Event Types - Base44 Support Documentation

Every audit log event has an event type that identifies what happened. Event types follow a dot-separated naming convention: <category>.<resource>.<action>. Below is the full list of event types, grouped by category. The Metadata column lists the keys that may appear in the metadata field for each event type. See Metadata key reference for descriptions.

Authentication

Event type	Description	Metadata
`auth.login`	A user attempted to sign in to the Base44 platform. Use `status`, `error_code`, and the authentication metadata to determine the outcome and sign-in method.	`auth_method`, `auth_provider`, `email_domain`, `email_hash`, `failure_reason`, `is_new_user`, `mcp_oauth`, `mfa_method`, `oauth_error_type`, `sso_provider`, `turnstile_result`, `user_id`, `visitor_cookie`
`auth.signup`	A user attempted to create a Base44 platform account. Use `status`, `error_code`, and the signup metadata to determine whether registration completed and which authentication flow was used.	`auth_method`, `auth_provider`, `email_domain`, `email_hash`, `failure_reason`, `is_new_user`, `mcp_oauth`, `oauth_error_type`, `signup_stage`, `sso_provider`, `turnstile_result`, `user_id`, `visitor_cookie`
`auth.mfa.sent`	An MFA challenge was issued as part of platform sign-in or workspace reauthentication. The metadata identifies the authentication flow that required the challenge.	`auth_method`, `auth_provider`, `email_domain`, `email_hash`, `is_new_user`, `sso_provider`, `turnstile_result`, `user_id`, `visitor_cookie`
`auth.mfa`	A user submitted an MFA challenge for verification. The event `status` indicates whether the challenge was accepted or rejected.	`auth_method`
`auth.password_changed`	A user set a new platform password, either through an authenticated password change or by completing a password-reset flow.

API

Event type	Description	Metadata
`api.function.call`	An app backend function completed an API invocation. The event `status` and returned status code show whether the function call succeeded.	`function_name`, `status_code`
`api.code.editing`	One or more app code files were changed through a code-editing API, including changes applied by an automated RLS remediation.	`file_path`

Entity CRUD

Event type	Description	Metadata
`app.entity.created`	A single record was created in one of the app’s entities. The metadata identifies the entity and new record.	`entity_name`, `entity_id`
`app.entity.updated`	A single existing record was modified in one of the app’s entities. The metadata identifies the entity and affected record.	`entity_name`, `entity_id`
`app.entity.deleted`	A single entity record was soft-deleted, so it is excluded from normal queries but remains available for restoration or permanent deletion.	`entity_name`, `entity_id`
`app.entity.bulk_created`	Multiple records were created in one entity through a bulk-create or import operation. The metadata identifies the operation and number of records created.	`entity_name`, `method`, `count`
`app.entity.bulk_deleted`	Multiple records in one entity were soft-deleted in a single bulk operation. The metadata identifies the entity and number of records affected.	`entity_name`, `method`, `count`
`app.entity.restored`	A previously soft-deleted entity record was restored and made available to normal queries again.	`entity_name`, `entity_id`
`app.entity.permanently_deleted`	A previously soft-deleted entity record was permanently removed and can no longer be restored.	`entity_name`, `entity_id`

Entity schema

Event type	Description	Metadata
`app.schema.created`	A new entity schema was added to an app. The metadata indicates whether the schema was created with row-level security rules.	`entity_name`, `has_rls`
`app.schema.updated`	An existing entity schema was changed, including changes made through code editing. The metadata indicates whether its row-level security configuration changed.	`entity_name`, `has_rls`, `rls_changed`
`app.schema.deleted`	An entity schema was removed from an app. The metadata identifies the deleted entity definition.	`entity_name`

Workspace members

Event type	Description	Metadata
`workspace.member.role_updated`	A workspace member’s assigned role was changed, either individually or as part of a bulk member update.	`target_email`, `new_role`, `old_role`
`workspace.member.invited`	A pending invitation was created for one person to join the workspace with the specified role.	`invitee_email`, `role`
`workspace.member.bulk_invited`	Invitations were successfully created for multiple people in one workspace operation. The metadata lists only the successful invitations.	`invitation_count`, `invitee_emails`
`workspace.member.invite_accepted`	An invited person accepted a pending workspace invitation and joined the workspace.
`workspace.member.invite_declined`	An invited person declined a pending workspace invitation.	`invitation_email`
`workspace.member.removed`	A member left or was removed from the workspace through the workspace UI, a bulk action, or SCIM provisioning.	`target_email`

