# Audit Event Catalog

> Every action nauthera-server can record in its audit log: its category, level, default severity, whether it can be suppressed, and its metadata keys.

The [audit log](https://www.nauthera.io/docs/v1/audit-log) records a closed set of actions. This page lists all
of them, generated from the server's event catalog; the running server publishes the same
catalog at `GET /v1/admin/audit-catalog`.

How to read the tables:

- **Action** is the stable wire name. Actions are never renamed, and the outcome is not
  part of the name: a refused sign-in is `auth.sign_in.completed` with
  `outcome: failure`.
- **Level** is the lowest [`audit.level`](https://www.nauthera.io/docs/v1/audit-log#levels) at which the
  action's successes are recorded. A refusal or a server fault is recorded at `security`
  whatever the level says. **mandatory** actions are recorded whatever `level` and
  `exclude` say ([why](https://www.nauthera.io/docs/v1/audit-log#events-that-cannot-be-suppressed));
  **platform** actions belong to no organization, so through the API only
  `platform.audit` holders see them.
- **Severity** is the default for a success. A refusal is raised to at least `warning`.
- **Metadata** is the closed allowlist of keys a record of that action may carry in its
  `metadata`. Nothing outside the list is stored, and no key carries a credential.
  `repeat_count`, `first_seen_at` and `last_seen_at` mark actions whose refusals are
  [coalesced](https://www.nauthera.io/docs/v1/audit-log#levels).

## Catalog

{/* AUTO-GENERATED-AUDIT-CATALOG-START */}

### Authentication

Category `authentication`.

| Action | What it records | Level | Severity | Metadata |
|---|---|---|---|---|
| `auth.account.locked` | An account, or an identifier no account holds, was soft-locked after consecutive failed password verifications. | security, **mandatory** | warning | `identifier` `client_id` `limit_scope` `attempts` `locked_until` |
| `auth.email_verification.completed` | Someone verified an email address from a link. | security | notice | `cause` `stage` `header` `origin` `fetch_site` |
| `auth.email_verification.requested` | Someone asked for a link to verify an email address. | security | info | `identifier` `cause` `stage` `header` `origin` `fetch_site` `limit_scope` |
| `auth.invitation.accepted` | Someone chose a password from an invitation link. | security | notice | `cause` `stage` `header` `origin` `fetch_site` |
| `auth.password_reset.completed` | Someone set a new password from a reset link. | security | warning | `cause` `stage` `header` `origin` `fetch_site` `sessions_revoked` |
| `auth.password_reset.requested` | Someone asked for a password-reset link. | security | notice | `identifier` `cause` `stage` `header` `origin` `fetch_site` `limit_scope` |
| `auth.rate_limit.triggered` | A throttle refused an authentication attempt or a request, or its backend failed and it let them through. | security | warning | `limit_scope` `identifier` `client_id` `attempts` `cause` `error_class` `window_start` `window_end` `count` `repeat_count` `first_seen_at` `last_seen_at` |
| `auth.registration.completed` | A user self-registered a local account, or created one through an identity provider. | security, **mandatory** | notice | `identifier` `email` `username` `client_id` `pushed` `mfa_required` `mfa_rules` `email_verification_required` `cause` `stage` `rolled_back` `header` `origin` `fetch_site` `identity_provider` |
| `auth.sign_in.alerted` | A user was sent an alert about a sign-in from a new browser or network. | security | notice | `new_browser` `new_network` `client_id` |
| `auth.sign_in.completed` | A user attempted an interactive sign-in, by password or through an identity provider. | security, **mandatory** | notice | `identifier` `client_id` `pushed` `mfa_required` `amr` `acr` `method` `cause` `attempts` `remaining` `locked_until` `identifier_attempts` `stage` `header` `origin` `fetch_site` `new_browser` `new_network` `network_zones` `mfa_rules` `mfa_spared` `identity_provider` `status` `upstream_error` `upstream_mfa` `member_org` |
| `auth.sign_out.completed` | A user signed out of their interactive session. | security | info | `sessions_revoked` `cause` |
| `http.cleartext_credential.received` | A request carried a credential over a hop a trusted proxy reported as unencrypted. | security | warning | `carried_in` `repeat_count` `first_seen_at` `last_seen_at` |
| `http.forwarding.ignored` | Forwarding headers from a peer outside the trusted-proxy list were ignored. | security | warning | `headers` `repeat_count` `first_seen_at` `last_seen_at` |
| `http.header.repeated` | A request was refused because a single-valued header field was repeated. | security | warning | `header` `repeat_count` `first_seen_at` `last_seen_at` |
| `http.request.screened` | A request was refused before a handler judged it: its size, its shape, its origin or the cross-site request forgery check. | trace | info | `cause` `violations` `rejected_values` `client_id` `header` `origin` `fetch_site` `repeat_count` `first_seen_at` `last_seen_at` |
| `oauth.client_authentication.attempted` | A client's authentication at the token, introspection, revocation, pushed-authorization or device-authorization endpoint was refused. | trace | info | `client_id` `cause` `auth_method` `registered_auth_method` `alg` `key_id` `audience` `skew_seconds` `grant_type` |

