--- title: "List Audit Logs" method: GET path: "/v2/audit-logs" tags: ["Audit Log API"] --- # List Audit Logs `GET /v2/audit-logs` List audit logs for your organization. You can optionally filter by time range. ## Query parameters - `pageToken` string - `pageSize` integer - `startTime.seconds` union — Unix timestamp in seconds. - integer - string, int64 ## Response `200` Success - SvlogPublicapiListAuditLogsResponse - `data` SvlogEventsAuditLogEvent[] - `id` string - `teamId` string, nullable — Not all events are team-specific (though most are) - `timestamp` string, date-time — A timestamp in RFC 3339 format (e.g., "2025-01-15T01:30:15Z"). - `actor` union - object - `apiKey` SvauthModelsApiKeyActor, required - `displayName` string — Use to simplify display / export for audit logs - `id` string - object - `impersonatedUser` SvauthModelsImpersonatedUserActor, required — ImpersonatedUserActor represents actions taken by a support agent on behalf of a user. The user fields (display_name, email, name) describe the impersonated customer, while the support_agent_* fields identify the support agent performing the action. - `displayName` string — Use to simplify display / export for audit logs - `email` string - `name` string - `supportAgentId` string — Okta ID of the support agent - `supportAgentEmail` string — Email of the support agent - `supportTokenId` string — ID of the support token used for impersonation - `id` string - object - `system` SvauthModelsSystemActor, required - `displayName` string — Use to simplify display / export for audit logs - `id` string - object - `user` SvauthModelsUserActor, required - `displayName` string — Use to simplify display / export for audit logs - `email` string - `name` string - `id` string - object - `worker` SvauthModelsWorkerActor, required - `displayName` string — Use to simplify display / export for audit logs - `id` string - `context` SvlogEventsContext - `ipAddress` string - `userAgent` string - `eventType` union - object - `accessDeprovisioned` SvlogEventsAccessDeprovisionedEvent, required — Emitted when a user's access has been deprovisioned for an entitlement - `accessRequest` SvlogEventsAccessRequest - `id` string - `entitlement` SvlogEventsEntitlement - `id` string - `displayName` string - `resource` SvlogEventsResource - `id` string - `displayName` string - `user` SvlogEventsUser - `id` string - `displayName` string - `email` string — Email serves as display name for users - `name` string — Full name if available - `reason` string — Optional free-form reason (e.g., "expired", "revoked") - `ticket` SvlogEventsTicket - `id` string - `displayName` string - `accessReviewRemediationAction` SvlogEventsAccessReviewRemediationAction — Identifies the svhelp access_review_remediation_actions row that drove a UAR-triggered deprov. Metadata only — not a SIEM target. - `id` string - object — svflow access-policy approval procedures — the approval gate on an access policy. Policy create/update/delete were already audited; the procedure lifecycle (who approves access requests) was not. Emitted from the handler seams that mutate a policy-linked procedure (public Create/Update/DeleteAccessPolicyApprovalProcedure and the user-API Set/UnsetApprovalProcedure policy branch), after the mutation commits. Renumbered from 145-147 to 158-160: 145-148 were claimed by access_review_policy_* on main while this branch was in flight — see the reservation note above. - `accessPolicyApprovalProcedureCreated` SvlogEventsAccessPolicyApprovalProcedureCreatedEvent, required — Approval-procedure lifecycle on an access policy (the 0-or-1 approval gate that access requests under the policy must pass). The policy CRUD events above don't cover it: the procedure is a separate svflow resource, so its mutations previously left no audit trail even though they change who can approve access. - `accessPolicy` SvlogEventsAccessPolicy - `id` string - `displayName` string - `approvalProcedureId` string - `stepCount` integer — Number of approval steps configured. - object - `accessPolicyApprovalProcedureDeleted` SvlogEventsAccessPolicyApprovalProcedureDeletedEvent, required - `accessPolicy` SvlogEventsAccessPolicy - `id` string - `displayName` string - `approvalProcedureId` string - object - `accessPolicyApprovalProcedureUpdated` SvlogEventsAccessPolicyApprovalProcedureUpdatedEvent, required - `accessPolicy` SvlogEventsAccessPolicy - `id` string - `displayName` string - `approvalProcedureId` string - `stepCount` integer — Number of approval steps after the replacement (steps are replaced wholesale, not patched). - object - `accessPolicyCreated` SvlogEventsAccessPolicyCreatedEvent, required - `accessPolicy` SvlogEventsAccessPolicy - `id` string - `displayName` string - object - `accessPolicyDeleted` SvlogEventsAccessPolicyDeletedEvent, required - `accessPolicy` SvlogEventsAccessPolicy - `id` string - `displayName` string - object - `accessPolicyUpdated` SvlogEventsAccessPolicyUpdatedEvent, required - `accessPolicy` SvlogEventsAccessPolicy - `id` string - `displayName` string - `changes` SvlogEventsFieldChange[] — What actually changed - union — Generic field change tracking - We keep this generic to minimize the amount of schema we have to keep in sync just to track field changes. - … - object — Access lifecycle events - `accessProvisioned` SvlogEventsAccessProvisionedEvent, required — Emitted when a user's access has been provisioned for an entitlement - `accessRequest` SvlogEventsAccessRequest - `id` string - `entitlement` SvlogEventsEntitlement - `id` string - `displayName` string - `resource` SvlogEventsResource - `id` string - `displayName` string - `user` SvlogEventsUser - `id` string - `displayName` string - `email` string — Email serves as display name for users - `name` string — Full name if available - `ticket` SvlogEventsTicket - `id` string - `displayName` string - object - `accessReviewPolicyCreated` SvlogEventsAccessReviewPolicyCreatedEvent, required - `policy` SvlogEventsAccessReviewPolicy - `id` string - `displayName` string - object - `accessReviewPolicyDeleted` SvlogEventsAccessReviewPolicyDeletedEvent, required — Soft delete; reviews that pinned a config revision keep enforcing it. - `policy` SvlogEventsAccessReviewPolicy - `id` string - `displayName` string - object - `accessReviewPolicySetTeamDefault` SvlogEventsAccessReviewPolicySetTeamDefaultEvent, required — previous_default is unset when the team had no default before. - `policy` SvlogEventsAccessReviewPolicy - `id` string - `displayName` string - `previousDefault` SvlogEventsAccessReviewPolicy - `id` string - `displayName` string - object - `accessReviewPolicyUpdated` SvlogEventsAccessReviewPolicyUpdatedEvent, required — A config change appends a new pinned-config revision; the target carries the post-update identity. - `policy` SvlogEventsAccessReviewPolicy - `id` string - `displayName` string - `changes` SvlogEventsFieldChange[] - union — Generic field change tracking - We keep this generic to minimize the amount of schema we have to keep in sync just to track field changes. - … - object — svmeta Catalyst agent configs (scheduled sessions managed via the public API). - `agentConfigCreated` SvlogEventsAgentConfigCreatedEvent, required - `agentConfig` SvlogEventsAgentConfig - `id` string - `displayName` string - object - `agentConfigDeleted` SvlogEventsAgentConfigDeletedEvent, required - `agentConfig` SvlogEventsAgentConfig - `id` string - `displayName` string - object - `agentConfigUpdated` SvlogEventsAgentConfigUpdatedEvent, required - `agentConfig` SvlogEventsAgentConfig - `id` string - `displayName` string - object - `agentInstalled` SvlogEventsAgentInstalledEvent, required - `agentConfig` SvlogEventsAgentConfig - `id` string - `displayName` string - object — svmeta agent run/install actions (not config CRUD): triggering a manual run creates an agent session; installing pulls an agent from the marketplace. Supersede the legacy catalyst_scheduled_session_* and catalyst_agent_installed events (fields 85-87, now unemitted). - `agentSessionTriggered` SvlogEventsAgentSessionTriggeredEvent, required - `agentConfig` SvlogEventsAgentConfig - `id` string - `displayName` string - object - `apiKeyCreated` SvlogEventsApiKeyCreatedEvent, required — Emitted when an API key is created. Forward-declared. Token material is never logged — only the key's id / display name. - `apiKey` SvlogEventsApiKey — An API key. Only the key's id and display name are ever carried — the token/secret material is never logged. - `id` string - `displayName` string - object - `apiKeyRevoked` SvlogEventsApiKeyRevokedEvent, required — Emitted when an API key is revoked. Forward-declared. - `apiKey` SvlogEventsApiKey — An API key. Only the key's id and display name are ever carried — the token/secret material is never logged. - `id` string - `displayName` string - object — Automated credential refresh/rotation on an existing connection (silent OAuth token refresh, Jira Forge scheduled system-token rotation). Deliberate, user-initiated credential replacement emits app_instance_reconnected instead. Baseline severity is DEBUG (see producer.debugEventNames): per-credential rotation cadence can be minutes, so this is retained for forensics but kept out of the default INFO feed. - `appInstanceAuthRefreshed` SvlogEventsAppInstanceAuthRefreshedEvent, required - `appInstance` SvlogEventsAppInstance - `id` string - `displayName` string - `service` string - object - `appInstanceCreated` SvlogEventsAppInstanceCreatedEvent, required - `appInstance` SvlogEventsAppInstance - `id` string - `displayName` string - `service` string - object - `appInstanceDeleted` SvlogEventsAppInstanceDeletedEvent, required - `appInstance` SvlogEventsAppInstance - `id` string - `displayName` string - `service` string - object - `appInstanceReconnected` SvlogEventsAppInstanceReconnectedEvent, required - `appInstance` SvlogEventsAppInstance - `id` string - `displayName` string - `service` string - object — App-instance cross-team sharing (grant/revoke of credential-backed access to another team in the same org). - `appInstanceShared` SvlogEventsAppInstanceSharedEvent, required - `appInstance` SvlogEventsAppInstance - `id` string - `displayName` string - `service` string - `sharedWithTeam` SvlogEventsTeam - `id` string - `displayName` string - object - `appInstanceUnshared` SvlogEventsAppInstanceUnsharedEvent, required - `appInstance` SvlogEventsAppInstance - `id` string - `displayName` string - `service` string - `sharedWithTeam` SvlogEventsTeam - `id` string - `displayName` string - object - `catalystAgentInstalled` SvlogEventsCatalystAgentInstalledEvent, required - `scheduledSession` SvlogEventsCatalystScheduledSession - `id` string - `displayName` string - object - `catalystChangeSetReviewed` SvlogEventsCatalystChangeSetReviewedEvent, required - `changeSet` SvlogEventsCatalystChangeSet - `id` string - object — svmeta Catalyst (agent-session) — first audit coverage wave. These actions previously emitted no org-level audit event. Each carries its Outcome on the envelope (catalyst_change_set_reviewed records DENIED on a rejected change set). - `catalystChangesApplied` SvlogEventsCatalystChangesAppliedEvent, required - `session` SvlogEventsCatalystSession - `id` string - `displayName` string - `changeSet` SvlogEventsCatalystChangeSet - `id` string - object - `catalystScheduledSessionCreated` SvlogEventsCatalystScheduledSessionCreatedEvent, required - `scheduledSession` SvlogEventsCatalystScheduledSession - `id` string - `displayName` string - object - `catalystScheduledSessionTriggered` SvlogEventsCatalystScheduledSessionTriggeredEvent, required - `scheduledSession` SvlogEventsCatalystScheduledSession - `id` string - `displayName` string - object - `catalystSessionSharingChanged` SvlogEventsCatalystSessionSharingChangedEvent, required - `session` SvlogEventsCatalystSession - `id` string - `displayName` string - `shared` boolean - object - `catalystSkillDeployed` SvlogEventsCatalystSkillDeployedEvent, required - `skill` SvlogEventsCatalystSkill - `id` string - `displayName` string - object - `categoryCreated` SvlogEventsCategoryCreatedEvent, required — category_created: a new ticket category option was created. - `category` SvlogEventsCategory - `id` string - `displayName` string - object - `categoryDeleted` SvlogEventsCategoryDeletedEvent, required — category_deleted: a category option (and its subcategories) was deleted. The delete handler resolves the category before deletion so the event carries the full identity. - `category` SvlogEventsCategory - `id` string - `displayName` string - object - `categoryUpdated` SvlogEventsCategoryUpdatedEvent, required — category_updated: an existing category option's name, description, or parent changed. The category carries the post-update identity as a target. - `category` SvlogEventsCategory - `id` string - `displayName` string - object — Custom-role lifecycle (svauth, org-admin surface) - `customRoleCreated` SvlogEventsCustomRoleCreatedEvent, required - `customRole` SvlogEventsCustomRole - `id` string - `displayName` string - object - `customRoleDeleted` SvlogEventsCustomRoleDeletedEvent, required - `customRole` SvlogEventsCustomRole - `id` string - `displayName` string - object - `customRoleGrantsSet` SvlogEventsCustomRoleGrantsSetEvent, required — Emitted when an admin replaces the set of actions a custom role grants. - `customRole` SvlogEventsCustomRole - `id` string - `displayName` string - `grantedActions` string[] — The full granted set after the change (action slugs). - object - `customRoleMemberAssigned` SvlogEventsCustomRoleMemberAssignedEvent, required - `customRole` SvlogEventsCustomRole - `id` string - `displayName` string - `memberUser` SvlogEventsUser - `id` string - `displayName` string - `email` string — Email serves as display name for users - `name` string — Full name if available - `memberGroup` SvlogEventsGroup - `id` string - `displayName` string - object - `customRoleMemberUnassigned` SvlogEventsCustomRoleMemberUnassignedEvent, required - `customRole` SvlogEventsCustomRole - `id` string - `displayName` string - `memberUser` SvlogEventsUser - `id` string - `displayName` string - `email` string — Email serves as display name for users - `name` string — Full name if available - `memberGroup` SvlogEventsGroup - `id` string - `displayName` string - object - `customRoleTeamBound` SvlogEventsCustomRoleTeamBoundEvent, required - `customRole` SvlogEventsCustomRole - `id` string - `displayName` string - `team` SvlogEventsTeam - `id` string - `displayName` string - object - `customRoleTeamUnbound` SvlogEventsCustomRoleTeamUnboundEvent, required - `customRole` SvlogEventsCustomRole - `id` string - `displayName` string - `team` SvlogEventsTeam - `id` string - `displayName` string - object - `customRoleUpdated` SvlogEventsCustomRoleUpdatedEvent, required - `customRole` SvlogEventsCustomRole - `id` string - `displayName` string - `changes` SvlogEventsFieldChange[] — What actually changed - union — Generic field change tracking - We keep this generic to minimize the amount of schema we have to keep in sync just to track field changes. - … - object — svanalytics dashboard + widget lifecycle — first audit coverage wave. These CRUD actions previously emitted no org-level audit event. Emitted from svanalytics' user-API handlers (Create/Update/Delete Dashboard/Widget ForTeam), where the acting user is resolved from the request and the team scope is the *ForTeam team_id. Each carries SUCCESS on the envelope (these handler seams only emit after the mutation commits). Pure layout reflows (UpdateDashboardLayout) and the default-dashboard toggle (SetDefaultDashboard) are intentionally NOT audited — high-frequency UX state, not security-relevant mutations. - `dashboardCreated` SvlogEventsDashboardCreatedEvent, required — dashboard_created: a new analytics dashboard was created for a team. - `dashboard` SvlogEventsDashboard - `id` string - `displayName` string - object - `dashboardDeleted` SvlogEventsDashboardDeletedEvent, required — dashboard_deleted: a dashboard was deleted. Emitted from the delete handler, which resolves the dashboard (and its team scope) before deletion so the audit event still carries the full identity. - `dashboard` SvlogEventsDashboard - `id` string - `displayName` string - object - `dashboardUpdated` SvlogEventsDashboardUpdatedEvent, required — dashboard_updated: an existing dashboard's name, description, or variables changed (the content edits, not pure layout reflows). The dashboard carries the post-update identity as a target. - `dashboard` SvlogEventsDashboard - `id` string - `displayName` string - object - `emailIntakeConfigCreated` SvlogEventsEmailIntakeConfigCreatedEvent, required - `config` SvlogEventsEmailIntakeConfig - `id` string - `displayName` string — The intake email address - `teamId` string - object - `emailIntakeConfigDeleted` SvlogEventsEmailIntakeConfigDeletedEvent, required - `config` SvlogEventsEmailIntakeConfig - `id` string - `displayName` string — The intake email address - `teamId` string - object - `emailIntakeConfigUpdated` SvlogEventsEmailIntakeConfigUpdatedEvent, required - `config` SvlogEventsEmailIntakeConfig - `id` string - `displayName` string — The intake email address - `teamId` string - `changes` SvlogEventsFieldChange[] — What actually changed - union — Generic field change tracking - We keep this generic to minimize the amount of schema we have to keep in sync just to track field changes. - … - object — svflow entitlement lifecycle (the access-grant config on an app resource). Access policy create/update/delete and the access provision/deprovision lifecycle were already audited; the entitlement CRUD that sits between them was the gap. Emitted from svflow's public-API handlers (Create/Update/DeleteAppResourceEntitlement), where the acting principal (user or API key) is resolved from the request. Each carries SUCCESS on the envelope (these handler seams only emit after the mutation commits). - `entitlementCreated` SvlogEventsEntitlementCreatedEvent, required — entitlement_created: a new entitlement (a grantable unit of access on an app resource) was created. Both the entitlement and its parent resource are carried as targets so SIEM can pivot on either. - `entitlement` SvlogEventsEntitlement - `id` string - `displayName` string - `resource` SvlogEventsResource - `id` string - `displayName` string - object - `entitlementDeleted` SvlogEventsEntitlementDeletedEvent, required — entitlement_deleted: an entitlement was deleted (soft-deleted). Emitted from the delete handler, which resolves the entitlement (and its team scope) before deletion so the audit event still carries the full identity. - `entitlement` SvlogEventsEntitlement - `id` string - `displayName` string - `resource` SvlogEventsResource - `id` string - `displayName` string - object — svflow entitlement requestability toggle: whether end users can request this role/entitlement through Serval (requests_enabled). Flipping it changes who can ask for access, so it is audited as its own action rather than folded into the generic entitlement_updated (which the public update handlers still emit for any config change). Emitted from the access state manager so every mutation surface is covered by one seam: the settings user API (Set/BulkSet EntitlementsRequestable), the public-API entitlement/role update endpoints (single + batch), and the private API. Fires only when the stored value actually changed, post-commit, SUCCESS on the