Workspace billing

Event type	Description	Metadata
`workspace.invoice.read`	A workspace administrator retrieved the workspace’s invoice history. The metadata records how many invoices were returned.	`count`
`workspace.stripe.session_created`	A workspace administrator opened the billing flow and Base44 created a Stripe customer-portal session for the workspace.	`stripe_customer_id`, `domain`

Workspace SSO

Event type	Description	Metadata
`workspace.sso.enabled`	Single sign-on was enabled for the workspace, allowing applicable authentication flows to use the workspace’s SSO provider.
`workspace.sso.disabled`	Single sign-on was disabled for the workspace. Users can no longer authenticate through the workspace’s SSO configuration.
`workspace.sso.settings_updated`	One or more settings in the workspace’s existing SSO configuration were changed. The metadata identifies the provider and changed fields.	`sso_provider`, `updated_fields`

Workspace API keys

Event type	Description	Metadata
`workspace.api_key.created`	A workspace API key was created with a set of scopes and app-access restrictions. Only the non-secret key prefix is included in the audit event.	`key_id`, `key_name`, `key_prefix`
`workspace.api_key.updated`	A workspace API key’s name, description, scopes, or app-access restrictions were changed. The key secret itself is never included.	`key_id`, `key_prefix`, `old_name`, `new_name`, `old_description`, `new_description`
`workspace.api_key.disabled`	An active workspace API key was disabled. Requests using that key are rejected until it is enabled again.	`key_id`, `key_name`, `key_prefix`
`workspace.api_key.enabled`	A disabled workspace API key was re-enabled, allowing it to authenticate requests with its configured permissions.	`key_id`, `key_name`, `key_prefix`
`workspace.api_key.deleted`	A workspace API key was permanently deleted and can no longer authenticate requests. Only its identifying, non-secret details are retained in the event.	`key_id`, `key_name`, `key_prefix`

Workspace settings

Event type	Description	Metadata
`workspace.settings.updated`	One or more workspace-level settings changed, such as app visibility, app-transfer policy, SSO requirements, guest invitations, data region, or IP allowlisting.	`fields_changed`
`workspace.admin.created`	A Base44 administrator or support user created a workspace on behalf of its owner and assigned its initial subscription tier.	`workspace_name`, `subscription_tier`, `is_enterprise`
`workspace.admin.migrated_v2`	A Base44 administrator or support user migrated a legacy workspace to the newer workspace model and assigned its target subscription tier.	`target_tier`, `is_enterprise`

Workspace and agent skills

Event type	Description	Metadata
`workspace.skill.created`	A persisted workspace or agent skill was created successfully. The event is emitted after the skill is saved, whether it was added through the workspace or App Agents UI, a direct API for those skill models, an approved Builder installation, an initial personal-agent `skills` payload, or an agent copy operation.	`scope_type`, `skill_id`, `skill_name`
`workspace.skill.updated`	A persisted workspace or agent skill was updated successfully.	`scope_type`, `skill_id`, `skill_name`
`workspace.skill.deleted`	A persisted workspace or agent skill was deleted successfully.	`scope_type`, `skill_id`, `skill_name`

For agent-owned skills, the event’s top-level app_id identifies the owning app or agent. scope_type is the persisted skill’s bounded classification; there is no separate creation-source field. Skill descriptions, instructions, prompts, source files, credentials, secrets, tokens, connection data, and arbitrary stored objects are intentionally excluded from audit metadata. Conversation-only skill activation and attaching an existing skill to an agent are configuration actions, not creation. Filesystem skills stored only under .agents/skills/ are a separate runtime-file model with no persisted skill record and are not represented by these events.

