# Audit log categories

Audit log categories simplify security monitoring by allowing you to identify events of interest based on **what happened** rather than needing to enumerate every possible event name across all Foundry services. Instead of tracking hundreds of service-specific event names, categories let you focus on high-level actions like data loading, data exporting, or authentication attempts, regardless of which product or feature generated the log.

## Why categories matter

In traditional audit logging systems, security analysts must understand the implementation details of every service to write effective queries. When investigating potential data exfiltration, for example, you might need to know that the relevant event names are EXPORT\_DATASET, DOWNLOAD\_FILE, CREATE\_EXTERNAL\_CONNECTION, and dozens of others, while also maintaining this list as new features are added.

Audit log categories solve this problem through abstraction. In the `audit.3` schema, every event must be logged under one or more standardized categories that provide consistent request and result parameters. This means the following:

* **Service-agnostic queries:** Filter for `dataExport` to find all data export events, regardless of which Foundry product performed the export.
* **Future-proof monitoring:** New export capabilities will log with the `dataExport` category; you do not need to update your queries.
* **Faster investigations:** Spend less time understanding system internals and more time analyzing user behavior.
* **Predictable structure:** Each category defines exactly which request and result fields will be present, making automated analysis more reliable.

## Audit.2 vs audit.3 schemas

While `audit.2` logs may contain category information, their usage is optional and not enforced. This means categories might be missing entirely, or the associated request and result parameters may not follow a consistent structure.

In contrast, the `audit.3` schema enforces category usage with the following guarantees:

* Every audit log must specify at least one category.
* Every category explicitly defines the request and result fields that will be present.
* Standard parameters enable analysis without service-specific knowledge.

**Field naming:** `audit.3` uses `requestFields` and `resultFields` for parameter information, while `audit.2` uses `request_params` and `result_params`.

Refer to our [audit logging overview](../audit-logs-overview/index.md) documentation for comprehensive information about schema differences and migration guidance.

## Example workflow

A typical security monitoring workflow using categories looks like this:

**1. Identify categories of interest**

Based on your security requirements, determine which categories are relevant. For example:

* Investigating potential data access: `dataLoad`
* Monitoring exports: `dataExport`
* Reviewing logins: `userLogin`

**2. Query logs by category**

Use an external SIEM or a Foundry audit log export dataset with Pipeline Builder to filter logs. In pseudo-code this would look like:

```
allLogs.filter {log -> interestingCategories.any{log.categories.contains(it)}}
```

**Performance note:** Audit log datasets can contain very high volumes of data. Always filter using the `time` column before performing aggregations or visualizations to ensure performant queries.

**3. Analyze structured parameters**

For each matching log, examine the `requestFields` and `resultFields`. These contain the specific information submitted by the user and returned by the system, separated to help you differentiate between:

* **Request fields** (`requestFields`): What the user provided (for example, which resources they requested).
* **Result fields** (`resultFields`): What the system returned (for example, which resources were actually loaded).

For example, a log with the `dataLoad` category will contain a list of all resources loaded during that interaction in either `requestFields` or `resultFields`, allowing you to immediately understand data access patterns without knowing which specific Foundry service handled the request.

**4. Cross-reference categories**

Many events generate logs with multiple categories. When investigating a potential incident, you can verify that while a user loaded many datasets (`dataLoad`), no actual exports occurred by confirming the absence of the `dataExport` category in their activity.

## Available categories

Below are the available audit log categories.

