About
This data dictionary provides all details on captured events needed to align Audit data to meet your compliance or business requirements.
All times and dates are in ISO8601 format.
As of 7/31/25, all products have migrated to this schema. For information regarding the deprecated (v1) schema, please reference Audit Data Dictionary (v1.0)
Event names and types
The Audit API captures a wide range of events, each with a well-defined structure, as shown in the table below:
| Field |
Type | Description |
| id | string | Unique identifier for the event (UUID format) |
| object | object | Details about the object associated with the event |
| action | object | Type (create, read, update, delete) and result (success, error) of action |
| owner | object | Details about the owner of the object |
| actor | object | Details about the user or entity that performed the action |
| clientInfo | object | Information about the client (IP, user agent, etc.) that initiated event |
| metadata | object | Additional context and metadata associated with the event |
| diff | object | Detailed diff of object changes (for update events) |
| timestamp | datetime |
Timestamp of when the event occurred |
Object Field
The object field captures granular details about the entities involved in the event
|
Object Type |
Description |
| Data Object | Events related to data assets (files, emails, etc.) |
| User Object | Events related to user lifecycle and settings changes |
| Organization Object | Events related to organization lifecycle and settings changes |
| Rule Object | Events related to Security Rule lifecycle and triggers |
| Unit Object | Events related to organizational unit/user group lifecycle |
Action Field
The action field provides crucial information about what happened in the event
| Action Type | Description |
| create | Creation of a new object |
| read | Read or access of an object (primarily for data objects) |
| update | Modification or update to an object's attributes or settings |
| delete | Deletion or removal of an object |
| triggered | Security Rule violation or trigger (only applies to rule objects) |
Action Result Descriptions
| Action Result | Description |
| success | Action completed successfully |
| error | Action failed due to an error (details usually in metadata) |
| encrypt | Security Rule forced object encryption |
| block | Security Rule blocked user action (e.g. sending an email/file) |
| override | User overrode Security Rule warning and proceeded with action |
| cancel | User canceled action after Security Rule warning to remediate |