Domains

Event type	Description	Metadata
`domain.created`	A custom-domain resource was added to the workspace so the domain could be configured and linked to an app.	`domain`, `domain_id`
`domain.deleted`	A custom-domain resource was removed from the workspace. This deletes its Base44 configuration rather than merely unlinking it from an app.	`domain`, `domain_id`
`domain.linked`	An existing custom domain was associated with an app so it could serve that app after verification and configuration.	`domain`, `domain_id`
`domain.unlinked`	A custom domain was detached from its app without deleting the domain resource from the workspace.	`domain`, `domain_id`
`domain.verified`	Base44 completed a verification check for a custom domain. The metadata records the resulting verification state.	`domain`, `domain_id`, `verification_status`
`domain.disabled`	A Base44 administrator or support user disabled a custom domain without deleting or unlinking its configuration, so it no longer serves the linked app.	`domain`, `domain_id`
`domain.enabled`	A Base44 administrator or support user enabled a previously disabled custom domain for its linked app.	`domain`, `domain_id`
`domain.email.enabled`	A custom email-sending domain was enabled for an app after its sender configuration was saved.	`domain`, `domain_id`
`domain.email.updated`	The sender name, sender address, or other configuration for an enabled custom email domain was changed.	`domain`, `domain_id`
`domain.email.disabled`	A custom email-sending domain was disabled, causing the app to stop using it for outgoing email.	`domain`, `domain_id`

App lifecycle

Event type	Description	Metadata
`app.created`	A new app was created in the workspace. The metadata records the app’s name and type at creation time.	`app_name`, `app_type`
`app.deleted`	An app was deleted from the workspace. The event retains the app’s name and workspace context for later investigation.	`app_name`
`app.published`	An app deployment completed and the deployed version became the app’s active served version. When the deployment used a saved checkpoint, its ID appears in the metadata.	`checkpoint_id`
`app.unpublished`	A published app was taken offline while its app configuration and source remained in the workspace.

App users

Event type	Description	Metadata
`app.user.registered`	An app-user record was created, either through direct registration or because an existing platform user received access to the app.	`target_email`, `role`, `registration_method`
`app.user.deleted`	An app-user record was deleted, removing that person’s user profile and access within the app.	`target_user_id`, `target_email`
`app.user.updated`	An administrator changed fields on an existing app-user record. The metadata identifies the affected user without including the changed profile data.	`target_user_id`, `target_email`
`app.user.role_changed`	An existing app user’s application-level role changed. The metadata records both the previous and new roles.	`target_email`, `old_role`, `new_role`
`app.auth.login`	A user successfully authenticated to a published app. The metadata identifies the app authentication method, such as password or an identity provider.	`auth_method`
`app.user.invited`	A person was invited to an app with an application role and, when applicable, collaborator access for editing the app.	`invitee_email`, `role`
`app.access.requested`	A person verified their email and submitted a request to access a private app for administrator review.	`requester_email`
`app.access.approved`	An app administrator approved a pending access request, allowing the requester to register or creating their app-user record immediately.	`target_email`
`app.access.denied`	An app administrator denied and removed a pending access request.	`target_email`

Integrations

Event type	Description	Metadata
`integration.custom.created`	A custom API-key integration was created for an app with one or more selected endpoints.	`integration_slug`, `integration_name`, `endpoint_count`
`integration.custom.updated`	The name, authentication settings, or selected endpoints of an existing custom integration were changed.	`integration_slug`, `fields_changed`
`integration.custom.deleted`	A custom integration and its saved configuration were removed from the app.	`integration_slug`, `integration_name`
`integration.stripe.sandbox_claimed`	A Stripe test sandbox was claimed and associated with the app that completed the connection flow.	`sandbox_id`
`integration.stripe.live_configured`	The app completed its live-mode Stripe configuration, including flows that promote an existing sandbox connection to live mode.
`integration.stripe.removed`	The app’s Stripe payment integration and saved connection configuration were removed.
`integration.wix_payments.connected`	A Wix Payments account was successfully connected to the app for payment processing.
`integration.wix_payments.disconnected`	The app’s Wix Payments connection was removed, so the app can no longer process payments through that account.
`integration.oauth.connected`	An app established an OAuth connection to an external integration, either directly or by attaching a workspace-shared connection.	`integration_type`
`integration.oauth.disconnected`	An app removed its OAuth connection to an external integration.	`integration_type`

