Event catalog

These are the actions currently emitted, their possible outcomes and their details keys. Keys depend on the operation and outcome; details may be null. success means success, failure means a failed operation, and denied means rejection.

category	action	outcome	details
`account`	`account.email_in_use_denied`	denied	email
`account`	`account.email_removed`	success	email
`account`	`account.email_verification_cancelled`	success	email
`account`	`account.email_verification_requested`	success	email
`account`	`account.email_verified`	success	email
`account`	`account.primary_email_changed`	success	from_email, to_email
`api_token`	`api_token.audit_events_read`	success	returned, has_more
`api_token`	`api_token.reports_read`	success	endpoint, returned, has_more, report_id
`api_token`	`api_token.created`	success / denied	name, scopes, expires_at, prefix
`api_token`	`api_token.reissued`	success / denied	name, old_id, replacement_id, old_prefix, new_prefix
`api_token`	`api_token.resumed`	success / denied	name, prefix
`api_token`	`api_token.revoked`	success / denied	name, prefix, reason
`api_token`	`api_token.suspended`	success / denied	name, prefix
`auth`	`auth.magic_link_requested`	success	—
`auth`	`auth.session_deleted`	success	count, reason
`auth`	`auth.sign_in`	success	—
`auth`	`auth.sign_in_denied`	denied	—
`auth`	`auth.sign_out`	success	—
`auth`	`auth.sso_sign_in`	success	—
`auth`	`auth.sso_sign_in_failed`	failure	—
`auth`	`mfa.admin_reset`	success	reason
`auth`	`mfa.disabled`	success	—
`auth`	`mfa.enabled`	success	—
`auth`	`mfa.failed`	failure	enrollment
`auth`	`mfa.locked`	denied	—
`auth`	`mfa.recovery_regenerated`	success	—
`auth`	`mfa.recovery_used`	success	—
`auth`	`mfa.verified`	success	method, enrollment
`auth`	`passkey.clone_detected`	denied	credential_prefix
`auth`	`passkey.deleted`	success	credential_prefix, name
`auth`	`passkey.registered`	success	credential_prefix, name
`auth`	`passkey.registration_failed`	failure	—
`auth`	`passkey.sign_in`	success	credential_prefix
`auth`	`passkey.sign_in_failed`	denied	credential_prefix
`domain`	`domain.added`	success / denied	name, active_requested, schedule, changed
`domain`	`domain.deleted`	success / denied	name
`domain`	`domain.limit_exceeded`	denied	—
`domain`	`domain.schedule_denied`	denied	—
`domain`	`domain.updated`	success	name, active_requested, schedule, changed
`evaluation`	`evaluation.completed`	success	domain_id, attempts
`evaluation`	`evaluation.failed`	failure	domain_id, attempts, reason
`evaluation`	`evaluation.requested`	success / denied	domain_id, domain_name, cooldown, next_at
`member`	`auth.sso_jit_join`	success	—
`member`	`member.invitation_accept_denied`	denied	plan_code, limit, current
`member`	`member.invitation_accepted`	success	role
`member`	`member.invitation_resent`	success	invited_email, role
`member`	`member.invitation_revoked`	success / denied	—
`member`	`member.invited`	success / denied	invited_email, role, plan_code, limit, current
`member`	`member.left`	success	role
`member`	`member.removed`	success / denied	user_id, role
`member`	`member.role_changed`	success / denied	user_id, from_role, to_role
`organization`	`organization.access_denied_ip`	denied	—
`organization`	`organization.created`	success	—
`organization`	`organization.ip_allow_entry_added`	success	cidr, note
`organization`	`organization.ip_allowlist_disabled`	success	entry_id
`organization`	`organization.ip_allowlist_disabled_by_operator`	success	reason
`organization`	`organization.ip_allowlist_enabled`	success	entry_id
`organization`	`organization.ip_allowlist_removed`	success	entry_id
`organization`	`organization.mfa_required_changed`	success	required
`organization`	`organization.saml_config_saved`	success	fingerprint
`organization`	`organization.sso_domain_added`	success	domain
`organization`	`organization.sso_domain_removed`	success	domain
`organization`	`organization.sso_domain_verified`	success	domain
`organization`	`organization.sso_enabled_changed`	success	enabled
`organization`	`organization.sso_required_changed`	success	required
`organization`	`organization.sso_required_cleared_by_operator`	success	reason

Authentication and account events are recorded for the user’s organizations. Organization switching is not recorded. Secrets, authorization headers and Cookies are not exposed. Sanitization can omit or redact values in free-text details.

role / from_role / to_role are OWNER, ADMIN, MEMBER or VIEWER. schedule is MANUAL, DAILY or WEEKLY. changed lists the changed activeRequested / schedule settings. reason is an operation-specific explanation. evaluation.failed includes attempts that will be retried. api_token.audit_events_read records successful audit log reads. api_token.reports_read records successful evaluation results reads; its details include endpoint, returned, has_more and, for a single report, report_id. A read event does not appear in its own response.