Get an audit event (admin)

The record id (UUIDv7, so it is also creation-ordered).

When the event happened.

When the record was persisted. It differs from occurred_at by however long the event was buffered, so the gap is the write pipeline's lag.

The group an action belongs to, for faceting. Declared per action rather than derived from the action's first segment, because the two do not always agree: oauth.* and oidc.* events are both "token" work to an operator, and the grouping a UI offers should follow what an operator is looking for rather than how the constant is spelled.

How an attempt ended. denied is separated from failure because "you were not allowed" and "you got it wrong" are different security signals — a cluster of the former is what a SIEM alerts on. error marks a failure attributable to the server, so an operator can tell "users are getting it wrong" from "we are broken". The server enforces the pairing: error always carries the reason internal_error or unavailable, and those two reasons never appear under any other outcome.

How much an event matters, lowest first. Assigned per action, and an occurrence may raise it but never lower it. A refusal or a server fault is raised to at least warning whatever its action's default, so severity >= warning selects everything that did not go as asked; a protocol step that only looks like a failure (authorization_pending, use_dpop_nonce, mfa_required, passkey_offered, login_required, interaction_required, consent_required, account_selection_required) keeps its action's default.

The organization the event is ABOUT. Empty for a platform-scoped record (process startup, retention) — those have no owning tenant and are visible only through the main organization.

Whether the actor acted from a different organization than the one the event is about — a main-org administrator operating on a tenant. Derived from the two organization ids.

The organization the ACTOR came from.

The object the event acted upon. Absent for events that act on nothing in particular. display is a snapshot, for the same reason as on the actor.

The caller's address, resolved through the trusted-proxy policy.

The ISO 3166-1 alpha-2 code of the country client_ip is in, read when the record is returned. Present only when the server has an IP geolocation database (geoip.database) that knows the address.

How a client address was determined. socket means it is the connecting peer's own address, from a peer that forwarded no client, so it came off the connection and the caller could not have chosen it; forwarded means it came from a header set by a peer inside the trusted-proxy list; proxy means the request came through a trusted proxy that forwarded but named no client to believe, so the address is the proxy's own.

Whether the client's own hop to the deployment was encrypted, and on whose word. tls: this listener completed a TLS handshake and no trusted proxy reported a scheme; cleartext: it did not, and no trusted proxy reported a scheme. forwarded_tls and forwarded_cleartext are a trusted proxy's report (X-Forwarded-Proto): every hop it recorded was https, or one was not. It is the same verdict that decides whether the response carries Strict-Transport-Security, and it is computed by the server, never copied from a header. Absent on records with no request behind them (startup, maintenance, the pipeline's own records) and on the summary of a coalesced refusal, whose requests may have arrived differently; the summary of a coalesced edge finding (http.forwarding.ignored, http.cleartext_credential.received) carries the transport its window is keyed on.

The trusted proxy that vouched for a forwarded client_ip: the address of the peer that connected to this server, present when client_ip_source is forwarded (every other source already puts that peer in client_ip). It is also set on a coalesced summary of forwarded requests (http.cleartext_credential.received carrying a repeat_count, whose window is the proxy's rather than a client's), where client_ip and client_ip_source are absent because the clients varied. A forwarded address is only as true as the peer that wrote it, and this names the peer.

The ISO 3166-1 alpha-2 code of the country proxy_ip is in, as client_ip_country is read.

The raw User-Agent, stored unparsed.

The kind of client the record's User-Agent claims sent the request: browser, a browser a person drives; ai_agent, an AI crawler, assistant or agent (a training crawler, a page fetched for an assistant's user, a coding agent signing in to a tool); crawler, a search, link-preview or SEO crawler; automation, a headless or test-driven browser; library, a program calling directly (an HTTP library, a command-line tool, a native app, a health probe); unknown, a header that is empty or names none of these. It is read from the stored user_agent each time the record is served, so every record carries the server's current reading. A User-Agent is whatever its sender writes, so this is a claim, never a verified identity. Absent on records no request produced (startup, maintenance, the pipeline's own records) and on the summary of a coalesced refusal.

The product a client other than a browser names in its User-Agent, as its vendor names it (ClaudeBot, Claude Code, curl), from the list the server recognizes. Absent when the header names none of them; never text copied from the header.

Matches the X-Request-ID echoed to the caller. An inbound X-Request-ID is kept only from a trusted proxy; otherwise the server mints the id.

W3C trace id, for correlating with distributed traces. An inbound traceparent is honored only from a trusted proxy.

The OpenAPI operationId that served the request, exactly as this document spells it (getJWKS, signIn). A route mounted outside the document carries the name it declares: the per-organization discovery and key-set routes the operationId of the document they serve, the others a stable name of their own (authUI, dashboard, healthz, pprof). A control-plane event carries the gRPC full method name (/package.Service/Method). Empty when the request was refused before it was routed. Records stored by an earlier release carry the generated Go identifier instead (GetJWKS), so a query spanning the change matches both spellings. Stored instead of a request path, which would be unbounded in cardinality and would embed user ids and email addresses.

The request method. A method outside the registered set (RFC 9110 §9 and PATCH) is recorded as _OTHER, as OpenTelemetry records it.

The public id of the login session the event belongs to, the sid relying parties receive. An event an administrator caused through the admin API carries the session their access token was issued in.

The OAuth client the server resolved the event to: the client that authenticated, the registered client a client authentication named (whether or not it succeeded), or the client of a verified token, session or flow. It says which registered client the event concerns, not that the request proved it was that client. An event an administrator caused names the admin client their access token was minted for (the console or the machine client), never a client they manage. Any other administrative or client lifecycle event never sets it; it names the client as its target.

An OAuth client the event names that the server did not resolve it to: the client_id a sign-in form carried, an identifier a client authentication presented that no client registered, a logout's unverified hint. Present only when client_id is absent, so a record names its client in at most one of the two, and which one says whether the server resolved the client or the caller only named it. A named value is whatever the caller sent, bounded. Records written before the server kept this field carry it in metadata.client_id only.

Per-action detail. Its keys are declared per action in the server's catalog (see the catalog endpoint) and anything undeclared is dropped before storage, so it can never carry credentials. A field with a closed vocabulary (the catalog's field_values) only ever holds a value from it. Two reserved keys may appear: _dropped lists keys that were removed — undeclared, or carrying a value outside their vocabulary — and _truncated lists keys whose values were shortened to fit the size bounds, so each such stored value is a prefix of the one the server was given. A key is never removed for its size.

Distributed-trace id (hex) for correlating this response with traces and logs. Present only when tracing is enabled and the request was recorded. Opaque and safe to log/share.

Field-level violations (present for validation errors).

Distributed-trace id (hex) for correlating this response with traces and logs. Present only when tracing is enabled and the request was recorded. Opaque and safe to log/share.

Field-level violations (present for validation errors).

Distributed-trace id (hex) for correlating this response with traces and logs. Present only when tracing is enabled and the request was recorded. Opaque and safe to log/share.

Field-level violations (present for validation errors).

Distributed-trace id (hex) for correlating this response with traces and logs. Present only when tracing is enabled and the request was recorded. Opaque and safe to log/share.

Field-level violations (present for validation errors).

Distributed-trace id (hex) for correlating this response with traces and logs. Present only when tracing is enabled and the request was recorded. Opaque and safe to log/share.

Field-level violations (present for validation errors).