Audit Events
Reference
Audit Events
Section titled “Audit Events”Generated source hash: sha256:01af8b210344a852f262a8d5427827c5c19a5fb3a107d5378f778ae6ab2b9f65.
Audience
Section titled “Audience”- Security reviewers tracing governed decisions.
- Operators building SIEM/export mappings.
- Docs authors checking which audit fields are safe to mention publicly.
What is this?
Section titled “What is this?”This page is generated from contracts/events/audit-event.schema.json. Audit events are retained decision metadata. They are not a payload archive.
When do I use it?
Section titled “When do I use it?”Use it when a page or export needs exact event type, admin action, or required-field names. Use Audit and Deny Diagnostics for workflow behavior.
What happens?
Section titled “What happens?”- Required fields:
event_id,timestamp,tenant_id,environment_id,event_type,request_id,client_surface_id,policy_decision,policy_version,credential_mode,outcome,redaction_status. - Safe orientation fields:
event_id,timestamp,tenant_id,environment_id,request_id,client_session_id,policy_version,credential_mode,outcome,redaction_status. 14event types and51admin actions are listed from the schema.
Event types
Section titled “Event types”tool_call.requestedtool_call.completedtool_call.deniedpolicy_decisioncredential_modecredential_resolutionprivate_route_decisionupstream_callconnector_healthsession_lifecycleapi_adapter_calladmin_changerevocationauthentication
Admin actions
Section titled “Admin actions”submit_server_manifestsubmit_api_sourceapprove_registry_itemreject_registry_itemdisable_registry_itemarchive_registry_itemchange_registry_ownermanifest_validation_failedupdate_health_statuspublish_catalog_capabilitysubmit_agentapprove_agentdisable_agentcreate_policy_draftsearch_auditterminate_sessionupdate_deployment_statuscreate_telemetry_configupdate_telemetry_configtest_telemetry_configdisable_telemetry_configcreate_siem_webhookupdate_siem_webhooktest_siem_webhookdisable_siem_webhookemergency_disablepublish_policypublish_policy_versionarchive_policy_versioncreate_credential_bindingupdate_credential_bindingrotate_credential_bindingapprove_credential_bindingreject_credential_bindingdisable_credential_bindingrevoke_credential_bindingregister_connectordisable_connectorrevoke_connectorupdate_connector_healthrotate_connector_identitycreate_client_surfacedisable_client_surfacecreate_local_identity_userdisable_local_identity_userupdate_local_identity_groupcreate_role_bindingdelete_role_bindingcreate_audit_exportcreate_revocationpermission_denied
What can go wrong?
Section titled “What can go wrong?”- Audit records include prompts, tool payloads, request bodies, response bodies, tokens, credentials, or secret material. That is a release blocker.
- A public page links raw evidence instead of the schema or a curated runbook.
- SIEM/export docs add fields that are absent from the schema.
- Deny diagnostics confirms cross-tenant or cross-environment request IDs. Unknown or stale selectors should stay safe.
Source truth
Section titled “Source truth”- Read Audit and Deny Diagnostics for workflow behavior.
- Read Schemas for the broader contract inventory.
- Read Security Review for no-secret gates.
Type set in Geist, Source Serif 4, and Departure Mono.