| Audit log category | Category description | Request fields | Result fields |
| --- | --- | --- | --- |
| `apiGatewayRequest` | A request to an API gateway.<br><br>User actions may result in requests that are fulfilled by an API gateway. Use this audit log to view the name or origin of the request. To get more information about this user action, find other audit logs associated with this request by filtering to logs with the same `traceId` field. To find audit logs for requests made by the API gateway when fulfilling the user-initiated request, further filter to logs that have a `userAgent` field starting with the `service` name in this audit log. | `operationNames` <br />docs: The name of the request. If a batch request, this may include multiple names.<br />type: optional |
| `appConfigAccess` | Load application-specific configuration. These may be tied to a user or resource. | `accessedAppConfigIds` <br />docs: The application resources that were accessed in this event. <br />type: required  <br /><br />`accessAppConfigDescription` <br />docs: A description of the configuration access. <br />type: required  |
| `appConfigCreate` | Create application-specific configuration. These may be tied to a user or resource. | `createAppConfigDescription` <br />docs: A description of the configuration creation. <br />type: required  | `createdAppConfigIds` <br />docs: The application resources that were created in this event. <br />type: required  |
| `appConfigDelete` | Delete application-specific configuration. These may be tied to a user or resource. | `deletedAppConfigIds` <br />docs: The ApplicationResouces that were deleted in this event. <br />type: required  <br /><br />`deleteAppConfigDescription` <br />docs: A description of the configuration deletion. <br />type: required  |
| `appConfigSearch` | Search for application-specific configuration. These may be tied to a user or resource. `appConfigSearch` should be used when the exact result values of a request are unknown, or variable. | `appConfigSearchQuery` <br />docs: The search-query that this event is running. <br />type: required  | `appConfigSearchResults` <br />docs: The search-results that are returned to the user in this event. <br />type: required  |
| `appConfigUpdate` | Update application-specific configuration. These may be tied to a user or resource. | `updatedAppConfigIds` <br />docs: The application resources that were updated in this event. <br />type: required  <br /><br />`updateAppConfigDescription` <br />docs: A description of the configuration update. <br />type: required  |
| `assetFileLoad` | Deprecated; use AssetFileLoadV2. Loads a file's full coordinate, such as group, artifact, and version, from a static asset. | `requestMavenCoordinate` <br />docs: Maven coordinate for the asset requested. Might not include `groupId` or version. <br />type: required <br />type: required | `responseMavenCoordinate` <br />docs: The full Maven coordinate for the returned asset. <br />type: required |
| `assetFileLoadV2` | Loads a file either from the asset coordinate or through the content addressable storage. | `fileIdentifier`<br />type: required | `fileLoadResponse`<br />type: required |
| `auditDataRedact` | Redaction of audit data as part of remediation of a data spill. | `requestedAuditEventIds`<br />docs: The identifiers for the audit events which were believed to be impacted by the spill.<br />type: required<br /><br />`organizationRid`<br />docs: The organization to which the suspected audit events were attributed.<br />type: required<br /><br />`startDate`<br />docs: The beginning of the window of time in which the suspected audit events occurred.<br />type: required<br /><br />`endDate`<br />docs:The end of the window of time in which the suspected audit events occurred.<br />type: required<br /><br /> `redactionReason`<br />docs: The reason for the redaction; must be non-empty.<br />type: required | `redactionRequestId`<br />docs: The UUID associated with this request.<br />type: required<br /><br />` redactedAuditEventIds`<br />docs: The identifiers which were actually redacted in the specified organization.<br />type: required<br /><br />`redactedServiceUserAttributedAuditEventIds`<br />docs: The service user-attributed audit event identifiers which were actually redacted.<br />type: required<br /><br />`missingAuditEventIds`<br />docs: The identifiers for suspected audit events which were found in neither the specified organization nor among service user-attributed audit events in the specified window.<br />type: required<br /><br />`redactedLineCount`<br />docs: The number of physical lines which were actually redacted as part of the completion of this request.<br />type: required<br /><br />`modifiedFiles`<br />docs: A mapping from the original filename to a new filename for all modified files.<br />type: required  |
| `auditDataShareCreate` | Creation of shares of audit data. For example, signed URLs that can be used to retrieve audit logs. No data is returned in this request; instead, this endpoint returns pointers that can be used to retrieve audit log data without further auth checks. | `shareTargets`<br />docs: The identifiers for the audit data being shared.<br />type: required | `shareIds`<br />docs: Map from share targets to created data shares.<br />type: required |
