#### [Abblix\.SecurityEvents\.CAEP](https://www.abblix.com/en/docs/api/abblix-securityevents-caep 'index')

## Abblix\.SecurityEvents\.CAEP Namespace

| Classes | |
| :--- | :--- |
| [AssuranceLevelChangePayload](https://www.abblix.com/en/docs/api/abblix-securityevents-caep/Abblix.SecurityEvents.CAEP.AssuranceLevelChangePayload 'Abblix\.SecurityEvents\.CAEP\.AssuranceLevelChangePayload') | Assurance Level Change \(CAEP 1\.0 Section 3\.4\): the subject's authentication strength changed since the initial login, in either direction \- a user stepping up with a second factor at one provider is a signal every other provider holding the session may act on\. When [EventTimestamp](https://www.abblix.com/en/docs/api/abblix-securityevents-caep/Abblix.SecurityEvents.CAEP.CaepEventPayload#Abblix.SecurityEvents.CAEP.CaepEventPayload.EventTimestamp 'Abblix\.SecurityEvents\.CAEP\.CaepEventPayload\.EventTimestamp') is included it is the moment of the change\. |
| [AssuranceLevelChangePayload\.ChangeDirections](https://www.abblix.com/en/docs/api/abblix-securityevents-caep/Abblix.SecurityEvents.CAEP.AssuranceLevelChangePayload.ChangeDirections 'Abblix\.SecurityEvents\.CAEP\.AssuranceLevelChangePayload\.ChangeDirections') | The values the "change\_direction" member may carry \(CAEP 1\.0 Section 3\.4\.1\)\. |
| [AssuranceLevelChangePayload\.Namespaces](https://www.abblix.com/en/docs/api/abblix-securityevents-caep/Abblix.SecurityEvents.CAEP.AssuranceLevelChangePayload.Namespaces 'Abblix\.SecurityEvents\.CAEP\.AssuranceLevelChangePayload\.Namespaces') | The level namespaces Section 3\.4\.1 names\. The set is open: any other value is an alias for a custom namespace the two parties agreed on, which is why [Namespace](https://www.abblix.com/en/docs/api/abblix-securityevents-caep/Abblix.SecurityEvents.CAEP.AssuranceLevelChangePayload#Abblix.SecurityEvents.CAEP.AssuranceLevelChangePayload.Namespace 'Abblix\.SecurityEvents\.CAEP\.AssuranceLevelChangePayload\.Namespace') is a string rather than a closed enumeration\. |
| [CaepClaimNames](https://www.abblix.com/en/docs/api/abblix-securityevents-caep/Abblix.SecurityEvents.CAEP.CaepClaimNames 'Abblix\.SecurityEvents\.CAEP\.CaepClaimNames') | The wire names of the CAEP event claims \(CAEP 1\.0 Sections 2, 3\): one registry, because the common claims cross every event type and per\-model copies of one name drift apart\. |
| [CaepEventPayload](https://www.abblix.com/en/docs/api/abblix-securityevents-caep/Abblix.SecurityEvents.CAEP.CaepEventPayload 'Abblix\.SecurityEvents\.CAEP\.CaepEventPayload') | The claims every CAEP event may carry \(CAEP 1\.0 Section 2\): when it happened, who set it in motion, and why \- the latter twice, because the administrator's log line and the sentence an end user should read are different texts in different languages\. |
| [CaepEventPayload\.InitiatingEntities](https://www.abblix.com/en/docs/api/abblix-securityevents-caep/Abblix.SecurityEvents.CAEP.CaepEventPayload.InitiatingEntities 'Abblix\.SecurityEvents\.CAEP\.CaepEventPayload\.InitiatingEntities') | The values the "initiating\_entity" claim may carry \(CAEP 1\.0 Section 2\)\. |
| [CaepEventTypes](https://www.abblix.com/en/docs/api/abblix-securityevents-caep/Abblix.SecurityEvents.CAEP.CaepEventTypes 'Abblix\.SecurityEvents\.CAEP\.CaepEventTypes') | The event type URIs CAEP 1\.0 defines \(its Section 3\), and the one registration call that teaches a receiver's event registry the whole dictionary\. |
| [CaepInteropProfilePolicy](https://www.abblix.com/en/docs/api/abblix-securityevents-caep/Abblix.SecurityEvents.CAEP.CaepInteropProfilePolicy 'Abblix\.SecurityEvents\.CAEP\.CaepInteropProfilePolicy') | What the CAEP Interoperability Profile 1\.0 demands of a TRANSMITTER's payload, on top of what CAEP 1\.0 permits: each of its three use cases requires `reason_admin` to carry a non\-empty object\. |
