Skip to main content
Every audit log event has an event type that identifies what happened. Event types follow a dot-separated naming convention: <category>.<resource>.<action>. Below is the full list of event types, grouped by category. The Metadata column lists the keys that may appear in the metadata field for each event type. See Metadata key reference for descriptions.

Authentication

API

Event typeDescriptionMetadata
api.function.callBackend function invoked via API.function_name, status_code
api.code.editingCode editing action via API.file_path

Entity CRUD

Event typeDescriptionMetadata
app.entity.createdEntity record created.entity_name, entity_id
app.entity.updatedEntity record updated.entity_name, entity_id
app.entity.deletedEntity record deleted (soft delete).entity_name, entity_id
app.entity.bulk_createdMultiple entity records created.entity_name, method, count
app.entity.bulk_deletedMultiple entity records deleted.entity_name, method, count
app.entity.restoredSoft-deleted entity record restored.entity_name, entity_id
app.entity.permanently_deletedEntity record permanently deleted.entity_name, entity_id

Entity schema

Event typeDescriptionMetadata
app.schema.createdEntity schema created.entity_name, has_rls
app.schema.updatedEntity schema updated.entity_name, has_rls, rls_changed
app.schema.deletedEntity schema deleted.entity_name

Workspace members

Event typeDescriptionMetadata
workspace.member.role_updatedMember role changed.target_email, new_role, old_role
workspace.member.seat_updatedMember seat type changed.target_email, old_seat_type, new_seat_type
workspace.member.invitedMember invited.invitee_email, role
workspace.member.bulk_invitedMultiple members invited.invitation_count, invitee_emails
workspace.member.invite_acceptedInvitation accepted.
workspace.member.invite_declinedInvitation declined.invitation_email
workspace.member.removedMember removed.target_email

Workspace billing

Event typeDescriptionMetadata
workspace.invoice.readInvoice accessed.count
workspace.stripe.session_createdStripe billing portal session created.stripe_customer_id, domain

Workspace SSO

Event typeDescriptionMetadata
workspace.sso.enabledSSO enabled for workspace.
workspace.sso.disabledSSO disabled for workspace.
workspace.sso.settings_updatedSSO settings updated.sso_provider, updated_fields

Workspace settings

Event typeDescriptionMetadata
workspace.settings.updatedWorkspace settings updated.fields_changed
workspace.admin.createdWorkspace created by admin.workspace_name, subscription_tier, is_enterprise
workspace.admin.migrated_v2Workspace migrated to v2.target_tier, is_enterprise

Domains

Event typeDescriptionMetadata
domain.createdCustom domain created.domain, domain_id
domain.deletedCustom domain deleted.domain, domain_id
domain.linkedDomain linked to an app.domain, domain_id
domain.unlinkedDomain unlinked from an app.domain, domain_id
domain.verifiedDomain verified.domain, domain_id, verification_status
domain.disabledDomain disabled.domain, domain_id
domain.enabledDomain enabled.domain, domain_id
domain.email.enabledEmail domain enabled.domain, domain_id
domain.email.updatedEmail domain updated.domain, domain_id
domain.email.disabledEmail domain disabled.domain, domain_id

App lifecycle

Event typeDescriptionMetadata
app.createdApp created.app_name, app_type
app.deletedApp deleted.app_name
app.publishedApp published.checkpoint_id
app.unpublishedApp unpublished.

App users

Event typeDescriptionMetadata
app.user.registeredApp user registered.target_email, role, registration_method
app.user.deletedApp user deleted.target_user_id, target_email
app.user.updatedApp user updated.target_user_id, target_email
app.user.role_changedApp user role changed.target_email, old_role, new_role
app.auth.loginApp user login.auth_method
app.user.invitedApp user invited.invitee_email, role
app.access.requestedApp access requested.requester_email
app.access.approvedApp access approved.target_email
app.access.deniedApp access denied.target_email

Integrations

Event typeDescriptionMetadata
integration.custom.createdCustom integration created.integration_slug, integration_name, endpoint_count
integration.custom.updatedCustom integration updated.integration_slug, fields_changed
integration.custom.deletedCustom integration deleted.integration_slug, integration_name
integration.stripe.sandbox_claimedStripe sandbox claimed.sandbox_id
integration.stripe.live_configuredStripe live mode configured.
integration.stripe.removedStripe integration removed.
integration.wix_payments.connectedWix Payments connected.
integration.wix_payments.disconnectedWix Payments disconnected.
integration.oauth.connectedOAuth integration connected.integration_type
integration.oauth.disconnectedOAuth integration disconnected.integration_type