envelope. - `entitlementRequestabilityChanged` SvlogEventsEntitlementRequestabilityChangedEvent, required — entitlement_requestability_changed: the requests_enabled toggle on an entitlement flipped — whether end users can request this role through Serval. Carries the new value so SIEM can distinguish opening up a role from locking it down without diffing consecutive events. - `entitlement` SvlogEventsEntitlement - `id` string - `displayName` string - `resource` SvlogEventsResource - `id` string - `displayName` string - `requestable` boolean - object - `entitlementUpdated` SvlogEventsEntitlementUpdatedEvent, required — entitlement_updated: an existing entitlement's configuration changed (name, description, provisioning method, access policy, linked entitlements, etc.). The entitlement and resource carry the post-update identity as targets. - `entitlement` SvlogEventsEntitlement - `id` string - `displayName` string - `resource` SvlogEventsResource - `id` string - `displayName` string - object - `entityCreated` SvlogEventsEntityCreatedEvent, required - `entity` SvlogEventsEntity - `id` string - `displayName` string - `entityTypeId` string - object - `entityDeleted` SvlogEventsEntityDeletedEvent, required - `entity` SvlogEventsEntity - `id` string - `displayName` string - `entityTypeId` string - object — svstore entity / entity-type changes (#12583) - `entityTypeCreated` SvlogEventsEntityTypeCreatedEvent, required - `entityType` SvlogEventsEntityType - `id` string - `displayName` string - `entitySchemaId` string - `entitySchema` SvlogEventsEntitySchema - `id` string - `displayName` string - object - `entityTypeDeleted` SvlogEventsEntityTypeDeletedEvent, required - `entityType` SvlogEventsEntityType - `id` string - `displayName` string - `entitySchemaId` string - object - `entityTypeFieldCreated` SvlogEventsEntityTypeFieldCreatedEvent, required - `field` SvlogEventsEntityTypeField - `id` string - `displayName` string - `entityTypeId` string - `entityType` SvlogEventsEntityType - `id` string - `displayName` string - `entitySchemaId` string - object - `entityTypeFieldDeleted` SvlogEventsEntityTypeFieldDeletedEvent, required - `field` SvlogEventsEntityTypeField - `id` string - `displayName` string - `entityTypeId` string - `entityType` SvlogEventsEntityType - `id` string - `displayName` string - `entitySchemaId` string - object - `entityTypeUpdated` SvlogEventsEntityTypeUpdatedEvent, required - `entityType` SvlogEventsEntityType - `id` string - `displayName` string - `entitySchemaId` string - `changes` SvlogEventsFieldChange[] - union — Generic field change tracking - We keep this generic to minimize the amount of schema we have to keep in sync just to track field changes. - … - object - `entityUpdated` SvlogEventsEntityUpdatedEvent, required - `entity` SvlogEventsEntity - `id` string - `displayName` string - `entityTypeId` string - object — svflow folder lifecycle (the per-team, nestable tree that organizes workflows and skills/guidance). Emitted from svflow's public-API folder handlers (Create/Update/Delete/SetFolderResourceLocation). Folder placement governs which workflows/skills are visible where, so its mutations are security-relevant and org-audited. - `folderCreated` SvlogEventsFolderCreatedEvent, required — folder_created: a new folder was created for a team, under the root or an existing parent folder. - `folder` SvlogEventsFolder — A svflow folder (the per-team tree node that organizes workflows or skills). - `id` string - `displayName` string - object - `folderDeleted` SvlogEventsFolderDeletedEvent, required — folder_deleted: a folder was deleted (soft-deleted). Its direct contents (subfolders and workflow/skill files) are reparented to the root rather than cascade-deleted. Emitted from the delete handler, which resolves the folder (and its team scope) before deletion so the event still carries the identity. - `folder` SvlogEventsFolder — A svflow folder (the per-team tree node that organizes workflows or skills). - `id` string - `displayName` string - object - `folderResourceLocationSet` SvlogEventsFolderResourceLocationSetEvent, required — folder_resource_location_set: a workflow or skill/guidance was placed into a folder or moved back to the team root. The moved resource is always carried as a target; the destination folder is carried when the resource was placed into one (unset means it was moved to the root). - `resource` SvlogEventsFolderResource — The workflow or skill/guidance whose folder placement changed. The resource keeps its own display name in its create/update audit events, so the move event carries only the identity (id + kind) needed to link the two. - `id` string - `resourceType` string — "workflow" or "guidance". - `folder` SvlogEventsFolder — A svflow folder (the per-team tree node that organizes workflows or skills). - `id` string - `displayName` string - object - `folderUpdated` SvlogEventsFolderUpdatedEvent, required — folder_updated: an existing folder was renamed and/or reparented (moved under a different parent, or to the root). The folder carries the post-update identity as the target. - `folder` SvlogEventsFolder — A svflow folder (the per-team tree node that organizes workflows or skills). - `id` string - `displayName` string - object — svauth group lifecycle (org-admin / public-API surface). Groups drive access through the SpiceDB mirror, so their create/update/delete are security-relevant org-level mutations. Emitted from svauth's public-API group handlers; org-scoped (no team on the envelope). - `groupCreated` SvlogEventsGroupCreatedEvent, required — Emitted when a group is created. The new group is the SIEM target. - `group` SvlogEventsGroup - `id` string - `displayName` string - object - `groupDeleted` SvlogEventsGroupDeletedEvent, required — Emitted when a group is deleted. The delete handler resolves the group before deletion so the event still carries the full identity. - `group` SvlogEventsGroup - `id` string - `displayName` string - object - `groupUpdated` SvlogEventsGroupUpdatedEvent, required — Emitted when a group's name and/or membership changes. The group carries the post-update identity as the target. - `group` SvlogEventsGroup - `id` string - `displayName` string - object - `guidanceCreated` SvlogEventsGuidanceCreatedEvent, required - `guidance` SvlogEventsGuidance - `id` string - `displayName` string — Should generally include a name where possible as makes it easier to identify the object on export to SIEM without complex hydration - object - `guidanceDeleted` SvlogEventsGuidanceDeletedEvent, required - `guidance` SvlogEventsGuidance - `id` string - `displayName` string — Should generally include a name where possible as makes it easier to identify the object on export to SIEM without complex hydration - object - `guidanceDeployed` SvlogEventsGuidanceDeployedEvent, required - `guidance` SvlogEventsGuidance - `id` string - `displayName` string — Should generally include a name where possible as makes it easier to identify the object on export to SIEM without complex hydration - `previousVersion` SvlogEventsGuidanceVersion - `id` string — This is the version ID, not the guidance ID - `displayName` string - `guidanceId` string - `versionNumber` integer - `deployedVersion` SvlogEventsGuidanceVersion - `id` string — This is the version ID, not the guidance ID - `displayName` string - `guidanceId` string - `versionNumber` integer - object - `guidanceDisabled` SvlogEventsGuidanceDisabledEvent, required - `guidance` SvlogEventsGuidance - `id` string - `displayName` string — Should generally include a name where possible as makes it easier to identify the object on export to SIEM without complex hydration - object - `guidanceEnabled` SvlogEventsGuidanceEnabledEvent, required - `guidance` SvlogEventsGuidance - `id` string - `displayName` string — Should generally include a name where possible as makes it easier to identify the object on export to SIEM without complex hydration - object - `guidanceUpdated` SvlogEventsGuidanceUpdatedEvent, required - `guidance` SvlogEventsGuidance - `id` string - `displayName` string — Should generally include a name where possible as makes it easier to identify the object on export to SIEM without complex hydration - `version` SvlogEventsGuidanceVersion - `id` string — This is the version ID, not the guidance ID - `displayName` string - `guidanceId` string - `versionNumber` integer - `changes` SvlogEventsFieldChange[] — What actually changed - union — Generic field change tracking - We keep this generic to minimize the amount of schema we have to keep in sync just to track field changes. - … - object — A simulated-user reply was sent into an interactive help-agent simulation — one record per message, for a who-sent-what trail. - `helpAgentSimulationReply` SvlogEventsHelpAgentSimulationReplyEvent, required — help_agent_simulation_reply: a simulated-user reply was sent into an interactive help-agent simulation. Emitted once per reply and attributed to the user who sent it (which, when replying to a shared/other user's run, may differ from who started it), giving a complete "who sent each message" trail for transparency. Emitted for every reply, not only live-workflow runs, so it is INFO baseline rather than WARN. Two SIEM targets: the team and the run. - `team` SvlogEventsTeam - `id` string - `displayName` string - `simulationRun` SvlogEventsHelpAgentSimulationRun - `id` string — No obvious display name for simulation runs, so we skip that field - `speakerEmail` string — The simulated user this reply was spoken as (the ticket requester or an additional participant), so an auditor can see whose voice drove the turn. - object — A help-agent simulation was started. Emitted for every start from svhelp's creation surfaces (user API, public API, Catalyst's private API); WARN when it exercised