{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://auth.proudbase.com/schemas/events/security.credential_compromised.v1.json",
  "title": "security.credential_compromised (v1)",
  "description": "An administrator marked a user's password as compromised. Emitted when an administrator marks the user's active password as compromised. All sessions and grants are revoked (session.revoked with reason \"credential_compromised\") and the user must recover the account. org_id is never set.",
  "type": "object",
  "allOf": [
    {
      "$ref": "envelope.v1.json"
    }
  ],
  "properties": {
    "event_type": {
      "const": "security.credential_compromised"
    },
    "event_version": {
      "const": 1
    },
    "data": {
      "type": "object",
      "description": "Event data. All members are identifiers or state, so the minimal and standard payload forms are identical.",
      "required": [
        "user_id"
      ],
      "properties": {
        "user_id": {
          "$ref": "envelope.v1.json#/$defs/user_id",
          "description": "The affected user."
        }
      },
      "additionalProperties": false
    },
    "org_id": {
      "description": "Never set for this event type by the current server."
    }
  },
  "x-event-type": "security.credential_compromised",
  "x-subscribable": true,
  "x-emitted-by": [
    "internal/authentication/factors.go: (*Service).MarkPasswordCompromised"
  ],
  "x-org-scoped": "never",
  "examples": [
    {
      "event_id": "obx_01jbc0nrt4gyaprpz71pncy10e",
      "event_type": "security.credential_compromised",
      "event_version": 1,
      "occurred_at": "2026-10-10T12:10:00.123456789Z",
      "realm_id": "rlm_01jbxe2ktygrnsjxt1j8etsahj",
      "data": {
        "user_id": "usr_01jb4rsd73q99h2e30n9ak6n8d"
      }
    }
  ]
}