### Sessions

Category `session`.

| Action | What it records | Level | Severity | Metadata |
|---|---|---|---|---|
| `oidc.logout.frontchannel.rendered` | A front-channel logout page was rendered, asking the browser to call each relying party's logout URI. | security | info | `count` `client_id` `cause` `metadata_field` |
| `oidc.logout.initiated` | An RP-initiated logout was requested. | write | info | `client_id` `post_logout_redirect_uri` `redirect_honored` `redirect_refused` `cause` `audience` `hint` |
| `oidc.logout.participant.added` | A relying party was recorded as a participant in a login session, making it a back-channel logout target. | security, **mandatory** | info | `client_id` `sid` |
| `oidc.logout.participant.skipped` | A relying party that took part in an ending session was not sent a back-channel logout token. | security | info | `client_id` `sid` `cause` |
| `oidc.logout.token.delivered` | A back-channel logout token was delivered to a relying party. | security, **mandatory** | notice | `client_id` `sid` `status` `attempts` `stage` `cause` `rp_error` `endpoint_host` `duration_ms` `jti` |
| `session.created` | An interactive login session was established. | security | info | `amr` `acr` `expires_at` `client_id` |
| `session.history.listed` | A page of a user's ended sessions was listed through the admin API. | trace | info | `count` `sort` `from` `to` `cause` `target_user_id` `slug` |
| `session.listed` | A page of an organization's active sessions was listed through the admin API. | read | info | `count` `sort` `cause` `slug` |
| `session.presented` | An endpoint that acts for a signed-in user refused the login session a request presented. | trace | info | `cause` `repeat_count` `first_seen_at` `last_seen_at` |
| `session.revoked` | One or more login sessions were revoked. | security, **mandatory** | notice | `count` `trigger` `target_user_id` `justification` |

### Multi-factor authentication

Category `mfa`.