| `auditDataTransform` | Transform exactly one DataResource which contains audit data in some way. | `transformTarget`<br />docs: The resource that was transformed.<br />type: required<br /><br /> `transformDescriptions`<br />docs: Descriptions of the transformations that were performed.<br />type: required | `transformDestination`<br />docs: The destination to which the output of the transformations on the input were written. If absent, then the transformations are assumed to have been performed in-memory only (the output may or may not have been shown to the user, but it was not persisted). To indicate an in-place transformation, the transformTarget and transformDestination fields should contain the same DataResource.<br />type: optional |
| `authenticationCheck` | Checks authentication status via a programmatic or manual authentication event, such as token validation. | `authenticationCheckTargets` <br />docs: The identifiers against which that auth is being checked. <br />type: optional  | `authenticationCheckResult` <br />docs: Whether this authentication check succeeded or not. <br />type: required <br /><br />`authenticationCheckResultMessage` <br />docs: Further details on this authentication check result. <br />type: optional  |
| `authorizationCheck` | Checks authorization status via a programmatic or manual authorization event, like checking permissions. | `authorizationCheckTargets` <br />docs: The identifiers that auth is being checked against. <br />type: optional  <br /><br />`authorizationCheckOperations` <br />docs: The values within the authorization attempt, such as the permission being checked for. <br />type: required | `authorizationCheckSucceededTargets` <br />docs: Targets that passed authorization. <br />type: required  <br /><br />`authorizationCheckFailedTargets` <br />docs: Targets that failed authorization. <br />type: required  <br /><br />`authorizationCheckResultMessage` <br />docs: Further details on this authorization check result. <br />type: optional  |
| `bulkDataImport` | Bulk imports to the platform. Differs from `dataImport` in that the direct relationship between destinations and origins may not be known. | `bulkImportedFiles` <br />docs: The files that were imported <br />type: required | `bulkImportDestinations` <br />docs: The destination for the bulk imports. <br />type: required  |
| `cancelCodeExecution` | Cancellation of an existing code execution. | `cancelledExecutedResources` <br /> docs: The specific resources that were being executed before cancellation. For example, this could be a `modelUUID` or a `buildRID`. <br />type: required  <br /><br />`cancelledExecutedResourceEnvironment` <br />docs: The encompassing environment for the resources that were being executed before cancellation. For example, this could be a `liveRID` or a `workbookRID`. <br />type: required  |
| `codeExecution` | Occurrence of code execution, which might not write results to a `dataResource`. | `executedResourceEnvironment` <br />docs: The encompassing environment for the resources that were executed. For example, this could be a liveRID or a workbookRID. <br />type: required  | `executedResources` <br />docs: The specific resources that were executed. For example, this could be a modelUUID or a buildRID or if run on a container, pass in the identifier of the container. <br />type: required  |
| `configureInfra` | A user configures some infrastructure like a node or a service. | `configureInfraTargets` <br />docs: The SystemResources that are being configured. <br />type: required  | `configureInfraRequestId` <br />docs: The request-id of this configuration event. <br />type: required |
| `containerLaunch` | Registers the preparation of a compute environment. This should be emitted when, for example, a Spark module is launched. If possible, pass in a location identifier of the compute environment like a host name. | `requestedContainerIdsToLaunch` <br />docs: The IDs of the resources that were requested to be launched. <br />type: optional  | `launchedContainerIds` <br />docs: The IDs of the resources that were launched. <br />type: required  |
| `containerLoad` | Registers the load of a compute environment. This should be emitted when, for example, a spark module is read. If possible, pass in a location identifier of the compute environment like a host name. | `requestedContainerLoadIds` <br />docs: The IDs of the resources that were requested. <br />type: required  | `loadedContainerLoadIds` <br />docs: The IDs of the resources that were loaded. <br />type: required  |
| `containerSearch` | Registers the search of compute environments. This should be emitted when, for example, spark module list is read. | `containerSearchQuery` <br />docs: The search-query that this event is running. <br />type: optional  | `containerSearchResults` <br />docs: The search-results that are returned to the user in this event. <br />type: required  |
