> ## Documentation Index > Fetch the complete documentation index at: https://docs.base44.com/llms.txt > Use this file to discover all available pages before exploring further. # Event Types > All audit log event types available for filtering Every audit log event has an event type that identifies what happened. Event types follow a dot-separated naming convention: `..`. Below is the full list of event types, grouped by category. The **Metadata** column lists the keys that may appear in the `metadata` field for each event type. See [Metadata key reference](#metadata-key-reference) for descriptions. ## Authentication | Event type | Description | Metadata | | ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `auth.login` | A user attempted to sign in to the Base44 platform. Use `status`, `error_code`, and the authentication metadata to determine the outcome and sign-in method. | [`auth_method`](#auth_method), [`auth_provider`](#auth_provider), [`email_domain`](#email_domain), [`email_hash`](#email_hash), [`failure_reason`](#failure_reason), [`is_new_user`](#is_new_user), [`mcp_oauth`](#mcp_oauth), [`mfa_method`](#mfa_method), [`oauth_error_type`](#oauth_error_type), [`sso_provider`](#sso_provider), [`turnstile_result`](#turnstile_result), [`user_id`](#user_id), [`visitor_cookie`](#visitor_cookie) | | `auth.signup` | A user attempted to create a Base44 platform account. Use `status`, `error_code`, and the signup metadata to determine whether registration completed and which authentication flow was used. | [`auth_method`](#auth_method), [`auth_provider`](#auth_provider), [`email_domain`](#email_domain), [`email_hash`](#email_hash), [`failure_reason`](#failure_reason), [`is_new_user`](#is_new_user), [`mcp_oauth`](#mcp_oauth), [`oauth_error_type`](#oauth_error_type), [`signup_stage`](#signup_stage), [`sso_provider`](#sso_provider), [`turnstile_result`](#turnstile_result), [`user_id`](#user_id), [`visitor_cookie`](#visitor_cookie) | | `auth.mfa.sent` | An MFA challenge was issued as part of platform sign-in or workspace reauthentication. The metadata identifies the authentication flow that required the challenge. | [`auth_method`](#auth_method), [`auth_provider`](#auth_provider), [`email_domain`](#email_domain), [`email_hash`](#email_hash), [`is_new_user`](#is_new_user), [`sso_provider`](#sso_provider), [`turnstile_result`](#turnstile_result), [`user_id`](#user_id), [`visitor_cookie`](#visitor_cookie) | | `auth.mfa` | A user submitted an MFA challenge for verification. The event `status` indicates whether the challenge was accepted or rejected. | [`auth_method`](#auth_method) | | `auth.password_changed` | A user set a new platform password, either through an authenticated password change or by completing a password-reset flow. | | ## API | Event type | Description | Metadata | | ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------- | | `api.function.call` | An app backend function completed an API invocation. The event `status` and returned status code show whether the function call succeeded. | [`function_name`](#function_name), [`status_code`](#status_code) | | `api.code.editing` | One or more app code files were changed through a code-editing API, including changes applied by an automated RLS remediation. | [`file_path`](#file_path) | ## Entity CRUD | Event type | Description | Metadata | | -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------- | | `app.entity.created` | A single record was created in one of the app's entities. The metadata identifies the entity and new record. | [`entity_name`](#entity_name), [`entity_id`](#entity_id) | | `app.entity.updated` | A single existing record was modified in one of the app's entities. The metadata identifies the entity and affected record. | [`entity_name`](#entity_name), [`entity_id`](#entity_id) | | `app.entity.deleted` | A single entity record was soft-deleted, so it is excluded from normal queries but remains available for restoration or permanent deletion. | [`entity_name`](#entity_name), [`entity_id`](#entity_id) | | `app.entity.bulk_created` | Multiple records were created in one entity through a bulk-create or import operation. The metadata identifies the operation and number of records created. | [`entity_name`](#entity_name), [`method`](#method), [`count`](#count) | | `app.entity.bulk_deleted` | Multiple records in one entity were soft-deleted in a single bulk operation. The metadata identifies the entity and number of records affected. | [`entity_name`](#entity_name), [`method`](#method), [`count`](#count) | | `app.entity.restored` | A previously soft-deleted entity record was restored and made available to normal queries again. | [`entity_name`](#entity_name), [`entity_id`](#entity_id) | | `app.entity.permanently_deleted` | A