a privileged capability (impersonating another user and/or executing live workflows), INFO otherwise. Team-scoped; the caller is the actor, targeting the team and the run. - `helpAgentSimulationStarted` SvlogEventsHelpAgentSimulationStartedEvent, required — help_agent_simulation_started: a help-agent simulation was started. Emitted for every start so the log carries who started each simulation; severity is WARN when the start exercised a privileged capability (impersonation and/or live workflows) and INFO for a plain self-simulation with mocked tools. Two SIEM targets: the team the simulation runs in, and the simulation run itself (so an auditor can pivot straight to the run). The caller (a user or an API key) is the envelope actor. The simulated users are recorded by count and by email, so an auditor can see who was role-played; the two booleans record which privileged gate(s), if any, the start cleared. - `team` SvlogEventsTeam - `id` string - `displayName` string - `simulationRun` SvlogEventsHelpAgentSimulationRun - `id` string — No obvious display name for simulation runs, so we skip that field - `simulatedUserCount` integer — How many users the simulation role-plays (the requester plus any additional simulated participants). Equals len(simulated_user_emails). - `simulatedUserEmails` string[] — Emails of the simulated users, for observability — answers "who was role-played" (and, on an impersonation start, who was impersonated) without a join back to the run. This is PII, deliberately carried here; for a plain self-simulation it is just the caller's own email. - `impersonation` boolean — True when the simulation runs as someone other than the caller (or the caller has no user identity, e.g. an API key), which required the RUN_SIMULATION_AS_OTHER_USER grant. - `liveWorkflows` boolean — True when the simulation was configured to execute live (real) workflows, which required the RUN_PUBLISHED_WORKFLOW grant. - object - `impersonationSessionStarted` SvlogEventsImpersonationSessionStartedEvent, required — Emitted when a support agent starts an impersonation session by redeeming a support token - `impersonatedUser` SvlogEventsUser - `id` string - `displayName` string - `email` string — Email serves as display name for users - `name` string — Full name if available - `supportTokenId` string — ID of the support token used for impersonation - `supportAgentId` string — Okta ID of the support agent - `supportAgentEmail` string — Email of the support agent - object - `impersonationSessionTerminated` SvlogEventsImpersonationSessionTerminatedEvent, required — Emitted when impersonation sessions are terminated (e.g., when user clears support tokens) - `impersonatedUser` SvlogEventsUser - `id` string - `displayName` string - `email` string — Email serves as display name for users - `name` string — Full name if available - `supportTokenId` string — ID of the support token that was deleted - `sessionsTerminatedCount` integer — Number of sessions that were terminated - `reason` string — Reason for termination (e.g., "user_revoked", "admin_revoked") - `supportAgentId` string — Okta ID of the support agent whose impersonation session was terminated. Resolved from the support token's redemption record; empty if no redemption is found. - `supportAgentEmail` string — Email of the support agent whose impersonation session was terminated. - object - `knowledgeBaseArchived` SvlogEventsKnowledgeBaseArchivedEvent, required - `knowledgeBase` SvlogEventsKnowledgeBase - `id` string - `displayName` string - object - `knowledgeBaseCreated` SvlogEventsKnowledgeBaseCreatedEvent, required - `knowledgeBase` SvlogEventsKnowledgeBase - `id` string - `displayName` string - object - `knowledgeBaseDeleted` SvlogEventsKnowledgeBaseDeletedEvent, required - `knowledgeBase` SvlogEventsKnowledgeBase - `id` string - `displayName` string - object - `knowledgeBaseUpdated` SvlogEventsKnowledgeBaseUpdatedEvent, required - `knowledgeBase` SvlogEventsKnowledgeBase - `id` string - `displayName` string - `changes` SvlogEventsFieldChange[] - union — Generic field change tracking - We keep this generic to minimize the amount of schema we have to keep in sync just to track field changes. - … - object - `knowledgeDocumentAudienceUpdated` SvlogEventsKnowledgeDocumentAudienceUpdatedEvent, required - `document` SvlogEventsKnowledgeDocument - `id` string - `displayName` string - `knowledgeBaseId` string - `changes` SvlogEventsFieldChange[] - union — Generic field change tracking - We keep this generic to minimize the amount of schema we have to keep in sync just to track field changes. - … - object - `knowledgeDocumentCreated` SvlogEventsKnowledgeDocumentCreatedEvent, required - `document` SvlogEventsKnowledgeDocument - `id` string - `displayName` string - `knowledgeBaseId` string - object - `knowledgeDocumentPublished` SvlogEventsKnowledgeDocumentPublishedEvent, required - `document` SvlogEventsKnowledgeDocument - `id` string - `displayName` string - `knowledgeBaseId` string - object - `labelCreated` SvlogEventsLabelCreatedEvent, required — label_created: a new ticket label option was created. - `label` SvlogEventsLabel - `id` string - `displayName` string - object - `labelDeleted` SvlogEventsLabelDeletedEvent, required — label_deleted: a label option was deleted (cascading off any tickets). The delete handler resolves the label before deletion so the event carries the full identity. - `label` SvlogEventsLabel - `id` string - `displayName` string - object - `labelUpdated` SvlogEventsLabelUpdatedEvent, required — label_updated: an existing label option's name, description, or color changed. The label carries the post-update identity as a target. - `label` SvlogEventsLabel - `id` string - `displayName` string - object - `mcpOauthAuthorized` SvlogEventsMCPOAuthAuthorizedEvent, required — Emitted when a user approves an MCP OAuth authorization request - `clientId` string - `redirectUri` string - `client` SvlogEventsMcpClient — An OAuth client of the MCP authorization server. MCP clients register dynamically and carry no human-readable name, so the OAuth client_id is the identifier; there is no display_name field (same as WorkflowRun). - `id` string — The OAuth client_id - object - `mcpOauthDenied` SvlogEventsMCPOAuthDeniedEvent, required — Emitted when a user denies an MCP OAuth authorization request - `clientId` string - `redirectUri` string - `client` SvlogEventsMcpClient — An OAuth client of the MCP authorization server. MCP clients register dynamically and carry no human-readable name, so the OAuth client_id is the identifier; there is no display_name field (same as WorkflowRun). - `id` string — The OAuth client_id - object - `mcpOauthTokenRevoked` SvlogEventsMCPOAuthTokenRevokedEvent, required — Emitted when an MCP OAuth refresh token is revoked - `user` SvlogEventsUser - `id` string - `displayName` string - `email` string — Email serves as display name for users - `name` string — Full name if available - object — svauth org offboarding: SpiceDB (authorization-engine) teardown at soft delete. The companion of org_sso_teardown for the SECOND external-trust surface severed at soft delete: the org's engine-held access facts (role grants/members, team role-bindings, group memberships) are deleted. Emitted from the OrganizationManager.TeardownAuthzRelationships seam; org-scoped (no team on the envelope). Carries ERROR on the Outcome when the teardown aborts partway, so a half-completed revocation is audited. Renumbered from 145 to 152: 145/146 were claimed by access_review_policy_created/updated on main while this branch was in flight — see the reservation note below. - `orgAuthzTeardown` SvlogEventsOrgAuthzTeardownEvent, required — Emitted when an org's SpiceDB (authorization-engine) footprint is torn down as part of offboarding: the relationship tuples keyed by the org's roles, teams, and groups are deleted from the engine. The org is the SIEM target; org-scoped. Counts are per-category ENTITY counts (roles/teams/groups whose tuples were fully swept before any abort) — SpiceDB's DeleteRelationships reports no per-tuple counts, and the entity ids are deliberately omitted, keeping the payload enumeration-free like org_sso_teardown. The Outcome on the envelope records SUCCESS on a clean teardown or ERROR when it aborts partway. - `organization` SvlogEventsOrganization - `id` string - `displayName` string - `rolesTornDown` integer - `teamsTornDown` integer - `groupsTornDown` integer - object — svauth org offboarding lifecycle transition (pause / resume / soft-delete / restore / cold-store / purge). Emitted from the OrganizationManager transition seam; org-scoped (no team on the envelope). The free-text business reason lives in the org_lifecycle_events ledger, not this payload, so no PII reaches SIEM. - `orgLifecycleStateChanged` SvlogEventsOrgLifecycleStateChangedEvent, required — Emitted on a customer-org offboarding lifecycle transition. from_state / to_state are org_lifecycle_state values ("active", "paused", "soft_deleted", "cold_stored", "purged"). The org is the SIEM target; org-scoped. - `organization` SvlogEventsOrganization - `id` string - `displayName` string - `fromState` string - `toState` string - object — svflow org offboarding: provider OAuth-credential revocation at soft delete. The third external-trust surface severed alongside org_sso_teardown / org_authz_teardown: every team's app-instance OAuth credentials are revoked AT THE EXTERNAL PROVIDER (nothing local is deleted — the wipe happens at cold-store). Emitted once per org-level teardown pass from the integrationrevoke.Revoker.TeardownTrustForTeams seam; org-scoped (no team on the envelope). Carries ERROR on the Outcome when enumeration aborts the pass partway. Renumbered from 146 to 153 alongside