| `containerStop` | Registers the shutdown of a compute environment. If possible, pass in a human readable reason for the shutdown, for example "failure" or "user request". | `stoppedContainerIds` <br />docs: The IDs of the resources that were stopped. <br />type: required  <br /><br />`containerStopReason` <br />docs: The reason why the resource was stopped. <br />type: optional  |
| `createInfra` | A user creates some infrastructure like a node or a service. | `createInfraTargets` <br />docs: The SystemResources that are being created. <br />type: required  | `createdInfraResources` <br />docs: The SystemResources that were created. This should have a more explicit identifier. <br />type: required  |
| `dataCreate` | Indicates the addition of some new entry of data into the platform where it did not exist prior. This event may be reflected as a `dataPromote` in a separate service if it is logged in the landing service. | `createdResources` <br />docs: The DataResources that were created in this event. <br />type: required  |
| `dataDelete` | Related to the deletion of data, independent of the granularity of that deletion. | `deletedResources` <br />docs: The DataResources that were deleted in this event. <br />type: required  |
| `dataExport` | Export of data from the platform. Use for things like downloading data from the platform, such as a system external to Palantir, csv file and more. If data was exported to another Palantir system, use the `dataPromote` category. | `downloadedResources` <br />docs: All resources that were downloaded in this event. <br />type: required  | `downloadedSize` <br />docs: The size, in bytes, of the downloaded data. <br />type: required |
| `dataImport` | Imports to the platform. Unlike `dataPromote`, `dataImport` refers only to data being ingested from outside the platform. This means that a `dataImport` in Palantir Gotham could show up as a `dataPromote` in a separate service. | `importedFilename` <br />docs: The filename of the imported data. <br />type: required  <br /><br />`importedFileType` <br />docs: The filetype of the imported data. <br />type: required <br /><br />`importParentResourceId` <br />docs: The parent of the destination resource. <br />type: optional | `importResourceId:` <br />docs: The destination resource for the imported data. <br />type: required <br /><br />`importedSize` <br />docs: The total size, in bytes, of the imported data. <br/>type: optional |
| `dataLoad` | Refers to the loading of data to be returned to a user. For purely back-end loads, use `internal`. | `loadedResources` <br />docs: The DataResources that were loaded in this event. <br />type: required  |
| `dataMerge` | Refers to the combination of two datasources into one. This would be triggered by a JOIN in Contour or a Resolution event in Palantir Gotham. | `resourcesToMerge` <br />docs: The resources that were merged in this event. <br />type: required  | `mergedResult` <br />docs: The resultant DataResource from the merging of the resources. <br />type: required  |
| `dataPromote` | Indicates that a user promoted data to an external Palantir system, Gotham or otherwise. | `promotionDestinations` <br />docs: The destinations to which the DataResources were promoted. <br />type: required <br /><br /> `promotionDescription` <br />docs: A description of this promotion event. <br />type: required  <br /><br />`promotedResources` <br />docs: The resources that were promoted to another system. <br />type: required  |
| `dataSearch` | Searches of datasets, objects, or other searches for data within the system. | `dataSearchQuery` <br />docs: The query that this search is executing. <br />type: required  <br /><br /> `dataSearchContext` <br />docs: Further information to contextualize the current query. This information is unstructured and should not be relied upon beyond informing auditors. <br />type:list\<common.ResourceContext>| `dataSearchResults` <br />docs: All resources that were presented to the user by this search result. <br />type: required  |
| `dataShareCreate` | Creation of a share of data. For example, when creating a link that grants access to resources on visit. | `dataShareCreateId` <br />docs: An optional identifier for this share, if available. <br />type: optional <br /><br />`dataShareCreateTargets` <br />type: required  |
| `dataShareDisable` | Deactivation of a mechanism to share data. For example, the disabling of a link that grants access to resources on visit. | `dataShareDisableId` <br />docs: An optional identifier for this share, if available. <br />type: optional <br /><br />`dataShareDisableTargets` <br />type: required  |
| `dataShare` | Discretionary share of data. | `dataShareId` <br />docs: An optional identifier for this share, if available. <br />type: optional  <br /><br />`dataShareTargets` <br />type: required  <br /><br />`dataShareReason` <br /> docs: A human-readable reason this data was shared (for example, "visited a share link"). <br />type: required  |
| `dataTransform` | Transform one or more DataResources in some way. | `transformTargets` <br />docs: The resources that were transformed. <br />type: required  <br /><br />`transformDescription` <br />docs: A description of the transformation that was performed. <br />type: required  |