previously soft-deleted entity record was permanently removed and can no longer be restored. | [`entity_name`](#entity_name), [`entity_id`](#entity_id) | ## Entity schema | Event type | Description | Metadata | | -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- | | `app.schema.created` | A new entity schema was added to an app. The metadata indicates whether the schema was created with row-level security rules. | [`entity_name`](#entity_name), [`has_rls`](#has_rls) | | `app.schema.updated` | An existing entity schema was changed, including changes made through code editing. The metadata indicates whether its row-level security configuration changed. | [`entity_name`](#entity_name), [`has_rls`](#has_rls), [`rls_changed`](#rls_changed) | | `app.schema.deleted` | An entity schema was removed from an app. The metadata identifies the deleted entity definition. | [`entity_name`](#entity_name) | ## Workspace members | Event type | Description | Metadata | | ---------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------- | | `workspace.member.role_updated` | A workspace member's assigned role was changed, either individually or as part of a bulk member update. | [`target_email`](#target_email), [`new_role`](#new_role), [`old_role`](#old_role) | | `workspace.member.invited` | A pending invitation was created for one person to join the workspace with the specified role. | [`invitee_email`](#invitee_email), [`role`](#role) | | `workspace.member.bulk_invited` | Invitations were successfully created for multiple people in one workspace operation. The metadata lists only the successful invitations. | [`invitation_count`](#invitation_count), [`invitee_emails`](#invitee_emails) | | `workspace.member.invite_accepted` | An invited person accepted a pending workspace invitation and joined the workspace. | | | `workspace.member.invite_declined` | An invited person declined a pending workspace invitation. | [`invitation_email`](#invitation_email) | | `workspace.member.removed` | A member left or was removed from the workspace through the workspace UI, a bulk action, or SCIM provisioning. | [`target_email`](#target_email) | ## Workspace billing | Event type | Description | Metadata | | ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------- | | `workspace.invoice.read` | A workspace administrator retrieved the workspace's invoice history. The metadata records how many invoices were returned. | [`count`](#count) | | `workspace.stripe.session_created` | A workspace administrator opened the billing flow and Base44 created a Stripe customer-portal session for the workspace. | [`stripe_customer_id`](#stripe_customer_id), [`domain`](#domain) | ## Workspace SSO | Event type | Description | Metadata | | -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------- | | `workspace.sso.enabled` | Single sign-on was enabled for the workspace, allowing applicable authentication flows to use the workspace's SSO provider. | | | `workspace.sso.disabled` | Single sign-on was disabled for the workspace. Users can no longer authenticate through the workspace's SSO configuration. | | | `workspace.sso.settings_updated` | One or more settings in the workspace's existing SSO configuration were changed. The metadata identifies the provider and changed fields. | [`sso_provider`](#sso_provider), [`updated_fields`](#updated_fields) | ## Workspace API keys | Event type | Description | Metadata | | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `workspace.api_key.created` | A workspace API key was created with a set of scopes and app-access restrictions. Only the non-secret key prefix is included in the audit event. | [`key_id`](#key_id), [`key_name`](#key_name), [`key_prefix`](#key_prefix) | | `workspace.api_key.updated` | A workspace API key's name, description, scopes, or app-access restrictions were changed. The key secret itself is never included. | [`key_id`](#key_id), [`key_prefix`](#key_prefix), [`old_name`](#old_name), [`new_name`](#new_name), [`old_description`](#old_description), [`new_description`](#new_description) | | `workspace.api_key.disabled` | An active workspace API key was disabled. Requests using that key are rejected until it is enabled again. | [`key_id`](#key_id), [`key_name`](#key_name), [`key_prefix`](#key_prefix) | | `workspace.api_key.enabled` | A disabled workspace API key was re-enabled, allowing it to authenticate requests with its configured permissions. | [`key_id`](#key_id), [`key_name`](#key_name), [`key_prefix`](#key_prefix) | | `workspace.api_key.deleted` | A workspace API key was permanently deleted and can no longer authenticate requests. Only its identifying, non-secret details are retained in the event. | [`key_id`](#key_id), [`key_name`](#key_name), [`key_prefix`](#key_prefix) | ## Workspace