Audit event reference

Automation orchestrator audit events include event categories, severity levels, actor types, and common fields.

Event categories

Automation orchestrator classifies each audit event into one of the following categories:

Category Description
User action User-initiated operations such as creating or modifying platform resources, updating settings, and administrative tasks.
Workflow event Workflow lifecycle events including creation, runs, completion, and failure.
Agent interaction Actions performed by AI agents within workflow runs.
Large language model (LLM) interaction API calls to LLM providers, including the request and response cycle.
LLM tool call Tool invocations that LLMs make during agent runs, including which tools were used and their results.
LLM reasoning Reasoning steps that LLMs produce within agent nodes.
API execution API endpoint operations for all authenticated requests.
System operation Internal platform operations that system processes perform.
Security event Security-relevant activities including authentication attempts, authorization decisions, and session lifecycle.

All event categories are subject to the platform retention policy. For retention details, see Audit data retention reference.

Severity levels

Automation orchestrator assigns severity automatically based on the outcome of the operation:

Severity Description
Info Normal operations completed successfully. Most events are recorded at this level.
Warning Operations that completed but encountered unexpected conditions, such as client errors or dependency warnings.
Error Operations that failed, such as server errors or unhandled exceptions.
Critical Security-relevant failures that require immediate attention.

Severity is determined by the outcome of each individual operation, not by the event type. Any event type can produce any severity level depending on whether the operation succeeded, encountered warnings, or failed. For example, a credential_created event is Info when successful but escalates to Error if the creation fails due to an encryption error.

When a tracked operation raises an exception, the severity escalates to at least Error regardless of the default level.

Actor types

Each audit event identifies who performed the action using one of three actor types:

Actor type Description
User A human user authenticated to the platform. The event records the user's unique identifier and username.
System An internal automated process or background task performed by the platform itself, such as scheduled maintenance or internal state transitions. Events with the System actor type do not have an associated user identity.
Service An internal service authenticated with mutual TLS (mTLS), or a service account used for external system-to-system integration. Internal service-to-service requests that authenticate with mTLS are classified as Service. For mTLS requests, the platform records the certificate common name (CN) as the actor username. Service-to-service JWT tokens are attributed to the actor identity encoded in the token.

Hard-delete lifecycle and audit records

Automation orchestrator uses a hard-delete model. When a resource is deleted, the platform permanently removes the resource from the database. Audit events that reference the deleted resource remain in your observability backend until the retention window expires.

After a resource is hard-deleted:

  • The resource_urn and resource_name fields in historical events still contain the values recorded at the time of each event.
  • You cannot navigate from an audit event back to the deleted resource because the resource no longer exists.
  • Delete events (workflow_deleted, credential_deleted, and similar actions) record the final state of the resource before removal.

Export audit records for deleted resources before the retention window expires if you need to preserve a complete audit trail. For export instructions, see Export audit data to external storage.

Common event fields

Audit events contain the following fields. Most fields are present on every event. Fields marked as conditional are present only on specific event types.

Field Type Description
event_id UUIDv7 Unique identifier for the event. The timestamp is encoded in the UUIDv7 value.
event_category String Event category.
event_severity String Severity level.
event_status String Conditional. Outcome of the operation: success or error. Not present on all event types.
event_action String The specific action performed, such as update_setting or request_completed.
timestamp ISO 8601 UTC timestamp of when the event was emitted.
actor_id String Unique identifier of the user, system process, or service that performed the action.
actor_username String Conditional. Username of the actor. Present for user-initiated actions. Absent for system and middleware-generated events.
actor_type String Actor classification.
source_component String The platform module that generated the event, such as syntara.settings.router.
resource_urn String Uniform Resource Name (URN) identifying the affected resource.
resource_name String Human-readable name of the resource at the time of the event.
workflow_id String Conditional. Identifier of the associated workflow. Present only on workflow-related events.
activity_id String Conditional. Identifier of the specific workflow node (activity). Present only on workflow-related events.
execution_id String Conditional. Identifier of the workflow execution run. Present only on workflow-related events.
event_message String Human-readable description of what happened.
audit.event_source String Event origin: business_event for application instrumentation, crud_event for database trigger events.

Resource URN formats

The resource_urn field follows the format urn:syntara:{resource_type}:{identifier}. Use this field to filter events by resource type in your observability backend.

