AuditRecord

Shape

• actorAuditActor

  • The AuditActor schema
  • actor_typestringWhat kind of caller acted: user, service_account, pipeline_run, anonymous, or scim — an organization's identity provider calling with its SCIM token.
  • auth_methodAuthMethodjwtaccess_tokenanonymousHow the caller authenticated.
  • idstringThe id of the user, service account or pipeline run that acted, or anonymous.
  • avatar_urlstring or nulloptional
  • emailstringoptional
  • token_idstring or nulloptional
  • usernamestringoptional
• audit_idAuditId (string · uuid)
• categoryAuditCategorymutationauth_eventsensitive_readWhat kind of operation the record captures.
• hashstringSHA256(canonical_json(record without hash) ‖ prev_hash), hex.
• http_methodstring
• monthstringThe month the record belongs to, YYYY-MM. Each month's records form one segment of the chain.
• occurred_atstring
• operation_idstring
• outcomeAuditOutcomesuccessdeniedfailureThe result of the audited operation.
• prev_hashstringHash of the previous record in the chain (genesis = 64 zeros; first of a month links to the prior month's tip).
• recorded_atstringWhen the record was written to the log, RFC 3339 with microseconds.
• request_idstring
• routestring
• scopestringWhich audit chain the record belongs to — an organisation, a user, or the platform.
• seqinteger · int640–∞Monotonic position within (scope, month).
• status_codeinteger · int320–∞
• accessAccessAuditDetail or nulloptionalFor an operation that changed who can do what: each grant it made, changed or revoked, with the role before and after. Absent everywhere else — and absent fields do not enter the hash, so every record written before this field existed verifies unchanged.

  • The AccessAuditDetail schema
  • changesarray of AccessAuditChange

    • The AccessAuditChange schema
    • grant_idGrantId (string · uuid)
    • scopeScopeRef
    • sensitivebooleanWhether either role carries a sensitive or reserved permission.
    • subjectSubjectRef
    • afterRoleRef or nulloptionalThe role after the change. Absent for a revoked grant.
    • beforeRoleRef or nulloptionalThe role before the change. Absent for a new grant.
  • inheritanceInheritanceAuditChange or nulloptionalA scope's inheritance switched.

    • The InheritanceAuditChange schema
    • inherits_accessboolean
    • scopeScopeRef
  • limitLimitAuditChange or nulloptionalA limit set or removed.

    • The LimitAuditChange schema
    • ceilingCeilingRef
    • limit_idLimitId (string · uuid)
    • scopeScopeRef
    • setbooleantrue when the limit was set, false when it was removed.
    • subjectLimitSubjectRef
  • roleRoleAuditChange or nulloptionalA custom role's permissions changing — which changes access wherever the role is granted, without any grant changing.

    • The RoleAuditChange schema
    • grants_affectedinteger · int64
    • limits_affectedinteger · int64
    • permissions_addedarray of string
    • permissions_removedarray of string
    • role_idRoleId (string · uuid)
• mcpMcpAuditDetail or nulloptionalFor a request an AI agent made through the MCP server: the tool and the client. Absent everywhere else, and so outside the hash of every record that does not carry it.

  • The McpAuditDetail schema
  • toolstringThe tool whose execution made the request.
  • clientstring or nulloptionalThe client application the tool call came from, as that application named itself.
  • oauth_client_idstring or nulloptionalThe app the access token was issued to, when an app connected through sign-in — its own registered identifier, which, unlike the self-reported client name, the person consented to.
• resource_bindingstring or nulloptional
• source_ipstring or nulloptional
• target_idstring or nulloptional
• target_typestring or nulloptional
• user_agentstring or nulloptional

Graph

Used by