Product · Hand off setup and watch it
Observability and audit
What RealmSSO records, and what it does not
RealmSSO pulls sign-in events about every 60 seconds and keeps them 90 days by default. Connection health runs on demand. There is no scheduled check. The audit log records changes made through the API. It has no export, and there is no metrics endpoint.
Events and health
Events and health checks belong to one account. Each row names its limit.
Sign-in events
RealmSSO pulls users’ sign-ins through a connection into account-wide events about every 60 seconds. It records successes and failures. The dashboard can be about a minute behind. Admin Portal sign-ins are events too. There is no filter by connection. You read events in the dashboard and the API.
Dashboard
The dashboard shows one selected account at a time. It shows sign-in counts, SCIM counts, a health summary and the 50 latest events.
SCIM events
Each SCIM write that RealmSSO processes records an event, whether it succeeds or fails. A request refused before processing, for example for a bad token or an invalid body, records nothing. A read records nothing.
Connection health
A connection check records only healthy or down, never degraded. The dashboard’s health summary has four buckets: healthy, degraded, down and unknown. Degraded stays empty. Connection health runs on demand. There is no scheduled check. You run a check from the API or the dashboard.
How long events stay
RealmSSO keeps sign-in and sync events 90 days by default, then purges them. The events carry an email address and an IP address. They outlast an account’s deletion until the purge.
Reading the data
The API also serves an event timeline, which no screen shows. The audit log has no export and no streaming. There is no metrics endpoint for Prometheus.
The audit log
Each account has an audit log. It is separate from events. Each row says what it leaves out.
What it records
The audit log records changes made through the RealmSSO API, including the IT admin’s changes in the Admin Portal. Each row shows who acted, what they did, on which resource, from which address and when. It also records agent client sign-ins, with agent as the actor. User sign-ins, Admin Portal sign-ins and SCIM syncs are not in it. They are events instead. Dashboard sign-ins are in neither.
Best effort
Audit writes are best effort. A failed write does not fail the request, so an action can succeed with no audit row.
Who can read it
Any dashboard user on the account can read the audit log, from the viewer role up. So can an API key with the audit:read scope. Your customer’s IT admin cannot.
How long rows stay
Audit rows stay while the account exists. RealmSSO deletes them when it deletes the account. The 90-day event purge does not touch them.
Talk to the people who build it.
We run RealmSSO for you. Tell us which identity providers your customers use and how many customers you have, and we will tell you what fits today.