> ## Documentation Index
> Fetch the complete documentation index at: https://docs.centure.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Directory Sync Events

> Audit log events for directory sync connections and user provisioning

Directory sync events track automated user provisioning through SCIM 2.0 directory connections. These events record directory configuration changes and management portal access for directory sync administration.

<Info>
  All directory sync events include the standard [actor, targets, context, and metadata](/logs/audit-events#base-event-schema) fields. The schemas below show event-specific fields.
</Info>

## directory\_sync.delete

Records when a directory sync connection is deleted, disabling automated user provisioning.

### Triggered When

Admin deletes a directory sync connection from the SSO settings page.

### Event Schema

<ResponseField name="action" type="string" required>
  `directory_sync.delete`
</ResponseField>

<ResponseField name="targets" type="array" required>
  <Expandable title="directory_sync target">
    <ResponseField name="type" type="string" required>
      `directory_sync`
    </ResponseField>

    <ResponseField name="id" type="string" required>
      Directory's unique identifier
    </ResponseField>

    <ResponseField name="name" type="string" required>
      Display name in format: `{directory_type} Directory` (e.g., "gsuite directory Directory")
    </ResponseField>

    <ResponseField name="metadata.directory_id" type="string" required>
      Directory's unique identifier (same as id)
    </ResponseField>

    <ResponseField name="metadata.directory_type" type="string" required>
      Directory provider type (e.g., "gsuite directory", "azure scim v2.0", "okta scim v2.0", "generic scim v2.0")
    </ResponseField>

    <ResponseField name="metadata.organization_id" type="string" required>
      Organization's unique identifier
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="metadata.source" type="string" required>
  Page route where directory was deleted (e.g., `/organizations/[orgId]/sso`)
</ResponseField>

### Example Event

```json theme={null}
{
  "action": "directory_sync.delete",
  "occurredAt": "2025-01-15T14:30:00.000Z",
  "version": 1,
  "actor": {
    "type": "user",
    "id": "user_01JGXYZ123",
    "name": "Alice Johnson",
    "metadata": {
      "first_name": "Alice",
      "last_name": "Johnson",
      "email": "alice@example.com",
      "impersonator_email": "",
      "impersonator_reason": ""
    }
  },
  "targets": [
    {
      "type": "directory_sync",
      "id": "directory_01JGXYZ789",
      "name": "okta scim v2.0 Directory",
      "metadata": {
        "directory_id": "directory_01JGXYZ789",
        "directory_type": "okta scim v2.0",
        "organization_id": "org_01JGXYZ456"
      }
    }
  ],
  "context": {
    "location": "192.0.2.1",
    "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)..."
  },
  "metadata": {
    "source": "/organizations/org_01JGXYZ456/sso"
  }
}
```

***

## directory\_sync.create\_management\_portal\_url

Records when an admin generates a URL to access the WorkOS directory sync management portal for configuring SCIM connections.

### Triggered When

Admin requests access to the WorkOS directory sync portal from the SSO settings page.

### Event Schema

<ResponseField name="action" type="string" required>
  `directory_sync.create_management_portal_url`
</ResponseField>

<ResponseField name="targets" type="array" required>
  <Expandable title="organization target">
    <ResponseField name="type" type="string" required>
      `organization`
    </ResponseField>

    <ResponseField name="id" type="string" required>
      Organization's unique identifier
    </ResponseField>

    <ResponseField name="name" type="string" required>
      Organization name
    </ResponseField>

    <ResponseField name="metadata.name" type="string" required>
      Organization name (duplicated for consistency)
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="metadata.source" type="string" required>
  Page route where portal URL was generated (e.g., `/organizations/[orgId]/sso`)
</ResponseField>

### Example Event

```json theme={null}
{
  "action": "directory_sync.create_management_portal_url",
  "occurredAt": "2025-01-15T10:15:00.000Z",
  "version": 1,
  "actor": {
    "type": "user",
    "id": "user_01JGXYZ123",
    "name": "Alice Johnson",
    "metadata": {
      "first_name": "Alice",
      "last_name": "Johnson",
      "email": "alice@example.com",
      "impersonator_email": "",
      "impersonator_reason": ""
    }
  },
  "targets": [
    {
      "type": "organization",
      "id": "org_01JGXYZ456",
      "name": "Acme Corp",
      "metadata": {
        "name": "Acme Corp"
      }
    }
  ],
  "context": {
    "location": "192.0.2.1",
    "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)..."
  },
  "metadata": {
    "source": "/organizations/org_01JGXYZ456/sso"
  }
}
```

***

## Supported Directory Providers

Directory sync supports the following provider types:

* **gsuite directory** - Google Workspace directory sync
* **azure scim v2.0** - Microsoft Azure AD SCIM 2.0
* **okta scim v2.0** - Okta SCIM 2.0
* **generic scim v2.0** - Generic SCIM 2.0 providers

<Note>
  Directory sync creation events are not logged because directories are created through the WorkOS portal, which has its own audit trail. Only deletions performed within the Centure platform are tracked.
</Note>

***

## Related Events

<CardGroup cols={2}>
  <Card title="SSO" icon="fingerprint" href="/logs/events/sso">
    Single sign-on configuration and connections
  </Card>

  <Card title="Organizations" icon="building" href="/logs/events/organizations">
    Organization settings and domain management
  </Card>

  <Card title="Project Memberships" icon="users" href="/logs/events/project-memberships">
    User access grants and role changes
  </Card>

  <Card title="Audit Log Streams" icon="stream" href="/logs/events/audit-log-streams">
    Audit log portal access and SIEM configurations
  </Card>
</CardGroup>