# Audit event types

Understand the events recorded in the audit log and the details they contain.

Use this reference when you open an event in the [audit log](/docs/web-app/audit-log) and want to understand what it means. The names below match the **Event** column and the event page's title.

Every event identifies its actor, subject and time. The last column describes useful fields in **data**, which vary with the event and how the action happened. **No additional data** means you can use the actor, subject and timestamp to understand the event.

The **Event types** picker only lists events already recorded in your organization. You won't necessarily see every type below in your own log.

## Requests and decisions

These events describe a request arriving or ending, and changes to who can review it.

| Event | Meaning | Useful recorded details |
| --- | --- | --- |
| `approval.created` | An agent instance submitted an approval request. | `agent_instance_id`, `tool`, `deadline_at`. |
| `approval.decided` | A human or an approval pipeline approved or denied the request. | `status`; human decisions include `note`, `channel` and reviewer details. Automatic decisions identify `source` and the pipeline evaluation. |
| `approval.expired` | The request reached its deadline without an approval or denial. | No additional data. |
| `approval.cancelled` | The requesting agent instance withdrew the request. | `agent_instance_id`, `agent_instance_name`. |
| `request.reviewer_added` | Someone added another reviewer to the request. | The added person's `membership_id` and `added_by_membership_id`. |
| `decision.unrouted` | Someone made a decision using permission to act outside the request's normal reviewer routing. Recorded alongside `approval.decided`. | `decision_id`, `reason`, `dangerous`. |

## Approval pipeline evaluation

These events belong to the request being evaluated. The organization and agent stages are recorded as part of one evaluation. See [Approval pipelines](/docs/concepts/approval-pipelines) for how those stages fit together.

| Event | Meaning | Useful recorded details |
| --- | --- | --- |
| `request_approval_pipeline.started` | Pipeline evaluation began for a request. | `agent_slug`, `block_count`, and the organization and agent pipeline revisions. |
| `request_approval_block.evaluated` | A pipeline block finished checking the request. A [branch](/docs/web-app/branch-blocks) records `outcome` `enter` when the request matched it and `next` when the request skipped it. If no block inside the branch decided, the branch records a second event with `end_of_branch`. | `block_name`, `block_type`, `scope`, `revision`, `outcome`, `reason`, `attempt_count`, and any error or evaluation trace. `end_of_branch` is `true` on a branch's second event. |
| `request_approval_pipeline.suspended` | Evaluation paused before a block that continues asynchronously, such as an external check. It does not mean the pipeline was disabled. | The suspended block's ID, key, type and scope, plus the number of blocks already attempted. |
| `request_approval_pipeline.completed` | Evaluation finished with an approval, denial or need for human review. | `outcome`, `reason_code`, the deciding block when there is one, pipeline revisions, attempt counts and `duration_ms`. `reason_code` is `end_of_branch` when no block in an entered branch decided; the branch is then the deciding block. |

## Review routing and escalation

These events describe how an [escalation path](/docs/concepts/escalation-paths) handles human review, and when a reviewer claims or releases a request.

| Event | Meaning | Useful recorded details |
| --- | --- | --- |
| `routing.evaluated` | withHuman selected the request's review route, or placed it in the default queue. | `outcome`, `reason`, `urgency`, and the escalation path and pipeline identifiers when applicable. |
| `routing.level_entered` | The path or a team's policy reached a reviewer stage. This records the selected targets, not confirmation that messages were delivered. | `targets`, `level_ordinal`, `level_count`, `urgency`, `repeat`, and `team_id` for a team policy. |
| `routing.deferred` | Escalation was deferred until a later time. | `until` and the step's `node_id`; `team_id` when applicable. |
| `routing.urgency_raised` | The path raised the request's notification urgency. | `from`, `to`, `node_id`; `team_id` when applicable. |
| `routing.repeated` | The path or team policy started another pass. | `iteration`, `after`; `team_id` when applicable. |
| `routing.escalation_exhausted` | The path or team policy had no further escalation steps. An unanswered request can still be pending. | `team_id` for a team policy; otherwise no additional data. |
| `routing.claimed` | A reviewer claimed the request, pausing escalation while the claim is active. | `claim_id`, the reviewer's `membership_id`, `expires_at`. |
| `routing.claim_released` | The reviewer released their claim. | `claim_id`, `membership_id`. |
| `routing.claim_lapsed` | A claim expired automatically. | `claim_id`. |

