Event Types

All audit log event types available for filtering

Every audit log event has an event type that identifies what happened. Event types follow a dot-separated naming convention: <category>.<resource>.<action>.

Below is the full list of event types, grouped by category. The Metadata column lists the keys that may appear in the metadata field for each event type. See Metadata key reference for descriptions.

Authentication

Event type	Description	Metadata
auth.login	A user attempted to sign in to the Base44 platform. Use status, error_code, and the authentication metadata to determine the outcome and sign-in method.	auth_method, auth_provider, email_domain, email_hash, failure_reason, is_new_user, mcp_oauth, mfa_method, oauth_error_type, sso_provider, turnstile_result, user_id, visitor_cookie
auth.signup	A user attempted to create a Base44 platform account. Use status, error_code, and the signup metadata to determine whether registration completed and which authentication flow was used.	auth_method, auth_provider, email_domain, email_hash, failure_reason, is_new_user, mcp_oauth, oauth_error_type, signup_stage, sso_provider, turnstile_result, user_id, visitor_cookie
auth.mfa.sent	An MFA challenge was issued as part of platform sign-in or workspace reauthentication. The metadata identifies the authentication flow that required the challenge.	auth_method, auth_provider, email_domain, email_hash, is_new_user, sso_provider, turnstile_result, user_id, visitor_cookie
auth.mfa	A user submitted an MFA challenge for verification. The event status indicates whether the challenge was accepted or rejected.	auth_method
auth.password_changed	A user set a new platform password, either through an authenticated password change or by completing a password-reset flow.

API

Event type	Description	Metadata
api.function.call	An app backend function completed an API invocation. The event status and returned status code show whether the function call succeeded.	function_name, status_code
api.code.editing	One or more app code files were changed through a code-editing API, including changes applied by an automated RLS remediation.	file_path

Entity CRUD

Event type	Description	Metadata
app.entity.created	A single record was created in one of the app’s entities. The metadata identifies the entity and new record.	entity_name, entity_id
app.entity.updated	A single existing record was modified in one of the app’s entities. The metadata identifies the entity and affected record.	entity_name, entity_id
app.entity.deleted	A single entity record was soft-deleted, so it is excluded from normal queries but remains available for restoration or permanent deletion.	entity_name, entity_id
app.entity.bulk_created	Multiple records were created in one entity through a bulk-create or import operation. The metadata identifies the operation and number of records created.	entity_name, method, count
app.entity.bulk_deleted	Multiple records in one entity were soft-deleted in a single bulk operation. The metadata identifies the entity and number of records affected.	entity_name, method, count
app.entity.restored	A previously soft-deleted entity record was restored and made available to normal queries again.	entity_name, entity_id
app.entity.permanently_deleted	A previously soft-deleted entity record was permanently removed and can no longer be restored.	entity_name, entity_id

Entity schema

Event type	Description	Metadata
app.schema.created	A new entity schema was added to an app. The metadata indicates whether the schema was created with row-level security rules.	entity_name, has_rls
app.schema.updated	An existing entity schema was changed, including changes made through code editing. The metadata indicates whether its row-level security configuration changed.	entity_name, has_rls, rls_changed
app.schema.deleted	An entity schema was removed from an app. The metadata identifies the deleted entity definition.	entity_name

Workspace members

Event type	Description	Metadata
workspace.member.role_updated	A workspace member’s assigned role was changed, either individually or as part of a bulk member update.	target_email, new_role, old_role
workspace.member.invited	A pending invitation was created for one person to join the workspace with the specified role.	invitee_email, role
workspace.member.bulk_invited	Invitations were successfully created for multiple people in one workspace operation. The metadata lists only the successful invitations.	invitation_count, invitee_emails
workspace.member.invite_accepted	An invited person accepted a pending workspace invitation and joined the workspace.
workspace.member.invite_declined	An invited person declined a pending workspace invitation.	invitation_email
workspace.member.removed	A member left or was removed from the workspace through the workspace UI, a bulk action, or SCIM provisioning.	target_email

Workspace billing

Event type	Description	Metadata
workspace.invoice.read	A workspace administrator retrieved the workspace’s invoice history. The metadata records how many invoices were returned.	count
workspace.stripe.session_created	A workspace administrator opened the billing flow and Base44 created a Stripe customer-portal session for the workspace.	stripe_customer_id, domain

Workspace SSO

Event type	Description	Metadata
workspace.sso.enabled	Single sign-on was enabled for the workspace, allowing applicable authentication flows to use the workspace’s SSO provider.
workspace.sso.disabled	Single sign-on was disabled for the workspace. Users can no longer authenticate through the workspace’s SSO configuration.
workspace.sso.settings_updated	One or more settings in the workspace’s existing SSO configuration were changed. The metadata identifies the provider and changed fields.	sso_provider, updated_fields