settings | Event type | Description | Metadata | | ----------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- | | `workspace.settings.updated` | One or more workspace-level settings changed, such as app visibility, app-transfer policy, SSO requirements, guest invitations, data region, or IP allowlisting. | [`fields_changed`](#fields_changed) | | `workspace.admin.created` | A Base44 administrator or support user created a workspace on behalf of its owner and assigned its initial subscription tier. | [`workspace_name`](#workspace_name), [`subscription_tier`](#subscription_tier), [`is_enterprise`](#is_enterprise) | | `workspace.admin.migrated_v2` | A Base44 administrator or support user migrated a legacy workspace to the newer workspace model and assigned its target subscription tier. | [`target_tier`](#target_tier), [`is_enterprise`](#is_enterprise) | ## Domains | Event type | Description | Metadata | | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- | | `domain.created` | A custom-domain resource was added to the workspace so the domain could be configured and linked to an app. | [`domain`](#domain), [`domain_id`](#domain_id) | | `domain.deleted` | A custom-domain resource was removed from the workspace. This deletes its Base44 configuration rather than merely unlinking it from an app. | [`domain`](#domain), [`domain_id`](#domain_id) | | `domain.linked` | An existing custom domain was associated with an app so it could serve that app after verification and configuration. | [`domain`](#domain), [`domain_id`](#domain_id) | | `domain.unlinked` | A custom domain was detached from its app without deleting the domain resource from the workspace. | [`domain`](#domain), [`domain_id`](#domain_id) | | `domain.verified` | Base44 completed a verification check for a custom domain. The metadata records the resulting verification state. | [`domain`](#domain), [`domain_id`](#domain_id), [`verification_status`](#verification_status) | | `domain.disabled` | A Base44 administrator or support user disabled a custom domain without deleting or unlinking its configuration, so it no longer serves the linked app. | [`domain`](#domain), [`domain_id`](#domain_id) | | `domain.enabled` | A Base44 administrator or support user enabled a previously disabled custom domain for its linked app. | [`domain`](#domain), [`domain_id`](#domain_id) | | `domain.email.enabled` | A custom email-sending domain was enabled for an app after its sender configuration was saved. | [`domain`](#domain), [`domain_id`](#domain_id) | | `domain.email.updated` | The sender name, sender address, or other configuration for an enabled custom email domain was changed. | [`domain`](#domain), [`domain_id`](#domain_id) | | `domain.email.disabled` | A custom email-sending domain was disabled, causing the app to stop using it for outgoing email. | [`domain`](#domain), [`domain_id`](#domain_id) | ## App lifecycle | Event type | Description | Metadata | | ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------ | | `app.created` | A new app was created in the workspace. The metadata records the app's name and type at creation time. | [`app_name`](#app_name), [`app_type`](#app_type) | | `app.deleted` | An app was deleted from the workspace. The event retains the app's name and workspace context for later investigation. | [`app_name`](#app_name) | | `app.published` | An app deployment completed and the deployed version became the app's active served version. When the deployment used a saved checkpoint, its ID appears in the metadata. | [`checkpoint_id`](#checkpoint_id) | | `app.unpublished` | A published app was taken offline while its app configuration and source remained in the workspace. | | ## App users | Event type | Description | Metadata | | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------- | | `app.user.registered` | An app-user record was created, either through direct registration or because an existing platform user received access to the app. | [`target_email`](#target_email), [`role`](#role), [`registration_method`](#registration_method) | | `app.user.deleted` | An app-user record was deleted, removing that person's user profile and access within the app. | [`target_user_id`](#target_user_id), [`target_email`](#target_email) | | `app.user.updated` | An administrator changed fields on an existing app-user record. The metadata identifies the affected user without including the changed profile data. | [`target_user_id`](#target_user_id), [`target_email`](#target_email) | | `app.user.role_changed` | An existing app user's application-level role changed. The metadata records both the previous and new roles. | [`target_email`](#target_email), [`old_role`](#old_role), [`new_role`](#new_role) | | `app.auth.login` | A