## Approval pipeline changes

These events record changes to pipeline configuration. Saving a revision and activating it are separate events.

| Event | Meaning | Useful recorded details |
| --- | --- | --- |
| `request_approval_pipeline.revision_created` | A pipeline revision was created. | `scope`, `agent_slug` for an agent pipeline, `revision`, `block_count`. |
| `request_approval_pipeline.activated` | A pipeline revision became active. | `scope`, `agent_slug` when applicable, `revision`, `previous_active_revision`. |
| `request_approval_pipeline.archived` | An agent's pipeline was archived with the agent. | `agent_slug`, `scope`, `revision_count`, `active_revision`. |
| `request_approval_pipeline.restored` | An agent's archived pipeline was restored with the agent. | `agent_slug`, `scope`, `revision_count`, `active_revision`. |

## Escalation path changes

| Event | Meaning | Useful recorded details |
| --- | --- | --- |
| `escalation_path.created` | A named escalation path was created with its first revision. | `path_key`, `revision`. |
| `escalation_path.revision_created` | A new revision was saved for an existing path. | `path_key`, `revision`. |
| `escalation_path.activated` | A path revision became active. | `path_key`, `revision`, `previous_active_revision`. |
| `escalation_path.archived` | An escalation path was archived. | `path_key`, `revision_count`, `active_revision`. |

## Agents, instances and credentials

See [Agents](/docs/concepts/agents) for the distinction between an agent and its instances.

| Event | Meaning | Useful recorded details |
| --- | --- | --- |
| `agent.created` | An agent was created. | `agent_slug`, `name`. |
| `agent.renamed` | An agent's display name changed. | `agent_slug`, `previous_name`, `name`. |
| `agent.disabled` | An agent was disabled. | `agent_slug`, `previous_status`, `status`. |
| `agent.enabled` | An agent was re-enabled. | `agent_slug`, `previous_status`, `status`. |
| `agent.archived` | An agent was archived, including its pipeline and credentials. | `agent_slug`, `name`, `previous_status`, revoked credential and provisioner counts, and `pipeline_archived`. |
| `agent.restored` | An archived agent was restored. | `agent_slug`, `name`, `pipeline_restored`. |
| `agent_instance.registered` | A person registered an instance directly. | `agent_slug`, the instance's `name`. |
| `agent_instance.enrolled` | A person authorized an instance through the browser enrollment flow. | `agent_slug`, `agent_name`, `instance_name`. |
| `agent_instance.minted` | A provisioner token created an instance. | `provisioner_id`, the instance's `name`. |
| `agent_instance.renamed` | An instance's display name changed. | `agent_slug`, `previous_name`, `name`. |
| `agent_instance.disabled` | An individual instance was disabled. | `agent_slug`, `previous_status`, `status`. |
| `agent_instance.enabled` | An individual instance was re-enabled. | `agent_slug`, `previous_status`, `status`. |
| `agent_provisioner.created` | A provisioner token was issued for an agent. | `agent_slug`, `expires_at`. |
| `agent_provisioner.revoked` | A provisioner token was revoked. | No additional data. The subject identifies the provisioner. |
| `agent_credential.revoked` | An instance's credential was revoked. | No additional data. The subject identifies the credential. |