| Action | What it records | Level | Severity | Metadata |
|---|---|---|---|---|
| `mfa.email.activated` | An email factor was activated for an account. | security, **mandatory** | notice | `codes_issued` `method` `cause` `attempts` `attempts_remaining` `client_id` |
| `mfa.email.challenge_started` | A sign-in code was sent to an account's email factor, or the send was refused. | security | info | `method` `cause` `limit_scope` `stage` `client_id` |
| `mfa.email.enrollment_started` | An email factor's enrollment code was sent, or the send was refused. | security | info | `method` `cause` `limit_scope` `stage` `client_id` |
| `mfa.email.revoked` | An email factor was removed because the account's address changed. | security, **mandatory** | warning | `trigger` `method` |
| `mfa.email.verified` | An emailed code was answered. | security | info | `method` `cause` `attempts` `attempts_remaining` `client_id` |
| `mfa.factor.locked` | A second factor was locked after too many consecutive failed attempts. | security, **mandatory** | warning | `method` `limit_scope` `expires_at` `attempts` `client_id` |
| `mfa.passkey.challenge_started` | A passkey authentication ceremony began for an account. | security | info | `method` `cause` `client_id` |
| `mfa.passkey.enrollment_started` | A passkey registration ceremony began for an account. | security | info | `method` `cause` `client_id` |
| `mfa.passkey.offer_declined` | A user declined the offer to add a passkey after a password sign-in. | security | info | `method` `cause` `client_id` |
| `mfa.passkey.registered` | A passkey was enrolled for an account, or a registration was refused. | security, **mandatory** | notice | `codes_issued` `method` `cause` `attempts` `attempts_remaining` `client_id` |
| `mfa.passkey.verified` | A passkey assertion was answered. | security | info | `method` `cause` `attempts` `attempts_remaining` `client_id` |
| `mfa.recovery_code.consumed` | A single-use MFA recovery code was redeemed. | security, **mandatory** | warning | `remaining` `codes_remaining` `method` `cause` `attempts` `attempts_remaining` `client_id` |
| `mfa.recovery_codes.acknowledged` | A user confirmed they had stored their recovery codes. | security | info | `method` `cause` `client_id` |
| `mfa.recovery_codes.regenerated` | A fresh set of MFA recovery codes was issued, invalidating the previous set. | security, **mandatory** | notice | `issued` `method` `cause` `attempts` `attempts_remaining` `drift_steps` |
| `mfa.request.authenticated` | A second-factor endpoint refused the pending sign-in or session a request presented. | security | info | `cause` |
| `mfa.status.read` | A user's MFA enrollment status was read. | read | info | — |
| `mfa.totp.activated` | A TOTP factor was activated for an account. | security, **mandatory** | notice | `codes_issued` `method` `cause` `attempts` `attempts_remaining` `drift_steps` `client_id` |
| `mfa.totp.disabled` | A TOTP factor was removed from an account. | security, **mandatory** | warning | `trigger` `method` `cause` `attempts` `attempts_remaining` `drift_steps` |
| `mfa.totp.enrollment_started` | A TOTP enrollment began (a secret was generated but not yet confirmed). | security | info | `method` `cause` `redisplayed` `client_id` |
| `mfa.totp.verified` | A TOTP challenge was answered. | security | info | `method` `cause` `attempts` `attempts_remaining` `drift_steps` `client_id` |

### OAuth and OpenID Connect

Category `token`.

