Event Types

All audit log event types available for filtering

Every audit log event has an event type that identifies what happened. Event types follow a dot-separated naming convention: <category>.<resource>.<action>.

Below is the full list of event types, grouped by category. The Metadata column lists the keys that may appear in the metadata field for each event type. See Metadata key reference for descriptions.

Authentication

Event type	Description	Metadata
auth.login	A user attempted to sign in to the Base44 platform. Use status, error_code, and the authentication metadata to determine the outcome and sign-in method.	auth_method, auth_provider, email_domain, email_hash, failure_reason, is_new_user, mcp_oauth, mfa_method, oauth_error_type, sso_provider, turnstile_result, user_id, visitor_cookie
auth.signup	A user attempted to create a Base44 platform account. Use status, error_code, and the signup metadata to determine whether registration completed and which authentication flow was used.	auth_method, auth_provider, email_domain, email_hash, failure_reason, is_new_user, mcp_oauth, oauth_error_type, signup_stage, sso_provider, turnstile_result, user_id, visitor_cookie
auth.mfa.sent	An MFA challenge was issued as part of platform sign-in or workspace reauthentication. The metadata identifies the authentication flow that required the challenge.	auth_method, auth_provider, email_domain, email_hash, is_new_user, sso_provider, turnstile_result, user_id, visitor_cookie
auth.mfa	A user submitted an MFA challenge for verification. The event status indicates whether the challenge was accepted or rejected.	auth_method
auth.password_changed	A user set a new platform password, either through an authenticated password change or by completing a password-reset flow.
auth.mfa.enabled	A platform MFA was enabled.	method
auth.password_reset_requested	A platform password reset was requested.	auth_method, auth_provider, email_cleartext, email_domain, email_hash, failure_reason, is_new_user, turnstile_result, turnstile_validation, user_id, visitor_cookie
auth.oidc.authorization_granted	A platform OIDC authorization was granted.	client_id, scope
auth.account.locked	A platform account was locked.	actor_email, actor_user_id, disabled_reason, reason, request_id, target_email, target_user_id
auth.sessions.invalidated	Support invalidated a platform user’s sessions (app-user tokens are a separate event).	operator_email, operator_role, target_email, target_user_id
auth.account.unlocked	A platform account was unlocked.	actor_email, actor_user_id, previous_disabled_reason, reason, request_id, target_email, target_user_id
auth.mfa.disabled_by_admin	A platform MFA was disabled by an admin.	actor_email, actor_user_id, previous_methods, target_email, target_user_id, was_enabled
auth.platform_role.changed	A user’s platform_role was changed via the admin update-user endpoint (platform_owner only).	actor_email, actor_user_id, new_role, old_role, reason, source, target_email, target_user_id
auth.backoffice_role_grants.changed	A platform owner changed an editable backoffice role’s overrides (permissions added on top of its code row or removed from it).	actor_email, actor_user_id, added, previous_added, previous_removed, removed, revision, role
auth.backoffice_permission.kept_admin_only	A platform owner reviewed a new shareable permission and kept it admin-only.	actor_email, actor_user_id, permission
auth.account_api_key.used	Records account-key access once per targeted workspace: these keys act across memberships and bypass SSO. A single representative event would hide the other targets.	account_key_decision, method, path
auth.account_api_key.late_verdict	A block verdict reached after authentication, when a handler resolves a target the request never named (an app transfer’s stored destination). The usage row for that request was already written, truthfully, as allowed, at authentication nothing named the workspace now answering.	account_key_decision
auth.personal_access_token.refused	Recorded only when a real, identified token is refused (revoked owner/grant, wrong workspace, etc.); malformed/unknown tokens aren’t audited, and this is separate from the per-use volume event.	key_prefix, permission, token_name, violations
auth.personal_access_token.used	A platform personal access token was used.	key_prefix, method, path, token_name
auth.api_key.rotated	A platform API key was rotated.	endpoint, key_type, target_user_id
auth.api_key.viewed	A platform API key was viewed.	endpoint

API

Event type	Description	Metadata
api.function.call	An app backend function completed an API invocation. The event status and returned status code show whether the function call succeeded.	function_name, status_code
api.code.editing	One or more app code files were changed through a code-editing API, including changes applied by an automated RLS remediation.	file_path
api.fullstack_route.tested	An API fullstack route was tested.	method, path, status_code

Entity CRUD

Event type	Description	Metadata
app.entity.created	A single record was created in one of the app’s entities. The metadata identifies the entity and new record.	entity_name, entity_id
app.entity.updated	A single existing record was modified in one of the app’s entities. The metadata identifies the entity and affected record.	entity_name, entity_id
app.entity.deleted	A single entity record was soft-deleted, so it is excluded from normal queries but remains available for restoration or permanent deletion.	entity_name, entity_id
app.entity.bulk_created	Multiple records were created in one entity through a bulk-create or import operation. The metadata identifies the operation and number of records created.	entity_name, method, count
app.entity.bulk_deleted	Multiple records in one entity were soft-deleted in a single bulk operation. The metadata identifies the entity and number of records affected.	entity_name, method, count
app.entity.restored	A previously soft-deleted entity record was restored and made available to normal queries again.	entity_name, entity_id
app.entity.permanently_deleted	A previously soft-deleted entity record was permanently removed and can no longer be restored.	entity_name, entity_id
app.entity.update_many	Records in an app entity were updated by a filter.	count, entity_name, method
app.entity.bulk_updated	Records in an app entity were updated in bulk.	count, entity_name, method
app.entity.upsert	An app entity record was inserted or updated.	count, created, entity_name, method, updated

Entity schema

Event type	Description	Metadata
app.schema.created	A new entity schema was added to an app. The metadata indicates whether the schema was created with row-level security rules.	entity_name, has_rls
app.schema.updated	An existing entity schema was changed, including changes made through code editing. The metadata indicates whether its row-level security configuration changed.	entity_name, has_rls, rls_changed
app.schema.deleted	An entity schema was removed from an app. The metadata identifies the deleted entity definition.	entity_name

Workspace members

Event type	Description	Metadata
workspace.member.role_updated	A workspace member’s assigned role was changed, either individually or as part of a bulk member update.	target_email, new_role, old_role
workspace.member.invited	A pending invitation was created for one person to join the workspace with the specified role.	invitee_email, role
workspace.member.bulk_invited	Invitations were successfully created for multiple people in one workspace operation. The metadata lists only the successful invitations.	invitation_count, invitee_emails
workspace.member.invite_accepted	An invited person accepted a pending workspace invitation and joined the workspace.
workspace.member.invite_declined	An invited person declined a pending workspace invitation.	invitation_email
workspace.member.removed	A member left or was removed from the workspace through the workspace UI, a bulk action, or SCIM provisioning.	target_email
workspace.member.invite_resent	A workspace member invitation was resent.	invitee_email
workspace.member.bulk_invite_resent	Workspace member invitations were resent in bulk.	invitation_count, invitee_emails
workspace.member.credit_limit_updated	A workspace member credit limit was updated.	credit_limit, target_email
workspace.default_credit_limit_updated	A workspace default credit limit was updated.	default_credit_limit
workspace.member.partner_program_granted	A workspace member partner program access was granted.	target_email
workspace.member.partner_program_revoked	A workspace member partner program access was revoked.	reason, retired_partner_profile, target_email
workspace.member.role_recalculated	Effective-role recompute triggered by a group edit (per-member detail for small recomputes; aggregate counts for large ones).	affected_count, detail, group_ids, new_role, role_source, target_email, trigger
workspace.member.removal.group_cascade	A workspace member removal group membership was removed in cascade.	custom_groups_removed, idp_groups_held, member_email

Workspace billing

Event type	Description	Metadata
workspace.invoice.read	A workspace administrator retrieved the workspace’s invoice history. The metadata records how many invoices were returned.	count
workspace.stripe.session_created	A workspace administrator opened the billing flow and Base44 created a Stripe customer-portal session for the workspace.	stripe_customer_id, domain

Workspace SSO

Event type	Description	Metadata
workspace.sso.enabled	Single sign-on was enabled for the workspace, allowing applicable authentication flows to use the workspace’s SSO provider.
workspace.sso.disabled	Single sign-on was disabled for the workspace. Users can no longer authenticate through the workspace’s SSO configuration.
workspace.sso.settings_updated	One or more settings in the workspace’s existing SSO configuration were changed. The metadata identifies the provider and changed fields.	sso_provider, updated_fields
workspace.sso.verified_domain.added	A workspace SSO verified domain was added.	domain
workspace.sso.verified_domain.removed	A workspace SSO verified domain was removed.	domain
workspace.sso.verified_domain.pending_cancelled	A workspace SSO verified domain pending verification was cancelled.	domain
workspace.sso.jit_default_role.changed	A workspace SSO JIT default role was changed.	new_value, previous_value
workspace.sso.jit.provisioned_user	A workspace SSO JIT user was provisioned.	assigned_role, user_email
workspace.sso.enforcement.enabled	A workspace SSO enforcement was enabled.	change_type, effective, new_value, previous_value, reason
workspace.sso.enforcement.disabled	A workspace SSO enforcement was disabled.	change_type, effective, effective_enforcement, enforce_sso_intent, new_value, previous_value, reason
workspace.sso.guest_exemption.changed	A workspace SSO guest exemption was changed.	new_value, previous_value
workspace.sso.challenge.success	A workspace SSO challenge succeeded.	auth_method
workspace.sso.challenge.failure	A workspace SSO challenge failed.	auth_method, reason
workspace.sso.cross_tenant.blocked	A workspace SSO cross tenant was blocked.	email, reason
workspace.sso.auto_provision.default_changed	A workspace SSO auto provision default was changed.	new_value, old_value
workspace.sso.no_access.denied	A workspace SSO no access was denied.	email, reason

Workspace API keys

Event type	Description	Metadata
workspace.api_key.created	A workspace API key was created with a set of scopes and app-access restrictions. Only the non-secret key prefix is included in the audit event.	key_id, key_name, key_prefix
workspace.api_key.updated	A workspace API key’s name, description, scopes, or app-access restrictions were changed. The key secret itself is never included.	key_id, key_prefix, old_name, new_name, old_description, new_description
workspace.api_key.disabled	An active workspace API key was disabled. Requests using that key are rejected until it is enabled again.	key_id, key_name, key_prefix
workspace.api_key.enabled	A disabled workspace API key was re-enabled, allowing it to authenticate requests with its configured permissions.	key_id, key_name, key_prefix
workspace.api_key.deleted	A workspace API key was permanently deleted and can no longer authenticate requests. Only its identifying, non-secret details are retained in the event.	key_id, key_name, key_prefix

Workspace settings

Event type	Description	Metadata
workspace.settings.updated	One or more workspace-level settings changed, such as app visibility, app-transfer policy, SSO requirements, guest invitations, data region, or IP allowlisting.	fields_changed
workspace.admin.created	A Base44 administrator or support user created a workspace on behalf of its owner and assigned its initial subscription tier.	workspace_name, subscription_tier, is_enterprise
workspace.white_label.updated	White-label: the brand every app in the workspace is built under, and the system prompt its agent runs on. Its own code rather than a workspace.settings.updated row because it changes what the AI tells end users it is.
workspace.hub.updated	A workspace hub was updated.	custom_section_count, featured_count, has_cover, has_description, has_logo, has_name
workspace.admin.owner_changed	A workspace admin owner was changed.	admin_email, new_owner_email, new_owner_previous_role, ownerless_repair, previous_owner_email, previous_owner_new_role

Workspace dedicated KMS

Event type	Description	Metadata
workspace.admin.dedicated_kms.enabled	A Base44 administrator or support user enabled dedicated KMS encryption for the workspace, starting provisioning and migration to a dedicated key.	key_arn, key_alias, subscription_tier, trigger
workspace.admin.dedicated_kms.disabled	A Base44 administrator or support user disabled dedicated KMS encryption for the workspace, starting the revert to the shared key.	key_arn, key_alias, subscription_tier, trigger
workspace.admin.dedicated_kms.retried	A Base44 administrator or support user retried a stalled dedicated KMS enable or disable operation from its last recorded state.	key_arn, key_alias, subscription_tier, trigger, direction, from_state
workspace.dedicated_kms.migration_completed	The workspace’s data finished migrating to its dedicated KMS key.	key_arn, trigger, passes, blobs_rewrapped
workspace.dedicated_kms.reverted	The workspace’s data finished migrating back to the shared KMS key.	key_arn, trigger, passes, blobs_rewrapped
workspace.dedicated_kms.key_deletion_scheduled	A workspace dedicated KMS key deletion was scheduled.	deletion_date, key_alias, key_arn, reason
workspace.dedicated_kms.byok_released	A workspace released its bring-your-own-key encryption key.	blobs_rewrapped, key_arn, key_source, passes, trigger
workspace.dedicated_kms.byok_enabled	A workspace administrator enabled bring-your-own-key encryption.	key_alias, key_arn, key_source, subscription_tier, trigger
workspace.dedicated_kms.byok_key_replaced	A workspace administrator replaced the bring-your-own-key encryption key.	key_alias, key_arn, key_source, subscription_tier, trigger
workspace.dedicated_kms.byok_disabled	A workspace administrator disabled bring-your-own-key encryption.	key_alias, key_arn, key_source, replacement_key_arn, subscription_tier, trigger
workspace.dedicated_kms.byok_retried	A workspace administrator retried a bring-your-own-key encryption change.	direction, from_state, key_alias, key_arn, key_source, subscription_tier, trigger

Workspace and agent skills

Event type	Description	Metadata
workspace.skill.created	A persisted workspace or agent skill was created successfully. The event is emitted after the skill is saved, whether it was added through the workspace or App Agents UI, a direct API for those skill models, an approved skill installation from the skills registry, an initial personal-agent skills payload, or an agent copy operation.	scope_type, skill_id, skill_name
workspace.skill.updated	A persisted workspace or agent skill was updated successfully.	scope_type, skill_id, skill_name
workspace.skill.deleted	A persisted workspace or agent skill was deleted successfully.	scope_type, skill_id, skill_name
agent.skill.learned	An agent skill was learned.	conversation_id, source_message_ids

For agent-owned skills, the event’s top-level app_id identifies the owning app or agent. scope_type is the persisted skill’s bounded classification; there is no separate creation-source field. Skill descriptions, instructions, prompts, source files, credentials, secrets, tokens, connection data, and arbitrary stored objects are intentionally excluded from audit metadata. Conversation-only skill activation and attaching an existing skill to an agent are configuration actions, not creation. Filesystem skills stored only under .agents/skills/ are a separate runtime-file model with no persisted skill record and are not represented by these events.