user successfully authenticated to a published app. The metadata identifies the app authentication method, such as password or an identity provider. | [`auth_method`](#auth_method) | | `app.user.invited` | A person was invited to an app with an application role and, when applicable, collaborator access for editing the app. | [`invitee_email`](#invitee_email), [`role`](#role) | | `app.access.requested` | A person verified their email and submitted a request to access a private app for administrator review. | [`requester_email`](#requester_email) | | `app.access.approved` | An app administrator approved a pending access request, allowing the requester to register or creating their app-user record immediately. | [`target_email`](#target_email) | | `app.access.denied` | An app administrator denied and removed a pending access request. | [`target_email`](#target_email) | ## Integrations | Event type | Description | Metadata | | --------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- | | `integration.custom.created` | A custom API-key integration was created for an app with one or more selected endpoints. | [`integration_slug`](#integration_slug), [`integration_name`](#integration_name), [`endpoint_count`](#endpoint_count) | | `integration.custom.updated` | The name, authentication settings, or selected endpoints of an existing custom integration were changed. | [`integration_slug`](#integration_slug), [`fields_changed`](#fields_changed) | | `integration.custom.deleted` | A custom integration and its saved configuration were removed from the app. | [`integration_slug`](#integration_slug), [`integration_name`](#integration_name) | | `integration.stripe.sandbox_claimed` | A Stripe test sandbox was claimed and associated with the app that completed the connection flow. | [`sandbox_id`](#sandbox_id) | | `integration.stripe.live_configured` | The app completed its live-mode Stripe configuration, including flows that promote an existing sandbox connection to live mode. | | | `integration.stripe.removed` | The app's Stripe payment integration and saved connection configuration were removed. | | | `integration.wix_payments.connected` | A Wix Payments account was successfully connected to the app for payment processing. | | | `integration.wix_payments.disconnected` | The app's Wix Payments connection was removed, so the app can no longer process payments through that account. | | | `integration.oauth.connected` | An app established an OAuth connection to an external integration, either directly or by attaching a workspace-shared connection. | [`integration_type`](#integration_type) | | `integration.oauth.disconnected` | An app removed its OAuth connection to an external integration. | [`integration_type`](#integration_type) | ## App runtime | Event type | Description | Metadata | | -------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `app.entity.query` | An app queried records from one of its entities. The public audit event exposes the fields used for filtering instead of the raw database query. | [`filter_fields`](#filter_fields), [`sort`](#sort), [`limit`](#limit), [`skip`](#skip), [`fields`](#fields), [`entity_name`](#entity_name) | | `app.user.query` | An app queried its user records. The metadata records the query, projected fields, sorting, and pagination used for the read. | [`filter_fields`](#filter_fields), [`sort`](#sort), [`limit`](#limit), [`skip`](#skip), [`fields`](#fields) | | `app.integration.executed` | An app completed a call to a third-party integration. Use `status`, `error_code`, duration, and credit metadata to evaluate the execution. | [`function_name`](#function_name), [`credit_count`](#credit_count), [`duration_ms`](#duration_ms) | | `app.automation.executed` | An automation or agent-triggered automation run completed. Use `status` and the execution metadata to determine its outcome and resource usage. | [`automation_id`](#automation_id), [`automation_name`](#automation_name), [`automation_type`](#automation_type), [`duration_ms`](#duration_ms), [`credit_count`](#credit_count) | | `app.agent.conversation` | An AI agent processed a conversation turn or run. The metadata identifies the agent and conversation and summarizes message and credit usage without storing message content. | [`agent_name`](#agent_name), [`conversation_id`](#conversation_id), [`message_count`](#message_count), [`credit_count`](#credit_count) | | `app.user.page_visit` | The app runtime recorded an app user's visit to a page. The metadata identifies the page but does not include the page's content. | [`page_name`](#page_name) | ## Security | Event type | Description | Metadata | | ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `app.security.check_run` | An app security