App runtime

Event typeDescriptionMetadata
app.entity.queryEntity data queried.filter_fields, sort, limit, skip, fields, entity_name
app.user.queryApp user data queried.filter_fields, sort, limit, skip, fields
app.integration.executedIntegration executed.function_name, credit_count, duration_ms
app.automation.executedAutomation executed.automation_id, automation_name, automation_type, duration_ms, credit_count
app.agent.conversationAI agent conversation.agent_name, conversation_id, message_count, credit_count
app.user.page_visitApp user page visit.page_name

Security

Event typeDescriptionMetadata
app.security.check_runSecurity check executed.rls_recommendations_count, hardcoded_secrets_count, backend_functions_issues_count

Metadata key reference

All metadata values are strings.

agent_name

Name of the AI agent.

app_name

Name of the app.

app_type

Type of the app.

auth_method

Authentication method (e.g. email_password, google).

auth_provider

OAuth provider name, if applicable.

automation_id

ID of the automation.

automation_name

Name of the automation.

automation_type

Type of automation (e.g. scheduled, triggered).

backend_functions_issues_count

Number of backend function issues found in security scan.

checkpoint_id

Deployment checkpoint ID.

conversation_id

ID of the AI agent conversation.

count

Number of affected records, invoices, or other items.

credit_count

Credits consumed by the operation.

domain

The domain name.

domain_id

The domain ID.

duration_ms

Execution time in milliseconds.

email_domain

Domain portion of the user’s email address.

email_hash

SHA-256 hash of the user’s email address.

endpoint_count

Number of endpoints on the custom integration.

entity_id

ID of the affected entity record.

entity_name

Name of the entity.

failure_reason

Reason for failure when status is "failure".

fields

Fields included in a query response.

fields_changed

Comma-separated list of fields that were changed.

file_path

Path of the file being edited.

filter_fields

Field names being filtered on in a query (e.g. data.status, data.user_id).

function_name

Name of the backend function or integration function.

hardcoded_secrets_count

Number of hardcoded secrets found in security scan.

has_rls

Whether row-level security is enabled on the entity schema.

integration_name

Name of the custom integration.

integration_slug

Slug identifier of the custom integration.

integration_type

Type of OAuth integration.

invitation_count

Number of invitations sent in a bulk invite.

invitation_email

Email associated with the invitation.

invitee_email

Email of the invited user.

invitee_emails

Comma-separated emails of invited users (bulk invite).

is_enterprise

Whether the workspace is on an enterprise plan.

is_new_user

Whether this is the user’s first login.

limit

Maximum number of records requested in a query.

mcp_oauth

Whether the login was initiated via an MCP OAuth flow.

message_count

Number of messages in an AI agent conversation.

method

Bulk operation method.

mfa_method

MFA method used (e.g. totp, sms).

new_role

New role after a role change.

new_seat_type

New seat type after a seat change.

oauth_error_type

Type of OAuth error on failure.

old_role

Previous role before a role change.

old_seat_type

Previous seat type before a seat change.

page_name

Name of the visited page.

registration_method

How the app user registered.

requester_email

Email of the user requesting access.

rls_changed

Whether row-level security settings changed.

rls_recommendations_count

Number of RLS recommendations from security scan.

role

Role assigned to a user.

sandbox_id

Stripe sandbox ID.

signup_stage

Signup progress indicator (e.g. otp_pending, otp_verified).

skip

Number of records skipped in a query.

sort

Sort parameters used in a query.

sso_provider

SSO provider name.

status_code

HTTP status code returned by a backend function call.

stripe_customer_id

Stripe customer ID.

subscription_tier

Subscription tier of the workspace.

target_email

Email of the user affected by the action.

target_tier

Target subscription tier for a migration.

target_user_id

ID of the app user affected by the action.

turnstile_result

Cloudflare Turnstile verification result.

updated_fields

SSO settings fields that were updated.

user_id

ID of the authenticated user.

verification_status

Domain verification result. Marketing visitor cookie identifier.

workspace_name

Name of the workspace.