Domains

Event type	Description	Metadata
domain.created	A custom-domain resource was added to the workspace so the domain could be configured and linked to an app.	domain, domain_id
domain.deleted	A custom-domain resource was removed from the workspace. This deletes its Base44 configuration rather than merely unlinking it from an app.	domain, domain_id
domain.linked	An existing custom domain was associated with an app so it could serve that app after verification and configuration.	domain, domain_id
domain.unlinked	A custom domain was detached from its app without deleting the domain resource from the workspace.	domain, domain_id
domain.verified	Base44 completed a verification check for a custom domain. The metadata records the resulting verification state.	domain, domain_id, verification_status
domain.disabled	A Base44 administrator or support user disabled a custom domain without deleting or unlinking its configuration, so it no longer serves the linked app.	domain, domain_id
domain.enabled	A Base44 administrator or support user enabled a previously disabled custom domain for its linked app.	domain, domain_id
domain.email.enabled	A custom email-sending domain was enabled for an app after its sender configuration was saved.	domain, domain_id
domain.email.updated	The sender name, sender address, or other configuration for an enabled custom email domain was changed.	domain, domain_id
domain.email.disabled	A custom email-sending domain was disabled, causing the app to stop using it for outgoing email.	domain, domain_id
domain.redirect.updated	A domain redirect was updated.	domain, domain_id, target_domain
domain.reservation.claimed	A reserved hostname moved workspace after a proven claim, the losing side has no other record of it.	claiming_organization_id, domain, mechanism, previous_organization_ids

App lifecycle

Event type	Description	Metadata
app.created	A new app was created in the workspace. The metadata records the app’s name and type at creation time.	app_name, app_type
app.deleted	An app was deleted from the workspace. The event retains the app’s name and workspace context for later investigation.	app_name
app.published	An app deployment completed and the deployed version became the app’s active served version. When the deployment used a saved checkpoint, its ID appears in the metadata.	checkpoint_id
app.unpublished	A published app was taken offline while its app configuration and source remained in the workspace.
app.renamed	An app was renamed.	app_name, previous_name
app.purged	Distinct from app.deleted, which is the reversible soft delete: this one is the irreversible erasure, so “who destroyed it and when” is the only record that survives the app itself.	app_name, error_count, failed_steps, operator_email, operator_role

App users

Event type	Description	Metadata
app.user.registered	An app-user record was created, either through direct registration or because an existing platform user received access to the app.	target_email, role, registration_method
app.user.deleted	An app-user record was deleted, removing that person’s user profile and access within the app.	target_user_id, target_email
app.user.updated	An administrator changed fields on an existing app-user record. The metadata identifies the affected user without including the changed profile data.	target_user_id, target_email
app.user.role_changed	An existing app user’s application-level role changed. The metadata records both the previous and new roles.	target_email, old_role, new_role
app.auth.login	A user successfully authenticated to a published app. The metadata identifies the app authentication method, such as password or an identity provider.	auth_method
app.user.invited	A person was invited to an app with an application role and, when applicable, collaborator access for editing the app.	invitee_email, role
app.access.requested	A person verified their email and submitted a request to access a private app for administrator review.	requester_email
app.access.approved	An app administrator approved a pending access request, allowing the requester to register or creating their app-user record immediately.	target_email
app.access.denied	An app administrator denied and removed a pending access request.	target_email
app.app_user.sessions_revoked	Support revoked an app-user’s already-issued app-user JWTs (the only lever for an app owner, whom the product refuses to delete or downgrade).	is_app_owner, operator_email, operator_role, previously_revoked, target_app_role, target_app_user_id, target_email
app.user.restored	An app user was restored.	target_user_id
app.user.permanently_deleted	An app user was permanently deleted.	target_user_id
app.user.provisioned	An app user was provisioned.	role, target_email
app.user.deprovisioned	An app user was deprovisioned.	app_user_deleted, target_email
app.auth.email_verification.sent	An email verification code was sent so an app user could continue Microsoft sign-in.	auth_method
app.auth.email_verification	An app user attempted Microsoft email verification. The event status shows whether the code was accepted.	auth_method
app.user.guest_invite_blocked	An app user guest invite was blocked.	invitee_email, inviter_email, reason
app.user.invite_rate_limited	The app exhausted its plan’s invites-per-day budget. Distinct from the guest-invite block above: nothing about the invitee is wrong, the app is simply out of budget until the window rolls over.	authored_invite_cap, daily_limit, invite_count, plan_scaled, tier

Integrations

Event type	Description	Metadata
integration.custom.created	A custom API-key integration was created for an app with one or more selected endpoints.	integration_slug, integration_name, endpoint_count
integration.custom.updated	The name, authentication settings, or selected endpoints of an existing custom integration were changed.	integration_slug, fields_changed
integration.custom.deleted	A custom integration and its saved configuration were removed from the app.	integration_slug, integration_name
integration.stripe.sandbox_claimed	A Stripe test sandbox was claimed and associated with the app that completed the connection flow.	sandbox_id
integration.stripe.live_configured	The app completed its live-mode Stripe configuration, including flows that promote an existing sandbox connection to live mode.
integration.stripe.removed	The app’s Stripe payment integration and saved connection configuration were removed.
integration.wix_payments.connected	A Wix Payments account was successfully connected to the app for payment processing.
integration.wix_payments.disconnected	The app’s Wix Payments connection was removed, so the app can no longer process payments through that account.
integration.oauth.connected	An app established an OAuth connection to an external integration, either directly or by attaching a workspace-shared connection.	integration_type
integration.oauth.disconnected	An app removed its OAuth connection to an external integration.	integration_type
integration.wix_payments.test_checkout_created	An integration wix payments test checkout was created.	published_state, wix_session_id
integration.wix_payments.test_mode_changed	An integration wix payments test mode was changed.	test_mode
integration.payments_by_wix.disconnected	An integration payments by wix was disconnected.
integration.wix_merchant.connected	An integration wix merchant was connected.	merchant_id, partner_profile_id, site_id, tos_accepted
integration.wix_merchant.disconnected	An integration wix merchant was disconnected.	merchant_id, partner_profile_id, provider
integration.wix_merchant.subscription_canceled	An integration wix merchant subscription was canceled.	immediate, initiated_by, merchant_id, partner_profile_id, resulting_status, subscription_id
integration.wix_store.installed	Wix Stores: provisioning creates a Wix site under the owner’s identity and mints the app’s admin credential, so the run needs an attributable record.	metasite_id, newly_installed
integration.wix_store.removed	Removal is Base44-side only, the store stays live on Wix, so the event says removed, not uninstalled.	metasite_id
integration.shopify_store.created	Shopify stores: provisioning creates a real store on Base44’s Partner organization that no API can delete, and mints the app’s admin credential against it.	shop_domain
integration.shopify_store.admin_key_issued	The app-scoped key that lets the app’s own code reach its store’s Admin API.	shop_domain
integration.user_credentials.saved	An integration user credentials was saved.	action, connection_id, integration_type
integration.oauth.removed	An integration OAuth was removed.	integration_type
integration.oauth.workspace_connection.settings_changed	An integration OAuth workspace connection settings was changed.	connection_id, integration_type, new_allowed_consumers, new_name, old_allowed_consumers, old_name
integration.connector_webhook.registered	Connector webhook registrations: the routing rows that let a vendor push a tenant’s events into an app. Creating, stopping and failing to create one are auditable; the deliveries that follow are not (section 9.8).	integration_type, reason, registration_id, resource_id, route
integration.connector_webhook.stopped	An integration connector webhook was stopped.	integration_type, reason, registration_id, resource_id, route
integration.connector_webhook.activation_failed	An integration connector webhook activation failed.	error_code, integration_type
integration.connector_webhook.verification_token_claimed	An integration connector webhook verification token was claimed.	found, integration_type
integration.plaid.connected	An integration plaid was connected.	account_count, consented_products, environment, has_collaborators, institution_id, institution_name, item_id, scope, source, surface
integration.plaid.disconnected	An integration plaid was disconnected.	environment, error_code, item_id, reason, retained_count, revoked_count, scope, target_user_id
integration.plaid.collaborator_access_granted	An integration plaid collaborator access was granted.	environment, institution_name, source
integration.plaid.attached	An integration plaid was attached.	item_id
integration.plaid.detached	An integration plaid was detached.	item_id
integration.sequence.connected	An integration sequence was connected.	connection_id, connector
integration.sequence.disconnected	An integration sequence was disconnected.	connector, revoked_count
integration.wiz.connected	An integration Wiz was connected.	reason
integration.wiz.disconnected	An integration Wiz was disconnected.
integration.wiz.reverified	An integration Wiz was reverified.	reason
integration.tenzai.connected	No REVERIFIED counterpart: the Tenzai connector has no /verify endpoint, since nothing validates the key against Tenzai at connect time.
integration.tenzai.disconnected	An integration tenzai was disconnected.

App runtime

Event type	Description	Metadata
app.entity.query	An app queried records from one of its entities. The public audit event exposes the fields used for filtering instead of the raw database query.	filter_fields, sort, limit, skip, fields, entity_name
app.user.query	An app queried its user records. The metadata records the query, projected fields, sorting, and pagination used for the read.	filter_fields, sort, limit, skip, fields
app.integration.executed	An app completed a call to a third-party integration. Use status, error_code, duration, and credit metadata to evaluate the execution.	function_name, credit_count, duration_ms
app.automation.executed	An automation or agent-triggered automation run completed. Use status and the execution metadata to determine its outcome and resource usage.	automation_id, automation_name, automation_type, duration_ms, credit_count
app.agent.conversation	An AI agent processed a conversation turn or run. The metadata identifies the agent and conversation and summarizes message and credit usage without storing message content.	agent_name, conversation_id, message_count, credit_count
app.user.page_visit	The app runtime recorded an app user’s visit to a page. The metadata identifies the page but does not include the page’s content.	page_name
app.agent.notes_recording_captured	An app agent notes recording was captured.	duration_seconds, had_typed_notes, path, source, transcript_chars
app.agent.notes_shared	App agent notes were shared.	path, share_id
app.agent.computer_control_acquired	An app agent computer control was acquired.	conversation_id
app.agent.computer_control_released	An app agent computer control was released.	conversation_id
app.agent.computer_help_requested	An app agent computer help was requested.	conversation_id, tool_call_id
app.agent.computer_help_completed	An app agent computer help was completed.	conversation_id
app.agent.computer_task_started	An app agent computer task was started.	conversation_id, engine
app.agent.computer_task_finished	An app agent computer task finished.	conversation_id, engine, status
app.agent.computer_viewed	An app agent computer was viewed.	conversation_id
app.agent.notes_unshared	App agent notes were unshared.	path

Security

Event type	Description	Metadata
app.security.check_run	An app security scan completed. The event stores a summary and a run_id, when available. Detailed findings are retrieved separately and are never stored in the audit event.	run_id, findings_total, coverage_incomplete, highest_scored_severity, critical_findings_count, high_findings_count, medium_findings_count, low_findings_count, unscored_findings_count, rls_recommendations_count, hardcoded_secrets_count, backend_functions_issues_count, dependency_vulnerabilities_count, static_code_findings_count
app.security.headers_updated	App security headers were updated.	fields_changed
app.security.core_integration_protection.enabled	An app security core integration protection was enabled.
app.security.header_recommendation_dismissed	An app security header recommendation was dismissed.	flag
app.security.dependencies_upgraded	App security dependencies were upgraded.	commit, packages
app.security.finding_ignored	An app security finding was ignored.	finding_type, fingerprint
app.security.finding_restored	An app security finding was restored.	finding_type, fingerprint

To retrieve and interpret the detailed findings for a run, see Security scan findings.

TikTok Ads

Event type	Description	Metadata
tiktok_ads.profile.selected	A TikTok ads profile was selected.	account_id, identity_id, identity_type
tiktok_ads.profile.authorization_started	A TikTok ads profile authorization was started.