| Action | What it records | Level | Severity | Metadata |
|---|---|---|---|---|
| `oauth.authorization.requested` | An authorization request was answered: refused, or with a code, a sign-in or a consent prompt. | write | info | `client_id` `scope` `response_type` `redirect_uri` `response_mode` `pkce_method` `prompt` `max_age` `resource` `detail_types` `jkt` `pushed` `request_object` `flow_id` `result` `amr` `acr` `expires_in` `cause` `alg` `key_id` `skew_seconds` `surface` |
| `oauth.consent.decided` | A user approved or refused a client's authorization request. | security, **mandatory** | notice | `client_id` `scope` `approved` `resource` `detail_types` `pushed` `resulting_scope` `expires_at` `grant_change` `cause` `redirect_uri` |
| `oauth.consent.revoked` | A user withdrew a client's standing authorization. | security, **mandatory** | notice | `client_id` `count` `trigger` |
| `oauth.device.decided` | A user approved or denied a device authorization request. | security, **mandatory** | notice | `client_id` `approved` `scope` `resource` `dpop_bound` `attempts` `flow_id` |
| `oauth.device.redeemed` | A device_code was redeemed for tokens, ending a device authorization (RFC 8628). | write | info | `client_id` `scope` `resource` `dpop_bound` `flow_id` `grant_family` `jkt` |
| `oauth.device.requested` | A device authorization was requested (RFC 8628). | write | info | `client_id` `scope` `resource` `dpop_bound` `flow_id` `cause` |
| `oauth.device.user_code.attempted` | A user_code submitted on the device verification page was refused. | security, **mandatory** | notice | `attempts` `remaining` `session_ended` `client_id` `flow_id` `stage` |
| `oauth.token.introspected` | A token was introspected (RFC 7662). | read | info | `active` `token_type_hint` `cause` `grant_family` `owner_client_id` |
| `oauth.token.issued` | An access (and possibly ID) token was issued. | trace | info | `grant_type` `scope` `token_types` `expires_in` `cause` `audience` `jkt` `grant_family` `consumed` `owner_client_id` `reuse_delay_seconds` `flow_id` `proof_jkt` `skew_seconds` `stage` |
| `oauth.token.presented` | An access token presented at a protected resource was refused. | security | warning | `client_id` `audience` `jkt` `grant_family` `cause` `proof_jkt` `skew_seconds` `stage` |
| `oauth.token.refreshed` | An access token was renewed with a refresh token. | trace | info | `grant_type` `scope` `token_types` `expires_in` `cause` `audience` `jkt` `grant_family` `consumed` `owner_client_id` `reuse_delay_seconds` `proof_jkt` `skew_seconds` `stage` |
| `oauth.token.revoked` | A token was revoked: by the client through /revoke, by the server after a replay, for every grant of a deleted account, or for every refresh token of a session that ended. | security, **mandatory** | notice | `token_type_hint` `trigger` `grant_type` `cause` `revocation_status` `grant_family` `owner_client_id` `reuse_delay_seconds` |
| `oidc.userinfo.read` | The UserInfo endpoint returned claims for an access token. | read | info | `scope` `claims_released` `subject_status` |

### Users

Category `user`.

| Action | What it records | Level | Severity | Metadata |
|---|---|---|---|---|
| `user.blocked` | A user was blocked through the admin API, ending their sessions. | security, **mandatory** | warning | `status` `cause` `target_user_id` `slug` `justification` `notified` |
| `user.created` | A local user was created through the admin API. | security, **mandatory** | notice | `email` `username` `email_verified` `invited` `slug` `cause` |
| `user.deleted` | A local user was deleted, cascading to their sessions and factors. | security, **mandatory** | warning | `email` `username` `roles` `target_user_id` `slug` `justification` |
| `user.devices.listed` | The browsers and networks a user signed in from were listed through the admin API. | read | info | `count` `target_user_id` `slug` |
| `user.identities.listed` | The identity provider accounts linked to a user were listed through the admin API. | read | info | `count` `target_user_id` `slug` |
| `user.invitation.sent` | A user was emailed an invitation to choose a password. | write | notice | `cause` `stage` `limit_scope` `target_user_id` `slug` |
| `user.listed` | A page of users was listed through the admin API. | read | info | `count` `sort` `cause` `slug` |
| `user.password_change.required` | An administrator required a user to set a new password at their next sign-in. | security, **mandatory** | notice | `cause` `target_user_id` `slug` `justification` |
| `user.password_reset.sent` | An administrator emailed a user a password reset link through the admin API. | write | notice | `cause` `stage` `limit_scope` `target_user_id` `slug` |
| `user.password.changed` | A user's password was replaced. | security, **mandatory** | warning | `sessions_revoked` `self_service` `target_user_id` `slug` `justification` `cause` |
| `user.reactivated` | A suspended or blocked user was reactivated through the admin API. | security, **mandatory** | notice | `status` `target_user_id` `slug` `justification` `notified` |
| `user.read` | A single user record was read through the admin API. | read | info | `target_user_id` `slug` |
| `user.remembered_browsers.forgotten` | A user's browsers remembered for their second factor were forgotten through the admin API. | security, **mandatory** | notice | `count` `target_user_id` `slug` `justification` |
| `user.suspended` | A user was suspended through the admin API, ending their sessions. | security, **mandatory** | warning | `expires_at` `status` `cause` `target_user_id` `slug` `justification` `notified` |
| `user.unlocked` | The lock a user's wrong passwords set was released through the admin API. | security, **mandatory** | notice | `count` `target_user_id` `slug` `justification` |
| `user.updated` | A local user's profile was updated through the admin API. | write | notice | `changed` `target_user_id` `slug` `cause` |

