier",
  "client_id": "<redacted>",
  "client_name": "",
  "ip": "<redacted>",
  "user_agent": "Other 0.0.0 / Other 0.0.0",
  "details": {
    "request": {
      "method": "delete",
      "path": "/api/v2/user-blocks",
      "query": {
        "identifier": "<BLOCKED_IDENTIFIER>"
      },
      "userAgent": "PostmanRuntime/7.51.0",
      ...
    },
    "response": {
      "statusCode": 204,
      "body": {}
    }
  },
  ...
}

3. Unblock by the "Unblock a user" endpoint (DELETE  /v2/user-blocks/{id}) of the management API: This method generates a sapi event with description "Unblock a user" and a ublkdu event with description "User unblocked" in the tenant logs.
    When the user is unblocked from the Auth0 tenant dashboard ("Unblock for all IPs" button), this endpoint is called behind the scenes as well.
    
   Here are the examples:

{
  "date": "2026-02-16T01:59:15.708Z",
  "type": "ublkdu",
  "description": "User unblocked",
  "client_name": "",
  "details": {
    "request": {
      "auth": {
        "user": null
      }
    },
    "response": {}
  },
  "user_id": "<USER_ID_OF_BLOCKED_USER>,
  ...
}
{
  "date": "2026-02-16T01:59:15.711Z",
  "type": "sapi",
  "description": "Unblock a user",
  "client_id": "<redacted>",
  "client_name": "",
  "ip": "<redacted>",
  "user_agent": "Other 0.0.0 / Other 0.0.0",
  "details": {
    "request": {
      "method": "delete",
      "path": "/api/v2/user-blocks/<USER_ID_OF_BLOCKED_USER>",
      "query": {},
      "userAgent": "PostmanRuntime/7.51.0",
      ...
      }
    },
    "response": {
      "statusCode": 204,
      "body": {}
    }
  },
  ...
}

Based on the above analysis, the following searching condition should return all the user unblock events in the tenant logs:

type:ublkdu OR description:"Unblock by identifier" OR description:"Unblock a user"