| `dataUpdate` | Updates or attempted updates of data. This is a catch-all field and we recommend using `dataTransform` or `dataMerge` instead. |
| `inApplicationContext` | The request was initiated from a third-party application. | `applicationRid`<br />docs: The application from which the request was initiated.<br />type: required |
| `inEnrollmentContext` | The request was made in the context of one or more enrollments. | `enrollmentRids`<br />docs: The enrollments that were associated with the request.<br />type: required |
| `infraLogsAccess` | User requests logs from an infrastructure resource like a node or a service. | `infraLogsAccessTarget` <br />docs: The SystemResource from which logs are being requested. <br />type: required  | `infraLogsAccessRequestId`<br />docs: The request ID of this access request event. <br />type: required |
| `inHubContext` | The request was made in a hub-spoke environment context where services may query about configurations for different stacks/spokes than their own. | `targetEnvironment`<br />docs: The target environment being queried about.<br />type: required<br /><br />`targetSpokeEnvironment`<br />docs: If present, the target spoke environment being queried about.<br />type: optional | `targetEnrollment`<br />docs: If present, the target enrollment being queried about.<br />type: optional<br /><br />`targetDomain`<br />docs: If present, the target domain being queried about.<br />type: optional |
| `internal` | Catch-all for all internal events. These typically are low signal for audit users. |
| `llmInference` | Runs a prompt through a Generative AI model (a Large Language Model or LLM) that outputs a response. | `llmInferenceContext`<br />docs: Further context to identify this inference request, such as the model ID, or resources in foundry attributed to the request.<br />type: required<br /><br /> `llmInferenceInputs`<br />docs: The inputs that were used to generate the responses.<br />type: required | `llmInferenceResponses`<br />docs: The responses that were generated by the model.<br />type: required<br /><br />`llmInferenceResponseContext`<br />docs:  Further context to identify this inference request, such as the model ID. This must include any LLM inference context that is only available at response time.<br />type: required |
| `llmRoute` | Represents the forwarding of an LLM prompt to an appropriate backend. This audit category is intended for LLM proxies or load balancers (for example, llm-portal). | `llmRouteRequest`<br />type: required | `llmRouteResponse`<br />type: required |
| `logicAccess` | Access of logic. For example, viewing a Contour analysis. | `accessedLogicResources` <br />docs: All LogicResources accessed in this event. <br />type: required  |
| `logicCreate` | Creation of new logic. For example, when a new Contour board is created. || `createdLogicResources` <br />docs: All LogicResources created in this event. <br />type: required  |
| `logicDelete` | Deletion of logic. For example, deleting a Contour board. | `deletedLogicResources` <br />docs: All LogicResources deleted in this event. <br />type: required  |
| `logicSearch` | Search of some logic. For example, searching for a Contour analysis. | `logicSearchQuery` <br />docs: The query that this search is executing. <br />type: required  | `logicSearchResults` <br />docs: All underlying LogicResources returned by this search request. <br />type: required  |
| `logicUpdate` | An update to existing logic. For example, when a user saves a file, a push to a stemma repo occurs, or the logic of an existing Contour board is updated. | `updatedLogicResources` <br />docs: All LogicResources updated in this event. <br />type: required  |
| `managementGroups` | Changes to group membership should always go through here. | `groupPatches` <br />type: required |
| `managementPermissions` | Anything that changes permissions on the platform. These logs should use the `result_params` `changes` field to enumerate the precise change that occurred. Examples include sharing a resource or changing a resource's provenance. | `resourcesWithPermissionsChanges` <br />docs: The resources affected by the change in permissions <br />type: required  <br /><br />`permissionChangeContext` <br />docs: Further information to contextualize changed resources <br />type: optional |
| `managementUsers` | Changes and modifications to what users exist or their personal information. For events related to user permissions, use `managementPermissions`.  For events where a user is added or removed from a group, use `managementGroups`. | `managedUserIds` <br />type: required |
| `managementTokens` | Specific action related to token management, such as enabling, disabling, or revoking tokens. | `managedTokens` <br />docs: All tokens affected by the change. <br />type: required |
| `managementMarkings` | Anything that modifies access to mandatory controls. | `markingPatches` <br />type: required |
| `mandatoryControlManagement` | Privileged action affecting mandatory controls in the system. Replaced by `managementMarkings` in `audit.3`. |
| `mandatoryControlApplication` | Privileged action affecting mandatory controls in the system. Replaced by `managementPermissions` in `audit.3`. |
