---
title: Event structure
seo:
  description: Learn how a Holst API audit event is structured and which entity and action types it can contain.
---

## Event fields

Each event contains the following fields:

- `id` — unique identifier for the event.
- `occurredAt` — time the event occurred, formatted as an RFC 3339 timestamp.
- `action` — information about the action recorded in the audit log.
  - `type` — type of action, such as `workspace_create` or `user_sign_in`. The list of types is provided under [Action types](#action-types).
  - `details` — additional data about the action. The fields depend on the action type.
- `actor` — information about who performed the action.
  - `type` — indicates who performed the action: a user (`user`), an anonymous user (`anonymous`), the system (`system`), or an unknown actor (`unknown`).
  - `id` — identifier.
  - `name` — name, when available.
  - `email` — email address, when available.
- `context` — information about the request associated with the event. Fields may be absent for system events.
  - `requestId` — request identifier.
  - `sessionId` — session identifier.
  - `requestIp` — source IP address of the request.
- `scope` — identifies the organization, workspace, and channel associated with the event. Any of these fields may be absent.
  - `organizationId` — organization identifier.
  - `workspaceId` — workspace identifier.
  - `workspaceName` — workspace name.
  - `channelId` — channel identifier.
- `entity` — the object affected by the action.
  - `type` — entity type that determines the remaining fields. Possible values are listed under [Entity types](#entity-types).
  - `subtype` — more specific entity type, when applicable.
  - `id` — entity identifier.
  - `name` — entity name.
  - `email` — user email address.

## Example event

<div className="audit-event-example">

```json
{
  "id": "46b44beb-b585-4598-a241-6bacea128799",
  "occurredAt": "2026-08-31T09:20:35.213Z",
  "action": {
    "type": "workspace_create",
    "details": {
      "fields": {
        "name": "Marketing"
      }
    }
  },
  "actor": {
    "type": "user",
    "id": "87736cf6-ca84-4519-8fc2-81c815b76c63",
    "name": "Ivan Petrov",
    "email": "ivan@example.com"
  },
  "context": {
    "requestId": "4f7f8a01-3a71-42f9-b7b2-71dca2cb55c8",
    "sessionId": "c192570a-3c98-464f-9e78-0cee7fddc864",
    "requestIp": "203.0.113.10"
  },
  "scope": {
    "organizationId": "d311fcba-32ba-417c-aabb-221a819f2ea4",
    "workspaceId": "069018a1-f7ae-42f7-adc7-d6684364abca",
    "workspaceName": "Marketing"
  },
  "entity": {
    "type": "workspace",
    "id": "069018a1-f7ae-42f7-adc7-d6684364abca",
    "name": "Marketing"
  }
}
```

</div>

## Entity types

The `entity.type` field identifies the entity type:

| Entity type | Description |
| --- | --- |
| `channel` | Channel. Fields: `subtype`, `id`, `name`. The `subtype` field identifies the channel type: `board` or `folder`. |
| `workspace` | Workspace. Fields: `id`, `name`. |
| `organization` | Organization. Fields: `id`, `name`. |
| `user` | User. Fields: `id`, `name`, `email`. |

## Action types

The `action.type` field identifies the action type.

### Channels

| Action type |
| --- |
| `channel_create` |
| `channel_delete` |
| `channel_duplicate` |
| `channel_duplicate_from_board_shared_as_template` |
| `channel_move` |
| `channel_restore` |
| `channel_transfer_ownership` |
| `channel_update` |
| `channel_update_sharing_settings` |
| `channel_user_add` |
| `channel_user_remove` |
| `channel_user_role_change` |

### Workspaces

| Action type |
| --- |
| `workspace_attach_to_organization` |
| `workspace_create` |
| `workspace_delete` |
| `workspace_domain_add` |
| `workspace_domain_delete` |
| `workspace_domain_verify` |
| `workspace_invite_link_accept` |
| `workspace_invite_link_create` |
| `workspace_invite_link_revoke` |
| `workspace_join_request_accept` |
| `workspace_join_request_cancel` |
| `workspace_join_request_close` |
| `workspace_join_request_create` |
| `workspace_join_request_reject` |
| `workspace_role_mapping_create` |
| `workspace_role_mapping_delete` |
| `workspace_role_mapping_update` |
| `workspace_saml_idp_update` |
| `workspace_transfer_ownership` |
| `workspace_update` |
| `workspace_user_add` |
| `workspace_user_remove` |
| `workspace_user_role_change` |

### Organizations

| Action type |
| --- |
| `organization_managed_users_sign_out` |
| `organization_update` |
| `organization_user_add` |
| `organization_user_remove` |
| `organization_user_role_change` |

### Users and access tokens

| Action type |
| --- |
| `user_sign_in` |
| `user_sign_out` |
| `personal_access_token_create` |
| `personal_access_token_revoke` |

### Licenses

| Action type |
| --- |
| `subscription_license_mapping_create` |
| `subscription_license_mapping_delete` |
| `subscription_license_mapping_update` |
| `subscription_license_settings_update` |
| `subscription_license_request_approve` |
| `subscription_license_request_cancel` |
| `subscription_license_request_create` |
| `subscription_license_request_reject` |
| `subscription_user_license_issue` |
| `subscription_user_license_revoke` |