org_authz_teardown above. - `orgProviderTrustRevoked` SvlogEventsOrgProviderTrustRevokedEvent, required — Emitted when an org's provider OAuth credentials are revoked at their external providers as part of offboarding (svflow's revoke-only trust teardown at soft delete — no local row is deleted; the wipe happens at cold-store). One event per org-level teardown pass, not per credential. The org is the SIEM target; org-scoped. Counts summarize the per-credential outcomes across every team's app instances (no credential / integration ids are ever carried). dry_run mirrors the pass's manifest; a dry run is never emitted (it mutates nothing), so it is false on every recorded event. The Outcome on the envelope records SUCCESS on a completed pass — provider-side failures are best-effort, tallied under credentials_failed — or ERROR when enumeration aborts the pass partway. - `organization` SvlogEventsOrganization - `id` string - `displayName` string - `credentialsRevoked` integer - `credentialsUnsupported` integer - `credentialsFailed` integer - `dryRun` boolean - object — A Serval operator provisioned a new customer organization through the internal lifecycle console (org + first team + first admin, with a setup link issued to the admin). Org-scoped; the operator's svsupport-attested Okta identity is carried in the payload because svlog's Actor has no Okta-agent variant. - `orgProvisioned` SvlogEventsOrgProvisionedEvent, required — OrgProvisionedEvent is the durable record of operator-driven customer-org creation (the onboarding counterpart of the offboarding events above). The emails identify who exercised the privileged surface and who was granted first-admin — the attribution is the point of the event. - `organization` SvlogEventsOrganization - `id` string - `displayName` string - `operatorAgentEmail` string — Okta identity of the Serval operator who provisioned the org (svsupport-attested, never a raw wire claim). - `adminEmail` string — The customer's first admin: created as org_admin and sent the setup link. - `operatorAdminEmail` string — Set when the operator additionally created an org_admin for themselves in the new org (equals operator_agent_email), having attested the customer authorized staff access. Empty when no staff user was created. - object - `orgProvisionedViaAccessCode` SvlogEventsOrgProvisionedViaAccessCodeEvent, required — Emitted when a new organization is created by redeeming a single-use signup access code (signup-disabled / locked-down deployments). Customer-visible: surfaces in the new org's audit log as "provisioned by Serval support", naming the minting agent for transparency. - `organization` SvlogEventsOrganization - `id` string - `displayName` string - `mintedByAgentEmail` string — Email of the Serval support agent who minted the redeemed access code. - object — svhelp org-admin custom redaction patterns: create/update/delete of a regex enforced on persisted ticket content (security-relevant). - `orgRedactionPatternsChanged` SvlogEventsOrgRedactionPatternsChangedEvent, required — Emitted when an org admin creates, updates, or deletes a custom redaction pattern (svhelp). These patterns govern what is scrubbed from persisted ticket content, so every change is security-relevant. The changes carry the affected pattern (label/regex/enabled) as before→after field changes. - `organization` SvlogEventsOrganization - `id` string - `displayName` string - `changes` SvlogEventsFieldChange[] — What actually changed - union — Generic field change tracking - We keep this generic to minimize the amount of schema we have to keep in sync just to track field changes. - … - object - `orgSettingsChanged` SvlogEventsOrgSettingsChangedEvent, required — Emitted when organization-level settings change. Forward-declared. - `organization` SvlogEventsOrganization - `id` string - `displayName` string - `changes` SvlogEventsFieldChange[] — What actually changed - union — Generic field change tracking - We keep this generic to minimize the amount of schema we have to keep in sync just to track field changes. - … - object — A Serval operator re-issued the first-admin setup link for an already-provisioned org whose original link expired. Org-scoped; the operator's svsupport-attested Okta identity is carried in the payload (svlog's Actor has no Okta-agent variant), mirroring org_provisioned. - `orgSetupLinkResent` SvlogEventsOrgSetupLinkResentEvent, required — OrgSetupLinkResentEvent is the durable record of an operator re-issuing the first-admin setup link for an already-provisioned org (the recovery counterpart of org_provisioned, for when the original 24h link expired before the admin completed setup). The emails identify who exercised the privileged surface and which first-admin the fresh link was issued to. - `organization` SvlogEventsOrganization - `id` string - `displayName` string - `operatorAgentEmail` string — Okta identity of the Serval operator who re-issued the link (svsupport-attested, never a raw wire claim). - `adminEmail` string — The first admin the fresh setup link was re-issued to. - object — svauth org offboarding: irreversible WorkOS teardown. Distinct from org_lifecycle_state_changed (which records the state-machine move): this fires when the org's external identity-provider footprint is destroyed — its WorkOS SSO connections + Directory Sync directories, the WorkOS Organization itself, and the local Serval<->WorkOS mapping row (which also stops the SCIM delta-sync fan-out). Emitted from the OrganizationManager.TeardownWorkOS seam; org-scoped (no team on the envelope). Carries FAILURE/ERROR on the Outcome when the teardown aborts partway, so a half-completed destructive revocation is audited. - `orgSsoTeardown` SvlogEventsOrgSSOTeardownEvent, required — Emitted when an org's WorkOS (external identity-provider) footprint is torn down as part of offboarding: its SSO connections + Directory Sync directories are deleted, the WorkOS Organization is deleted, and the local Serval<->WorkOS mapping row is dropped. Irreversible; the org is the SIEM target; org-scoped. Counts summarize what was removed (no connection / directory ids or secrets are ever carried). The Outcome on the envelope records SUCCESS on a clean teardown or ERROR when it aborts partway. - `organization` SvlogEventsOrganization - `id` string - `displayName` string - `workosOrgId` string — The WorkOS Organization id that was torn down. Not a secret — an opaque provider handle — but the SSO connection / directory ids are deliberately omitted (count only), keeping the payload PII- and enumeration-free. - `connectionsDeleted` integer - `directoriesDeleted` integer - object — Cross-cutting authorization denial. Unlike every variant above (each owned by one service's handlers), this fires from the shared svauth WithAuth seam that fronts every authenticated RPC across all services, so it is the single "who was REFUSED access to what" signal compliance reviews key on. The actor is on the envelope; the payload carries the attempted action + the resource (team/org) the check ran against. Always DENIED on the Outcome. - `permissionDenied` SvlogEventsPermissionDeniedEvent, required — permission_denied: an authenticated request was rejected by an authorization check at the shared svauth WithAuth seam (the central CheckPermission step every service's authenticated RPCs pass through). The actor who was refused is on the envelope; the Outcome is always DENIED, with reason_code stable for SIEM ("permission_denied") and reason_detail human-readable (the attempted action + RPC method, no secrets/PII). resource is the team/org the check ran against, carried as the target so SIEM can pivot on "who was refused access to which resource". The actor is frequently unresolved here: the central check denies before the request context is enriched with the principal, so the envelope actor may be absent — the action + resource + actor IP/UA still make the denial actionable. - `resource` SvlogEventsAuthorizationResource — AuthorizationResource identifies the resource an authorization check ran against. It is deliberately a thin (id + display_name) target shape — the id is a team_id or org_id — so the permission_denied export keys on the contested resource without the denial path needing a name-resolving RPC. - `id` string - `displayName` string - `action` string — The authorization action string that was checked and refused (the svauth Action enum value, e.g. "MANAGE_TEAM"). This is the "what was attempted". - `rpcMethod` string — The RPC method the denial occurred on, when resolvable from the request context (e.g. "/svhelp.user.SvUserService/DeleteQueue"); empty otherwise. - object - `queueCreated` SvlogEventsQueueCreatedEvent, required — queue_created: a new ticket queue was created. - `queue` SvlogEventsQueue - `id` string - `displayName` string - object - `queueDeleted` SvlogEventsQueueDeletedEvent, required — queue_deleted: a queue was deleted. Emitted from the delete handler, which resolves the queue (and its team scope) before deletion. - `queue` SvlogEventsQueue - `id` string - `displayName` string - object - `queueUpdated` SvlogEventsQueueUpdatedEvent, required — queue_updated: an existing queue's name, description, filter, or match-all flag changed. The queue carries the post-update identity as a target. - `queue` SvlogEventsQueue - `id` string - `displayName` string - object - `routingRuleCreated` SvlogEventsRoutingRuleCreatedEvent, required — routing_rule_created: a new ticket-routing rule was created. Routing rules have no display name (they are identified by their condition/action set), so the target carries the id only. - `routingRule` SvlogEventsRoutingRule - `id` string - `displayName` string — Routing rules have no name column; display_name is left empty