Resource type URN format Example
User urn:syntara:user:{username} urn:syntara:user:admin
Approval urn:syntara:approval:{approval_id} urn:syntara:approval:abc-123
Credential urn:syntara:credential:{id} urn:syntara:credential:abc-123
Role urn:syntara:role:{id} urn:syntara:role:abc-123
Role assignment urn:syntara:role-assignment:{id} urn:syntara:role-assignment:abc-123
Policy urn:syntara:policy:{id} urn:syntara:policy:abc-123
Setting urn:syntara:setting:{key} urn:syntara:setting:logging.log_level
Setting (with category) urn:syntara:setting:{category}:{setting} urn:syntara:setting:logging:log_level
Workflow urn:syntara:workflow:{workflow_id} urn:syntara:workflow:abc-123
Ansible Automation Platform resource (list) urn:syntara:aap:{resource_type} urn:syntara:aap:job_templates
Ansible Automation Platform resource (get) urn:syntara:aap:{resource_type}:{resource_id} urn:syntara:aap:job_templates:42
Invocation urn:syntara:invocation:{id} urn:syntara:invocation:abc-123
Integration urn:syntara:integration:{id} urn:syntara:integration:abc-123
Identity provider urn:syntara:identity_provider:{id} urn:syntara:identity_provider:abc-123

Identifiers are URL-encoded per RFC 8141. Events generated by middleware (API execution, system operation) use a dynamic format: urn:syntara:{resource_type}:{resource_id} where the type and ID are derived from the request path.

Per-event structured data

Every audit event includes a structured_data object with fields specific to the event type. The data_type field identifies which schema applies. The fields error_type and error_message are common to all schemas and are only populated on error events.

Authentication events

Login (login-context)

Field Type Description
method String Authentication method. Values: password, oidc.

Session lifecycle (session-lifecycle-context)

Actions: session_created, session_revoked, session_refreshed

Field Type Description
jti String JSON Web Token (JWT) identifier for the session.
idp String Identity provider associated with the session.
lifecycle_action String Values: create, revoke, refresh.

User login (user-login-context)

Actions: user_login, new_user_login

Field Type Description
amr Array[String] Authentication method references. Values: pwd (password), fed (federated).
idp String Identity provider used.
is_first_login Boolean Whether this is the user's first login.

OpenID Connect (OIDC) flow (oidc-context)

Actions: oidc_authorize, oidc_callback

Field Type Description
provider_id String The configured OIDC provider identifier.
stage String Values: authorize, callback.

Session revocation (session-revocation)

Field Type Description
target_type String What was targeted. Values: user, idp.
target_identifier String The username or IDP identifier whose sessions were revoked.
sessions_revoked Integer Number of sessions revoked.
actor_source String Source that triggered the revocation.

Global token revocation (global-revocation)

Field Type Description
revocation_timestamp String ISO 8601 timestamp of the revocation event.
actor_source String Source that triggered global revocation.

Global revocation rejection (global-revocation-reject)

Field Type Description
token_type String Type of token that was rejected.
token_issued_at String When the rejected token was originally issued.
revocation_timestamp String The global revocation timestamp the token predates.

Stale token detected (stale-token-detection)

Field Type Description
token_version Integer Version number in the rejected token.
current_version Integer Current required token version.

Disabled user rejected (disabled-user-rejection)

Field Type Description
context String Where the rejection occurred. Values: middleware, token_refresh.

Account status change (account-status-changed)

Field Type Description
target_user_id UUID ID of the affected account.
target_username String Username of the affected account.
new_status String Values: enabled, disabled.

Password reset (password-reset)

Field Type Description
target_username String Username whose password was reset.
sessions_revoked Integer Sessions revoked after the reset.
actor_source String Source that triggered the reset.

Password changed (password-changed)

Field Type Description
target_user_id UUID ID of the user whose password changed.
target_username String Username of the user whose password changed.

Settings events

Setting changed (setting-changed)

Field Type Description
setting String Name of the setting that changed.
old_value Any The previous value.
new_value Any The new value.
category String The settings category.
value_type String Python type name of the value.
version Integer Settings schema version at time of change.

Settings bulk changed (setting-bulk-changed)

Field Type Description
settings Array[String] Names of all settings changed.
change_count Integer Total number of settings changed.

Credential events

Credential lifecycle (credential-lifecycle)

Actions: credential_created, credential_updated, credential_deleted

Field Type Description
action String Values: created, updated, deleted.
credential_name String Name of the credential.
credential_type_id UUID ID of the credential type.
affected_workflow_count Integer Workflows referencing this credential. Present only when greater than 0.
enabled_changed Boolean Whether the enabled state changed. Present only when true.