Billing

Event type	Description	Metadata
billing.academic_domain.decided	A billing academic domain was decided.	decision, domain, include_subdomains, revision
billing.social_bonus.claimed	A billing social bonus was claimed.	detail, outcome, platform, reason
billing.google_play.checkout.started	A billing Google play checkout was started.	base_plan_id, product_id
billing.google_play.subscription.updated	A billing Google play subscription was updated.	base_plan_id, product_id, state, tier
billing.apple.webhook.received	A billing apple webhook was received.	notification_type, original_transaction_id, owner_id, owner_type, product_id, revocation_reason, subtype, transaction_id

Superagent

Event type	Description	Metadata
superagent.channel.connected	A superagent channel was connected.	channel
app.superagent.email_workflows.setup	An app superagent email workflows setup changed.	filter_count, label_backfill_started, label_count, mailbox_profile_generated, provider, source, workflow_id, workflow_ids
app.superagent.email_settings.updated	An app superagent email settings was updated.	drafting_enabled, fields_changed, filter_count, filtering_enabled, label_count, labeling_enabled
app.superagent.proactivity.settings_updated	Superagent proactivity settings were updated.	enabled, notification_channel, observation_source_count, onboarding_version, retired_workflow_count, source
app.superagent.proactivity.semantic_index_provisioned	An app superagent proactivity semantic index was provisioned.	database, index, operation, version
app.superagent.proactivity.semantic_rollout_changed	An app superagent proactivity semantic rollout was changed.	enable_all, enabled_profile_count, evidence_sha256, index, version
app.superagent.proactivity.semantic_backfilled	An app superagent proactivity semantic index was backfilled.	after_id, eligible_count, profile_id, published_count, records_scanned, version
app.superagent.proactivity.slack_index_provisioned	An app superagent proactivity Slack index was provisioned.	database, enable_all, enabled_profile_count, evidence_sha256, operation, version
app.superagent.proactivity.slack_source_connected	An app superagent proactivity Slack source was connected.	channel_count, source_id
app.superagent.proactivity.followup_scheduled	An app superagent proactivity follow-up was scheduled.	followup_key, origin, revision, situation_key, status, task_id
app.superagent.proactivity.followup_updated	An app superagent proactivity follow-up was updated.	followup_key, origin, revision, situation_key, status, task_id
app.superagent.proactivity.followup_cancelled	An app superagent proactivity follow-up was cancelled.	followup_key, origin, revision, situation_key, status, task_id
app.superagent.proactivity.followup_completed	An app superagent proactivity follow-up was completed.	followup_key, origin, revision, situation_key, status, task_id
app.superagent.proactivity.interest_updated	An app superagent proactivity interest was updated.	interest_id, kind, origin, preference
app.superagent.proactivity.interest_removed	An app superagent proactivity interest was removed.	interest_id
app.superagent.proactivity.notification_rule_created	An app superagent proactivity notification rule was created.	has_expiry, mode, rule_id, rule_revision, rules_revision, scope_type, status
app.superagent.proactivity.notification_rule_updated	An app superagent proactivity notification rule was updated.	has_expiry, mode, rule_id, rule_revision, rules_revision, scope_type, status
app.superagent.proactivity.notification_rule_revoked	An app superagent proactivity notification rule was revoked.	has_expiry, mode, rule_id, rule_revision, rules_revision, scope_type, status
app.superagent.proactivity.decision_index_provisioned	An app superagent proactivity decision index was provisioned.	collections, database, operation
app.superagent.proactivity.retention_index_provisioned	An app superagent proactivity retention index was provisioned.	collections, created_index_count, database, operation
app.superagent.attention.dismissed	An app superagent attention was dismissed.	item_id
app.superagent.observation.recorded	A superagent observation was recorded.	note_id, observation_count, observation_id, source
app.superagent.memory.updated	An app superagent memory was updated.	action, checkpoint_id, conversation_id, memory_id
app.superagent.tool.approval	A superagent tool approval was recorded.	action, channel, conversation_id, surface, tool_call_id, tool_name
app.superagent.goal.created	An app superagent goal was created.	goal_id, goal_name, goal_status, state_revision
app.superagent.goal.updated	An app superagent goal was updated.	goal_id, goal_name, goal_status, state_revision
app.superagent.goal.note_changed	An app superagent goal note was changed.
app.superagent.capability.granted	An app superagent capability was granted.	capability, events, function_name, goal_name, goal_task_id, integration_type, kind, subscription
app.superagent.capability.invoked	An app superagent capability was invoked.	capability, function_name, goal_name, goal_task_id, kind
app.superagent.phone.released	An app superagent phone was released.	reason
app.superagent.phone.connected	An app superagent phone was connected.	verification_method
app.superagent.phone.keypad	A superagent phone keypad entry was recorded.	digit_count, outcome, transport
app.superagent.device_location.read	An app superagent device location was read.	accuracy_bucket, address_status, conversation_id, outcome, precision, source, tool_call_id

User push devices

Event type	Description	Metadata
user.push_device.registered	An user push device was registered.	device_id, platform
user.push_device.unregistered	An user push device was unregistered.	device_id

Builder

Event type	Description	Metadata
builder.queue.message_steered	A builder queue queued message was steered.	branch_id, conversation_id, item_id

Coupons

Event type	Description	Metadata
individual_coupon.generated	An individual coupon was generated.	campaign_id, count, max_redemptions
individual_coupon.redeemed	An individual coupon was redeemed.	campaign_id, coupon_id
premium_coupon.requested	A premium coupon was requested.	billing_cycle, code_count, code_mode, department, discount_cycles, discount_percent, premium_coupon_request_id, tier, uses_per_code
premium_coupon.codes_received	Premium coupon codes were received.	billing_cycle, code_count, code_mode, department, discount_cycles, discount_percent, premium_coupon_request_id, tier, uses_per_code

Entity version history

Event type	Description	Metadata
app.entity_version.bulk_restore_started	Version history: a point-in-time restore of one or more whole tables, rewriting their rows to an earlier instant. Distinct from app.entity.restored, which un-deletes a single record.	batch_id, checkpoint_id, data_as_of, entity_names, skipped_entities, table_count

Workspace groups

Event type	Description	Metadata
workspace.group.created	A workspace group was created.	group_id, group_name, initial_member_count, role
workspace.group.updated	A workspace group was updated.	group_id, group_name, role
workspace.group.deleted	A workspace group was deleted.	group_id, group_name, member_count, role, via_orphan_sweep
workspace.group.role_mapping_changed	A workspace group role mapping was changed.	group_id, group_name, new_role, old_role
workspace.group.member_added	A workspace group member was added.	group_id, group_name, member_count, member_emails, via_invitation
workspace.group.member_removed	A workspace group member was removed.	group_id, group_name, member_count, member_emails
workspace.groups.idp_mode.changed	A workspace groups IdP mode was changed.	new_value, previous_value

Workspace service principals

Event type	Description	Metadata
workspace.service.user_token_minted	Server-to-server end-user token vending (workspace API key with user_tokens:mint). Emitted on every mint.	minted_by_key_id, principal_user_id, service_external_id
workspace.service.principal_provisioned	Synthetic service-principal lifecycle (workspace API key with service_users:provision). Provision creates the token-only principal; deprovision removes its membership (which invalidates outstanding vended tokens on their next request via the workspace-grant re-validation).	principal_user_id, role, service_external_id
workspace.service.principal_deprovisioned	A workspace service principal was deprovisioned.	previous_role, principal_user_id, service_external_id

Whitelabel sockets

Event type	Description	Metadata
workspace.whitelabel_socket.session_created	A workspace whitelabel socket session was created.	app_ids, key_id, session_id
workspace.whitelabel_socket.room_added	A workspace whitelabel socket room was added.	app_id, key_id, session_id
workspace.whitelabel_socket.room_revoked	A workspace whitelabel socket room was revoked.	app_id, key_id, session_id
workspace.whitelabel_socket.session_ended	A workspace whitelabel socket session was ended.	key_id, session_id

Workspace MFA

Event type	Description	Metadata
workspace.mfa.enforcement.enabled	A workspace MFA enforcement was enabled.	new_value, previous_value
workspace.mfa.enforcement.disabled	A workspace MFA enforcement was disabled.	new_value, previous_value
workspace.mfa.challenge.failure	A member without account MFA refused at the workspace door.

Workspace GitHub

Event type	Description	Metadata
workspace.github_org_policy.updated	A workspace GitHub org policy was updated.	new_enabled, new_orgs, previous_enabled, previous_orgs
workspace.github_installation_policy.updated	A workspace GitHub installation policy was updated.	installation_id, new, previous
workspace.github_connection_mode.updated	A workspace GitHub connection mode was updated.	new, previous
workspace.github_add_organization_min_role.updated	A workspace GitHub add organization min role was updated.	new, previous
workspace.github_org_policy.repo_create_blocked	A workspace GitHub org policy repository creation was blocked.	flow, owner, reason
workspace.github_installation.connected	A workspace GitHub installation was connected.	account_login, account_type, installation_id, operation, reason, repository_selection
workspace.github_installation.reconnected	A workspace GitHub installation was reconnected.	account_login, account_type, expected_account_login, installation_id, operation, repository_selection, returned_account_login
workspace.github_installation.disconnected	A workspace GitHub installation was disconnected.	account_login, disconnected_app_count, failed_app_count, installation_id, remaining_app_count
workspace.github_installation.removed	A workspace GitHub installation was removed.	account_login, installation_id
app.github_repository.connected	An app GitHub repository was connected.	installation_id, linked_existing, repo_full_name, workspace_installation_id
app.github_repository.disconnected	An app GitHub repository was disconnected.	installation_id, repo_full_name, skip_sync, workspace_installation_id
app.github_repository.rebound	An app GitHub repository was rebound.	installation_id, repo_full_name, workspace_installation_id
app.github_repository.reconnected	An app GitHub repository was reconnected.	base44_head, direction, github_head, installation_id, repo_full_name, workspace_installation_id

App security center

Event type	Description	Metadata
workspace.app_security_center.exported	A workspace app security center was exported.	row_count, source
workspace.app_security_center.bulk_started	A workspace app security center bulk run was started.	action, actor_email, app_count, bulk_run_id, source
workspace.app_security_center.bulk_app_processed	A workspace app security center processed one app in a bulk run.	action, actor_email, after, app_name, before, bulk_run_id, failure_reason, outcome, source
workspace.app_security_center.bulk_finished	A workspace app security center bulk run finished.	action, actor_email, bulk_run_id, failed, processed, run_status, skipped, source, succeeded

Workspace governance

Event type	Description	Metadata
workspace.governance.rule_changed	A workspace governance rule was changed.	changes, group_id, new_group_app_policies, new_role_app_policies, old_group_app_policies, old_role_app_policies

App deploy approval

Event type	Description	Metadata
app.deploy_approval.requested	An app deploy approval was requested.	recipients_notified, requested_visibility

Workspace IP allowlist

Event type	Description	Metadata
workspace.ip_allowlist.bypassed	A workspace IP allowlist was bypassed.	client_ip, platform_role

URL redirects

Event type	Description	Metadata
url_redirect.created	An URL redirect was created.	match_type, redirect_id, source_path, target_path
url_redirect.updated	An URL redirect was updated.	redirect_id, source_path, target_path
url_redirect.deleted	An URL redirect was deleted.	redirect_id, source_path

App comments

Event type	Description	Metadata
app_comment.created	An app comment was created.	comment_id, element_tag, page_path, thread_id
app_comment.replied	An app comment received a reply.	comment_id, thread_id
app_comment.edited	An app comment was edited.	comment_id, thread_id
app_comment.resolved	An app comment was resolved.	thread_id
app_comment.unresolved	An app comment was reopened.	thread_id
app_comment.deleted	An app comment was deleted.	thread_id
app_comment.message_deleted	An app comment message was deleted.	comment_id, thread_id

App SEO

Event type	Description	Metadata
app.seo.fix_applied	An app SEO fix was applied.	fix_type

App model comparison

Event type	Description	Metadata
app.model_comparison.started	An app model comparison was started.	comparison_id, flow, model_ids
app.model_comparison.selected	An app model comparison was selected.	comparison_id, model_id, version
app.model_comparison.stopped	An app model comparison was stopped.	comparison_id

App auto approvals

Event type	Description	Metadata
app.auto_approvals.changed	Auto approve turned on/off: the setting that lets approval-gated tool calls run unreviewed, so “who disabled it and when” has to be answerable.	enabled

App social calendar

Event type	Description	Metadata
app.social_calendar.automation_mode_changed	How much of the social calendar runs unattended. Automatic mode publishes to the workspace’s public accounts with nobody in the loop, so the switch itself is the auditable act, not the individual post.	app_id, auto_approved, cancelled, mode, platforms, previous_mode, publish_dry_run
app.social_calendar.post_rescheduled	A post already handed to its publishing workflow moved to a new time: the old workflow is archived and a new one takes over, so this is when it goes public.	app_id, materialization_job_id, platform, post_id, previous_scheduled_at, previous_workflow_id, scheduled_at
app.social_calendar.channels_added	Channels added to an existing content plan; in a publishing mode a channel Base44 can post to joins it, so this widens where the app publishes.	automation_mode, credits, plan_platforms, platforms

App main branch protection

Event type	Description	Metadata
app.main_branch_protection.updated	An app main branch protection was updated.	protected

App insights agent

Event type	Description	Metadata
app.insights_agent.provisioned	An app insights agent was provisioned.	agent_id, cross_app_allowed_app_ids

App end user uploads

Event type	Description	Metadata
app.end_user_uploads.made_public	An end-user upload was written to permanent public storage on an app whose default is private. Those URLs never expire and cannot be recalled, so the introduction has to be attributable.	file_path

App SSO

Event type	Description	Metadata
app.sso.settings_updated	Per-app SSO credentials/provider rewritten. Changing which IdP an app trusts for login is exactly the change an auditor needs attributed.	provider_switched_from, sso_provider, updated_fields

App production agent

Event type	Description	Metadata
app.production_agent.updated	The Production Agent opt-in. Turning it on starts Base44 watching this app’s runtime failures; turning it off stops it.	enabled, staff_override

App production issue

Event type	Description	Metadata
app.production_issue.ignored	An owner dismissing a Production Agent issue, or bringing it back. Owner decisions on a platform suggestion, so who made them belongs in the trail.	cause, detector, issue_id
app.production_issue.restored	An app production issue was restored.	cause, detector, issue_id

App mobile build config

Event type	Description	Metadata
app.mobile_build_config.updated	An app mobile build config was updated.	actor_email, actor_role, changed_fields, changes

App workflow

Event type	Description	Metadata
app.workflow.file_key_renamed	Support moved a workflow’s sandbox .jsonc to a new file_key, a write into the customer’s repo, and the only path that can change a file_key at all.	new_file_key, old_file_key, operator_email, operator_role, workflow_id
app.workflow.run_resolved	Support resolved a workflow run stranded in status “running”, writes the terminal run row the closed execution failed to write.	operator_email, operator_role, resolved_status, run_id, source, workflow_id

App email pause

Event type	Description	Metadata
app.email_pause.lifted	Support lifted an app’s deliverability pause on emailing non-registered recipients.	had_hold, lifted, offences, operator_email, operator_role, still_breached, was_paused