| [CredentialChangePayload](https://www.abblix.com/en/docs/api/abblix-securityevents-caep/Abblix.SecurityEvents.CAEP.CredentialChangePayload 'Abblix\.SecurityEvents\.CAEP\.CredentialChangePayload') | Credential Change \(CAEP 1\.0 Section 3\.3\): a credential was created, changed, revoked or deleted \- a password reset, a certificate enrollment or revocation, a second\-factor or passwordless credential enrolled or removed\. When [EventTimestamp](https://www.abblix.com/en/docs/api/abblix-securityevents-caep/Abblix.SecurityEvents.CAEP.CaepEventPayload#Abblix.SecurityEvents.CAEP.CaepEventPayload.EventTimestamp 'Abblix\.SecurityEvents\.CAEP\.CaepEventPayload\.EventTimestamp') is included it is the moment of the change\. |
| [CredentialChangePayload\.ChangeTypes](https://www.abblix.com/en/docs/api/abblix-securityevents-caep/Abblix.SecurityEvents.CAEP.CredentialChangePayload.ChangeTypes 'Abblix\.SecurityEvents\.CAEP\.CredentialChangePayload\.ChangeTypes') | The values the "change\_type" member may carry \(CAEP 1\.0 Section 3\.3\.1\) \- this set is closed, unlike the credential types\. |
| [CredentialChangePayload\.CredentialTypes](https://www.abblix.com/en/docs/api/abblix-securityevents-caep/Abblix.SecurityEvents.CAEP.CredentialChangePayload.CredentialTypes 'Abblix\.SecurityEvents\.CAEP\.CredentialChangePayload\.CredentialTypes') | The credential kinds Section 3\.3\.1 names\. The set is open by the specification's own words: any other credential type mutually supported by the transmitter and the receiver is equally legal, which is why [CredentialType](https://www.abblix.com/en/docs/api/abblix-securityevents-caep/Abblix.SecurityEvents.CAEP.CredentialChangePayload#Abblix.SecurityEvents.CAEP.CredentialChangePayload.CredentialType 'Abblix\.SecurityEvents\.CAEP\.CredentialChangePayload\.CredentialType') is a string rather than a closed enumeration\. |
| [DeviceComplianceChangePayload](https://www.abblix.com/en/docs/api/abblix-securityevents-caep/Abblix.SecurityEvents.CAEP.DeviceComplianceChangePayload 'Abblix\.SecurityEvents\.CAEP\.DeviceComplianceChangePayload') | Device Compliance Change \(CAEP 1\.0 Section 3\.5\): the compliance status of the device identified by the subject changed\. When [EventTimestamp](https://www.abblix.com/en/docs/api/abblix-securityevents-caep/Abblix.SecurityEvents.CAEP.CaepEventPayload#Abblix.SecurityEvents.CAEP.CaepEventPayload.EventTimestamp 'Abblix\.SecurityEvents\.CAEP\.CaepEventPayload\.EventTimestamp') is included it is the moment of the change\. |
| [DeviceComplianceChangePayload\.ComplianceStatuses](https://www.abblix.com/en/docs/api/abblix-securityevents-caep/Abblix.SecurityEvents.CAEP.DeviceComplianceChangePayload.ComplianceStatuses 'Abblix\.SecurityEvents\.CAEP\.DeviceComplianceChangePayload\.ComplianceStatuses') | The values both status members carry \(CAEP 1\.0 Section 3\.5\.1\)\. |
| [RiskLevelChangePayload](https://www.abblix.com/en/docs/api/abblix-securityevents-caep/Abblix.SecurityEvents.CAEP.RiskLevelChangePayload 'Abblix\.SecurityEvents\.CAEP\.RiskLevelChangePayload') | Risk Level Change \(CAEP 1\.0 Section 3\.8\): the transmitter's assessed risk level for the subject changed at the moment [EventTimestamp](https://www.abblix.com/en/docs/api/abblix-securityevents-caep/Abblix.SecurityEvents.CAEP.CaepEventPayload#Abblix.SecurityEvents.CAEP.CaepEventPayload.EventTimestamp 'Abblix\.SecurityEvents\.CAEP\.CaepEventPayload\.EventTimestamp') names \- a password found in a breach, unapproved software on a device, or any other signal the transmitter abstracts into a level\. |
