Audit Events

Reference

Generated source hash: sha256:88e2e2994b09ee7d30294ee9bf021f2321e1c970c3607d97d2c3fd470e362596.

Use these event types and fields when investigating a decision or mapping an audit export. Audit stores decision metadata; it is not an archive of tool arguments or upstream responses.

Start with audit search when you need to find a specific request.

Event contract

Required fields: event_id, timestamp, tenant_id, environment_id, event_type, request_id, client_surface_id, policy_decision, policy_version, credential_mode, outcome, redaction_status.
Safe orientation fields: event_id, timestamp, tenant_id, environment_id, request_id, client_session_id, policy_version, credential_mode, outcome, redaction_status.
22 event types and 50 admin actions are listed from the schema.

Event types

tool_call.requested
tool_call.completed
tool_call.denied
policy_decision
credential_mode
credential_resolution
private_route_decision
upstream_call
connector_health
session_lifecycle
api_adapter_call
admin_change
revocation
authentication
management.operation.started
management.operation.completed
management.operation.denied
management.operation.failed
engineering.operation.started
engineering.operation.completed
engineering.operation.denied
engineering.operation.failed

Admin actions

submit_server_manifest
approve_registry_item
reject_registry_item
disable_registry_item
archive_registry_item
change_registry_owner
manifest_validation_failed
update_health_status
publish_catalog_capability
submit_agent
approve_agent
disable_agent
create_policy_draft
search_audit
terminate_session
update_deployment_status
create_telemetry_config
update_telemetry_config
test_telemetry_config
disable_telemetry_config
create_siem_webhook
update_siem_webhook
test_siem_webhook
disable_siem_webhook
emergency_disable
publish_policy
publish_policy_version
archive_policy_version
create_credential_binding
update_credential_binding
rotate_credential_binding
approve_credential_binding
reject_credential_binding
disable_credential_binding
revoke_credential_binding
register_connector
disable_connector
revoke_connector
update_connector_health
rotate_connector_identity
create_client_surface
disable_client_surface
create_local_identity_user
disable_local_identity_user
update_local_identity_group
create_role_binding
delete_role_binding
create_audit_export
create_revocation
permission_denied

Usage notes

Keep tokens, secrets, and raw payloads out of event mappings. Verify external receipt separately from export configuration. Use scoped identifiers when querying a denial.

Source truth

Read Audit and Deny Diagnostics for workflow behavior.
Read Schemas for the broader contract inventory.
Read Security Review for no-secret gates.

Amelfi documentation · Space Grotesk / Geist Mono