Credential encryption failure (credential-encryption-failure)

Field Type Description
operation String The failed operation. Value: decrypt.
credential_name String Name of the credential that failed.

Authorization events

Authorization denied (authorization-denied)

Field Type Description
resource_type String The type of resource the action was attempted on.
action String The action that was denied.
denied_by String The policy or rule that caused the denial.

Role assignment (role-assignment)

Actions: role_assigned, role_revoked

Field Type Description
action String Values: assigned, revoked.
principal_type String Values: user, service_account. Present only for user and service account assignments.
principal_name String Name of the user or service account. Present only for user and service account assignments.
group_name String Name of the group. Present only for group assignments.
role_name String Name of the role.
project_id UUID Project scope for the assignment. Present only when project-scoped.

Role lifecycle (role-lifecycle)

Actions: role_created, role_updated, role_deleted

Field Type Description
action String Values: created, updated, deleted.
role_name String Name of the role.
affected_assignments_count Integer Principals with this role. Present only when greater than 0.

Identity provider events

Identity provider lifecycle (identity-provider-lifecycle)

Actions: identity_provider_created, identity_provider_updated

Field Type Description
action String Values: created, updated.
provider_name String Name of the identity provider.
disable_tls_verify Boolean Whether TLS verification is disabled for this provider.

Invocation events

Invocation created (invocation-created-context)

Field Type Description
invocation_id UUID ID of the created invocation.
session_id String Session this invocation belongs to.
file_ids Array[String] IDs of files attached to the invocation.
agent String Agent type requested.
model String LLM model requested.
metadata Object Additional metadata submitted with the invocation.

Invocation cancelled (invocation-cancelled-context)

Field Type Description
invocation_id UUID ID of the cancelled invocation.
cancellation_result String Values: success, not_found, not_cancellable.
cancellation_reason String Human-readable reason for cancellation.
files_cleaned Array[UUID] IDs of files cleaned up during cancellation.
current_status String Invocation status at the time of the cancellation attempt.

Integration events

Integration created (integration-create-context)

Field Type Description
integration_name String Name of the integration.
integration_type String Type of integration.
description String Description of the integration.
initial_status String Integration status after creation.

Integration updated (integration-update-context)

Field Type Description
integration_name String Name of the integration.
integration_type String Type of integration.
updated_fields Array[String] Names of the fields that changed.

Integration deleted (integration-delete-context)

Field Type Description
integration_name String Name of the deleted integration.
tools_deleted Integer Tools removed as part of the deletion.

Integration refreshed (integration-refresh-context)

Field Type Description
integration_name String Name of the integration.
integration_type String Type of integration.
result_status String Integration status after refresh.
tools_synced_count Integer New tools discovered.
tools_updated_count Integer Existing tools updated.
tools_disabled_count Integer Tools disabled because they are no longer returned by the integration.

Integration validated (integration-validate-context)

Field Type Description
integration_name String Name of the integration.
integration_type String Type of integration.
timeout Boolean Whether the validation request timed out.
result_status String Integration status after validation.

Integration discovered (integration-discover-context)

A test-connection probe on an unsaved integration. No database writes occur.

Field Type Description
integration_type String Type of integration being probed.
tools_found_count Integer Number of tools discovered.
models_found_count Integer Number of models discovered.

Tool events

Tool updated (tool-update-context)

Field Type Description
tool_name String Short name of the tool.
namespaced_name String Fully namespaced tool name.
integration_id UUID ID of the integration that owns this tool.
updated_fields Array[String] Names of the fields that changed.

Tools bulk updated (tool-bulk-update-context)

Field Type Description
tool_count Integer Total tools targeted by the operation.
enabled Boolean Whether tools were being enabled (true) or disabled (false).
updated_count Integer Tools successfully updated.
skipped_count Integer Tools skipped because they were already in the desired state.
duplicate_count Integer Duplicate IDs in the request.
deleted_count Integer Tools that could not be updated because they were already deleted.
not_found_count Integer Tool IDs not found.

Approval events

Approval requested (approval-requested)

Field Type Description
name String Human-readable name of the approval step.

Approval decided (approval-decided)

Field Type Description
decision String Values: approved, rejected.
wait_time_ms Integer Time in milliseconds between when the request was created and when the decision was recorded.

Workflow events

Execution started (workflow-execution-started)

Fired by the Temporal activity sync service when a workflow execution transitions from pending to running.