| `metaDataAccess` | Refers to the loading of metadata. Metadata is data *about* data; for example, various API-accessible metrics that describe data within a pipeline, like counts, dataset names, transaction IDs and more. As such, metadata may not have its own identifier but instead will be related to the data that it describes.  | `accessedMetaDataResources` <br />docs: The underlying DataResources that the accessed metadata describes. <br />type: required  <br /><br />`accessedMetaDataDescription` <br /> docs: A description of the metadata access. <br />type: required  |
| `metaDataCreate` | The creation of metadata. Metadata is data *about* data; for example, various API-accessible metrics that describe data within a pipeline, like counts, dataset names, transaction IDs and more. | `createdMetaDataDescription` <br />docs: A description of the metadata creation. <br />type: required  | `createdMetaDataResources` <br />docs: The underlying DataResources that the created metadata describes. <br />type: required  |
| `metaDataDelete` | The deletion of metadata. Metadata is data *about* data; for example, various API-accessible metrics that describe data within a pipeline, like counts, dataset names, transaction IDs and more. | `deletedMetaDataResources` <br /> docs: The underlying DataResources that the deleted metadata describes. <br />type: required  <br /><br />`deletedMetaDataDescription` <br />docs: A description of the metadata deletion. <br />type: required  |
| `metaDataSearch` | Search of metadata associated with a dataset, objects, or other searches for metadata within the system. | `metaDataSearchQuery` <br />docs: The query that this search is executing. <br />type: required  | `metaDataSearchResults` <br />docs: All underlying resources that had metadata presented to the user by this search result. <br />type: required  |
| `metaDataUpdate` | The updating of metadata. MetaData is data *about* data; for example, various API-accessible metrics that describe data within a pipeline, like counts, dataset names, transaction IDs and more. | `updatedMetaDataResources` <br />docs: The underlying DataResources that the updated metadata describes. <br />type: required  <br /><br />`updatedMetaDataDescription` <br />docs: A description of the metadata update. <br />type: required  |
| `monitorAccess` | Access of a monitor, for example viewing details about how it works. | `accessedMonitorResources` <br />docs: The MonitorResources that were accessed in this event. <br />type: required  <br /><br />`accessedMonitorDescription` <br />docs: A description of the monitor access. <br />type: optional  |
| `monitorCreate` | Creation of a monitor. | `createdMonitorDescription` <br />docs: A description of the monitor creation. <br />type: optional  | `createdMonitorResources` <br />docs: The MonitorResources that were created in this event. <br />type: required  |
| `monitorDelete` | Deletion of a monitor. | `deletedMonitorResources` <br />docs: The MonitorResources that were deleted in this event. <br />type: required  <br /><br />`deletedMonitorDescription` <br />docs: A description of the monitor deletion. <br />type: optional  |
| `monitorRun` | Execution of a particular monitor, potentially triggering actions or notifications. | `runMonitorTargets` <br />docs: The MonitorResources that were run in this event. <br />type: required  |
| `monitorSearch` | Searching for a monitor. | `monitorSearchQuery` <br />docs: The search-query that this event is running. <br />type: required  | `monitorSearchResults` <br />docs: The search-results that are returned to the user in this event. <br/>type: required  |
| `monitorUpdate` | Update a monitor, potentially changing how it behaves. | `updatedMonitorResources` <br />docs: The MonitorResources that were updated in this event. <br />type: required  <br /><br />`updatedMonitorDescription` <br />docs: A description of the monitor update. <br />type: optional  |
| `oauth2InitiateAuthFlow` | Start the OAuth 2.0 Authorization Code flow with the external OAuth 2.0 server. | `oauth2InitiateAuthFlowUser` <br />docs: The user for whom this oauth2 flow is being started. <br />type: required  <br /><br />`oauth2InitiateAuthClientId` <br />docs: The client-id the oauth2 flow is being performed for. <br />type: required  |
| `onBehalfOf` | The request was made on behalf of other users, usually by a service user. | `onBehalfOfUserIds` <br />docs: The upstream users. The first user ID is the most upstream user. <br />type: required  |
| `ontologyDataLoad` | The loading of ontology data to be returned to a user. | `ontologyDataLoadContext` <br />docs: Further context to identify this load request, such as the owning RID. <br />type: optional <br /><br />`requestedOntologyDataResources` <br />docs: The OntologyDataResources that were requested in this event. <br />type: required  | `loadedOntologyDataResources` <br />docs: The OntologyDataResources that were loaded in this event. <br />type: required  |
