Event structure

Event fields

Each event contains the following fields:

• id — unique identifier for the event.
• occurredAt — time the event occurred, formatted as an RFC 3339 timestamp.
• action — information about the action recorded in the audit log.
  • type — type of action, such as workspace_create or user_sign_in. The list of types is provided under Action types.
  • details — additional data about the action. The fields depend on the action type.
• actor — information about who performed the action.
  • type — indicates who performed the action: a user (user), an anonymous user (anonymous), the system (system), or an unknown actor (unknown).
  • id — identifier.
  • name — name, when available.
  • email — email address, when available.
• context — information about the request associated with the event. Fields may be absent for system events.
  • requestId — request identifier.
  • sessionId — session identifier.
  • requestIp — source IP address of the request.
• scope — identifies the organization, workspace, and channel associated with the event. Any of these fields may be absent.
  • organizationId — organization identifier.
  • workspaceId — workspace identifier.
  • workspaceName — workspace name.
  • channelId — channel identifier.
• entity — the object affected by the action.
  • type — entity type that determines the remaining fields. Possible values are listed under Entity types.
  • subtype — more specific entity type, when applicable.
  • id — entity identifier.
  • name — entity name.
  • email — user email address.

Example event

{
  "id": "46b44beb-b585-4598-a241-6bacea128799",
  "occurredAt": "2026-08-31T09:20:35.213Z",
  "action": {
    "type": "workspace_create",
    "details": {
      "fields": {
        "name": "Marketing"
      }
    }
  },
  "actor": {
    "type": "user",
    "id": "87736cf6-ca84-4519-8fc2-81c815b76c63",
    "name": "Ivan Petrov",
    "email": "ivan@example.com"
  },
  "context": {
    "requestId": "4f7f8a01-3a71-42f9-b7b2-71dca2cb55c8",
    "sessionId": "c192570a-3c98-464f-9e78-0cee7fddc864",
    "requestIp": "203.0.113.10"
  },
  "scope": {
    "organizationId": "d311fcba-32ba-417c-aabb-221a819f2ea4",
    "workspaceId": "069018a1-f7ae-42f7-adc7-d6684364abca",
    "workspaceName": "Marketing"
  },
  "entity": {
    "type": "workspace",
    "id": "069018a1-f7ae-42f7-adc7-d6684364abca",
    "name": "Marketing"
  }
}

Entity types

The entity.type field identifies the entity type:

Action types

The action.type field identifies the action type.

Channels

Workspaces

Organizations

Users and access tokens

Licenses