and the target is keyed on the id. - object - `routingRuleDeleted` SvlogEventsRoutingRuleDeletedEvent, required — routing_rule_deleted: a routing rule was deleted. Emitted from the delete handler, which resolves the rule (and its team scope) before deletion. - `routingRule` SvlogEventsRoutingRule - `id` string - `displayName` string — Routing rules have no name column; display_name is left empty and the target is keyed on the id. - object - `routingRuleUpdated` SvlogEventsRoutingRuleUpdatedEvent, required — routing_rule_updated: an existing routing rule's conditions or actions changed (the handler bumps the rule's updated_at). The rule carries its identity as a target. - `routingRule` SvlogEventsRoutingRule - `id` string - `displayName` string — Routing rules have no name column; display_name is left empty and the target is keyed on the id. - object — svhelp saved simulation configs (versioned help-agent scenarios). Config CRUD is audited like the other help-desk configuration above; simulation RUNS are operational executions and intentionally are not. - `simulationConfigCreated` SvlogEventsSimulationConfigCreatedEvent, required — simulation_config_created: a saved help-agent simulation scenario was created (revision 1). - `simulationConfig` SvlogEventsSimulationConfig - `id` string - `displayName` string - object - `simulationConfigDeleted` SvlogEventsSimulationConfigDeletedEvent, required — simulation_config_deleted: a saved simulation config was soft-deleted. Emitted from the delete handler, which resolves the config before deletion so the event carries the full identity. - `simulationConfig` SvlogEventsSimulationConfig - `id` string - `displayName` string - object - `simulationConfigUpdated` SvlogEventsSimulationConfigUpdatedEvent, required — simulation_config_updated: a saved simulation config was renamed, re-described, or had a new scenario revision minted. The config carries the post-update identity as a target. - `simulationConfig` SvlogEventsSimulationConfig - `id` string - `displayName` string - object — svhelp help-desk configuration lifecycle — first audit coverage wave for the admin config entities (SLA definitions, routing rules, queues, label options, category options). These CRUD actions previously emitted no org-level audit event; they sit alongside the already-audited email_intake_config_* events as the rest of svhelp's admin config surface. Emitted from svhelp's user-API handlers, where the acting user is resolved from the request and the team scope is the entity's team. Each carries SUCCESS on the envelope (these handler seams only emit after the mutation commits). Per-ticket label add/remove and the per-condition / per-action sub-entities (SlaCondition, SlaActionDefinition, RoutingRuleCondition/Action) are intentionally NOT audited — ticket-level / too granular; the parent definition create/update covers the meaningful governance change. - `slaDefinitionCreated` SvlogEventsSlaDefinitionCreatedEvent, required — sla_definition_created: a new SLA definition (the team-scoped target / response-time policy) was created. - `slaDefinition` SvlogEventsSlaDefinition - `id` string - `displayName` string - object - `slaDefinitionDeleted` SvlogEventsSlaDefinitionDeletedEvent, required — sla_definition_deleted: an SLA definition was deleted. Emitted from the delete handler, which resolves the definition (and its team scope) before deletion so the audit event still carries the full identity. - `slaDefinition` SvlogEventsSlaDefinition - `id` string - `displayName` string - object - `slaDefinitionUpdated` SvlogEventsSlaDefinitionUpdatedEvent, required — sla_definition_updated: an existing SLA definition's name, target duration, schedule, or attachment criteria changed. The definition carries the post-update identity as a target. - `slaDefinition` SvlogEventsSlaDefinition - `id` string - `displayName` string - object - `ssoConfigChanged` SvlogEventsSSOConfigChangedEvent, required — Emitted when an organization's SSO / SAML configuration changes. Forward-declared. Secrets / certs are never logged. - `organization` SvlogEventsOrganization - `id` string - `displayName` string - `changes` SvlogEventsFieldChange[] — What actually changed - union — Generic field change tracking - We keep this generic to minimize the amount of schema we have to keep in sync just to track field changes. - … - object — svmeta team-level Catalyst settings (default worker mode, publish review policy). - `teamCatalystSettingsChanged` SvlogEventsTeamCatalystSettingsChangedEvent, required - `team` SvlogEventsCatalystTeam - `id` string - object — Identity & RBAC change coverage (svauth org-admin surface). team_created / team_deleted are wired end-to-end; the rest are forward-declared and wired in fast-follows. - `teamCreated` SvlogEventsTeamCreatedEvent, required — Emitted when a team is created. The new team is the SIEM target. - `team` SvlogEventsTeam - `id` string - `displayName` string - object - `teamDefaultAssigneesChanged` SvlogEventsTeamDefaultAssigneesChangedEvent, required — team_default_assignees_changed: a team's default ticket assignee set changed. - `team` SvlogEventsTeam - `id` string - `displayName` string - object - `teamDeleted` SvlogEventsTeamDeletedEvent, required — Emitted when a team is deleted (soft-delete). - `team` SvlogEventsTeam - `id` string - `displayName` string - object — svflow approval override break-glass - `teamOverrideApproverDecision` SvlogEventsTeamOverrideApproverDecisionEvent, required — Emitted when a designated override approver decides (approves/denies) the current in-flight step of an approval request, stepping in for the assigned approvers. The actor on the envelope is the override approver. Exercising the standing bypass is security-relevant, so it is always audited. - `team` SvlogEventsTeam - `id` string - `displayName` string - `approvalRequestId` string - `stepId` string - `approved` boolean — true = approved, false = denied. - `justification` string - `bypassedApproverUserIds` string[] — The assigned (non-override) approvers who were stepped over by this override decision, captured at decision time so the audit record is self-contained (forensics shouldn't need to re-join the DB, whose state may have changed). - object - `teamUpdated` SvlogEventsTeamUpdatedEvent, required — Emitted when a team's settings change (e.g. name). Forward-declared; call-site wiring lands in a fast-follow. - `team` SvlogEventsTeam - `id` string - `displayName` string - `changes` SvlogEventsFieldChange[] — What actually changed - union — Generic field change tracking - We keep this generic to minimize the amount of schema we have to keep in sync just to track field changes. - … - object - `ticketAssigned` SvlogEventsTicketAssignedEvent, required — Emitted when a ticket's assignee changes. assignee is empty on unassign; previous_assignee is context only (not a SIEM target). - `ticket` SvlogEventsTicket - `id` string - `displayName` string - `assignee` SvlogEventsUser - `id` string - `displayName` string - `email` string — Email serves as display name for users - `name` string — Full name if available - `previousAssignee` SvlogEventsUser - `id` string - `displayName` string - `email` string — Email serves as display name for users - `name` string — Full name if available - object - `ticketDeleted` SvlogEventsTicketDeletedEvent, required — Emitted when a ticket is hard-deleted via the public DeleteTicket API for data-retention purposes. Irreversible cross-service wipe (svhelp + svflow + svrunstate). - `ticket` SvlogEventsTicket - `id` string - `displayName` string - object - `ticketEscalated` SvlogEventsTicketEscalatedEvent, required — Emitted when a ticket's escalation level changes (e.g. "AI" -> "HUMAN"). - `ticket` SvlogEventsTicket - `id` string - `displayName` string - `oldLevel` string - `newLevel` string - object — Per-ticket label application by a human agent. The AI/worker auto-categorizer applies the same labels through the shared TicketManager methods, but those system-actor emits are suppressed (same high-volume telemetry concern as ticket_viewed) — only user-initiated label changes are audited here. - `ticketLabelAdded` SvlogEventsTicketLabelAddedEvent, required — Emitted when a human agent applies a label to a ticket (single, bulk, or the create-label-and-apply flow). Both the ticket and the applied label are SIEM targets so "who tagged ticket X with label Y" is answerable. Bulk operations emit one event per (ticket, label) actually affected. - `ticket` SvlogEventsTicket - `id` string - `displayName` string - `label` SvlogEventsLabel - `id` string - `displayName` string - object - `ticketLabelRemoved` SvlogEventsTicketLabelRemovedEvent, required — Emitted when a human agent removes a label from a ticket (single or bulk). Mirrors TicketLabelAddedEvent: both ticket and label are SIEM targets, one event per (ticket, label) actually affected. - `ticket` SvlogEventsTicket - `id` string - `displayName` string - `label` SvlogEventsLabel - `id` string - `displayName` string - object — svhelp ticket-model (change models + custom ticket types) authoring. A ticket model defines a ticket type's status lifecycle, transition rules, entry-action workflows, and custom fields, so create/update/ delete of one is a material governance change to how a whole class of tickets is triaged and automated. Emitted from the changemodel state manager so both the settings user API and the Catalyst public API are covered by one seam. ticket_model_updated covers any configuration mutation (header rename, lifecycle, transitions, preconditions, entry actions) on an existing model. - `ticketModelCreated` SvlogEventsTicketModelCreatedEvent, required — ticket_model_created: a new ticket model (change model or custom ticket type) was