App prerender

Event type	Description	Metadata
app.prerender.recached	Support ran a one-off SEO prerender warm for an app’s sitemap pages.	domains, enrolled, failed, force, mode, operator_email, operator_role, rendered, skip_reason, warm_skipped
app.prerender.code_pages_declared	An admin declared route templates as code pages, turning off the record-existence / anonymous-RLS oracle for every URL under them.	added, code_page_routes, operator_email, operator_role

App backend functions

Event type	Description	Metadata
app.backend_functions.source_redeployed	Support redeployed backend functions missing from the deployment map, from the source archive.	deployed, error, errors, missing, operator_email, operator_role

App move

Event type	Description	Metadata
app.move.completed	An app move completed.	move_type, source_workspace_id, target_workspace_id
app.move.failed	An app move failed.	move_type, source_workspace_id, target_workspace_id, transfer_id
app.move.requested	An app move was requested.	requester_email, target_workspace_id, transfer_id
app.move.request_approved	An app move request was approved.	reviewer_email, target_workspace_id, transfer_id
app.move.request_rejected	An app move request was rejected.	comment, reviewer_email, transfer_id
app.move.request_cancelled	An app move request was cancelled.	cancelled_by, transfer_id

App ownership transfer

Event type	Description	Metadata
app.ownership_transfer.initiated	An app ownership transfer was initiated.	new_owner_email, transfer_id
app.ownership_transfer.resent	An app ownership transfer was resent.	new_owner_email, transfer_id
app.ownership_transfer.cancelled	An app ownership transfer was cancelled.	new_owner_email, transfer_id
app.ownership_transfer.transferred_to_member	An app ownership transfer was transferred to a member.	keep_sender_as_collaborator, new_owner_email, new_owner_id, previous_owner_id

App data residency

Event type	Description	Metadata
app.data_residency.migration_started	An app data residency migration was started.	attempt_id, mode, source_region, target_region
app.data_residency.migration_completed	An app data residency migration completed.	attempt_id, mode, source_region, target_region
app.data_residency.migration_failed	An app data residency migration failed.	attempt_id, error, error_code, mode, source_region, target_region
app.data_residency.migration_rolled_back	An app data residency migration was rolled back.	attempt_id, error, mode, source_region, target_region
app.data_residency.migration_finalized	An app data residency migration was finalized.	app_users_deleted, attempt_id, entitys_deleted, mode, source_region, target_region

App collaborator

Event type	Description	Metadata
app.collaborator.auto_enrolled	An app collaborator was auto-enrolled.	collaborator_source

App collaboration mode

Event type	Description	Metadata
app.collaboration_mode.updated	An app collaboration mode was updated.	collaboration_mode, previous_mode

App first party

Event type	Description	Metadata
app.first_party.billing_workspace.changed	First-party (dogfood) apps: which of the payer’s workspaces first-party generation bills. Money-path routing, so switches must leave a trail.	new_workspace_id, payer_id, previous_workspace_id

App group share

Event type	Description	Metadata
app.group_share.created	App-level group access (workspace groups shared with an app). Named app.* (not workspace.) so the per-app Logs Explorer can list them, its frontend allowlist excludes workspace. events.	group_id, group_name, role
app.group_share.role_changed	An app group share role was changed.	group_id, new_role, old_role
app.group_share.removed	An app group share was removed.	group_id, reason
app.group_share.members_granted	An app group share members was granted.	count, trigger
app.group_share.members_revoked	An app group share members was revoked.	count, trigger

App secret

Event type	Description	Metadata
app.secret.created	App backend-function secrets: user-attributable CRUD of credentials must leave a durable trail, workspace/account API keys already do, and these are the credentials user apps call third parties with.	secret_count, secret_names, source_app_id, via
app.secret.updated	An app secret was updated.	secret_count, secret_names, source_app_id, via
app.secret.deleted	An app secret was deleted.	deleted_count, secret_count, secret_names

App deployment resource

Event type	Description	Metadata
app.deployment_resource.synced	An app deployment resource was synced.	action, deployment_id, environment_name, error_count, file_count, manifest_hash, resource_name, resource_type, routing_bound, session_id, version_id

App email template

Event type	Description	Metadata
app.email_template.created	Emails tab (app editor). The delete is destructive, it unlinks the template file and drops the row, and the test sends put real mail on the wire, so each is an auditable action on an app a workspace operator may not own.
app.email_template.deleted	An app email template was deleted.

App email

Event type	Description	Metadata
app.email.test_sent	An app email test send was recorded.

App system email

Event type	Description	Metadata
app.system_email.materialized	An app system email was materialized.

App feature flag

Event type	Description	Metadata
app.feature_flag.created	Feature flags & Experiments (app editor). Each state transition changes what published-app visitors see, so every one is auditable.
app.feature_flag.activated	An app feature flag was activated.
app.feature_flag.paused	An app feature flag was paused.
app.feature_flag.archived	An app feature flag was archived.
app.feature_flag.rollout_changed	An app feature flag rollout was changed.

App experiment

Event type	Description	Metadata
app.experiment.created	An app experiment was created.
app.experiment.started	An app experiment was started.
app.experiment.paused	An app experiment was paused.
app.experiment.resumed	An app experiment was resumed.
app.experiment.completed	An app experiment completed.

Imported apps

Event type	Description	Metadata
imported_app.pull_request.opened	An imported app pull request was opened.	pull_request, repo
imported_app.commit.reviewed	An imported app commit was reviewed.	branch_id, feature_changes, needs_review_changes, preview_changes, review_id
imported_app.setup.state_changed	An imported app setup state was changed.	branch_id, setup_state, source
imported_app.pr_files.reverted	An imported app PR files was reverted.	branch_id, commit, files
imported_app.pull_request.merged	An imported app pull request was merged.	base_branch, pull_request, repo
imported_app.conflict_resolution.started	An imported app conflict resolution was started.	base_branch, pull_request, repo
imported_app.pull_request.commented	An imported app pull request comment was added.	pull_request, repo
imported_app.pr_thread.replied	An imported app PR thread received a reply.	repo, thread_id
imported_app.pr_thread.resolved	An imported app PR thread was resolved.	repo, thread_id
imported_app.branch.created	An imported app branch was created.	branch, entry_point
imported_app.branch.merged	An imported app branch was merged.	pull_request, repo
imported_app.main.promoted	An imported app main was promoted.	commit, generation_id
imported_app.main.retry_requested	An imported app main retry was requested.	failure_id
imported_app.main.investigation_requested	An imported app main investigation was requested.	branch_id, failure_id
imported_app.preview_origin.updated	An imported app preview origin was updated.	shared_preview_origin
imported_app.verification_session.mirrored	An imported app verification session was mirrored.	cookie_count, preview_id, size_bytes, storage_key_count
imported_app.verification_session.used	An imported app verification session was used.	age_seconds, cookie_count, storage_key_count
imported_app.verification_session.deleted	An imported app verification session was deleted.	deleted, reason

App branch sync

Event type	Description	Metadata
app.branch_sync.cancelled	An app branch sync was cancelled.	branch_id

Marketing agent

Event type	Description	Metadata
marketing_agent.provisioned	Marketing agent (the workspace-shared CMO Superagent). Provisioning mints a workspace app and every run spends workspace credits, so both the mint and the setup lifecycle are auditable; budget is shared state any editor can change.
marketing_agent.setup.started	A marketing agent setup was started.
marketing_agent.setup.completed	A marketing agent setup completed.	competitor_research
marketing_agent.setup.reset	Destructive and app-wide: one editor’s reset throws away the plan for every editor of that app, so it is worth being able to answer “who did that”.
marketing_agent.action_plan.generated	A marketing agent action plan was generated.	count, mode
marketing_agent.action_plan.appended	A marketing agent action plan was appended.	count, mode
marketing_agent.action_item.status_updated	A marketing agent action item status was updated.	from_status, kind, to_status
marketing_agent.action_autonomy.changed	A marketing agent action autonomy was changed.	from_mode, kind, paused, to_mode
marketing_agent.action_item.auto_executed	A marketing agent action item auto ran.	kind, outcome, run_day
marketing_agent.social_content.generated	The agent writing into another feature on the user’s behalf: it spends their integration credits and the posts land on the shared Social page, so the trail has to say which networks it generated and who asked for it.	mode, platforms

Marketing DNA

Event type	Description	Metadata
marketing_dna.analyzed	Business DNA. The analysis spends model calls, and both it and the editable fields are APP-WIDE: one editor’s re-analysis or correction is what every other editor, and everything generated from the DNA, reads next.
marketing_dna.edited	A marketing dna was edited.	fields

Marketing OS

Event type	Description	Metadata
marketing_os.business.created	Marketing OS. A brain is the business knowledge every marketing workflow reads, so who registered a business and who wrote which brain version is the trail behind every asset produced from it.	business_id
marketing_os.brain.version_saved	A marketing OS brain version was saved.	business_id, version_id
marketing_os.brain.activated	A marketing OS brain was activated.	business_id, version_id
marketing_os.brain.compile_started	A compile crawls the business’s public site and spends model calls, so who started one and against which extra pages is part of the same trail.	business_id, extra_urls_count, file_count
marketing_os.insight.dismissed	An owner said a proposal was not worth doing. The read side is not audited — opening an inbox is not an action — but dismissing one is a decision about what the engine may propose next, and it is the owner-side half of the beat’s own suppression counters.	business_id, detector, insight_id
marketing_os.business.apps_linked	Which Base44 apps a business reads analytics from. Owner-declared and cross-tenant by nature — the route refuses an app of another workspace — so who pointed a business at which app is part of the same trail as who registered the business.	app_ids, business_id
marketing_os.business.deleted	”Start over”: the owner removed the business, every brain version and everything the beat stored for it. Nothing is left to restore from, so the event is written before the sweep.	business_id
marketing_os.file.added	Setup: the files an owner handed over (stored privately and read by a model) and what they said in the optional steps. A file or a recorded stage changes what the next compile reads.	business_id, file_id, kind, purpose, size_bytes
marketing_os.file.removed	A marketing OS file was removed.	business_id, file_id, kind
marketing_os.setup.stage_recorded	A marketing OS setup stage was recorded.	business_id, stage, status
marketing_os.setup.focus_products_set	Marketing OS focus products were set.	business_id, product_count
marketing_os.setup.finished	A marketing OS setup finished.	business_id, file_count

Payments

Event type	Description	Metadata
payments.transaction.refunded	A payments transaction was refunded.	amount, currency, full, provider, transaction_id
payments.checkout.created	A payments checkout was created.	amount_total, checkout_id, currency, item_count, recurring

Penetration tests

Event type	Description	Metadata
pentest.run.started	Spending the key, not storing it: a run points a third-party agent at a live app and hands them an admin’s address. Started only, never refused starts, which have their own gate metric and would fill the trail with expired-key noise.	report_recipient, run_id
pentest.run.stopped	A pentest run was stopped.	run_id

Connectors

Event type	Description	Metadata
connector.access.changed	A connector access was changed.	action, auth_method, integration_type, source
connector.governance.builder_toggled	A connector governance builder access was toggled.	bulk_operation, enabled, integration_type, previous_enabled
connector.governance.per_user_toggled	A connector governance per-user access was toggled.	bulk_operation, enabled, integration_type, previous_enabled
connector.governance.new_connector_policy_toggled	A connector governance new-connector policy was toggled.	enabled, previous_enabled, snapshot_row_count
connector.oauth_gateway.toggled	Which callback URL a workspace connector registers with its provider: the shared OAuth gateway URL or the per-app URLs. Flipping it changes where every future authorization for that connector returns, so both directions carry an actor/history trail.	connector_id, integration_type, uses_oauth_gateway
connector.base44_credentials.registered	A workspace registered a connector that runs on Base44’s OWN OAuth client rather than credentials the builder supplied. That decides whose client every app user of that workspace then consents against, and whose standing with the provider is spent, so it needs an actor trail.	connector_id, integration_type, scopes

Workspace data policy

Event type	Description	Metadata
workspace.data_policy.updated	A workspace data policy was updated.	allowed_channels_new, enforced_new
workspace.data_policy.exception_added	A workspace data policy exception was added.	app_ids, app_names, reason
workspace.data_policy.exception_removed	A workspace data policy exception was removed.	app_id, reason

App video

Event type	Description	Metadata
app.video.generation.requested	An app video generation was requested.	model, video_id

App speech

Event type	Description	Metadata
app.speech.generation.requested	An app speech generation was requested.	characters, model

Support

Event type	Description	Metadata
support.access.granted	A support access was granted.	access_type, app_ids, cross_user_access, source, support_user, target_user, ticket_id, ticket_owner, workspace_id
support.misuse_report.submitted	A support misuse report was submitted.	form_type, reporter_kind, ticket_id
support.misuse_report.guest_reply_posted	A support misuse report guest reply was posted.	form_type, reporter_kind, ticket_id

Admin

Event type	Description	Metadata
admin.self_access.granted	An admin self access was granted.	admin_email, admin_user_id, app_id, source, ttl_seconds
admin.consent.configuration_repaired	An admin consent configuration was repaired.
admin.partner.policy_warning_sent	Staff removed a partner’s ring reviews from the Profile Screening tab and the final-warning email went out. The row is the record of who was warned when, so a repeat offender’s next screening shows the earlier warning.	target_user_id