### Organizations

Category `organization`.

| Action | What it records | Level | Severity | Metadata |
|---|---|---|---|---|
| `broker_membership.accepted` | A member organization accepted a broker's invitation, and the broker's clients may sign in its users. | security, **mandatory** | warning | `membership_id` `side` `cause` `slug` `target_slug` `ref` |
| `broker_membership.clients_set` | A broker changed which of its clients a membership admits. | security, **mandatory** | warning | `membership_id` `side` `all_clients` `client_ids` `cause` `slug` |
| `broker_membership.ended` | A broker membership was ended, and the broker's clients no longer sign in the member's users. | security, **mandatory** | warning | `membership_id` `side` `status` `cause` `slug` `target_slug` `ref` |
| `broker_membership.invited` | An organization invited another to let its clients sign in the other's users. | security, **mandatory** | warning | `membership_id` `side` `all_clients` `client_ids` `cause` `slug` `target_slug` `ref` |
| `broker_membership.listed` | An organization's broker memberships were listed through the admin API. | read | info | `count` `slug` |
| `email_domain.claimed` | An organization claimed an email domain, pending proof that it owns it. | security, **mandatory** | notice | `domain` `domain_claim_id` `cause` `slug` `violations` |
| `email_domain.listed` | An organization's email domain claims were listed through the admin API. | read | info | `count` `slug` |
| `email_domain.lost` | A verified email domain's DNS record was no longer found, and the domain stopped routing to the organization. | security, **mandatory** | warning | `domain` `domain_claim_id` |
| `email_domain.removed` | An organization removed its claim on an email domain. | security, **mandatory** | warning | `domain` `domain_claim_id` `status` `cause` `slug` |
| `email_domain.verified` | An email domain claim was proved by its DNS record, and the domain routes sign-ins to the organization. | security, **mandatory** | warning | `domain` `domain_claim_id` `cause` `slug` |
| `identity_provider.applied` | An operator created or replaced an organization's external identity provider through the control plane. | security, **mandatory** | warning | `ref` `manager` `cause` `violations` |
| `identity_provider.deleted` | An operator deleted an organization's external identity provider through the control plane. | security, **mandatory** | warning | `ref` `manager` `cause` `violations` |
| `identity_provider.listed` | An organization's external identity providers were listed through the admin API. | read | info | `count` `slug` |
| `ldap_directory.applied` | An operator created or replaced an organization's directory connection through the control plane. | security, **mandatory** | warning | `ref` `manager` `cause` `violations` |
| `ldap_directory.deleted` | An operator deleted an organization's directory connection through the control plane. | security, **mandatory** | warning | `ref` `manager` `cause` `violations` |
| `organization.created` | An organization was created, with its own signing key and admin clients. | security, **mandatory** | notice | `slug` `display_name` `issuer` `fips_mode` `fapi_mode` `email_verification_required` `key_id` `cause` `violations` `stage` `ref` `client_id` `manager` `client_org` `rolled_back` |
| `organization.deleted` | An organization was deleted. | security, **mandatory** | critical | `slug` `display_name` `issuer` `fips_mode` `fapi_mode` `email_verification_required` `key_id` `cause` `violations` `stage` |
| `organization.listed` | A page of organizations was listed through the admin API. | read | info | `count` `sort` `cause` |
| `organization.mail.tested` | An administrator sent a test message through an organization's email relay. | write | info | `slug` `relay_ok` |
| `organization.read` | A single organization was read through the admin API. | read | info | `slug` `cause` `violations` |
| `organization.route.attempted` | A request addressed an organization by its path and was not served as that organization's. | trace | info | `slug` `cause` `repeat_count` `first_seen_at` `last_seen_at` |
| `organization.snapshot.read` | An organization's user, session and client counts were read through the admin API. | trace | info | `from` `to` `slug` |
| `organization.updated` | An organization's settings were updated. | security, **mandatory** | notice | `changed` `slug` `fapi_mode` `email_verification_required` `cause` `violations` |
| `resource_problem.listed` | What operators reported they could not do for an organization's resources was listed through the admin API. | read | info | `count` `slug` `sort` `cause` |
| `resource_problem.read` | One problem an operator reported for a resource was read through the admin API. | read | info | `slug` |
| `resource_status.reported` | An operator reported through the control plane that one of its resources is not ready, or is ready again. | security | info | `ref` `resource` `status` `cause` `violations` |

