---
title: "Auditing users and login activity"
slug: "auditing-users"
updated: 2025-03-31T10:31:14Z
published: 2025-03-31T10:31:14Z
canonical: "support.lusid.com/auditing-users"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.lusid.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Auditing users and login activity

Okta is FINBOURNE’s identity provider. You can retrieve Okta’s system logs from within FINBOURNE applications. This enables you to conveniently monitor and troubleshoot the following activity:

- User creations and removals
- Logins to FINBOURNE applications
- Role assignments.

This service is provided by Okta’s [SystemLogs](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/SystemLog/) API. You can access this service using the following APIs provided by FINBOURNE’s Identity application:

- The Identity [ListLogs](https://www.lusid.com/docs/api/identity/endpoints/identity-logs/ListLogs) API enables you to retrieve Okta’s system log for every user.
- The Identity [ListUserLogs](https://www.lusid.com/docs/api/identity/endpoints/identity-logs/ListUserLogs) API enables you to retrieve Okta’s system log just for you.

Alternatively, if you have a Luminesce license you can access this service using the `Sys.Okta.SystemLogs` provider.

Note the following:

- Logs older than 90 days are not returned, in accordance with [Okta’s data retention policy](https://support.okta.com/help/Documentation/Knowledge_Article/Okta-Data-Retention-Policy).
- All requests are subject to [Okta’s rate limits](https://developer.okta.com/docs/reference/rate-limits/).

For example, the following call to the `ListLogs` API uses the `oktaSince` and `oktaUntil` query parameters to retrieve all activity for every user on 1 March 2025:

```json
curl -X GET "https://<your-domain>.lusid.com/identity/api/logs?oktaSince=2025-03-01T00%3A00%3A00Z&oktaUntil=2025-03-02T00%3A00%3A00Z"
  -H "Authorization: Bearer <your-API-access-token>"
```

Note query parameters map directly to Okta’s `SystemLogs` API query parameters, so for more information see [Okta’s API documentation](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/SystemLog/).

To use the Luminesce `Sys.Okta.SystemLogs` provider, navigate to the **Data Virtualisation > Query Editor** dashboard in the LUSID web app and write a [valid SQL query](/v1/docs/understanding-the-luminesce-sql-query-syntax), for example:

```sql
select * from Sys.Okta.SystemLogs 
    where OktaSince = #2025-03-01 00:00:00# 
    and OktaUntil = #2025-03-02 00:00:00#
```