Admin billing

Event type	Description	Metadata
admin.billing.apple.viewed	An admin billing apple was viewed.	environment, exception_type, history_outcome, status_outcome, workspace_id
admin.contract.onboarded	An admin contract was onboarded.	billing_interval, first_year_price_cents, plan, stripe_subscription_id, total_value_cents
admin.contract.subscription_created	An admin contract subscription was created.
admin.billing.tier_changed	Backoffice billing writes. Every admin mutation of a workspace’s subscription, credits or coupons emits one of these with before/after + provider in metadata.	fields_changed, provider, workspace_id
admin.billing.sync_applied	An admin billing sync was applied.	account_id, changed_fields, provider, stripe_customer_id, stripe_subscription_id, subscription_id, workspace_id
admin.billing.plan_reverted	An admin billing plan was reverted.	new_billing_interval, new_stripe_price_id, new_stripe_subscription_id, new_stripe_subscription_status, new_subscription_period_end, new_subscription_period_start, new_tier, previous_stripe_price_id, previous_stripe_subscription_id, previous_stripe_subscription_status, previous_subscription_period_end, previous_subscription_period_start, previous_tier, provider, stripe_customer_id, target_user_id, workspace_id
admin.billing.refund_issued	An admin billing refund was issued.	amount, currency, invoice_id, refund_status, stripe_charge_id, stripe_refund_id, ticket_id, workspace_id
admin.billing.subscription_canceled	An admin billing subscription was canceled.	immediate, provider, reason, subscription_id, workspace_id
admin.billing.cache_refreshed	An admin billing cache was refreshed.	workspace_id
admin.credits.granted	An admin credits was granted.	amount, credit_type, issue_id, organization_id, reason, reason_code, ticket_link
admin.credits.revoked	An admin credits was revoked.	amount, bonus_credit_id, credit_type, organization_id, user_id
admin.credits.topup_exhausted	An admin credits top-up was exhausted.	description, record_id, target_user_id, workspace_id
admin.credits.quota_block_cleared	An admin credits quota block was cleared.	cleared, workspace_id
admin.coupon.created	An admin coupon was created.	amount, code, credit_type, max_number_of_people
admin.gift_card.created	An admin gift card was created.	amount_cents, gift_card_id, has_recipient

Admin compliance partners

Event type	Description	Metadata
admin.compliance_partner.created	Compliance API partner registry. These are the only actions that decide whose signature we accept, and a partner’s credential reads posture across every customer who shares a workspace key with them, so registering a key, or suspending one partner, changes what a third party can see about many customers at once.	client_id, name, partner_id, slug
admin.compliance_partner.suspended	An admin compliance partner was suspended.	partner_id, slug
admin.compliance_partner.reinstated	An admin compliance partner was reinstated.	partner_id, slug
admin.compliance_partner.key_added	An admin compliance partner key was added.	algorithm, key_id, label, partner_id, slug
admin.compliance_partner.key_disabled	An admin compliance partner key was disabled.	key_id, partner_id, slug
admin.compliance_partner.key_renamed	An admin compliance partner key was renamed.	key_id, label, partner_id, slug

Admin marketing

Event type	Description	Metadata
admin.marketing_os.business_recompiled	Backoffice Marketing OS. All act on a workspace the operator is not a member of: a recompile spends model calls against a customer’s site, a delete drops the business and every immutable brain version under it with nothing to restore from, and a beat can put a proposal in front of the customer.	business_id, organization_id
admin.marketing_os.business_deleted	An admin marketing OS business was deleted.	business_id, organization_id, versions_deleted
admin.marketing_os.beat_triggered	An admin marketing OS beat was triggered.	business_id, dry_run, organization_id
admin.marketing_os.feedback_status_changed	An admin marketing OS feedback status was changed.	business_id, feedback_id, organization_id, status
admin.marketing_os.prompt_version_saved	An admin marketing OS prompt version was saved.	baseline_hash, item_key, version_id
admin.marketing_emails.template_created	Backoffice marketing email templates: who changed or test-sent what goes out as marketing mail.
admin.marketing_emails.template_updated	An admin marketing emails template was updated.
admin.marketing_emails.template_deleted	An admin marketing emails template was deleted.
admin.marketing_emails.test_sent	An admin marketing emails test send was recorded.
admin.marketing_campaigns.created	Backoffice marketing campaigns: who launched, stopped or changed mail to an audience.
admin.marketing_campaigns.updated	An admin marketing campaigns was updated.
admin.marketing_campaigns.launched	An admin marketing campaigns was launched.
admin.marketing_campaigns.paused	An admin marketing campaigns was paused.
admin.marketing_campaigns.resumed	An admin marketing campaigns was resumed.
admin.marketing_campaigns.cancelled	An admin marketing campaigns was cancelled.
admin.marketing_campaigns.duplicated	An admin marketing campaigns was duplicated.
admin.marketing_campaigns.test_sent	An admin marketing campaigns test send was recorded.
admin.marketing_campaigns.sent_now	An admin marketing campaigns was sent immediately.
admin.marketing_campaigns.exact_stats_requested	Exact stats were requested for an admin marketing campaign.
admin.marketing_campaigns.pause_all	Admin marketing campaigns were paused.
admin.marketing_campaigns.resume_all	Admin marketing campaigns were resumed.
admin.marketing_canvas.created	An admin marketing canvas was created.
admin.marketing_canvas.updated	An admin marketing canvas was updated.
admin.marketing_canvas.launched	An admin marketing canvas was launched.
admin.marketing_canvas.paused	An admin marketing canvas was paused.
admin.marketing_canvas.resumed	An admin marketing canvas was resumed.
admin.marketing_canvas.cancelled	An admin marketing canvas was cancelled.
admin.marketing_canvas.duplicated	An admin marketing canvas was duplicated.
admin.marketing_canvas.generated	An admin marketing canvas was generated.
admin.marketing_segments.created	An admin marketing segments was created.
admin.marketing_segments.updated	An admin marketing segments was updated.
admin.marketing_segments.duplicated	An admin marketing segments was duplicated.
admin.marketing_segments.archived	An admin marketing segments was archived.
admin.marketing_segments.unarchived	An admin marketing segments was restored from archive.
admin.marketing_segments.exact_stats_requested	Exact stats were requested for an admin marketing segment.
admin.marketing_emails.assistant_asked	An admin marketing emails assistant was asked.	actions, messages, model
admin.marketing_analytics.dashboard_created	An admin marketing analytics dashboard was created.
admin.marketing_analytics.dashboard_updated	An admin marketing analytics dashboard was updated.
admin.marketing_analytics.dashboard_deleted	An admin marketing analytics dashboard was deleted.
admin.marketing_analytics.dashboard_duplicated	An admin marketing analytics dashboard was duplicated.
admin.marketing_analytics.dashboard_generated	An admin marketing analytics dashboard was generated.
admin.marketing_analytics.insights_run_started	An admin marketing analytics insights run was started.
admin.marketing_emails.template_duplicated	An admin marketing emails template was duplicated.
admin.marketing_emails.template_imported	An admin marketing emails template was imported.
admin.marketing_emails.template_generated	An admin marketing emails template was generated.
admin.marketing_emails.template_ai_edited	An admin marketing emails template was edited with AI.

Admin blog

Event type	Description	Metadata
admin.blog.author_created	Corpus-wide draft mutation: the operation-level record (actor, needle, aggregate counts) that per-post revision notes cannot provide.	author_id, name, slug
admin.blog.author_deleted	An admin blog author was deleted.	author_id, name, slug
admin.blog.author_updated	An admin blog author was updated.	author_id, name, previous_slug, slug
admin.blog.bulk_replace	An admin blog bulk replace was recorded.	already_applied, blanked, conflicts, drifted, find, occurrences, oversized, posts_changed, replace, unreviewed_matches
admin.blog.category_created	An admin blog category was created.	category_id, name, slug
admin.blog.category_updated	An admin blog category was updated.	category_id, changed_fields, slug
admin.blog.parity_fix	An admin blog parity fix was applied.	blog_heads_aligned, blog_post_revisions_inserted, blog_posts_updated, conflicts, document_writes, drifted, posts_planned, slug
admin.blog.redirect_created	An admin blog redirect was created.	redirect_id, source_path, target_path, target_post_id
admin.blog.redirect_updated	An admin blog redirect was updated.	previous_target, redirect_id, source_path, target_path, target_post_id
admin.blog.post_deleted	An admin blog post was deleted.	post_id, redirect_path, released_slug, source_path, title
admin.blog.post_published	An admin blog post was published.	head_revision_id, post_id, previous_status, slug
admin.blog.post_redirect_updated	An admin blog post redirect was updated.	post_id, previous_redirect_path, redirect_path, source_path, title
admin.blog.post_url_changed	An admin blog post URL was changed.	path, post_id, previous_path, redirect_created
admin.blog.post_scheduled	An admin blog post was scheduled.	head_revision_id, post_id, previous_status, publish_at, slug
admin.blog.post_slug_released	An admin blog post slug was released.	post_id, released_slug, source_path
admin.blog.post_unpublished	An admin blog post was unpublished.	post_id, previous_status, slug
admin.blog.publish_override	An admin blog publish override was recorded.	head_revision_id, issue_count, issue_counts, issues_sha256, post_id, slug
admin.blog.team_role_updated	An admin blog team role was updated.	actor_email, actor_user_id, previous_role, role, target_email, target_user_id

Admin community

Event type	Description	Metadata
admin.community_event.created	Backoffice community-event management. Beyond the usual who-changed-what, send_start_reminder on these events decides whether every registrant gets an outbound “starting now” notification, and a delete drops the whole registration cohort, both need an attributable record.
admin.community_event.updated	An admin community event was updated.
admin.community_event.deleted	An admin community event was deleted.
admin.community.verification_changed	An admin granted or removed a community listing’s verified state (is_official). It puts a public Base44 trust badge on the listing and suppresses the leaving-Base44 warning, so the flip needs an attributable who/when record.	community_id, is_official, name, previous_is_official
admin.badge_award.granted	Identity-badge awards a human decides (Launchpad / Shark Tank / Vibe Sprint wins). The grant is what earns the badge, and revoking does not un-earn it, so both sides of the decision need a trail.	award_key, reason, target_user_id
admin.badge_award.revoked	An admin badge award was revoked.	award_key, target_user_id

Marketing campaigns

Event type	Description	Metadata
marketing_campaigns.triggered	An external system queueing recipients on an API-triggered campaign with the trigger key.	queued, recipients

Catalog

Event type	Description	Metadata
catalog.listing.admin_edited	Platform admin directly edited a template catalog listing’s metadata (name/description/categories/screenshots), bypassing the submit-update review flow. metadata.changes carries per-field old/new values.	actor_email, changes, listing_id
catalog.listing.converted_to_free	A seller took the price off their template listing (paid -> free), applied live without review. One-way while paid listings are sunset, and it is what the 30-day notice asks sellers to do, so the who/when is worth keeping.	actor_email, listing_id, previous_price_usd
catalog.listing.archived_by_sunset	Recorded only by the removed one-off sunset script (2026-10-01); kept so its audit rows stay typed.
catalog.taxonomy.category_featured_changed	An admin marked/unmarked a taxonomy category as featured (drives the marketing “Featured” tab).	actor_email, category_slug_id, featured, type

Partners

Event type	Description	Metadata
partner.contact.spam_reported	A partner reported a client for spam/abuse from a contact thread. The audit row is the queryable trust & safety record: metadata.reported_user_id is what turns single reports into “N distinct partners reported this requester”, which is the signal a coordinated spray produces and a single partner’s dispute does not.	contact_request_id, partner_profile_id, reported_user_id
partner.payment_suggestion.dismissed	A partner payment suggestion was dismissed.	contact_request_id, scope

Profile

Event type	Description	Metadata
profile.pinned_app.security_acknowledged	The pinner accepted the public-profile exposure notice for these apps; the row is the record of what they were shown (scan state + finding counts) at the time.

Workspace compliance

Event type	Description	Metadata
workspace.compliance_api.read	Workspace API key management The family below is key lifecycle only; this is the one “key was used to read” event.	endpoint, partner, scope, window_seconds

Personal access tokens

Event type	Description	Metadata
workspace.personal_access_token.created	Personal access token management. Two principals mutate the same row, the owner and a governing workspace admin, so every event carries an actor_role in its metadata.	actor_role, app_access_mode, app_ids, permission, token_id, token_name, token_prefix, token_user_id, violations
workspace.personal_access_token.updated	A workspace personal access token was updated.	actor_role, token_id, token_name, token_prefix, token_user_id
workspace.personal_access_token.disabled	A workspace personal access token was disabled.	actor_role, new_status, old_status, token_id, token_name, token_prefix, token_user_id
workspace.personal_access_token.enabled	A workspace personal access token was enabled.	actor_role, new_status, old_status, token_id, token_name, token_prefix, token_user_id
workspace.personal_access_token.deleted	A workspace personal access token was deleted.	actor_role, token_id, token_name, token_prefix, token_user_id

Workspace webhooks

Event type	Description	Metadata
workspace.webhook.created	Workspace webhook management. A listener URL is an ingress credential, so minting, re-pointing, rotating and revoking one are all auditable; the inbound events it then receives are not (server-to-server, not a person).	display_name, name, provider_hint, verification_mode, webhook_id
workspace.webhook.updated	A workspace webhook was updated.	changed, creator_user_id, display_name, name, provider_hint, verification_mode, webhook_id
workspace.webhook.token_rotated	A workspace webhook token was rotated.	creator_user_id, display_name, name, provider_hint, verification_mode, webhook_id
workspace.webhook.paused	A workspace webhook was paused.	creator_user_id, display_name, name, provider_hint, verification_mode, webhook_id
workspace.webhook.resumed	A workspace webhook was resumed.	creator_user_id, display_name, name, provider_hint, verification_mode, via, webhook_id
workspace.webhook.deleted	A workspace webhook was deleted.	creator_user_id, display_name, name, provider_hint, verification_mode, webhook_id
workspace.webhook.shape_set	A workspace webhook payload shape was set.	display_name, event_type_key, name, provider_hint, verification_mode, webhook_id
workspace.webhook.attached	Attaching decides whether the URL accepts at all, so it belongs with the rest of the listener’s lifecycle even though a workflow save triggers it.	display_name, name, provider_hint, verification_mode, webhook_id, workflow_id
workspace.webhook.detached	A workspace webhook was detached.	display_name, name, provider_hint, verification_mode, webhook_id, workflow_id
workspace.webhook.url_revealed	Reads are normally not auditable, but an owner/admin opening a listener they did not create is a privileged cross-user read, and “who looked at mine” is the question asked after an incident.	creator_user_id, display_name, name, provider_hint, verification_mode, webhook_id

Workspace outbound webhooks

Event type	Description	Metadata
workspace.outbound_webhook.created	Outbound webhook management, the egress direction, a different product from the WORKSPACE_WEBHOOK_* group above (those are inbound listeners). A registered endpoint receives every selected app lifecycle event in the workspace, so its URL decides where that data goes: registering, re-pointing and activating one are all auditable.	endpoint_id, selected_event_types, state, target_url
workspace.outbound_webhook.updated	A workspace outbound webhook was updated.	deactivated, endpoint_id, previous_target_url, selected_event_types, state, target_url
workspace.outbound_webhook.activated	A workspace outbound webhook was activated.	endpoint_id, selected_event_types, state, target_url
workspace.outbound_webhook.activation_failed	A workspace outbound webhook activation failed.	endpoint_id, failure_category, http_status, selected_event_types, state, target_url
workspace.outbound_webhook.paused	A workspace outbound webhook was paused.	consecutive_failed_deliveries, endpoint_id, selected_event_types, state, target_url
workspace.outbound_webhook.resumed	A workspace outbound webhook was resumed.	endpoint_id, selected_event_types, state, target_url
workspace.outbound_webhook.deleted	A workspace outbound webhook was deleted.	endpoint_id, selected_event_types, state, target_url
workspace.outbound_webhook.replayed	A workspace outbound webhook was replayed.	delivery_id, endpoint_id, generation, selected_event_types, state, target_url
workspace.outbound_webhook.recovered	A workspace outbound webhook was recovered.	endpoint_id, requeued, selected_event_types, since, state, target_url
workspace.outbound_webhook.signing_key_rotated	A workspace outbound webhook signing key was rotated.
workspace.outbound_webhook.signing_key_rotation_completed	A workspace outbound webhook signing key rotation completed.
workspace.outbound_webhook.signing_key_revoked	A workspace outbound webhook signing key was revoked.