## Teams and team escalation policies

| Event | Meaning | Useful recorded details |
| --- | --- | --- |
| `team.created` | A team was created, either by a person or directory sync. | `name`; directory-created teams also identify their `admission_source`. |
| `team.renamed` | A team's name changed. | `before`, `after`. |
| `team.archived` | A team was archived. | The team's `name`, or `admission_source` when archived by directory sync. |
| `team.members_changed` | A team's membership was edited. | `added` and `removed` member IDs, and `source`. |
| `team_escalation_policy.revision_created` | A revision of a team's escalation policy was saved. | `team_id`, `revision`. |
| `team_escalation_policy.activated` | A team escalation policy revision became active. | `team_id`, `revision`, `previous_active_revision`. |
| `team_escalation_policy.deactivated` | A team's escalation policy was deactivated. | `team_id`, `revision`; `reason` when caused by archiving the team. |

## Webhook endpoints

| Event | Meaning | Useful recorded details |
| --- | --- | --- |
| `webhook_endpoint.revision_created` | A webhook endpoint revision was saved, including the first revision of a new endpoint. | `endpoint_key`, `name`, `revision`, `url_host`, `secret_created`. |
| `webhook_endpoint.activated` | A webhook endpoint revision became active. | `endpoint_key`, `revision`, `previous_active_revision`, `url_host`. |
| `webhook_endpoint.deactivated` | An active webhook endpoint was deactivated. | `endpoint_key`, `revision`. |
| `webhook_endpoint.secret_rotated` | An endpoint's signing secret was rotated. | `endpoint_key`, `name`. The secret itself is not recorded. |
| `webhook_endpoint.tested` | Someone tested a webhook endpoint. The result may be a success or a failure. | `endpoint_key`, `revision`, `http_status`, `duration_ms`, `problem`. |

## Gateway activity

| Event | Meaning | Useful recorded details |
| --- | --- | --- |
| `agent.tool_access_changed` | An agent’s access to a server’s tools changed. | `agent_slug`, `mcp_server`, `previous`, and `current` grants, including their revisions. |
| `gateway.tool_call` | The gateway recorded the outcome of a tool call. | `tool`, `mcp_server`, `outcome`, `agent_instance_id`, and `approval_request_id` for the request the pipeline decided the call on, and `reason: access_denied` when tool access blocked the call before a request was created. |
| `gateway_server.created` | An upstream MCP server was added to the gateway. | `slug`, `name`, `revision`, `url`, `auth_mode`. |
| `gateway_server.revision_created` | A new gateway server configuration revision was saved. | `slug`, `name`, `revision`, `url`, `auth_mode`. |
| `gateway_server.activated` | A gateway server revision became active. | `slug`, `revision`, `previous_active_revision`. |
| `gateway_server.deactivated` | A gateway server was deactivated. | `slug`, `revision`. |
| `gateway_server.archived` | A gateway server was archived and its saved secrets were removed. | `slug`, `revision_count`, `active_revision`, `secrets_dropped`. |
| `gateway_server.secret_set` | A gateway server secret was saved or replaced. | `kind`, identifying the kind of secret. The secret itself is not recorded. |
| `gateway_server.secret_deleted` | A gateway server secret was removed. | `kind`. |

## Tool presentations

| Event | Meaning | Useful recorded details |
| --- | --- | --- |
| `tool_presentation.created` | A presentation was created to control how a tool's requests are displayed. | `runtime`, `server`, `tool`. |
| `tool_presentation.updated` | A tool presentation was changed. | `runtime`, `server`, `tool`. |
| `tool_presentation.deleted` | A tool presentation was removed. | `runtime`, `server`, `tool`. |