### Clients

Category `client`.

| Action | What it records | Level | Severity | Metadata |
|---|---|---|---|---|
| `branding.applied` | An operator created or replaced a client's sign-in page branding through the control plane. | security, **mandatory** | notice | `client_id` `ref` `manager` `cause` `violations` |
| `branding.deleted` | An operator deleted a client's sign-in page branding through the control plane. | security, **mandatory** | notice | `client_id` `ref` `manager` `cause` `violations` |
| `client.adopted` | Provisioning took an existing admin client into an organization and granted it the organization's admin roles. | security, **mandatory** | warning | `client_id` `client_type` `role` `scope` `minted` |
| `client.applied` | An operator created or replaced an OAuth client through the control plane. | security, **mandatory** | notice | `client_id` `ref` `manager` `cause` `violations` `scope` |
| `client.configuration.read` | A client read its own registration through the RFC 7592 configuration endpoint. | read | info | `client_id` |
| `client.configured` | A client replaced its own registration through the RFC 7592 configuration endpoint. | security, **mandatory** | notice | `client_id` `grant_types` `scope` `changed` `client_type` |
| `client.deleted` | An operator deleted an OAuth client through the control plane. | security, **mandatory** | warning | `client_id` `ref` `manager` `cause` `violations` |
| `client.deregistered` | A client deprovisioned its own registration through the RFC 7592 configuration endpoint. | security, **mandatory** | warning | `client_id` `software_id` `software_version` `grant_types` `client_type` |
| `client.listed` | A page of an organization's OAuth clients was listed through the admin API. | read | info | `count` `sort` `cause` `slug` |
| `client.name.suspicious` | A client's display name carried characters that misrepresent it, and was shown to a user anyway. | security | warning | `markers` `name_length` `surface` |
| `client.provisioned` | The server provisioned an OAuth client for an organization, or rewrote one's registered scopes. | security, **mandatory** | notice | `client_id` `client_type` `removed_scope` `scope` `role` `redirect_uri` `post_logout_redirect_uri` `cause` `ref` `manager` `client_org` |
| `client.read` | A single OAuth client's registered configuration was read through the admin API. | read | info | `target_client_ref` `slug` |
| `client.registered` | A client registered itself through RFC 7591 dynamic client registration. | security, **mandatory** | notice | `client_id` `software_id` `software_version` `grant_types` `scope` `client_type` |
| `client.registration.attempted` | A request to the dynamic client registration or configuration endpoint was refused. | security | warning | `client_id` `metadata_field` `cause` `grant_family` `jkt` |
| `client.secret.issued` | A confidential client's secret was minted and disclosed once. | security, **mandatory** | warning | `client_id` `delivered` |
| `client.usage.read` | A single OAuth client's daily, monthly and all-time user counts were read through the admin API. | trace | info | `target_client_ref` `slug` |