Data operations

Event type	Description	Metadata
data.exported	A data was exported.	app_name, entity_record_count, export_raw_data, export_type, file_count, format
data.imported	A data was imported.	entity_name, format, record_count

File operations

Event type	Description	Metadata
file.uploaded	A file was uploaded.	actor_email, content_type, file_name, listing_id, purpose, size, visibility

GDPR erasure

Event type	Description	Metadata
gdpr.workspace.files_erased	GDPR data erasure. One event per sole-member workspace whose owned files (brand assets, fonts) the erasure sweep deleted; the actor is the GDPR lifecycle cron, not a human.	actor_email, files_deleted, reason, target_email, target_user_id, workspace_id
gdpr.request.recovered	A deletion request orphaned in IN_PROGRESS by a worker death was routed back into the lifecycle by the recover sweep; the actor is the GDPR lifecycle cron, not a human.	action, actor_email, request_id, requeued_to, roster_gap, target_email, target_user_id, trigger, unfinished_tasks
gdpr.version_history.erased	One event per app whose version-history pre-images were VERIFIED physically gone from every region, written by the entity-version erasure cron.	actor_email, app_id, regions, source, verified_at

Workspace erasure

Event type	Description	Metadata
workspace.erasure.planned	A workspace erasure was planned.	attempt, manifest_sha256, request_id
workspace.erasure.approved	A workspace erasure was approved.	attempt, manifest_sha256, request_id
workspace.erasure.started	A workspace erasure was started.	manifest_sha256, request_id
workspace.erasure.completed	A workspace erasure completed.	manifest_sha256, request_id
workspace.erasure.failed	A workspace erasure failed.	manifest_sha256, request_id
workspace.erasure.recovered	A workspace erasure was recovered.	attempt, manifest_sha256, request_id

Google Ads

Event type	Description	Metadata
google_ads.account.lifecycle_changed	Google Ads backoffice (support agent actions). The specific operation is carried in the audit row’s metadata["subtype"]; these 6 members keep the enum coarse so dashboards/alerts group by domain, not by every button.	account_id, action_id, amount_cents, billing_setup_resource, block_reason, budget_end_confirmed, budget_reactivation_failed, cadence, charge_status, currency_code, current_status, decline_code, denylist_owner_present, error, from, monthly_limit_dollars, noop, organization_id, prior_block_reason, promoted, reason, recommended_next_action, recovered_default_cap, restored_status, risk_evidence_preserved, subtype, ticket_id, to, user_email, was_finalized
google_ads.billing.action	A Google Ads billing action was recorded.	account_id, action_id, amount_micros, blocking_credit_id, blocking_credit_type, blocking_status, code, credit_id, currency_code, decline_code, error, month, organization_id, reason, result, status, subtype, ticket_id, user_email, year
google_ads.note.changed	A Google Ads note was changed.	account_id, action_id, fields, is_pinned, note_id, organization_id, reason, subtype, ticket_id, user_email
google_ads.sync.triggered	A Google Ads sync was triggered.	account_id, action_id, counts, currency_code, detect_degraded, drift_count, error, escalated, noop_drifts, organization_id, partial, reason, reconcile_campaigns, reconcile_error, remediated, skipped, status, subtype, sync_types, ticket_id, total_cost_micros, user_email, window
google_ads.dispute.status_updated	A Google Ads dispute status was updated.	account_id, action_id, internal_note, organization_id, reason, resolution_status, stripe_event_id, subtype, ticket_id, user_email
google_ads.video.uploaded	NOT a backoffice action: the app owner published their own video bytes to the Google-managed YouTube channel behind our MCC. External publication is the auditable act, and the file.uploaded row from staging the file in our storage does not record it (nor whether it reached YouTube).	account_id, still_processing, upload_rn, video_id
google_ads.product_feed.provisioned	The owner’s product-feed check created or changed Merchant Center setup on their behalf: sub-account, homepage claim, data source, or the Ads link.	account_id, changed

Community

Event type	Description	Metadata
community.agent.provisioned	A community agent was provisioned.	agent_app_id, kind, source
community.draft.sent	A community draft was sent.	approved, draft_id, edited, kind, queued, segment_id, skipped, topic
community.autonomy.changed	A community autonomy was changed.	enabled, kind, matched, mode, setting, topic, via
community.channel.claimed	A community channel was claimed.	channel, ig_account_id

Admin base router

Event type	Description	Metadata
admin.base_router.metric_created	An admin base router metric was created.	kind, metric_id, name, source, workflow
admin.base_router.metric_updated	An admin base router metric was updated.	kind, metric_id, name, source, workflow
admin.base_router.metric_deleted	An admin base router metric was deleted.	kind, metric_id, name, source, workflow
admin.base_router.policy_published	An admin base router policy was published.	manifest_version, owner, reason, version, workflow
admin.base_router.policy_reverted	An admin base router policy was reverted.	manifest_version, owner, reason, reverted_to, version, workflow
admin.base_router.policy_returned_to_yaml	An admin base router policy was returned to its YAML source.	manifest_version, owner, reason, version, workflow

App MCP connections

Event type	Description	Metadata
app_mcp.connections.revoked_on_disable	Per-app MCP connections (an AI client holding an app-user’s OAuth grant). Deactivating MCP kills every connection at once, which is the event a future investigator needs to explain why all of an app’s connectors stopped.	revoked_count

Agent Slack

Event type	Description	Metadata
agent.slack.reply_mode_changed	Superagent Slack channel (what the agent ingests, and who is billed for it).	channel_id, scope, smart_reply, team_id, via

---

Metadata key reference

All metadata values are strings.

access_type

Value of access type recorded for this event.

account_count

Number of account.

account_id

Identifier of the account.

account_key_decision

Value of account key decision recorded for this event.

account_login

Value of account login recorded for this event.

account_type

Value of account type recorded for this event.

accuracy_bucket

Bucket describing how precise the device location reading was.

action

Value of action recorded for this event.

action_id

Identifier of the action.

actions

Value of actions recorded for this event.

actor_email

Email address recorded as actor email.

actor_role

Value of actor role recorded for this event.

actor_user_id

Identifier of the actor user.

added

Value of added recorded for this event.

address_status

Status of the reverse-geocoded address for a device location reading.

admin_email

Email address recorded as admin email.

admin_user_id

Identifier of the admin user.

affected_count

Number of affected.

after

Value of after recorded for this event.

after_id

Identifier of the after.

age_seconds

Value of age seconds recorded for this event.

agent_app_id

Identifier of the agent app.

agent_id

Identifier of the agent.

agent_name

Name of the AI agent.

algorithm

Value of algorithm recorded for this event.

allowed_channels_new

Value of allowed channels new recorded for this event.

already_applied

Value of already applied recorded for this event.

amount

Value of amount recorded for this event.

amount_cents

Value of amount cents recorded for this event.

amount_micros

Value of amount micros recorded for this event.

amount_total

Value of amount total recorded for this event.

app_access_mode

Value of app access mode recorded for this event.

app_count

Number of app.

app_id

Identifier of the app.

app_ids

Identifiers recorded for app.

app_name

Name of the app.

app_names

Names of the app.

app_type

Type of the app.

app_user_deleted

Value of app user deleted recorded for this event.

app_users_deleted

Number of app user records deleted when a data residency migration was finalized.

approved

Value of approved recorded for this event.

assigned_role

Value of assigned role recorded for this event.

attempt

Value of attempt recorded for this event.

attempt_id

Identifier of the data residency migration attempt.

auth_method

Authentication method (e.g. email_password, google).

auth_provider

OAuth provider name, if applicable.

author_id

Identifier of the author.

authored_invite_cap

Value of authored invite cap recorded for this event.

auto_approved

Value of auto approved recorded for this event.

automation_id

ID of the automation.

automation_mode

Value of automation mode recorded for this event.

automation_name

Name of the automation.

automation_type

Type of automation (e.g. scheduled, triggered).

award_key

Value of award key recorded for this event.

backend_functions_issues_count

Number of backend-function authorization issues.

base44_head

Value of base44 head recorded for this event.

base_branch

Value of base branch recorded for this event.

base_plan_id

Identifier of the base plan.

baseline_hash

Value of baseline hash recorded for this event.

batch_id

Identifier of the batch.

before

Value of before recorded for this event.

billing_cycle

Billing cycle the coupon applies to.

billing_interval

Value of billing interval recorded for this event.

billing_setup_resource

Value of billing setup resource recorded for this event.

blanked

Value of blanked recorded for this event.

blobs_rewrapped

Number of encrypted blobs re-wrapped during a dedicated KMS migration or revert.

block_reason

Value of block reason recorded for this event.

blocking_credit_id

Identifier of the blocking credit.

blocking_credit_type

Value of blocking credit type recorded for this event.

blocking_status

Status recorded for this event.

blog_heads_aligned

Value of blog heads aligned recorded for this event.

blog_post_revisions_inserted

Value of blog post revisions inserted recorded for this event.

blog_posts_updated

Value of blog posts updated recorded for this event.

bonus_credit_id

Identifier of the bonus credit.

branch

Value of branch recorded for this event.

branch_id

Identifier of the branch.

budget_end_confirmed

Value of budget end confirmed recorded for this event.

budget_reactivation_failed

Value of budget reactivation failed recorded for this event.

bulk_operation

Value of bulk operation recorded for this event.

bulk_run_id

Identifier of the bulk run.

business_id

Identifier of the business.

cadence

Value of cadence recorded for this event.

campaign_id

Identifier of the coupon campaign.

cancelled

Value of cancelled recorded for this event.

cancelled_by

Value of cancelled by recorded for this event.

capability

Value of capability recorded for this event.

category_id

Identifier of the category.

category_slug_id

Identifier of the category slug.

cause

Value of cause recorded for this event.

change_type

Value of change type recorded for this event.

changed

Value of changed recorded for this event.

changed_fields

Value of changed fields recorded for this event.

changes

Value of changes recorded for this event.

channel

Value of channel recorded for this event.

channel_count

Number of channel.

channel_id

Identifier of the channel.

characters

Value of characters recorded for this event.

charge_status

Status recorded for this event.

checkout_id

Identifier of the checkout.

checkpoint_id

Deployment checkpoint ID.

claiming_organization_id

Identifier of the claiming organization.

cleared

Value of cleared recorded for this event.

client_id

Identifier of the client.

client_ip

Value of client ip recorded for this event.

code

Value of code recorded for this event.

code_count

Number of coupon codes requested or generated.

code_mode

Whether the premium coupon request issued a shared code or unique codes.

code_page_routes

Value of code page routes recorded for this event.

collaboration_mode

Value of collaboration mode recorded for this event.

collaborator_source

Value of collaborator source recorded for this event.

collections

Value of collections recorded for this event.

comment

Value of comment recorded for this event.

comment_id

Identifier of the comment.

commit

Value of commit recorded for this event.

community_id

Identifier of the community.

comparison_id

Identifier of the comparison.

competitor_research

Value of competitor research recorded for this event.

conflicts

Value of conflicts recorded for this event.

connection_id

Identifier of the connection.

connector

Value of connector recorded for this event.

connector_id

Identifier of the connector.

consecutive_failed_deliveries

Value of consecutive failed deliveries recorded for this event.

consented_products

Value of consented products recorded for this event.

contact_request_id

Identifier of the contact request.

content_type

Value of content type recorded for this event.

conversation_id

ID of the AI agent conversation.

cookie_count

Number of cookie.

count

Number of affected records, invoices, or other items.

counts

Value of counts recorded for this event.

coupon_id

Identifier of the coupon.

coverage_incomplete

The string "true" when any scan section is failed, not_run, unknown, or has missing historical coverage. This key is absent when all five sections completed and is never emitted as "false".

created

Number of records created by the operation.

created_index_count

Number of created index.

creator_user_id

Identifier of the creator user.

credit_count

Credits consumed by the operation.

credit_id

Identifier of the credit.

credit_limit

Value of credit limit recorded for this event.

credit_type

Value of credit type recorded for this event.