authored. - `ticketModel` SvlogEventsTicketModel — TicketModel is the audit-target identity for a ticket model. display_name is the model's admin-facing name; ticket_type / ticket_subtype disambiguate which type family and slug the model configures (e.g. change/normal or a custom type's derived subtype). - `id` string - `displayName` string - `ticketType` string - `ticketSubtype` string - object - `ticketModelDeleted` SvlogEventsTicketModelDeletedEvent, required — ticket_model_deleted: a ticket model was deleted. The delete path resolves the model (and its team scope) before deletion so the event carries the full identity. - `ticketModel` SvlogEventsTicketModel — TicketModel is the audit-target identity for a ticket model. display_name is the model's admin-facing name; ticket_type / ticket_subtype disambiguate which type family and slug the model configures (e.g. change/normal or a custom type's derived subtype). - `id` string - `displayName` string - `ticketType` string - `ticketSubtype` string - object - `ticketModelUpdated` SvlogEventsTicketModelUpdatedEvent, required — ticket_model_updated: an existing ticket model's header or configuration (lifecycle, transitions, preconditions, entry actions) changed. The model carries the post-update identity as the target. - `ticketModel` SvlogEventsTicketModel — TicketModel is the audit-target identity for a ticket model. display_name is the model's admin-facing name; ticket_type / ticket_subtype disambiguate which type family and slug the model configures (e.g. change/normal or a custom type's derived subtype). - `id` string - `displayName` string - `ticketType` string - `ticketSubtype` string - object — svhelp ticket owning ("assignment") group set/cleared/reassigned — ownership is security-relevant independent of the AI/HUMAN escalation level, so it is audited even when the level is unchanged. - `ticketOwningGroupChanged` SvlogEventsTicketOwningGroupChangedEvent, required — Emitted when a ticket's owning ("assignment") group is set, cleared, or reassigned, independent of the individual assignee. new_group is the group the ticket is now owned by (a SIEM target); old_group is context only. Either may be unset (unowned ticket gaining a group / a group being cleared). - `ticket` SvlogEventsTicket - `id` string - `displayName` string - `oldGroup` SvlogEventsGroup - `id` string - `displayName` string - `newGroup` SvlogEventsGroup - `id` string - `displayName` string - object - `ticketPermanentlyDeleted` SvlogEventsTicketPermanentlyDeletedEvent, required - `ticket` SvlogEventsTicket - `id` string - `displayName` string - object - `ticketPriorityChanged` SvlogEventsTicketPriorityChangedEvent, required — Emitted when a ticket's priority changes. old/new are priority option display names. - `ticket` SvlogEventsTicket - `id` string - `displayName` string - `oldPriority` string - `newPriority` string - object — Ticket state-change events (first coverage wave). These actions were previously only recorded in svhelp-local *_events tables and never surfaced at the org level. Each carries its Outcome on the envelope (incl. DENIED/FAILURE on rejected attempts). - `ticketStatusChanged` SvlogEventsTicketStatusChangedEvent, required — Emitted when a ticket's status changes (or a status change is attempted and rejected — see AuditLogEvent.outcome). old/new are status option display names; reason mirrors the user-facing status-change reason. - `ticket` SvlogEventsTicket - `id` string - `displayName` string - `oldStatus` string - `newStatus` string - `reason` string - object - `ticketTeamChanged` SvlogEventsTicketTeamChangedEvent, required — Emitted when a ticket is moved between teams. new_team is the entity acted toward (a SIEM target); old_team is context only. - `ticket` SvlogEventsTicket - `id` string - `displayName` string - `oldTeam` SvlogEventsTeam - `id` string - `displayName` string - `newTeam` SvlogEventsTeam - `id` string - `displayName` string - `reason` string - object — Canonical declarations for in-flight coverage PRs. The emit wiring lands in those PRs; the variants are declared here so field numbers are disjoint across the three (they otherwise collide at 65-68) and the audit-equivalence registry can catalog them now. svhelp ticket trash lifecycle (#12528) - `ticketTrashed` SvlogEventsTicketTrashedEvent, required - `ticket` SvlogEventsTicket - `id` string - `displayName` string - object — svhelp ticket type/classification change (e.g. request -> incident -> major_incident). System-driven today — the update-ticket-type workflow action and the AI type-inference activity both run as the system user — but a reclassification changes how a ticket is triaged and reported, a material, security-relevant change audited alongside status/priority changes. - `ticketTypeChanged` SvlogEventsTicketTypeChangedEvent, required — Emitted when a ticket's type/classification changes (e.g. "request" -> "incident"). old/new are ticket_type enum values. - `ticket` SvlogEventsTicket - `id` string - `displayName` string - `oldType` string - `newType` string - object - `ticketUntrashed` SvlogEventsTicketUntrashedEvent, required - `ticket` SvlogEventsTicket - `id` string - `displayName` string - object - `ticketViewed` SvlogEventsTicketViewedEvent, required — Emitted when a user accesses a ticket (detail view). Dedup'd per (user, ticket) at the emit site so React Query refetches collapse. - `ticket` SvlogEventsTicket - `id` string - `displayName` string - `viewType` 'VIEW_TYPE_UNSPECIFIED' | 'VIEW_TYPE_TEAM' | 'VIEW_TYPE_LIMITED' | 'VIEW_TYPE_JOURNEY' | 'VIEW_TYPE_PUBLIC_API' - object - `userAddedToTeam` SvlogEventsUserAddedToTeamEvent, required - `user` SvlogEventsUser - `id` string - `displayName` string - `email` string — Email serves as display name for users - `name` string — Full name if available - `team` SvlogEventsTeam - `id` string - `displayName` string - `role` string - object - `userAuthMethodUpdated` SvlogEventsUserAuthMethodUpdatedEvent, required — Emitted when an org admin grants or revokes magic-link SSO bypass for a user. - `affectedUser` SvlogEventsUser - `id` string - `displayName` string - `email` string — Email serves as display name for users - `name` string — Full name if available - `newAuthMethod` string — "magic_link" or "" (cleared/revoked) - object - `userCreated` SvlogEventsUserCreatedEvent, required — Emitted when a user account is created / an invitation is accepted — as distinct from UserInvitedEvent, which fires when the invite is *sent*. Forward-declared; call-site wiring lands in a fast-follow. - `user` SvlogEventsUser - `id` string - `displayName` string - `email` string — Email serves as display name for users - `name` string — Full name if available - object - `userDeactivated` SvlogEventsUserDeactivatedEvent, required — Emitted when a user is deactivated (soft-deleted) from an organization - `deactivatedUser` SvlogEventsUser - `id` string - `displayName` string - `email` string — Email serves as display name for users - `name` string — Full name if available - object - `userInvited` SvlogEventsUserInvitedEvent, required - `invitedUser` SvlogEventsUser - `id` string - `displayName` string - `email` string — Email serves as display name for users - `name` string — Full name if available - `invitation` SvlogEventsUserInvitation - `id` string - object — svauth Tier-1 authentication / session events. Emitted at svauth's own RPC-handler boundary (Login / FinalizeSession / Logout), NOT inside the vendored authenticate clone. user_login_failed carries the attempted identity (email only, no resolved user id) since the actor is unauthenticated; its Outcome is DENIED (deactivated / password-login disabled) or FAILURE (bad credentials / invalid token). - `userLogin` SvlogEventsUserLoginEvent, required — user_login: a user successfully authenticated and bound a session to an organization. Emitted from svauth's FinalizeSession handler (where the user is fully resolved), not the vendored authenticate clone. method records the login mechanism (e.g. "password", "magic_link", "sso") as metadata; the organization the session bound to is carried as a target so SIEM can pivot on both the user and the org they entered. - `user` SvlogEventsUser - `id` string - `displayName` string - `email` string — Email serves as display name for users - `name` string — Full name if available - `organization` SvlogEventsOrganization - `id` string - `displayName` string - `method` string - object - `userLoginFailed` SvlogEventsUserLoginFailedEvent, required — user_login_failed: an authentication attempt was rejected. The actor is unauthenticated (no resolved principal), so the attempted identity is carried in the payload as a User target with email only and no id — never as a resolved user. method is the attempted mechanism; the Outcome on the envelope carries the machine-stable reason_code (DENIED for deactivated / password-login-disabled, FAILURE for bad credentials / invalid token). - `attemptedIdentity` SvlogEventsUser - `id` string - `displayName` string - `email` string — Email serves as display name for users - `name` string — Full name if available - `method` string - object - `userLogout` SvlogEventsUserLogoutEvent, required — user_logout: a user ended their session(s). Emitted from svauth's Logout handler after the session teardown succeeds. Global-scope logout revokes the user's refresh tokens across devices. - `user` SvlogEventsUser - `id` string - `displayName` string - `email` string — Email serves as display name for users - `name` string — Full name if available - object - `userMfaEnrolled` SvlogEventsUserMFAEnrolledEvent, required — user_mfa_enrolled: a user enrolled a new multi-factor authentication factor. Bridged from the gotrue `factor_in_progress` audit action, which fires once when