scan completed. The event contains the scan identifier and finding counts only; it does not store vulnerability details in the audit log. | [`rls_recommendations_count`](#rls_recommendations_count), [`hardcoded_secrets_count`](#hardcoded_secrets_count), [`backend_functions_issues_count`](#backend_functions_issues_count) | *** ## Metadata key reference All metadata values are strings. #### `agent_name` Name of the AI agent. #### `app_name` Name of the app. #### `app_type` Type of the app. #### `auth_method` Authentication method (e.g. `email_password`, `google`). #### `auth_provider` OAuth provider name, if applicable. #### `automation_id` ID of the automation. #### `automation_name` Name of the automation. #### `automation_type` Type of automation (e.g. scheduled, triggered). #### `backend_functions_issues_count` Number of backend function issues found in security scan. #### `checkpoint_id` Deployment checkpoint ID. #### `conversation_id` ID of the AI agent conversation. #### `count` Number of affected records, invoices, or other items. #### `credit_count` Credits consumed by the operation. #### `domain` The domain name. #### `domain_id` The domain ID. #### `duration_ms` Execution time in milliseconds. #### `email_domain` Domain portion of the user's email address. #### `email_hash` SHA-256 hash of the user's email address. #### `endpoint_count` Number of endpoints on the custom integration. #### `entity_id` ID of the affected entity record. #### `entity_name` Name of the entity. #### `failure_reason` Reason for failure when status is `"failure"`. #### `fields` Fields included in a query response. #### `fields_changed` Comma-separated list of fields that were changed. #### `file_path` Path of the file being edited. #### `filter_fields` Field names being filtered on in a query (e.g. `data.status, data.user_id`). #### `function_name` Name of the backend function or integration function. #### `hardcoded_secrets_count` Number of hardcoded secrets found in security scan. #### `has_rls` Whether row-level security is enabled on the entity schema. #### `integration_name` Name of the custom integration. #### `integration_slug` Slug identifier of the custom integration. #### `integration_type` Type of OAuth integration. #### `invitation_count` Number of invitations sent in a bulk invite. #### `invitation_email` Email associated with the invitation. #### `invitee_email` Email of the invited user. #### `invitee_emails` Comma-separated emails of invited users (bulk invite). #### `is_enterprise` Whether the workspace is on an enterprise plan. #### `is_new_user` Whether this is the user's first login. #### `key_id` ID of the workspace API key. #### `key_name` Name of the workspace API key. #### `key_prefix` Non-secret prefix of the API key, used to identify it without exposing the secret. #### `limit` Maximum number of records requested in a query. #### `mcp_oauth` Whether the login was initiated via an MCP OAuth flow. #### `message_count` Number of messages in an AI agent conversation. #### `method` Bulk operation method. #### `mfa_method` MFA method used (e.g. `totp`, `sms`). #### `new_description` New description after an update. #### `new_name` New name after a rename. #### `new_role` New role after a role change. #### `oauth_error_type` Type of OAuth error on failure. #### `old_description` Previous description before an update. #### `old_name` Previous name before a rename. #### `old_role` Previous role before a role change. #### `page_name` Name of the visited page. #### `registration_method` How the app user registered. #### `requester_email` Email of the user requesting access. #### `rls_changed` Whether row-level security settings changed. #### `rls_recommendations_count` Number of RLS recommendations from security scan. #### `role` Role assigned to a user. #### `sandbox_id` Stripe sandbox ID. #### `signup_stage` Signup progress indicator (e.g. `otp_pending`, `otp_verified`). #### `skip` Number of records skipped in a query. #### `sort` Sort parameters used in a query. #### `sso_provider` SSO provider name. #### `status_code` HTTP status code returned by a backend function call. #### `stripe_customer_id` Stripe customer ID. #### `subscription_tier` Subscription tier of the workspace. #### `target_email` Email of the user affected by the action. #### `target_tier` Target subscription tier for a migration. #### `target_user_id` ID of the app user affected by the action. #### `turnstile_result` Cloudflare Turnstile verification result. #### `updated_fields` SSO settings fields that were updated. #### `user_id` ID of the authenticated user. #### `verification_status` Domain verification result. #### `visitor_cookie` Marketing visitor cookie identifier. #### `workspace_name` Name of the workspace.