<a id="ip-filter-authz-auditable-events"></a>

# IP Filter Authorization Auditable Event Methods on Confluent Cloud

The following auditable event methods for operations on IP filters generate
auditable event messages for the `io.confluent.cloud/authorization` event
type. An auditable event method sends a message to the audit log when the
corresponding auditable event occurs; the message is stored as an audit log
record.

For details about the IP filtering feature and the use of IP filters and IP
groups, see [IP Filtering on Confluent Cloud](../../../security/access-control/ip-filtering/overview.md#ip-filtering). For the events generated when IP filters and
IP groups are created, updated, or deleted, see
[IP Filter and IP Group Management](ip-filter-management.md#ip-filter-management-auditable-events).
For more information about audit log records, see
[Audit Log Event Records](../audit-log-records.md#cloud-audit-log-records).

| Method name                                          | Action triggering an auditable event message                                |
|------------------------------------------------------|-----------------------------------------------------------------------------|
| [ip-filter.Authorize](#ip-filter-authorize-examples) | An IP filter denies access to Confluent Cloud resources in an organization. |

<a id="ip-filter-authorize-examples"></a>

## ip-filter.Authorize

An IP filter generates the `ip-filter.Authorize` event when it denies a
request to access Confluent Cloud resources in an organization. The filter denies the
request because the request’s IP address falls outside every IP group’s
Classless Inter-Domain Routing (CIDR) block in the filter.

To view an example event message, expand the following dropdown:

### Failure: IP filter denied access

```json
{
   "datacontenttype":"application/json",
   "data":{
      "serviceName":"crn://confluent.cloud/",
      "methodName":"ip-filter.Authorize",
      "cloudResources":[
         {
            "resource":{
               "type":"ORGANIZATION",
               "resourceId":"26bdbe6b-0c1b-4d25-a6e6-7bcc4d0932e3"
            }
         }
      ],
      "authenticationInfo":{
         "principal":{
            "confluentUser":{
               "resourceId":"u-123456"
            }
         },
         "result":"SUCCESS",
         "identity":"crn://confluent.cloud/organization=26fcbe6c-0c1b-4d65-a7e5-6acb4d082313/identity-provider=Confluent/identity=u-123456"
      },
      "authorizationInfo":{
         "result":"DENY",
         "ipfilterAuthorization":{
            "operation_group":"MANAGEMENT"
         }
      },
      "requestMetadata":{
         "requestId":[
            "b0c6a8d763140e9e23789d2dce4b6ac5"
         ],
         "clientAddress":[
            {
               "ip":"1.2.3.4"
            }
         ]
      },
      "resourceName":"crn://confluent.cloud/organization=26fcbe6c-0c1b-4d65-a7e5-6acb4d082313"
   },
   "subject":"crn://confluent.cloud/organization=26fcbe6c-0c1b-4d65-a7e5-6acb4d082313",
   "specversion":"1.0",
   "id":"0e0376b2-9100-43d8-a387-bd53e8bebdb3",
   "source":"crn://confluent.cloud/",
   "time":"2023-12-01T18:14:20.929608274Z",
   "type":"io.confluent.cloud/authorization"
}
```