| `ontologyDataTransform` | The modification of ontology data via patches or edits. | `ontologyDataTransformTargets` <br />docs: The OntologyDataResources that the user intends to transform. <br />type: optional  <br /><br />`ontologyDataTransformContext` <br />docs: Further context to identify this transform request. <br />type: optional <br /><br />`ontologyDataTransformDescription` <br />docs: A description of the transformation that was performed. <br />type: optional  | `transformedOntologyDataResources` <br />docs: The OntologyDataResources that were transformed by the request. <br />type: optional  |
| `ontologyDataSearch` | Search of ontology data within the system. | `ontologyDataSearchContext` <br />docs: Further context to identify this load request, such as the owning RID. <br />type: optional <br /><br />`searchedOntologyLogicResources` <br />docs: The logical selections included in this search. <br />type: required  | `ontologyDataSearchResults` <br />docs: All resources that were presented to the user by this search result. <br />type: required  |
| `ontologyLogicAccess` | Access of ontology logic. For example, viewing an object set or sets. | `requestedOntologyLogicResources` <br />docs: The OntologyLogicResources that were requested. <br />type: required  | `loadedOntologyLogicResources` <br />docs: The OntologyLogicResources that were present in the response. <br />type: required  |
| `ontologyLogicCreate` | Creation of new ontology logic. For example, when a new object set is created. | `createOntologyLogicContext` <br />docs: Further context to narrow down an identifier, or further identify this request. For example, owning RID, or parent Compass RID. This includes a "type" context identifying the type represented by this request, for example, temporary object set, permanent object set, versioned object set, and more. <br />type: optional | `createdOntologyLogicResources` <br />docs: All LogicResources created in this event. <br />type: required  |
| `ontologyLogicDelete` | Deletion of ontology logic, for example a new object set. | `deleteOntologyLogicContext` <br />docs: Further context to narrow down an identifier, or further identify this request. For example, owning RID, or parent Compass RID. This includes a "type" context identifying the type represented by this request, for example, temporary object set, permanent object set, versioned object set, and more. <br />type: optional | `deletedOntologyLogicResources` <br />docs: All LogicResources deleted in this event. <br />type: required  |
| `ontologyLogicUpdate` | Update ontology logic, for example saving a new version of an object set. | `updateOntologyLogicContext` <br />docs: Further context to narrow down an identifier, or further identify this request. For example, owning RID, or parent Compass RID. This includes a "type" context identifying the type represented by this request, for example, temporary object set, permanent object set, versioned object set, and more. <br />type: optional | `updatedOntologyLogicResources` <br />docs: All LogicResources updated in this event. <br />type: required  |
| `ontologyMetaDataCreate` | The creation of OntologyMetaDataResources. || `createdOntologyMetaDataResources` <br />docs: All OntologyMetaDataResources created in this event. <br />type: required  |
| `ontologyMetaDataDelete` | The deletion of OntologyMetaDataResources. | `deletedOntologyMetaDataResources` <br />docs: All OntologyMetaDataResources deleted in this event. <br />type: required  |
| `ontologyMetaDataLoad` | The loading of Ontology MetaData to be returned to a user. | `requestedOntologyMetaDataResources` <br />docs: The OntologyMetadataResources that were requested. <br />type: required  | `loadedOntologyMetaDataResources` <br />docs: The OntologyMetaDataResources that were present in the response. <br />type: required  |
| `ontologyMetaDataSearch` | Search for OntologyMetaDataResources that meet criteria. | `ontologyMetaDataSearchedResources` <br />docs: The OntologyMetaDataResources included in the search query. <br />type: required  <br /><br />`ontologyMetaDataSearchContext` <br />docs: Further context to the search query, such as DatasourceType. <br />type: optional | `ontologyMetaDataSearchResults` <br />docs: All OntologyMetaDataResources that were returned to the user. <br />type: required  |
| `ontologyMetaDataUpdate` | The modification of OntologyMetaDataResources. | `updatedOntologyMetaDataResources` <br />docs: All OntologyMetaDataResources updated in this event. <br />type: required  |
| `passThrough` | A category where the set of auditable parameters is determined at runtime, typically by an external system | `passThroughRequestParams` <br />type: required  | `passThroughResponseParams` <br/>type: required  |
| `requestAccess` | The loading of a request. | `accessedRequestIds` <br />docs: The requests that were accessed in this request. <br />type: required  <br /><br />`accessedRequestDescription` <br />docs: A description of the request access. <br />type: optional  |
| `requestApprove` | Approving a request, or part of a request. A request may require multiple approvals before it can be performed. | `approvedRequestIds` <br />docs: The requests that are being approved <br />type: required  <br /><br />`approveRequestUserId` <br />docs: The user that approved the request <br />type: optional  |
