CircleCI audit logs track actions like creating contexts and triggering workflows, but don't capture user login events. This creates a gap for security teams who need to monitor all platform access.

Problem:

* Can't track users who log in but don't trigger builds

* No way to see who accessed CircleCI during a given period

* Current "Active Users" only shows users who trigger work

* Missing visibility into authentication patterns and potential security incidents

Requested Events:

user.logged_in - Successful authentication

Use Case:

Enable security teams to monitor all platform access, track login patterns, and automate access reviews via audit logs and API.