Understand the events recorded in the audit log and the details they contain.
Updated Sep 24, 2026
Use this reference when you open an event in the audit log and want to understand what it means. The names below match the Event column and the event page's title.
Every event identifies its actor, subject and time. The last column describes useful fields in data, which vary with the event and how the action happened. No additional data means you can use the actor, subject and timestamp to understand the event.
The Event types picker only lists events already recorded in your organization. You won't necessarily see every type below in your own log.
Requests and decisions
These events describe a request arriving or ending, and changes to who can review it.
Event
Meaning
Useful recorded details
approval.created
An agent instance submitted an approval request.
agent_instance_id, tool, deadline_at.
approval.decided
A human or an approval pipeline approved or denied the request.
status; human decisions include note, channel and reviewer details. Automatic decisions identify source and the pipeline evaluation.
approval.expired
The request reached its deadline without an approval or denial.
No additional data.
approval.cancelled
The requesting agent instance withdrew the request.
agent_instance_id, agent_instance_name.
request.reviewer_added
Someone added another reviewer to the request.
The added person's membership_id and added_by_membership_id.
decision.unrouted
Someone made a decision using permission to act outside the request's normal reviewer routing. Recorded alongside approval.decided.
decision_id, reason, dangerous.
Approval pipeline evaluation
These events belong to the request being evaluated. The organization and agent stages are recorded as part of one evaluation. See Approval pipelines for how those stages fit together.
Event
Meaning
Useful recorded details
request_approval_pipeline.started
Pipeline evaluation began for a request.
agent_slug, block_count, and the organization and agent pipeline revisions.
request_approval_block.evaluated
A pipeline block finished checking the request. A branch records outcomeenter when the request matched it and next when the request skipped it. If no block inside the branch decided, the branch records a second event with end_of_branch.
block_name, block_type, scope, revision, outcome, reason, attempt_count, and any error or evaluation trace. end_of_branch is true on a branch's second event.
request_approval_pipeline.suspended
Evaluation paused before a block that continues asynchronously, such as an external check. It does not mean the pipeline was disabled.
The suspended block's ID, key, type and scope, plus the number of blocks already attempted.
request_approval_pipeline.completed
Evaluation finished with an approval, denial or need for human review.
outcome, reason_code, the deciding block when there is one, pipeline revisions, attempt counts and duration_ms. reason_code is end_of_branch when no block in an entered branch decided; the branch is then the deciding block.
Review routing and escalation
These events describe how an escalation path handles human review, and when a reviewer claims or releases a request.
Event
Meaning
Useful recorded details
routing.evaluated
withHuman selected the request's review route, or placed it in the default queue.
outcome, reason, urgency, and the escalation path and pipeline identifiers when applicable.
routing.level_entered
The path or a team's policy reached a reviewer stage. This records the selected targets, not confirmation that messages were delivered.
targets, level_ordinal, level_count, urgency, repeat, and team_id for a team policy.
routing.deferred
Escalation was deferred until a later time.
until and the step's node_id; team_id when applicable.
routing.urgency_raised
The path raised the request's notification urgency.
from, to, node_id; team_id when applicable.
routing.repeated
The path or team policy started another pass.
iteration, after; team_id when applicable.
routing.escalation_exhausted
The path or team policy had no further escalation steps. An unanswered request can still be pending.
team_id for a team policy; otherwise no additional data.
routing.claimed
A reviewer claimed the request, pausing escalation while the claim is active.
claim_id, the reviewer's membership_id, expires_at.
routing.claim_released
The reviewer released their claim.
claim_id, membership_id.
routing.claim_lapsed
A claim expired automatically.
claim_id.
Approval pipeline changes
These events record changes to pipeline configuration. Saving a revision and activating it are separate events.
Event
Meaning
Useful recorded details
request_approval_pipeline.revision_created
A pipeline revision was created.
scope, agent_slug for an agent pipeline, revision, block_count.
request_approval_pipeline.activated
A pipeline revision became active.
scope, agent_slug when applicable, revision, previous_active_revision.
agent_slug, mcp_server, previous, and current grants, including their revisions.
gateway.tool_call
The gateway recorded the outcome of a tool call.
tool, mcp_server, outcome, agent_instance_id, and approval_request_id for the request the pipeline decided the call on, and reason: access_denied when tool access blocked the call before a request was created.
gateway_server.created
An upstream MCP server was added to the gateway.
slug, name, revision, url, auth_mode.
gateway_server.revision_created
A new gateway server configuration revision was saved.
slug, name, revision, url, auth_mode.
gateway_server.activated
A gateway server revision became active.
slug, revision, previous_active_revision.
gateway_server.deactivated
A gateway server was deactivated.
slug, revision.
gateway_server.archived
A gateway server was archived and its saved secrets were removed.
kind, identifying the kind of secret. The secret itself is not recorded.
gateway_server.secret_deleted
A gateway server secret was removed.
kind.
Tool presentations
Event
Meaning
Useful recorded details
tool_presentation.created
A presentation was created to control how a tool's requests are displayed.
runtime, server, tool.
tool_presentation.updated
A tool presentation was changed.
runtime, server, tool.
tool_presentation.deleted
A tool presentation was removed.
runtime, server, tool.
Invitations and membership
Event
Meaning
Useful recorded details
invitation.created
Someone was invited to the organization.
email, the invitation's permission grants.
invitation.resent
An invitation was renewed for resending.
email.
invitation.revoked
An outstanding invitation was revoked.
email.
invitation.accepted
Someone accepted an invitation.
email, user_id.
membership.created
A person joined the organization.
admission_source and, depending on how they joined, their email or permission grants.
membership.suspended
A person's organization membership was suspended.
previous_status, or directory details such as external_id and email.
membership.reactivated
A person's organization membership was made active again.
previous_status.
membership.deprovisioned
A person's organization membership was deprovisioned.
previous_status, or directory details such as external_id and email.
membership.directory_synced
Directory sync updated a person's membership to active.
external_id, email.
membership.identity_linked
A verified sign-in identity was linked to a member.
provider_key, issuer, email.
directory.command_rejected
A directory update could not be applied.
reason, external_event_id.
Roles and permission policies
Permission policies describe a person's, team's or API key's access. Role and assignment events record changes to the roles and grants that provide that access.
Event
Meaning
Useful recorded details
permission_policy.created
A permission policy was added.
principal_kind, principal_id, and the policy in after.
permission_policy.updated
A permission policy was changed.
principal_kind, principal_id, before, after.
permission_policy.deleted
A permission policy was removed.
principal_kind, principal_id, and its recorded policy details in before and after.