credits

Value of credits recorded for this event.

critical_findings_count

Number of dependency and static-code findings with critical severity.

cross_app_allowed_app_ids

Identifiers recorded for cross app allowed app.

cross_user_access

Value of cross user access recorded for this event.

currency

Value of currency recorded for this event.

currency_code

Value of currency code recorded for this event.

current_status

Status recorded for this event.

custom_groups_removed

Value of custom groups removed recorded for this event.

custom_section_count

Number of custom section.

daily_limit

Value of daily limit recorded for this event.

data_as_of

Value of data as of recorded for this event.

database

Value of database recorded for this event.

deactivated

Value of deactivated recorded for this event.

decision

Value of decision recorded for this event.

decline_code

Value of decline code recorded for this event.

default_credit_limit

Value of default credit limit recorded for this event.

deleted

Value of deleted recorded for this event.

deleted_count

Number of records deleted.

deletion_date

Value of deletion date recorded for this event.

delivery_id

Identifier of the delivery.

denylist_owner_present

Value of denylist owner present recorded for this event.

department

Department recorded on the coupon request.

dependency_vulnerabilities_count

Number of dependency vulnerabilities.

deployed

Value of deployed recorded for this event.

deployment_id

Identifier of the deployment.

description

Value of description recorded for this event.

detail

Value of detail recorded for this event.

detect_degraded

Value of detect degraded recorded for this event.

detector

Value of detector recorded for this event.

device_id

Identifier of the device.

digit_count

Number of digit.

direction

Direction of a dedicated KMS operation, to_dedicated or to_shared.

disabled_reason

Value of disabled reason recorded for this event.

disconnected_app_count

Number of disconnected app.

discount_cycles

Number of billing cycles the discount applies to.

discount_percent

Discount percent on the coupon.

display_name

Name of the display.

document_writes

Value of document writes recorded for this event.

domain

The domain name.

domain_id

The domain ID.

domains

Value of domains recorded for this event.

draft_id

Identifier of the draft.

drafting_enabled

Value of drafting enabled recorded for this event.

drift_count

Number of drift.

drifted

Value of drifted recorded for this event.

dry_run

Value of dry run recorded for this event.

duration_ms

Execution time in milliseconds.

duration_seconds

Value of duration seconds recorded for this event.

edited

Value of edited recorded for this event.

effective

Value of effective recorded for this event.

effective_enforcement

Value of effective enforcement recorded for this event.

element_tag

Tag of the preview element the comment is attached to.

eligible_count

Number of eligible.

email

Value of email recorded for this event.

email_cleartext

Email address, included only for internal addresses during authentication auditing.

email_domain

Domain portion of the user’s email address.

email_hash

SHA-256 hash of the user’s email address.

enable_all

Value of enable all recorded for this event.

enabled

Whether the setting was turned on.

enabled_profile_count

Number of enabled profile.

endpoint

Value of endpoint recorded for this event.

endpoint_count

Number of endpoints on the custom integration.

endpoint_id

Identifier of the webhook endpoint.

enforce_sso_intent

Value of enforce sso intent recorded for this event.

enforced_new

Value of enforced new recorded for this event.

engine

Value of engine recorded for this event.

enrolled

Value of enrolled recorded for this event.

entity_id

ID of the affected entity record.

entity_name

Name of the entity.

entity_names

Names of the entity.

entity_record_count

Number of entity record.

entitys_deleted

Number of entity records deleted when a data residency migration was finalized.

entry_point

Value of entry point recorded for this event.

environment

Value of environment recorded for this event.

environment_name

Name of the environment.

error

Error recorded for the operation. This is a short error string, not a secret.

error_code

Error code recorded when the operation failed.

error_count

Number of error.

errors

Value of errors recorded for this event.

escalated

Value of escalated recorded for this event.

event_type_key

Value of event type key recorded for this event.

events

Value of events recorded for this event.

evidence_sha256

Value of evidence sha256 recorded for this event.

exception_type

Value of exception type recorded for this event.

expected_account_login

Value of expected account login recorded for this event.

export_raw_data

Value of export raw data recorded for this event.

export_type

Value of export type recorded for this event.

extra_urls_count

Number of extra urls.

failed

Value of failed recorded for this event.

failed_app_count

Number of failed app.

failed_steps

Value of failed steps recorded for this event.

failure_category

Category recorded when the operation failed.

failure_id

Identifier of the failure.

failure_reason

Reason for failure when status is "failure".

feature_changes

Value of feature changes recorded for this event.

featured

Value of featured recorded for this event.

featured_count

Number of featured.

feedback_id

Identifier of the feedback.

fields

Fields included in a query response.

fields_changed

Comma-separated list of fields that were changed.

file_count

Number of file.

file_id

Identifier of the file.

file_name

Name of the file.

file_path

Path of the file being edited.

files

Value of files recorded for this event.

files_deleted

Value of files deleted recorded for this event.

filter_count

Number of filter.

filter_fields

Field names being filtered on in a query (e.g. data.status, data.user_id).

filtering_enabled

Value of filtering enabled recorded for this event.

find

Value of find recorded for this event.

finding_type

Value of finding type recorded for this event.

findings_total

Number of findings from scan sections that completed. When coverage_incomplete is present, this value is a floor rather than an authoritative total.

fingerprint

Value of fingerprint recorded for this event.

first_year_price_cents

Value of first year price cents recorded for this event.

fix_type

Value of fix type recorded for this event.

flag

Value of flag recorded for this event.

flow

Value of flow recorded for this event.

followup_key

Identifier of the superagent follow-up.

force

Value of force recorded for this event.

form_type

Value of form type recorded for this event.

format

Value of format recorded for this event.

found

Value of found recorded for this event.

from

Previous value before a change, such as a Google Ads cadence change.

from_mode

Value of from mode recorded for this event.

from_state

Dedicated KMS state the workspace was in when a retry was requested.

from_status

Status recorded for this event.

full

Value of full recorded for this event.

function_name

Name of the backend function or integration function.

generation

Value of generation recorded for this event.

generation_id

Identifier of the generation.

gift_card_id

Identifier of the gift card.

github_head

Value of github head recorded for this event.

goal_id

Identifier of the goal.

goal_name

Name of the goal.

goal_status

Status recorded for this event.

goal_task_id

Identifier of the goal task.

group_id

Identifier of the group.

group_ids

Identifiers recorded for group.

group_name

Name of the group.

had_hold

Value of had hold recorded for this event.

had_typed_notes

Value of had typed notes recorded for this event.

hardcoded_secrets_count

Number of hardcoded-secret findings.

has_collaborators

Whether this event recorded collaborators.

has_cover

Whether this event recorded cover.

has_description

Whether this event recorded description.

has_expiry

Whether the notification rule has an expiry.

has_logo

Whether this event recorded logo.

has_name

Whether this event recorded name.

has_recipient

Whether this event recorded recipient.

has_rls

Whether row-level security is enabled on the entity schema.

head_revision_id

Identifier of the blog post revision that was published.

high_findings_count

Number of dependency and static-code findings with high severity.

highest_scored_severity

Highest recognized severity among dependency and static-code findings only. Possible values are critical, high, medium, low, and none.

history_outcome

Value of history outcome recorded for this event.

http_status

HTTP status recorded for the operation.

identity_id

Identifier of the identity.

identity_type

Value of identity type recorded for this event.

idp_groups_held

Value of idp groups held recorded for this event.

ig_account_id

Identifier of the ig account.

immediate

Value of immediate recorded for this event.

include_subdomains

Value of include subdomains recorded for this event.

index

Value of index recorded for this event.

initial_member_count

Number of initial member.

initiated_by

Value of initiated by recorded for this event.

insight_id

Identifier of the insight.

installation_id

Identifier of the installation.

institution_id

Identifier of the institution.

institution_name

Name of the institution.

integration_name

Name of the custom integration.

integration_slug

Slug identifier of the custom integration.

integration_type

Type of OAuth integration.

interest_id

Identifier of the interest.

internal_note

Value of internal note recorded for this event.

invitation_count

Number of invitations sent in a bulk invite.

invitation_email

Email associated with the invitation.

invite_count

Number of invite.

invitee_email

Email of the invited user.

invitee_emails

Comma-separated emails of invited users (bulk invite).

inviter_email

Email address recorded as inviter email.

invoice_id

Identifier of the invoice.

is_app_owner

Whether app owner applies to this event.

is_enterprise

Whether the workspace is on an enterprise plan.

is_new_user

Whether this is the user’s first login.

is_official

Whether official applies to this event.

is_pinned

Whether pinned applies to this event.

issue_count

Number of issue.

issue_counts

Value of issue counts recorded for this event.

issue_id

Identifier of the issue.

issues_sha256

Value of issues sha256 recorded for this event.

item_count

Number of item.

item_id

Identifier of the item.

item_key

Value of item key recorded for this event.

keep_sender_as_collaborator

Value of keep sender as collaborator recorded for this event.

key_alias

Alias of the workspace’s dedicated KMS key.

key_arn

ARN of the workspace’s dedicated KMS key.

key_id

ID of the workspace API key.

key_name

Name of the workspace API key.

key_prefix

Non-secret prefix of the API key, used to identify it without exposing the secret.

key_source

Value of key source recorded for this event.

key_type

Value of key type recorded for this event.

kind

Value of kind recorded for this event.

label

Value of label recorded for this event.

label_backfill_started

Value of label backfill started recorded for this event.

label_count

Number of label.

labeling_enabled

Value of labeling enabled recorded for this event.

lifted

Value of lifted recorded for this event.

limit

Maximum number of records requested in a query.

linked_existing

Value of linked existing recorded for this event.

listing_id

Identifier of the listing.

low_findings_count

Number of dependency and static-code findings with low severity.

mailbox_profile_generated

Value of mailbox profile generated recorded for this event.

manifest_hash

Value of manifest hash recorded for this event.

manifest_sha256

SHA-256 digest of the workspace erasure manifest.

manifest_version

Value of manifest version recorded for this event.

match_type

Value of match type recorded for this event.

matched

Value of matched recorded for this event.

materialization_job_id

Identifier of the materialization job.

max_number_of_people

Value of max number of people recorded for this event.

max_redemptions

Maximum number of redemptions configured for the coupon.

mcp_oauth

Whether the login was initiated via an MCP OAuth flow.

mechanism

Value of mechanism recorded for this event.

medium_findings_count

Number of dependency and static-code findings with medium severity.

member_count

Number of member.

member_email

Email address recorded as member email.

member_emails

Email addresses recorded as member emails.

memory_id

Identifier of the memory.

merchant_id

Identifier of the merchant.

message_count

Number of messages in an AI agent conversation.

messages

Value of messages recorded for this event.

metasite_id

Identifier of the metasite.

method

Bulk operation method.

metric_id

Identifier of the metric.

mfa_method

MFA method used (e.g. totp, sms).

minted_by_key_id

Identifier of the minted by key.

missing

Value of missing recorded for this event.

mode

Mode recorded for the operation.

model

Value of model recorded for this event.

model_id

Identifier of the model.

model_ids

Identifiers recorded for model.

month

Value of month recorded for this event.

monthly_limit_dollars

Value of monthly limit dollars recorded for this event.

move_type

Value of move type recorded for this event.

name

Value of name recorded for this event.

needs_review_changes

Value of needs review changes recorded for this event.

new

Value of new recorded for this event.

new_allowed_consumers

New allowed consumers after the change.

new_billing_interval

New billing interval after the change.

new_description

New description after an update.

new_enabled

New enabled after the change.

new_file_key

New file key after the change.

new_group_app_policies

New group app policies after the change.

new_name

New name after a rename.

new_orgs

New orgs after the change.

new_owner_email

New owner email after the change.

new_owner_id

New owner id after the change.

new_owner_previous_role

New owner previous role after the change.

new_role

New role after a role change.

new_role_app_policies

New role app policies after the change.

new_status

New status after the change.

new_stripe_price_id

New stripe price id after the change.

new_stripe_subscription_id

New stripe subscription id after the change.

new_stripe_subscription_status

New stripe subscription status after the change.

new_subscription_period_end

New subscription period end after the change.

new_subscription_period_start

New subscription period start after the change.

new_tier

New tier after the change.

new_value

New value after the change.

new_workspace_id

New workspace id after the change.

newly_installed

Value of newly installed recorded for this event.

noop

Value of noop recorded for this event.

noop_drifts

Value of noop drifts recorded for this event.

note_id

Identifier of the note.

notification_channel

Value of notification channel recorded for this event.

notification_type

Value of notification type recorded for this event.

oauth_error_type

Type of OAuth error on failure.

observation_count

Number of observation.

observation_id

Identifier of the observation.

observation_source_count

Number of observation source.

occurrences

Value of occurrences recorded for this event.

offences

Value of offences recorded for this event.

old_allowed_consumers

Previous allowed consumers before the change.

old_description

Previous description before an update.

old_file_key

Previous file key before the change.

old_group_app_policies

Previous group app policies before the change.

old_name

Previous name before a rename.

old_role

Previous role before a role change.

old_role_app_policies

Previous role app policies before the change.

old_status

Previous status before the change.

old_value

Previous value before the change.

onboarding_version

Value of onboarding version recorded for this event.

operation

Value of operation recorded for this event.

operator_email

Email address recorded as operator email.

operator_role

Value of operator role recorded for this event.

organization_id

Identifier of the organization.

origin

Value of origin recorded for this event.

original_transaction_id

Identifier of the original transaction.

outcome

Outcome recorded for the operation.

oversized

Value of oversized recorded for this event.

owner

Value of owner recorded for this event.

owner_id

Identifier of the owner.

owner_type

Value of owner type recorded for this event.

ownerless_repair

Value of ownerless repair recorded for this event.

packages

Value of packages recorded for this event.

page_name

Name of the visited page.

page_path

Path of the page the comment is attached to.

partial

Value of partial recorded for this event.

partner

Value of partner recorded for this event.

partner_id

Identifier of the partner.