Field Type Description
workflow_name String Name of the workflow that started executing.

Execution lifecycle (execution-lifecycle)

Fired by the execution service when a user starts or cancels an execution via the API. Records the API-level intent. Temporal state transitions (pending to running, terminal states) are tracked separately by the execution started and execution completed events.

Actions: execution_started, execution_cancelled

Field Type Description
action String Values: started, cancelled.
workflow_name String Name of the workflow.
mode String Execution mode. Present when set.

Workflow execution completed (workflow-execution-completed)

Fired when a workflow execution reaches a terminal state in Temporal.

Field Type Description
status String Terminal status. Values: completed, failed, cancelled.
duration_ms Integer Total execution time in milliseconds.
node_count Integer Number of nodes executed.
error_count Integer Number of nodes that produced errors.

Workflow execution error (workflow-execution-error)

Fired when the Temporal engine reports a workflow-level or activity-level timeout, or an activity retry.

Field Type Description
timed_out_component String The component that triggered the error.
configured_timeout_seconds Float The timeout threshold configured for this component.
elapsed_time_ms Integer Time elapsed before the error occurred.
retry_count Integer Retries attempted before this event.
retry_reason String The reason a retry was triggered.

Workflow lifecycle (workflow-lifecycle)

Fired by the workflow service when a user creates, modifies, or removes a workflow definition.

Actions: workflow_created, workflow_updated, workflow_deleted, workflow_published, workflow_unpublished, workflow_restored

Field Type Description
action String Values: created, updated, deleted, published, unpublished, restored.
workflow_name String Name of the workflow.

Workflow version created (workflow-version-created)

Fired when a new version of a workflow is created.

Field Type Description
version Integer Version number of the newly created version.
change_summary Object Summary of what changed from the previous version. Present only when the new version differs from the previous one. Contains: nodes_added, nodes_removed, nodes_modified (arrays of objects with id and type), and edges_added, edges_removed (arrays of connection strings).

Workflow version published (workflow-version-published)

Fired when a workflow version is published, making it available for execution.

Field Type Description
version Integer Version number that was published.
workflow_name String Name of the workflow.
project_id UUID Project scope for the publish operation. Present only when project-scoped.
error_type String Error classification if the publish operation failed. Present only on failure.

Workflow version unpublished (workflow-version-unpublished)

Fired when a workflow version is unpublished.

Field Type Description
version Integer Version number that was unpublished.
workflow_name String Name of the workflow.
project_id UUID Project scope for the operation. Present only when project-scoped.
error_type String Error classification if the unpublish operation failed. Present only on failure.

Workflow version restored (workflow-version-restored)

Fired when a previous workflow version is restored as a new version.

Field Type Description
restored_from_version Integer Version number that was used as the restore source.
new_version Integer Version number of the newly created restore.
workflow_name String Name of the workflow.
project_id UUID Project scope for the operation. Present only when project-scoped.
error_type String Error classification if the restore operation failed. Present only on failure.

Workflow version exported (workflow-version-exported)

Fired when a workflow version is exported as a JSON file.

Field Type Description
version Integer Version number that was exported.

WebSocket connection (websocket-connection)

Fired by the execution streaming service when a WebSocket client connects to or disconnects from an execution event stream.

Actions: websocket_connected, websocket_disconnected, websocket_error

Field Type Description
action String Values: connected, disconnected, error.
client_ip String IP address of the WebSocket client.
connection_id String Unique identifier for this connection.
duration_ms Integer Connection duration in milliseconds. Present on disconnection events.
close_reason String Reason the connection closed. Present when available.
replay String Replay mode used for the connection. Present when set.

Agent and LLM events

Agent execution (agent_execution)

Actions: agent_started, agent_completed, agent_failed

Field Type Description
agent_type String Values: orchestrator, generic_agent.
status String Values: started, completed, failed.
session_id String Session this agent run belongs to.
invocation_id UUID Invocation this agent run belongs to.
request_id UUID Individual request identifier within the invocation.
context_applied Boolean Whether retrieval-augmented context was applied. Orchestrator only.
grounding_score Float Relevance score for the applied context. Orchestrator only.
routed_to_agent String Downstream agent the orchestrator selected. Orchestrator only.