### Roles

Category `role`.

| Action | What it records | Level | Severity | Metadata |
|---|---|---|---|---|
| `role.granted` | A role was granted to a user within an organization. | security, **mandatory** | warning | `role` `justification` `target_user_id` `notified` |
| `role.revoked` | A role was taken from a user within an organization. | security, **mandatory** | warning | `role` `justification` `target_user_id` `cause` `notified` |

### Admin API and edge

Category `admin`.

| Action | What it records | Level | Severity | Metadata |
|---|---|---|---|---|
| `admin.access.denied` | A request to the privileged admin API was refused by authorization. | security, **mandatory** | warning | `required_permission` `required_role` `required_scope` `target_slug` `target_user_id` `client_id` `audience` `scope` `roles` `cause` `jkt` `grant_family` `peer_identities` `ref` `proof_jkt` `skew_seconds` `stage` `domain` |

### Audit log

Category `audit`.

| Action | What it records | Level | Severity | Metadata |
|---|---|---|---|---|
| `audit.counts.read` | Audit records were counted over a window. | trace | info | `from` `to` `filters` `slug` |
| `audit.log.read` | The audit log was read. | security, **mandatory** | info | `count` `from` `to` `sort` `filters` `event_id` `platform_records` `filter_actor_id` `filter_target_id` `filter_client_id` `filter_session_id` `filter_client_net` `cause` `slug` |
| `audit.ranking.read` | The subjects behind a set of audit records were ranked by their count. | trace | info | `from` `to` `filters` `slug` |
| `threats.overview.read` | The threat overview was read over a window. | trace | info | `from` `to` `slug` |

### System

Category `system`.