| [RiskLevelChangePayload\.Principals](https://www.abblix.com/en/docs/api/abblix-securityevents-caep/Abblix.SecurityEvents.CAEP.RiskLevelChangePayload.Principals 'Abblix\.SecurityEvents\.CAEP\.RiskLevelChangePayload\.Principals') | The principal kinds Section 3\.8\.1 names, matching the complex\-subject member names of the Shared Signals Framework\. The set is open to any other entity the framework's subject model can express\. |
| [RiskLevelChangePayload\.RiskLevels](https://www.abblix.com/en/docs/api/abblix-securityevents-caep/Abblix.SecurityEvents.CAEP.RiskLevelChangePayload.RiskLevels 'Abblix\.SecurityEvents\.CAEP\.RiskLevelChangePayload\.RiskLevels') | The values both level members carry \(CAEP 1\.0 Section 3\.8\.1\) \- a closed set\. |
| [SessionEstablishedPayload](https://www.abblix.com/en/docs/api/abblix-securityevents-caep/Abblix.SecurityEvents.CAEP.SessionEstablishedPayload 'Abblix\.SecurityEvents\.CAEP\.SessionEstablishedPayload') | Session Established \(CAEP 1\.0 Section 3\.6\): the transmitter established a new session for the subject \- how a service closes the loop with the identity provider after federation, how an identity provider detects unintended logins, how a receiver inventories sessions\. The [EventTimestamp](https://www.abblix.com/en/docs/api/abblix-securityevents-caep/Abblix.SecurityEvents.CAEP.CaepEventPayload#Abblix.SecurityEvents.CAEP.CaepEventPayload.EventTimestamp 'Abblix\.SecurityEvents\.CAEP\.CaepEventPayload\.EventTimestamp') is the moment the session was established\. |
| [SessionPresentedPayload](https://www.abblix.com/en/docs/api/abblix-securityevents-caep/Abblix.SecurityEvents.CAEP.SessionPresentedPayload 'Abblix\.SecurityEvents\.CAEP\.SessionPresentedPayload') | Session Presented \(CAEP 1\.0 Section 3\.7\): the transmitter observed the subject's session to be present at the moment [EventTimestamp](https://www.abblix.com/en/docs/api/abblix-securityevents-caep/Abblix.SecurityEvents.CAEP.CaepEventPayload#Abblix.SecurityEvents.CAEP.CaepEventPayload.EventTimestamp 'Abblix\.SecurityEvents\.CAEP\.CaepEventPayload\.EventTimestamp') names \- the signal receivers build activity anomaly detection and live\-session inventories on\. |
| [SessionRevokedPayload](https://www.abblix.com/en/docs/api/abblix-securityevents-caep/Abblix.SecurityEvents.CAEP.SessionRevokedPayload 'Abblix\.SecurityEvents\.CAEP\.SessionRevokedPayload') | Session Revoked \(CAEP 1\.0 Section 3\.1\): the session identified by the subject has been revoked\. The event carries no claims of its own \- the subject names the session, directly or through the properties of a complex subject, in which case the revocation applies to any session matching the combined claims; when [EventTimestamp](https://www.abblix.com/en/docs/api/abblix-securityevents-caep/Abblix.SecurityEvents.CAEP.CaepEventPayload#Abblix.SecurityEvents.CAEP.CaepEventPayload.EventTimestamp 'Abblix\.SecurityEvents\.CAEP\.CaepEventPayload\.EventTimestamp') is included it is the moment of revocation\. |
| [TokenClaimsChangePayload](https://www.abblix.com/en/docs/api/abblix-securityevents-caep/Abblix.SecurityEvents.CAEP.TokenClaimsChangePayload 'Abblix\.SecurityEvents\.CAEP\.TokenClaimsChangePayload') | Token Claims Change \(CAEP 1\.0 Section 3\.2\): a claim in the token identified by the subject \- a JWT through the jwt\_id subject format, a SAML assertion through saml\_assertion\_id \- has changed\. When [EventTimestamp](https://www.abblix.com/en/docs/api/abblix-securityevents-caep/Abblix.SecurityEvents.CAEP.CaepEventPayload#Abblix.SecurityEvents.CAEP.CaepEventPayload.EventTimestamp 'Abblix\.SecurityEvents\.CAEP\.CaepEventPayload\.EventTimestamp') is included it is the moment the claim values changed\. |