partner_profile_id

Identifier of the partner profile.

passes

Number of re-wrap passes completed during a dedicated KMS migration or revert.

path

Value of path recorded for this event.

paused

Value of paused recorded for this event.

payer_id

Identifier of the payer.

permission

Value of permission recorded for this event.

plan

Value of plan recorded for this event.

plan_platforms

Value of plan platforms recorded for this event.

plan_scaled

Value of plan scaled recorded for this event.

platform

Value of platform recorded for this event.

platform_role

Value of platform role recorded for this event.

platforms

Value of platforms recorded for this event.

post_id

Identifier of the blog post.

posts_changed

Value of posts changed recorded for this event.

posts_planned

Value of posts planned recorded for this event.

precision

Location precision that was requested or applied.

preference

Value of preference recorded for this event.

premium_coupon_request_id

Identifier of the premium coupon request.

preview_changes

Value of preview changes recorded for this event.

preview_id

Identifier of the preview.

previous

Value of previous recorded for this event.

previous_added

Value of previous added recorded for this event.

previous_disabled_reason

Value of previous disabled reason recorded for this event.

previous_enabled

Value of previous enabled recorded for this event.

previous_is_official

Value of previous is official recorded for this event.

previous_methods

Value of previous methods recorded for this event.

previous_mode

Value of previous mode recorded for this event.

previous_name

Name of the previous.

previous_organization_ids

Identifiers recorded for previous organization.

previous_orgs

Value of previous orgs recorded for this event.

previous_owner_email

Email address recorded as previous owner email.

previous_owner_id

Identifier of the previous owner.

previous_owner_new_role

Value of previous owner new role recorded for this event.

previous_path

Value of previous path recorded for this event.

previous_price_usd

Value of previous price usd recorded for this event.

previous_redirect_path

Value of previous redirect path recorded for this event.

previous_removed

Value of previous removed recorded for this event.

previous_role

Value of previous role recorded for this event.

previous_scheduled_at

Timestamp recorded as previous scheduled at.

previous_slug

Value of previous slug recorded for this event.

previous_status

Status of the record before this change.

previous_stripe_price_id

Identifier of the previous stripe price.

previous_stripe_subscription_id

Identifier of the previous stripe subscription.

previous_stripe_subscription_status

Status recorded for this event.

previous_subscription_period_end

Value of previous subscription period end recorded for this event.

previous_subscription_period_start

Value of previous subscription period start recorded for this event.

previous_target

Value of previous target recorded for this event.

previous_target_url

URL recorded as previous target url.

previous_tier

Value of previous tier recorded for this event.

previous_value

Value of previous value recorded for this event.

previous_workflow_id

Identifier of the previous workflow.

previous_workspace_id

Identifier of the previous workspace.

previously_revoked

Value of previously revoked recorded for this event.

principal_user_id

Identifier of the principal user.

prior_block_reason

Value of prior block reason recorded for this event.

processed

Value of processed recorded for this event.

product_count

Number of product.

product_id

Identifier of the product.

profile_id

Identifier of the profile.

promoted

Value of promoted recorded for this event.

protected

Value of protected recorded for this event.

provider

Value of provider recorded for this event.

provider_hint

Value of provider hint recorded for this event.

provider_switched_from

Value of provider switched from recorded for this event.

publish_at

Timestamp recorded as publish at.

publish_dry_run

Value of publish dry run recorded for this event.

published_count

Number of published.

published_state

Value of published state recorded for this event.

pull_request

Value of pull request recorded for this event.

purpose

Value of purpose recorded for this event.

queued

Value of queued recorded for this event.

reason

Value of reason recorded for this event.

reason_code

Value of reason code recorded for this event.

recipients

Value of recipients recorded for this event.

recipients_notified

Value of recipients notified recorded for this event.

recommended_next_action

Value of recommended next action recorded for this event.

reconcile_campaigns

Value of reconcile campaigns recorded for this event.

reconcile_error

Value of reconcile error recorded for this event.

record_count

Number of record.

record_id

Identifier of the record.

records_scanned

Value of records scanned recorded for this event.

recovered_default_cap

Value of recovered default cap recorded for this event.

recurring

Value of recurring recorded for this event.

redirect_created

Value of redirect created recorded for this event.

redirect_id

Identifier of the redirect.

redirect_path

Value of redirect path recorded for this event.

refund_status

Status recorded for this event.

regions

Value of regions recorded for this event.

registration_id

Identifier of the registration.

registration_method

How the app user registered.

released_slug

Value of released slug recorded for this event.

remaining_app_count

Number of remaining app.

remediated

Value of remediated recorded for this event.

removed

Value of removed recorded for this event.

rendered

Value of rendered recorded for this event.

replace

Value of replace recorded for this event.

replacement_key_arn

Value of replacement key arn recorded for this event.

repo

Value of repo recorded for this event.

repo_full_name

Name of the repo full.

report_recipient

Value of report recipient recorded for this event.

reported_user_id

Identifier of the reported user.

reporter_kind

Value of reporter kind recorded for this event.

repository_selection

Value of repository selection recorded for this event.

request_id

Identifier of the request.

requested_visibility

Value of requested visibility recorded for this event.

requester_email

Email of the user requesting access.

requeued

Value of requeued recorded for this event.

requeued_to

Value of requeued to recorded for this event.

resolution_status

Status recorded for this event.

resolved_status

Status recorded for this event.

resource_id

Identifier of the resource.

resource_name

Name of the resource.

resource_type

Value of resource type recorded for this event.

restored_status

Status recorded for this event.

result

Value of result recorded for this event.

resulting_status

Status recorded for this event.

retained_count

Number of retained.

retired_partner_profile

Value of retired partner profile recorded for this event.

retired_workflow_count

Number of retired workflow.

returned_account_login

Value of returned account login recorded for this event.

reverted_to

Value of reverted to recorded for this event.

review_id

Identifier of the review.

reviewer_email

Email address recorded as reviewer email.

revision

Value of revision recorded for this event.

revocation_reason

Value of revocation reason recorded for this event.

revoked_count

Number of revoked.

risk_evidence_preserved

Value of risk evidence preserved recorded for this event.

rls_changed

Whether row-level security settings changed.

rls_recommendations_count

Number of RLS recommendations.

role

Role assigned to a user.

role_source

Value of role source recorded for this event.

roster_gap

Value of roster gap recorded for this event.

route

Value of route recorded for this event.

routing_bound

Value of routing bound recorded for this event.

row_count

Number of row.

rule_id

Identifier of the notification rule.

rule_revision

Revision of the notification rule after the change.

rules_revision

Revision of the notification rule set after the change.

run_day

Value of run day recorded for this event.

run_id

Identifier used to fetch the ownership-scoped scan run. This key can be absent.

run_status

Status recorded for this event.

sandbox_id

Stripe sandbox ID.

scheduled_at

Timestamp recorded as scheduled at.

scope

Value of scope recorded for this event.

scope_type

Stable skill scope. organization identifies a workspace skill, superagent identifies an agent-owned skill record, and, on create events, app identifies a custom skill embedded in an app’s agent configuration.

scopes

Value of scopes recorded for this event.

secret_count

Number of app secrets affected by the change.

secret_names

Names of the app secrets affected by the change. Secret values are not included.

segment_id

Identifier of the segment.

selected_event_types

Event types selected for the webhook endpoint.

service_external_id

Identifier of the service external.

session_id

Identifier of the session.

setting

Value of setting recorded for this event.

setup_state

Value of setup state recorded for this event.

share_id

Identifier of the share.

shared_preview_origin

Value of shared preview origin recorded for this event.

shop_domain

Value of shop domain recorded for this event.

signup_stage

Signup progress indicator (e.g. otp_pending, otp_verified).

since

Value of since recorded for this event.

site_id

Identifier of the site.

situation_key

Identifier of the situation the follow-up belongs to.

size

Value of size recorded for this event.

size_bytes

Value of size bytes recorded for this event.

skill_id

Stable ID of the persisted skill record. This field is omitted from create events for app skills because that model is keyed by name and has no separate ID.

skill_name

Name of the skill when the event was emitted.

skip

Number of records skipped in a query.

skip_reason

Value of skip reason recorded for this event.

skip_sync

Value of skip sync recorded for this event.

skipped

Value of skipped recorded for this event.

skipped_entities

Value of skipped entities recorded for this event.

slug

Slug of the blog post or page.

smart_reply

Value of smart reply recorded for this event.

snapshot_row_count

Number of snapshot row.

sort

Sort parameters used in a query.

source

Source recorded for the operation.

source_app_id

Identifier of the app a cloned secret was copied from.

source_id

Identifier of the source.

source_message_ids

Identifiers recorded for source message.

source_path

Value of source path recorded for this event.

source_region

Region the data was migrated from.

source_workspace_id

Identifier of the source workspace.

sso_provider

SSO provider name.

staff_override

Whether a staff override was applied.

stage

Value of stage recorded for this event.

state

Value of state recorded for this event.

state_revision

Value of state revision recorded for this event.

static_code_findings_count

Number of static-code findings. This key can be absent when the static scanner did not run, and absence does not mean zero.

status

Status recorded for the operation.

status_code

HTTP status code returned by a backend function call.

status_outcome

Value of status outcome recorded for this event.

still_breached

Value of still breached recorded for this event.

still_processing

Value of still processing recorded for this event.

storage_key_count

Number of storage key.

stripe_charge_id

Identifier of the stripe charge.

stripe_customer_id

Stripe customer ID.

stripe_event_id

Identifier of the stripe event.

stripe_refund_id

Identifier of the stripe refund.

stripe_subscription_id

Identifier of the stripe subscription.

subscription

Value of subscription recorded for this event.

subscription_id

Identifier of the subscription.

subscription_tier

Subscription tier of the workspace.

subtype

Value of subtype recorded for this event.

succeeded

Value of succeeded recorded for this event.

support_user

Value of support user recorded for this event.

surface

Value of surface recorded for this event.

sync_types

Value of sync types recorded for this event.

table_count

Number of table.

target_app_role

Value of target app role recorded for this event.

target_app_user_id

Identifier of the target app user.

target_domain

Value of target domain recorded for this event.

target_email

Email of the user affected by the action.

target_path

Value of target path recorded for this event.

target_post_id

Identifier of the target post.

target_region

Region the data was migrated to.

target_url

Destination URL of the outbound webhook endpoint.

target_user

Value of target user recorded for this event.

target_user_id

ID of the app user affected by the action.

target_workspace_id

Identifier of the target workspace.

task_id

Identifier of the task.

team_id

Identifier of the team.

test_mode

Value of test mode recorded for this event.

thread_id

Identifier of the comment thread.

ticket_id

Identifier of the ticket.

ticket_link

Value of ticket link recorded for this event.

ticket_owner

Value of ticket owner recorded for this event.

tier

Value of tier recorded for this event.

title

Value of title recorded for this event.

to

New value after a change, such as a Google Ads cadence change.

to_mode

Value of to mode recorded for this event.

to_status

Status recorded for this event.

token_id

Identifier of the token.

token_name

Name of the token.

token_prefix

Value of token prefix recorded for this event.

token_user_id

Identifier of the token user.

tool_call_id

Identifier of the tool call that requested the device location.

tool_name

Name of the tool.

topic

Value of topic recorded for this event.

tos_accepted

Value of tos accepted recorded for this event.

total_cost_micros

Value of total cost micros recorded for this event.

total_value_cents

Value of total value cents recorded for this event.

transaction_id

Identifier of the transaction.

transcript_chars

Value of transcript chars recorded for this event.

transfer_id

Identifier of the transfer.

transport

Value of transport recorded for this event.

trigger

What initiated a dedicated KMS operation: admin for an administrator-initiated change, tier_downgrade when a subscription downgrade forced a revert, or reaper for the scheduled background job.

ttl_seconds

Value of ttl seconds recorded for this event.

turnstile_result

Cloudflare Turnstile verification result.

turnstile_validation

Cloudflare Turnstile validation detail recorded for the authentication attempt.

type

Type recorded for this event.

unfinished_tasks

Value of unfinished tasks recorded for this event.

unreviewed_matches

Value of unreviewed matches recorded for this event.

unscored_findings_count

Number of RLS recommendations, hardcoded-secret findings, backend-function issues, and dependency or static-code findings without a recognized severity.

updated

Number of records updated by the operation.

updated_fields

SSO settings fields that were updated.

upload_rn

Value of upload rn recorded for this event.

user_email

Email address recorded as user email.

user_id

ID of the authenticated user.

uses_oauth_gateway

Value of uses oauth gateway recorded for this event.

uses_per_code

Number of times each coupon code can be redeemed.

verification_method

Value of verification method recorded for this event.

verification_mode

Value of verification mode recorded for this event.

verification_status

Domain verification result.

verified_at

Timestamp recorded as verified at.

version

Value of version recorded for this event.

version_id

Identifier of the version.

versions_deleted

Value of versions deleted recorded for this event.

via

How the change was made, such as clone, actor deploy, or a generated development secret.

via_invitation

Value of via invitation recorded for this event.

via_orphan_sweep

Value of via orphan sweep recorded for this event.

video_id

Identifier of the video.

violations

Value of violations recorded for this event.

visibility

Value of visibility recorded for this event.

visitor_cookie

Marketing visitor cookie identifier.

warm_skipped

Value of warm skipped recorded for this event.

was_enabled

Value of was enabled recorded for this event.

was_finalized

Value of was finalized recorded for this event.

was_paused

Value of was paused recorded for this event.

webhook_id

Identifier of the webhook.

window

Value of window recorded for this event.

window_seconds

Value of window seconds recorded for this event.

wix_session_id

Identifier of the wix session.

workflow

Value of workflow recorded for this event.

workflow_id

Identifier of the workflow.

workflow_ids

Identifiers recorded for workflow.

workspace_id

Identifier of the workspace.

workspace_installation_id

Identifier of the workspace installation.

workspace_name

Name of the workspace.

year

Value of year recorded for this event.