Workspace API keys

Event type	Description	Metadata
workspace.api_key.created	A workspace API key was created with a set of scopes and app-access restrictions. Only the non-secret key prefix is included in the audit event.	key_id, key_name, key_prefix
workspace.api_key.updated	A workspace API key’s name, description, scopes, or app-access restrictions were changed. The key secret itself is never included.	key_id, key_prefix, old_name, new_name, old_description, new_description
workspace.api_key.disabled	An active workspace API key was disabled. Requests using that key are rejected until it is enabled again.	key_id, key_name, key_prefix
workspace.api_key.enabled	A disabled workspace API key was re-enabled, allowing it to authenticate requests with its configured permissions.	key_id, key_name, key_prefix
workspace.api_key.deleted	A workspace API key was permanently deleted and can no longer authenticate requests. Only its identifying, non-secret details are retained in the event.	key_id, key_name, key_prefix

Workspace settings

Event type	Description	Metadata
workspace.settings.updated	One or more workspace-level settings changed, such as app visibility, app-transfer policy, SSO requirements, guest invitations, data region, or IP allowlisting.	fields_changed
workspace.admin.created	A Base44 administrator or support user created a workspace on behalf of its owner and assigned its initial subscription tier.	workspace_name, subscription_tier, is_enterprise
workspace.admin.migrated_v2	A Base44 administrator or support user migrated a legacy workspace to the newer workspace model and assigned its target subscription tier.	target_tier, is_enterprise

Domains

Event type	Description	Metadata
domain.created	A custom-domain resource was added to the workspace so the domain could be configured and linked to an app.	domain, domain_id
domain.deleted	A custom-domain resource was removed from the workspace. This deletes its Base44 configuration rather than merely unlinking it from an app.	domain, domain_id
domain.linked	An existing custom domain was associated with an app so it could serve that app after verification and configuration.	domain, domain_id
domain.unlinked	A custom domain was detached from its app without deleting the domain resource from the workspace.	domain, domain_id
domain.verified	Base44 completed a verification check for a custom domain. The metadata records the resulting verification state.	domain, domain_id, verification_status
domain.disabled	A Base44 administrator or support user disabled a custom domain without deleting or unlinking its configuration, so it no longer serves the linked app.	domain, domain_id
domain.enabled	A Base44 administrator or support user enabled a previously disabled custom domain for its linked app.	domain, domain_id
domain.email.enabled	A custom email-sending domain was enabled for an app after its sender configuration was saved.	domain, domain_id
domain.email.updated	The sender name, sender address, or other configuration for an enabled custom email domain was changed.	domain, domain_id
domain.email.disabled	A custom email-sending domain was disabled, causing the app to stop using it for outgoing email.	domain, domain_id

App lifecycle

Event type	Description	Metadata
app.created	A new app was created in the workspace. The metadata records the app’s name and type at creation time.	app_name, app_type
app.deleted	An app was deleted from the workspace. The event retains the app’s name and workspace context for later investigation.	app_name
app.published	An app deployment completed and the deployed version became the app’s active served version. When the deployment used a saved checkpoint, its ID appears in the metadata.	checkpoint_id
app.unpublished	A published app was taken offline while its app configuration and source remained in the workspace.

App users

Event type	Description	Metadata
app.user.registered	An app-user record was created, either through direct registration or because an existing platform user received access to the app.	target_email, role, registration_method
app.user.deleted	An app-user record was deleted, removing that person’s user profile and access within the app.	target_user_id, target_email
app.user.updated	An administrator changed fields on an existing app-user record. The metadata identifies the affected user without including the changed profile data.	target_user_id, target_email
app.user.role_changed	An existing app user’s application-level role changed. The metadata records both the previous and new roles.	target_email, old_role, new_role
app.auth.login	A user successfully authenticated to a published app. The metadata identifies the app authentication method, such as password or an identity provider.	auth_method
app.user.invited	A person was invited to an app with an application role and, when applicable, collaborator access for editing the app.	invitee_email, role
app.access.requested	A person verified their email and submitted a request to access a private app for administrator review.	requester_email
app.access.approved	An app administrator approved a pending access request, allowing the requester to register or creating their app-user record immediately.	target_email
app.access.denied	An app administrator denied and removed a pending access request.	target_email

Integrations

Event type	Description	Metadata
integration.custom.created	A custom API-key integration was created for an app with one or more selected endpoints.	integration_slug, integration_name, endpoint_count
integration.custom.updated	The name, authentication settings, or selected endpoints of an existing custom integration were changed.	integration_slug, fields_changed
integration.custom.deleted	A custom integration and its saved configuration were removed from the app.	integration_slug, integration_name
integration.stripe.sandbox_claimed	A Stripe test sandbox was claimed and associated with the app that completed the connection flow.	sandbox_id
integration.stripe.live_configured	The app completed its live-mode Stripe configuration, including flows that promote an existing sandbox connection to live mode.
integration.stripe.removed	The app’s Stripe payment integration and saved connection configuration were removed.
integration.wix_payments.connected	A Wix Payments account was successfully connected to the app for payment processing.
integration.wix_payments.disconnected	The app’s Wix Payments connection was removed, so the app can no longer process payments through that account.
integration.oauth.connected	An app established an OAuth connection to an external integration, either directly or by attaching a workspace-shared connection.	integration_type
integration.oauth.disconnected	An app removed its OAuth connection to an external integration.	integration_type

