1. Docs
  2. API Reference
  3. AuditLogRowDto

AuditLogRowDto

Example

JSON
{
  "id": "string",
  "account_id": "string",
  "application_id": "string",
  "environment_id": "string",
  "actor_id": "string",
  "actor_type": "string",
  "action": "string",
  "resource_type": "string",
  "resource_id": "string",
  "metadata": {},
  "created_at": "2026-04-20T12:00:00.000Z",
  "actor_label": "string",
  "resource_label": "string",
  "correlation_id": "00000000-0000-0000-0000-000000000000",
  "outcome": "success",
  "category": "auth",
  "severity": "info",
  "customer_visible": false,
  "identity_visible": false
}

Properties

19 properties 9 required

id string Required
account_id string Optional
nullable
application_id string Optional
nullable
environment_id string Optional
nullable
actor_id string Optional
nullable
actor_type string Required
action string Required
resource_type string Optional
nullable
resource_id string Optional
nullable
metadata object Required
created_at string Required
format: date-time
actor_label string Optional

Snapshot label of the actor at write time (email for users / identities, label otherwise). NULL on rows written before the Slice 2 deploy.

nullable
resource_label string Optional

Snapshot label of the affected resource at write time. NULL on rows written before the Slice 2 deploy.

nullable
correlation_id string Optional

Per-request correlation ID — every row written during the same HTTP request (or background job) shares this value. Use the query API's `correlation_id` filter to reconstruct a chain.

format: uuidnullable
outcome enum Required

`success` for normal-flow events, `failure` for errors, `denied` for authorization rejections.

Enumsuccessfailuredenied
category enum Optional

Broad classification from the action catalog (e.g. `auth`, `rbac`). NULL on legacy rows whose action key was unknown at backfill time — those carry the `unknown` value in storage.

Enumauthidentityadmin_usertenancyhierarchyorganizationrbacauthorizationapi_keysoauthwebhooksinvitesmfaauditbillingssounknownnullable
severity enum Required

`info` for normal-flow events, `notice` for important state changes, `warning` for failures, `critical` for security events.

Enuminfonoticewarningcritical
customer_visible boolean Required

Whether this row should appear in customer-facing audit views. `false` rows are internal-only (platform support).

identity_visible boolean Required

Whether this row should appear on a future end-user `My security activity` surface. Not consumed by current reads.

Was this page helpful?

Tell us how we can improve this guide.

Canopy