App runtime

Event type	Description	Metadata
`app.entity.query`	An app queried records from one of its entities. The public audit event exposes the fields used for filtering instead of the raw database query.	`filter_fields`, `sort`, `limit`, `skip`, `fields`, `entity_name`
`app.user.query`	An app queried its user records. The metadata records the query, projected fields, sorting, and pagination used for the read.	`filter_fields`, `sort`, `limit`, `skip`, `fields`
`app.integration.executed`	An app completed a call to a third-party integration. Use `status`, `error_code`, duration, and credit metadata to evaluate the execution.	`function_name`, `credit_count`, `duration_ms`
`app.automation.executed`	An automation or agent-triggered automation run completed. Use `status` and the execution metadata to determine its outcome and resource usage.	`automation_id`, `automation_name`, `automation_type`, `duration_ms`, `credit_count`
`app.agent.conversation`	An AI agent processed a conversation turn or run. The metadata identifies the agent and conversation and summarizes message and credit usage without storing message content.	`agent_name`, `conversation_id`, `message_count`, `credit_count`
`app.user.page_visit`	The app runtime recorded an app user’s visit to a page. The metadata identifies the page but does not include the page’s content.	`page_name`

Security

Event type	Description	Metadata
`app.security.check_run`	An app security scan completed. The event stores a summary and a `run_id`, when available. Detailed findings are retrieved separately and are never stored in the audit event.	`run_id`, `findings_total`, `coverage_incomplete`, `highest_scored_severity`, `critical_findings_count`, `high_findings_count`, `medium_findings_count`, `low_findings_count`, `unscored_findings_count`, `rls_recommendations_count`, `hardcoded_secrets_count`, `backend_functions_issues_count`, `dependency_vulnerabilities_count`, `static_code_findings_count`

To retrieve and interpret the detailed findings for a run, see Security scan findings.

Metadata key reference

All metadata values are strings.

`run_id`

Identifier used to fetch the ownership-scoped scan run. This key can be absent.

`findings_total`

Number of findings from scan sections that completed. When coverage_incomplete is present, this value is a floor rather than an authoritative total.

`coverage_incomplete`

The string "true" when any scan section is failed, not_run, unknown, or has missing historical coverage. This key is absent when all five sections completed and is never emitted as "false".

`highest_scored_severity`

Highest recognized severity among dependency and static-code findings only. Possible values are critical, high, medium, low, and none.

`critical_findings_count`

Number of dependency and static-code findings with critical severity.

`high_findings_count`

Number of dependency and static-code findings with high severity.

`medium_findings_count`

Number of dependency and static-code findings with medium severity.

`low_findings_count`

Number of dependency and static-code findings with low severity.

`unscored_findings_count`

Number of RLS recommendations, hardcoded-secret findings, backend-function issues, and dependency or static-code findings without a recognized severity.

`rls_recommendations_count`

Number of RLS recommendations.

`hardcoded_secrets_count`

Number of hardcoded-secret findings.

`backend_functions_issues_count`

Number of backend-function authorization issues.

`dependency_vulnerabilities_count`

Number of dependency vulnerabilities.

`static_code_findings_count`

Number of static-code findings. This key can be absent when the static scanner did not run, and absence does not mean zero.

`agent_name`

Name of the AI agent.

`app_name`

Name of the app.

`app_type`

Type of the app.

`auth_method`

Authentication method (e.g. email_password, google).

`auth_provider`

OAuth provider name, if applicable.

`automation_id`

ID of the automation.

`automation_name`

Name of the automation.

`automation_type`

Type of automation (e.g. scheduled, triggered).

`checkpoint_id`

Deployment checkpoint ID.

`conversation_id`

ID of the AI agent conversation.

`count`

Number of affected records, invoices, or other items.

`credit_count`

Credits consumed by the operation.

`domain`

The domain name.

`domain_id`

The domain ID.

`duration_ms`

Execution time in milliseconds.

`email_domain`

Domain portion of the user’s email address.

`email_hash`

SHA-256 hash of the user’s email address.

`endpoint_count`

Number of endpoints on the custom integration.

`entity_id`

ID of the affected entity record.

`entity_name`

Name of the entity.

`failure_reason`

Reason for failure when status is "failure".

`fields`

Fields included in a query response.

`fields_changed`

Comma-separated list of fields that were changed.

`file_path`

Path of the file being edited.

`filter_fields`

Field names being filtered on in a query (e.g. data.status, data.user_id).