App runtime

Event type	Description	Metadata
app.entity.query	An app queried records from one of its entities. The public audit event exposes the fields used for filtering instead of the raw database query.	filter_fields, sort, limit, skip, fields, entity_name
app.user.query	An app queried its user records. The metadata records the query, projected fields, sorting, and pagination used for the read.	filter_fields, sort, limit, skip, fields
app.integration.executed	An app completed a call to a third-party integration. Use status, error_code, duration, and credit metadata to evaluate the execution.	function_name, credit_count, duration_ms
app.automation.executed	An automation or agent-triggered automation run completed. Use status and the execution metadata to determine its outcome and resource usage.	automation_id, automation_name, automation_type, duration_ms, credit_count
app.agent.conversation	An AI agent processed a conversation turn or run. The metadata identifies the agent and conversation and summarizes message and credit usage without storing message content.	agent_name, conversation_id, message_count, credit_count
app.user.page_visit	The app runtime recorded an app user’s visit to a page. The metadata identifies the page but does not include the page’s content.	page_name

Security

Event type	Description	Metadata
app.security.check_run	An app security scan completed. The event contains the scan identifier and finding counts only; it does not store vulnerability details in the audit log.	rls_recommendations_count, hardcoded_secrets_count, backend_functions_issues_count

---

Metadata key reference

All metadata values are strings.

agent_name

Name of the AI agent.

app_name

Name of the app.

app_type

Type of the app.

auth_method

Authentication method (e.g. email_password, google).

auth_provider

OAuth provider name, if applicable.

automation_id

ID of the automation.

automation_name

Name of the automation.

automation_type

Type of automation (e.g. scheduled, triggered).

backend_functions_issues_count

Number of backend function issues found in security scan.

checkpoint_id

Deployment checkpoint ID.

conversation_id

ID of the AI agent conversation.

count

Number of affected records, invoices, or other items.

credit_count

Credits consumed by the operation.

domain

The domain name.

domain_id

The domain ID.

duration_ms

Execution time in milliseconds.

email_domain

Domain portion of the user’s email address.

email_hash

SHA-256 hash of the user’s email address.

endpoint_count

Number of endpoints on the custom integration.

entity_id

ID of the affected entity record.

entity_name

Name of the entity.

failure_reason

Reason for failure when status is "failure".

fields

Fields included in a query response.

fields_changed

Comma-separated list of fields that were changed.

file_path

Path of the file being edited.

filter_fields

Field names being filtered on in a query (e.g. data.status, data.user_id).

function_name

Name of the backend function or integration function.

hardcoded_secrets_count

Number of hardcoded secrets found in security scan.

has_rls

Whether row-level security is enabled on the entity schema.

integration_name

Name of the custom integration.

integration_slug

Slug identifier of the custom integration.

integration_type

Type of OAuth integration.

invitation_count

Number of invitations sent in a bulk invite.

invitation_email

Email associated with the invitation.

invitee_email

Email of the invited user.

invitee_emails

Comma-separated emails of invited users (bulk invite).

is_enterprise

Whether the workspace is on an enterprise plan.

is_new_user

Whether this is the user’s first login.

key_id

ID of the workspace API key.

key_name

Name of the workspace API key.

key_prefix

Non-secret prefix of the API key, used to identify it without exposing the secret.

limit

Maximum number of records requested in a query.

mcp_oauth

Whether the login was initiated via an MCP OAuth flow.

message_count

Number of messages in an AI agent conversation.

method

Bulk operation method.

mfa_method

MFA method used (e.g. totp, sms).

new_description

New description after an update.

new_name

New name after a rename.

new_role

New role after a role change.

oauth_error_type

Type of OAuth error on failure.

old_description

Previous description before an update.

old_name

Previous name before a rename.

old_role

Previous role before a role change.

page_name

Name of the visited page.

registration_method

How the app user registered.

requester_email

Email of the user requesting access.

rls_changed

Whether row-level security settings changed.

rls_recommendations_count

Number of RLS recommendations from security scan.

role

Role assigned to a user.

sandbox_id

Stripe sandbox ID.

signup_stage

Signup progress indicator (e.g. otp_pending, otp_verified).

skip

Number of records skipped in a query.

sort

Sort parameters used in a query.

sso_provider

SSO provider name.

status_code

HTTP status code returned by a backend function call.

stripe_customer_id

Stripe customer ID.

subscription_tier

Subscription tier of the workspace.

target_email

Email of the user affected by the action.

target_tier

Target subscription tier for a migration.

target_user_id

ID of the app user affected by the action.

turnstile_result

Cloudflare Turnstile verification result.

updated_fields

SSO settings fields that were updated.

user_id

ID of the authenticated user.

verification_status

Domain verification result.

visitor_cookie

Marketing visitor cookie identifier.

workspace_name

Name of the workspace.