List login events
keycloak_events_loginRetrieve recent user login events from Keycloak to audit authentication activity or investigate failed logins. Returns a JSON array of events, optionally filtered by type or user.
Instructions
Read-only. Returns recent user login events from the realm's login event log (such as LOGIN, LOGIN_ERROR, and LOGOUT), as a JSON array ordered by the event log's default ordering. Use this to audit authentication activity or investigate failed logins; for administrative changes (user/role/config updates) use keycloak_events_admin instead. This tool is idempotent and never modifies Keycloak.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| max | No | Maximum number of login events to return. Integer between 1 and 500. Defaults to 20 when omitted. | |
| type | No | Optional Keycloak login event type to filter by, e.g. 'LOGIN', 'LOGIN_ERROR', or 'LOGOUT'. When omitted, events of all types are returned. | |
| user | No | Optional Keycloak user ID (UUID) to restrict results to a single user. When omitted, events for all users are returned. |