`function_name`

Name of the backend function or integration function.

`has_rls`

Whether row-level security is enabled on the entity schema.

`integration_name`

Name of the custom integration.

`integration_slug`

Slug identifier of the custom integration.

`integration_type`

Type of OAuth integration.

`invitation_count`

Number of invitations sent in a bulk invite.

`invitation_email`

Email associated with the invitation.

`invitee_email`

Email of the invited user.

`invitee_emails`

Comma-separated emails of invited users (bulk invite).

`is_enterprise`

Whether the workspace is on an enterprise plan.

`is_new_user`

Whether this is the user’s first login.

`key_id`

ID of the workspace API key.

`key_name`

Name of the workspace API key.

`key_prefix`

Non-secret prefix of the API key, used to identify it without exposing the secret.

`limit`

Maximum number of records requested in a query.

`mcp_oauth`

Whether the login was initiated via an MCP OAuth flow.

`message_count`

Number of messages in an AI agent conversation.

`method`

Bulk operation method.

`mfa_method`

MFA method used (e.g. totp, sms).

`new_description`

New description after an update.

`new_name`

New name after a rename.

`new_role`

New role after a role change.

`oauth_error_type`

Type of OAuth error on failure.

`old_description`

Previous description before an update.

`old_name`

Previous name before a rename.

`old_role`

Previous role before a role change.

`page_name`

Name of the visited page.

`registration_method`

How the app user registered.

`requester_email`

Email of the user requesting access.

`rls_changed`

Whether row-level security settings changed.

`role`

Role assigned to a user.

`sandbox_id`

Stripe sandbox ID.

`scope_type`

Stable skill scope. organization identifies a workspace skill, superagent identifies an agent-owned skill record, and, on create events, app identifies a custom skill embedded in an app’s agent configuration.

`signup_stage`

Signup progress indicator (e.g. otp_pending, otp_verified).

`skill_id`

Stable ID of the persisted skill record. This field is omitted from create events for app skills because that model is keyed by name and has no separate ID.

`skill_name`

Name of the skill when the event was emitted.

`skip`

Number of records skipped in a query.

`sort`

Sort parameters used in a query.

`sso_provider`

SSO provider name.

`status_code`

HTTP status code returned by a backend function call.

`stripe_customer_id`

Stripe customer ID.

`subscription_tier`

Subscription tier of the workspace.

`target_email`

Email of the user affected by the action.

`target_tier`

Target subscription tier for a migration.

`target_user_id`

ID of the app user affected by the action.

`turnstile_result`

Cloudflare Turnstile verification result.

`updated_fields`

SSO settings fields that were updated.

`user_id`

ID of the authenticated user.

`verification_status`

Domain verification result.

`visitor_cookie`

Marketing visitor cookie identifier.

`workspace_name`

Name of the workspace.

​Authentication

​API

​Entity CRUD

​Entity schema

​Workspace members

​Workspace billing

​Workspace SSO

​Workspace API keys

​Workspace settings

​Workspace and agent skills

​Domains

​App lifecycle

​App users

​Integrations

​App runtime

​Security

​Metadata key reference

​run_id

​findings_total

​coverage_incomplete

​highest_scored_severity

​critical_findings_count

​high_findings_count

​medium_findings_count

​low_findings_count

​unscored_findings_count

​rls_recommendations_count

​hardcoded_secrets_count

​backend_functions_issues_count

​dependency_vulnerabilities_count

​static_code_findings_count

​agent_name

​app_name

​app_type

​auth_method

​auth_provider

​automation_id

​automation_name

​automation_type

​checkpoint_id

​conversation_id

​count

​credit_count

​domain

​domain_id

​duration_ms

​email_domain

​email_hash

​endpoint_count

​entity_id

​entity_name

​failure_reason

​fields

​fields_changed

​file_path

​filter_fields

​function_name

​has_rls

​integration_name

​integration_slug

​integration_type

​invitation_count

​invitation_email

​invitee_email

​invitee_emails

​is_enterprise

​is_new_user

​key_id

​key_name

​key_prefix

​limit

​mcp_oauth

​message_count

​method

​mfa_method

​new_description

​new_name

​new_role

​oauth_error_type

​old_description