| Action | What it records | Level | Severity | Metadata |
|---|---|---|---|---|
| `http.request.served` | A request ended in a server fault nothing else recorded, or in a recovered panic. | trace | info | `status` `cause` `instance` `boot_id` |
| `system.admin.bootstrapped` | Configured admin subjects were granted main authority at startup. | security, **mandatory**, platform | notice | `granted` `instance` `boot_id` |
| `system.audit.checkpoint` | A writer signed a checkpoint of the audit log's hash chain; each record is the statement or one part of it. | security, **mandatory**, platform | info | `lane` `checkpoint_counter` `checkpoint_part` `chain_segment` `chain_month` `chain_seq` `chain_head` `chain_from` `chain_through` `chain_prev` `issued_at` `final` `chain_segments` `chain_gaps` `gaps_pending` `gaps_dropped` `key_id` `sig` `instance` `boot_id` |
| `system.audit.configured` | The server recorded the audit configuration it runs with, and what changed since the previous boot. | security, **mandatory**, platform | info | `audit_enabled` `audit_level` `audit_include` `audit_exclude` `fail_closed` `retention_days` `coalesce_window_seconds` `coalesce_max_keys` `checkpoint_interval_seconds` `checkpoint_key_id` `audit_rewrite_routes` `changed` `previous_audit_enabled` `previous_audit_level` `previous_audit_include` `previous_audit_exclude` `previous_fail_closed` `previous_retention_days` `previous_coalesce_window_seconds` `previous_coalesce_max_keys` `previous_checkpoint_interval_seconds` `previous_checkpoint_key_id` `previous_audit_rewrite_routes` `window_start` `window_end` `instance` `boot_id` |
| `system.audit.degraded` | The audit pipeline is degraded: mandatory events are not being persisted promptly. | security, **mandatory**, platform | critical | `trigger` `count` `error_class` `instance` `boot_id` |
| `system.audit.overflow` | Audit events were dropped because the write buffer was full. | security, **mandatory**, platform | critical | `dropped` `dropped_mandatory` `window_start` `window_end` `instance` `boot_id` |
| `system.audit.partition_created` | An audit-log partition was created ahead of time. | write, platform | info | `partition` `range_start` `range_end` `instance` `boot_id` |
| `system.audit.partition_dropped` | A month of audit history past the retention period was removed: its partition dropped. | security, **mandatory**, platform | warning | `partition` `range_start` `range_end` `retention_days` `instance` `boot_id` |
| `system.audit.recovered` | The audit pipeline recovered from its degraded state. | security, **mandatory**, platform | notice | `count` `instance` `boot_id` |
| `system.audit.write_delayed` | Mandatory audit events were persisted late, after the store refused them for a while. | security, **mandatory**, platform | warning | `count` `window_start` `window_end` `max_lag_ms` `error_class` `instance` `boot_id` |
| `system.audit.write_failed` | A batch of audit events could not be persisted. | security, **mandatory**, platform | critical | `count` `failed_mandatory` `error_class` `error` `window_start` `window_end` `instance` `boot_id` |
| `system.debug.accessed` | A runtime profiling endpoint was read on the internal listener. | security, platform | warning | `profile` `instance` `boot_id` `repeat_count` `first_seen_at` `last_seen_at` |
| `system.dependency.degraded` | A dependency the server relies on started failing. | security, **mandatory**, platform | warning | `dependency` `critical` `failed_op` `error_class` `window_start` `last_ok_at` `fails_closed` `fails_open` `instance` `boot_id` |
| `system.dependency.recovered` | A dependency that had been failing answers again. | security, **mandatory**, platform | notice | `dependency` `critical` `failed_op` `error_class` `window_start` `window_end` `count` `fails_closed` `fails_open` `instance` `boot_id` |
| `system.keys.loaded` | The server recorded the keys and cryptographic module it runs with, and what changed since the previous boot. | security, **mandatory**, platform | info | `signing_key_mode` `key_id` `retired_key_id` `kek_mode` `kek_retired` `kek_unreadable` `mfa_key_mode` `mfa_key_retired` `mfa_key_unreadable` `fips` `fips_module` `fips_required` `changed` `previous_signing_key_mode` `previous_key_id` `previous_retired_key_id` `previous_kek_mode` `previous_kek_retired` `previous_kek_unreadable` `previous_mfa_key_mode` `previous_mfa_key_retired` `previous_mfa_key_unreadable` `previous_fips` `previous_fips_module` `previous_fips_required` `instance` `boot_id` |
| `system.migration.applied` | Database migrations were applied. | security, **mandatory**, platform | notice | `count` `version` `migrations` `instance` `boot_id` |
| `system.session.reaped` | The background sweeper removed absolute-expired login sessions. | trace, platform | info | `count` `instance` `boot_id` |
| `system.signing_key.created` | A signing key was generated for an organization and added to the key set it publishes. | security, **mandatory**, platform | notice | `key_id` `alg` `instance` `boot_id` |
| `system.signing_key.dropped` | An organization's signing key could not be loaded, so it was left out of the key set published for it. | security, **mandatory**, platform | critical | `key_id` `alg` `stage` `cause` `instance` `boot_id` |
| `system.started` | The server started. | security, **mandatory**, platform | info | `version` `commit` `instance` `boot_id` |
| `system.stopped` | The server stopped. | security, **mandatory**, platform | info | `instance` `boot_id` `trigger` `stage` `uptime_seconds` `queued` `queued_mandatory` |
| `system.transport.configured` | The server recorded which proxies it trusts and whether it terminates TLS, and what changed since the previous boot. | security, **mandatory**, platform | info | `trusted_proxies` `trusted_proxies_count` `trusted_proxies_digest` `client_ip_mode` `client_ip_header` `tls_enabled` `hsts` `changed` `previous_trusted_proxies` `previous_trusted_proxies_count` `previous_trusted_proxies_digest` `previous_client_ip_mode` `previous_client_ip_header` `previous_tls_enabled` `previous_hsts` `instance` `boot_id` |

146 actions, 75 of them mandatory.
{/* AUTO-GENERATED-AUDIT-CATALOG-END */}