a new (still-unverified) factor is created during enrollment — the enrollment signal. (`verification_attempted` was rejected as the source: it also fires on every MFA login challenge, so it is not enrollment-specific.) factor_id / factor_type are lifted from the gotrue entry's traits; factor_type is empty when the enroll path did not record one (the TOTP enroll endpoint records only factor_id). - `user` SvlogEventsUser - `id` string - `displayName` string - `email` string — Email serves as display name for users - `name` string — Full name if available - `factorId` string - `factorType` string — e.g. "totp"; empty when gotrue did not record it - object - `userOrganizationRoleChanged` SvlogEventsUserOrganizationRoleChangedEvent, required - `user` SvlogEventsUser - `id` string - `displayName` string - `email` string — Email serves as display name for users - `name` string — Full name if available - `organizationId` string - `oldRole` string - `newRole` string - object — svauth account-security events, bridged from the vendored authenticate (gotrue) service's auth.audit_log_entries table by a Temporal cron tail (internal/auditbridge), NOT emitted from the authenticate clone itself. Each is a recorded, completed action (Outcome = SUCCESS); the actor is the user themselves, resolved per-org from auth.users.id → users.auth_user_id (one event per associated active org-user). - `userPasswordChanged` SvlogEventsUserPasswordChangedEvent, required — user_password_changed: a user changed their own password. Bridged from the gotrue `user_updated_password` audit action. Carries no secret material — only the user whose password changed. - `user` SvlogEventsUser - `id` string - `displayName` string - `email` string — Email serves as display name for users - `name` string — Full name if available - object - `userRemovedFromTeam` SvlogEventsUserRemovedFromTeamEvent, required - `user` SvlogEventsUser - `id` string - `displayName` string - `email` string — Email serves as display name for users - `name` string — Full name if available - `team` SvlogEventsTeam - `id` string - `displayName` string - `role` string — The role they had before removal - object - `userSessionRevoked` SvlogEventsUserSessionRevokedEvent, required — user_session_revoked: a user's session / refresh token was revoked. Bridged from the gotrue `token_revoked` audit action. Distinct from user_logout (already emitted by svauth's Logout RPC for user-initiated logout); this covers the gotrue-side revocations that have no Serval RPC handler. - `user` SvlogEventsUser - `id` string - `displayName` string - `email` string — Email serves as display name for users - `name` string — Full name if available - object - `userTeamRoleChanged` SvlogEventsUserTeamRoleChangedEvent, required - `user` SvlogEventsUser - `id` string - `displayName` string - `email` string — Email serves as display name for users - `name` string — Full name if available - `team` SvlogEventsTeam - `id` string - `displayName` string - `oldRole` string - `newRole` string - object - `widgetCreated` SvlogEventsWidgetCreatedEvent, required — widget_created: a new widget was created on a dashboard. - `widget` SvlogEventsWidget - `id` string - `displayName` string - object - `widgetDeleted` SvlogEventsWidgetDeletedEvent, required — widget_deleted: a widget was deleted. Emitted from the delete handler, which resolves the widget before deletion so the audit event still carries the full identity. - `widget` SvlogEventsWidget - `id` string - `displayName` string - object - `widgetUpdated` SvlogEventsWidgetUpdatedEvent, required — widget_updated: an existing widget's title, type, workflow binding, or config changed. The widget carries the post-update identity as a target. - `widget` SvlogEventsWidget - `id` string - `displayName` string - object - `workflowCreated` SvlogEventsWorkflowCreatedEvent, required - `workflow` SvlogEventsWorkflow - `id` string - `displayName` string — Should generally include a name where possible as makes it easier to identify the object on export to SIEM without complex hydration - object - `workflowDeleted` SvlogEventsWorkflowDeletedEvent, required - `workflow` SvlogEventsWorkflow - `id` string - `displayName` string — Should generally include a name where possible as makes it easier to identify the object on export to SIEM without complex hydration - object - `workflowDisabled` SvlogEventsWorkflowDisabledEvent, required - `workflow` SvlogEventsWorkflow - `id` string - `displayName` string — Should generally include a name where possible as makes it easier to identify the object on export to SIEM without complex hydration - object — svflow workflow / guidance enable-disable (#12592) - `workflowEnabled` SvlogEventsWorkflowEnabledEvent, required - `workflow` SvlogEventsWorkflow - `id` string - `displayName` string — Should generally include a name where possible as makes it easier to identify the object on export to SIEM without complex hydration - object - `workflowPublished` SvlogEventsWorkflowPublishedEvent, required - `workflow` SvlogEventsWorkflow - `id` string - `displayName` string — Should generally include a name where possible as makes it easier to identify the object on export to SIEM without complex hydration - `previousVersion` SvlogEventsWorkflowVersion - `id` string — This is the version ID, not the workflow ID - `displayName` string - `workflowId` string - `versionNumber` integer - `publishedVersion` SvlogEventsWorkflowVersion - `id` string — This is the version ID, not the workflow ID - `displayName` string - `workflowId` string - `versionNumber` integer - object - `workflowRunRequested` SvlogEventsWorkflowRunRequestedEvent, required - `workflow` SvlogEventsWorkflow - `id` string - `displayName` string — Should generally include a name where possible as makes it easier to identify the object on export to SIEM without complex hydration - `version` SvlogEventsWorkflowVersion - `id` string — This is the version ID, not the workflow ID - `displayName` string - `workflowId` string - `versionNumber` integer - `workflowRun` SvlogEventsWorkflowRun - `id` string — No obvious display name for workflow runs, so we skip that field - `workflowId` string - object - `workflowRunStarted` SvlogEventsWorkflowRunStartedEvent, required - `workflow` SvlogEventsWorkflow - `id` string - `displayName` string — Should generally include a name where possible as makes it easier to identify the object on export to SIEM without complex hydration - `version` SvlogEventsWorkflowVersion - `id` string — This is the version ID, not the workflow ID - `displayName` string - `workflowId` string - `versionNumber` integer - `workflowRun` SvlogEventsWorkflowRun - `id` string — No obvious display name for workflow runs, so we skip that field - `workflowId` string - object - `workflowUpdated` SvlogEventsWorkflowUpdatedEvent, required - `workflow` SvlogEventsWorkflow - `id` string - `displayName` string — Should generally include a name where possible as makes it easier to identify the object on export to SIEM without complex hydration - `version` SvlogEventsWorkflowVersion - `id` string — This is the version ID, not the workflow ID - `displayName` string - `workflowId` string - `versionNumber` integer - `changes` SvlogEventsFieldChange[] — What actually changed - union — Generic field change tracking - We keep this generic to minimize the amount of schema we have to keep in sync just to track field changes. - … - `outcome` SvlogEventsOutcome — Outcome captures the RESULT of an attempted action. event_data carries the full proto; svlog also lifts outcome.status into an indexed column so "every DENIED action by actor X" is a cheap query and SIEM rules can key on the status. - `status` 'STATUS_UNSPECIFIED' | 'STATUS_SUCCESS' | 'STATUS_FAILURE' | 'STATUS_DENIED' | 'STATUS_ERROR' — STATUS_SUCCESS: completed with its intended effect. STATUS_FAILURE: attempted, validly rejected for a business / validation / conflict reason (the actor's input; deterministic, 4xx-shaped). STATUS_DENIED: rejected by authorization / policy (security-relevant — the status compliance reviews care about most). STATUS_ERROR: unexpected internal / system fault (our fault, 5xx-shaped) — distinguishes a real denied/failed attempt from a transient glitch. - `reasonCode` string — Machine-stable code SIEM rules key on (e.g. "permission_denied", "transition_not_allowed", "precondition_not_met"). - `reasonDetail` string — Human-readable detail. MUST NOT contain PII or secrets. - `justification` string, nullable — Business reason the actor supplied at action time (the "why"), distinct from outcome.reason_detail (the "what happened"). Populated for privileged / sensitive actions (access grants, impersonation, deletions, config changes); empty otherwise. - `severity` 'SEVERITY_UNSPECIFIED' | 'SEVERITY_TRACE' | 'SEVERITY_DEBUG' | 'SEVERITY_INFO' | 'SEVERITY_WARN' | 'SEVERITY_ERROR' — Severity is the leveled-telemetry dimension of an audit event, mirroring the classic syslog level ordering. event_data carries the full proto; svlog also lifts the level name into an indexed column so the user-facing feed can cheaply drop sub-INFO operational noise without scanning every row. SEVERITY_INFO is the default for user-driven actions (everything emitted today). SEVERITY_DEBUG / SEVERITY_TRACE are for high-volume operational telemetry that should be retained but kept out of the default feed. SEVERITY_WARN / SEVERITY_ERROR escalate notable / faulty events for alerting. - `nextPageToken` string, nullable ## Other responses - `default` — Error --- [API](https://skmtc.net/serval/apis/serval-public-api.md) · [All operations](https://skmtc.net/serval/apis/serval-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/serval/serval-public-api/versions/0549515e9384/schema)