Agent invocation lifecycle (invocation_lifecycle)

Actions: invocation_created, invocation_running, invocation_paused, invocation_cancelled, invocation_completed, invocation_failed

Field Type Description
session_id String Session this invocation belongs to.
invocation_id UUID The invocation being tracked.
request_id UUID Request identifier within the invocation.
invocation_status String The new lifecycle status.
model_name String LLM model in use, if known at this lifecycle stage.

Context planning (context_planning)

Field Type Description
session_id String Session this planning step belongs to.
invocation_id UUID Invocation this planning step belongs to.
request_id UUID Request identifier.
phase String Values: retrieval, assembly, compression.
status String Values: started, completed, failed, cancelled.
document_count Integer Number of documents processed in this phase.

Context integration (context_integration)

Field Type Description
status String Values: success, timeout, fallback.
session_id String Session this integration belongs to.
invocation_id UUID Invocation this integration belongs to.
request_id UUID Request identifier.
grounding_score Float Relevance score for the integrated context.
citations_count Integer Number of source citations included.

LLM call (llm_interaction)

Field Type Description
session_id String Session this LLM call belongs to.
invocation_id UUID Invocation this LLM call belongs to.
request_id UUID Request identifier.
interaction_type String Values: standard, structured_output, extraction.
model_name String LLM model used.
status String Values: success, empty_response, error.
tools_available Integer Tools provided to the LLM.
tool_calls_made Integer Tool calls the LLM requested.
response_schema_provided Boolean Whether a JSON schema was provided for structured output.
fallback_strategy_used String Fallback strategy applied when the primary call failed.

Tool discovery (tool_discovery)

Field Type Description
session_id String Session this discovery step belongs to.
invocation_id UUID Invocation this discovery step belongs to.
request_id UUID Request identifier.
status String Values: started, completed, failed.
providers_discovered Integer Number of tool providers found.
tools_discovered Integer Total tools returned by providers.
tools_enabled Integer Tools that are enabled.
tools_disabled Integer Tools that are disabled.
tools_filtered Integer Tools removed by capability or permission filters.
tools_provided_to_llm Integer Final count of tools passed to the LLM.
tool_names Array[String] Names of tools provided to the LLM. Present when status is completed.

Tool invocation (tool_invocation)

Field Type Description
session_id String Session this tool call belongs to.
invocation_id UUID Invocation this tool call belongs to.
request_id UUID Request identifier.
tool_name String Name of the tool called.
status String Values: started, completed, failed.
tool_input Object Arguments passed to the tool. Present when status is started or completed.
tool_output String Raw output returned by the tool. Present when status is completed.

Ansible Automation Platform resource access events

Ansible Automation Platform resource access (aap-resource-access)

Fired when a user accesses external automation controller resources through the automation orchestrator proxy. These events record the resource type, operation, and whether a per-user credential was used.

Actions: aap_{resource_type}_get, aap_{resource_type}_listed

Field Type Description
resource_type String The Ansible Automation Platform resource type accessed. Values: organizations, job_templates, workflow_job_templates, inventories, execution_environments, credentials, instance_groups, labels.
action String Values: get, list.
credential_used Boolean Whether a per-user Ansible Automation Platform credential was used. When false, environment-level authentication was used.
result_count Integer Number of resources returned. Present on list operations.
resource_id Integer ID of the resource accessed. Present on get operations.
search_filter String Search term applied to the query. Present when set.
organization_filter String Organization scope applied to the query. Present when set.

File events

Files uploaded (files-uploaded-context)

Field Type Description
file_count Integer Number of files uploaded.
total_size_bytes Integer Total size of all uploaded files in bytes.
file_details Array[Object] Per-file metadata including filename, MIME type, and size.

File downloaded (file-downloaded-context)

Field Type Description
mime_type String MIME type of the downloaded file.
size_bytes Integer Size of the downloaded file in bytes.
storage_backend String Storage backend the file was retrieved from.

File converted (file-converted-context)

Field Type Description
file_id UUID ID of the file that was processed.
mime_type String MIME type of the source file.
size_bytes Integer Size of the source file in bytes.
conversion_state String Values: success, failed, skipped.
conversion_time_ms Integer Time taken for conversion in milliseconds. Absent when conversion_state is skipped.

File integrity failed (file-integrity-failed)

Field Type Description
storage_backend String Storage backend where the integrity check failed.
expected_hash String The checksum stored at upload time.
actual_hash String The checksum computed at retrieval time.

File cleaned up (file-cleaned-up-context)

Field Type Description
files_deleted Integer Number of files removed from storage.
multipart_uploads_aborted Integer Number of incomplete multipart uploads aborted.