| `requestCancel` | Canceling the request so that it will no longer be performed, such as closing a pull request. | `canceledRequestIds` <br />docs: The requests that are being canceled <br />type: required  |
| `requestCreate` | The creation of a request. Requests represent an action that has not yet been taken and may require approval, such as a pull request, access request, or checkpoint. | `createdRequestAffectedResources` <br />docs: The resources that are directly affected by the request. For example, for an update request this would be the updated resource, and for a create request this could be the parent resource. <br />type: required  <br /><br />`createdRequestDescription` <br />docs: A description of the request creation. <br />type: optional  | `createdRequestIds` <br />docs: The requests that were created in this request <br />type: required  |
| `requestDisapprove` | Disapproving a request. | `disapprovedRequestIds` <br />docs: The requests that are being disapproved. <br />type: required  <br /><br />`disapproveRequestUserId` <br />docs: The user that disapproved the request. <br />type: optional  |
| `requestExecute` | Executing the action associated with a request, such as merging a pull request or applying an access request. | `executedRequestIds` <br />docs: The requests that are being executed. <br />type: required  | `executeRequestAffectedResources` <br />docs: The resources that were affected by this request. This may not include all the resources that were provided when creating the request. <br />type: optional  |
| `requestSearch` | Searching for requests. | `requestSearchQuery` <br />docs: The search-query that this event is running. <br />type: required  | `requestSearchResults` <br />docs: The search-results that are returned to the user in this event. <br />type:required  |
| `requestUpdate` | The update of an existing request. | `updatedRequestIds` <br />docs: The requests that were updated in this request <br />type: required  <br /><br />`updatedRequestDescription` <br />docs: A description of the request update. <br />type: optional  |
| `restartInfra` | Restarts some infrastructure like a node or a service. | `restartedResources` <br />docs: All SystemResources that were restarted in this event. <br />type: required  |
| `reviewInfraAction` | A user approves or denies an action within the infrastructure space, such as configuring a node, a service and more. | `reviewInfraActionRequestId` <br />docs: The request-id of this review. <br />type: required <br /><br />`reviewInfraActionUser` <br />docs: The user who reviewed this action. <br />type: required  | `reviewInfraActionWasApproved` <br />docs: Whether the review was approved. <br />type: required  |
| `secretCreate` | Create a secret string. | `createdSecretType` <br />docs: The kind of secrets that were created <br />type: required | `createdSecretIdentifiers` <br />docs: The identifiers of the secrets that were created. <br />type: required  |
| `secretDeprecate` | Mark a secret as deprecated. | `deprecatedSecretIdentifier` <br />docs: The identifier of the secret that was deprecated. <br />type: required  |
| `secretLoad` | Retrieve a secret from the backing store. | `loadedSecretIdentifiers` <br />docs: The identifiers of the secrets that were loaded. <br />type: required  |
| `secretUse` | Use a secret via a backend endpoint. | `usedSecretOperation` <br />docs: The operation used for the secret. <br />type: required <br /><br />`usedSecretIdentifiers` <br />docs: The identifiers of the secrets that were used. <br />type: required  |
| `systemManagement` | Modification of or access to metadata that determines the layout and configuration of applications on the environment. Replaced by `appConfigCreate/Access/Update/Delete/Search` in `audit.3`. |
| `tokenAccess` | Accessing a previously generated token. || `accessedTokens` <br />docs: A description of how these tokens were accessed, for auditor-context. <br />type: required  |
| `tokenGeneration` | Action that leads to generation of a new token. | `generateTokensDescription` <br />docs: A description of how these tokens were generated, for auditor-context. <br />type: optional  | `generatedTokens` <br />docs: All tokens that were generated <br />type: optional  |
| `tokenRevoke` | Action that leads to the deletion of tokens. | `revokeTokensDescription` <br />docs: A description of how these tokens were generated, for auditor-context. <br />type: optional  | `revokedTokens` <br />docs: All tokens that were revoked. <br />type: required  |
| `upgradeInfra` | Some infrastructure was upgraded, including downgrades. | `upgradedResources` <br />docs: All SystemResources that were upgraded in this event. <br />type: required  |
| `userJustify` | Event when a user specifies a purpose justification for taking an action. | `userJustifyId` <br />docs: The user justifying the action. <br />type: required  <br /><br />`userJustification` <br />docs: The user's justification for taking the action. Multiple justifications can be provided. <br />type: required  |
| `userLogin` | Login events of users. || `loginUserId` <br />type: optional  |
| `userLogout` | Logout events of users. | `logoutUserId` <br />type: optional  |