## Invitations and membership

| Event | Meaning | Useful recorded details |
| --- | --- | --- |
| `invitation.created` | Someone was invited to the organization. | `email`, the invitation's permission `grants`. |
| `invitation.resent` | An invitation was renewed for resending. | `email`. |
| `invitation.revoked` | An outstanding invitation was revoked. | `email`. |
| `invitation.accepted` | Someone accepted an invitation. | `email`, `user_id`. |
| `membership.created` | A person joined the organization. | `admission_source` and, depending on how they joined, their email or permission grants. |
| `membership.suspended` | A person's organization membership was suspended. | `previous_status`, or directory details such as `external_id` and `email`. |
| `membership.reactivated` | A person's organization membership was made active again. | `previous_status`. |
| `membership.deprovisioned` | A person's organization membership was deprovisioned. | `previous_status`, or directory details such as `external_id` and `email`. |
| `membership.directory_synced` | Directory sync updated a person's membership to active. | `external_id`, `email`. |
| `membership.identity_linked` | A verified sign-in identity was linked to a member. | `provider_key`, `issuer`, `email`. |
| `directory.command_rejected` | A directory update could not be applied. | `reason`, `external_event_id`. |

## Roles and permission policies

Permission policies describe a person's, team's or API key's access. Role and assignment events record changes to the roles and grants that provide that access.

| Event | Meaning | Useful recorded details |
| --- | --- | --- |
| `permission_policy.created` | A permission policy was added. | `principal_kind`, `principal_id`, and the policy in `after`. |
| `permission_policy.updated` | A permission policy was changed. | `principal_kind`, `principal_id`, `before`, `after`. |
| `permission_policy.deleted` | A permission policy was removed. | `principal_kind`, `principal_id`, and its recorded policy details in `before` and `after`. |
| `role.created` | A role was created. | `key`, `name`, `permissions`, `bindable_scope_kinds`, `dangerous`. |
| `role.updated` | A role changed, including a System update to a built-in role. | The role's name and key, `before_permissions`, `after_permissions`. |
| `role.deleted` | A role was deleted. | Its `key`, `name` and `permissions` at deletion. |
| `role_assignment.granted` | A principal received a role for a particular scope. | `principal_kind`, `principal_id`, `role_key`, `scope_kind`, `scope_id`, `source`. |
| `role_assignment.revoked` | A principal's role assignment was removed. | `principal_kind`, `principal_id`, `role_key`, `scope_kind`, `scope_id`, `source`. |

## API keys

| Event | Meaning | Useful recorded details |
| --- | --- | --- |
| `api_key.created` | A personal or organization API key was created. | `kind`, `name`, `expires_at`, and its permissions or permission policies. |
| `api_key.revoked` | An API key was revoked, directly or because its holder lost access. | `revocation_reason`; automatic revocation can also identify the membership and key name. |
| `api_key.used` | An organization API key was used for an API call. | `credential_id`, the HTTP `method` and `route`. |

## Organization integrations

These events record connecting or removing an integration, rather than individual notifications.

| Event | Meaning | Useful recorded details |
| --- | --- | --- |
| `slack_connection.created` | A Slack workspace connection was installed or replaced. | `team_id`, `team_name`, `bot_user_id`, `scopes`. |
| `slack_connection.removed` | A Slack workspace connection was removed. | `team_id`, `team_name`. |
| `discord_connection.created` | A Discord server connection was installed or replaced. | `guild_id`, `guild_name`. |
| `discord_connection.removed` | A Discord server connection was removed. | `guild_id`, `guild_name`. |

## Organization settings and lifecycle

| Event | Meaning | Useful recorded details |
| --- | --- | --- |
| `organization.activated` | An organization was first activated. | The activating person's `email` and `display_name`, `admission_source`, and `identity_provider` when applicable. |
| `organization.policy_updated` | Organization policy settings changed. | `before`, `after`. |
| `organization.suspended` | An organization was suspended. | `reason`, `previous_status`. |
| `organization.resumed` | A suspended organization became active again. | `reason`, `previous_status`. |
| `organization.deletion_scheduled` | An organization was scheduled for deletion. | `reason`, `previous_status`. |
| `organization.deletion_canceled` | A scheduled organization deletion was cancelled. | `reason`, `previous_status`. |
| `onboarding.started` | Someone started an agent setup session. | `session_id`. |
| `onboarding.completed` | Organization onboarding was marked complete. | `outcome`, `session_id` when associated with a setup session. |

To follow these events for one request, return to [Request history](/docs/web-app/audit-log#request-history).