Event reference

The complete list of audit event types, grouped as the audit log’s category filter groups them. Every event carries the same envelope — actor, resource, outcome, timestamp — so this reference only describes what triggers each action.

Updated 30 July 2026 · 6 min read

Outcomes

Every event resolves to one of three outcomes. Long-running actions are recorded when they start and finalized when they finish, so an event’s outcome is always its real result, never its intent.

Outcome	Meaning
`success`	The action completed.
`denied`	Policy or approval refused it — most commonly a denied tool execution.
`failure`	The action was attempted and errored; the event carries the error message.

Agent & tool activity

Action	Emitted when
`tool.execute`	An agent invoked an MCP tool. Denied calls record outcome `denied`; calls that ran under a human approval carry the Approved badge.

Sessions

Action	Emitted when
`session.create`	An agent session was created — a chat, a planning session, or an execution session for a run.
`session.update`	A session’s configuration changed.
`session.archive`	A session was archived.
`convo-agent.archive`	A Convo Agent was archived.
`user.preferences.update`	A member changed their preferences.

Team & access control

Action	Emitted when
`user.invite`	An invitation was sent from Settings → Team.
`user.role.assign`	A role was assigned to a member.
`user.role.revoke`	A role was removed from a member.
`role.create`	A role was created.
`role.update`	A role was renamed or edited.
`role.delete`	A role was deleted.
`role.policy.attach`	A policy was attached to a role.
`role.policy.remove`	A policy was detached from a role.
`role.delegation.grant`	A member was granted the right to assume a role.
`role.delegation.revoke`	A delegation grant was revoked.
`policy.create`	A policy was created.
`policy.update`	A policy document changed — including any tool moving between Allow and Approve.
`policy.delete`	A policy was deleted.

Secrets & credentials

Action	Emitted when
`secret.upsert`	A provider API key was configured or replaced. The value itself is redacted.
`secret.delete`	A provider API key was deleted.
`mcp.credential.upsert`	An MCP credential was stored — organization- or user-scoped.
`mcp.credential.delete`	An MCP credential was removed.
`mcp.oauth-client.upsert`	An OAuth client was registered or updated for a server.
`mcp.oauth-client.delete`	An OAuth client was removed.
`mcp.aws-identity-center.upsert`	An AWS IAM Identity Center configuration was saved.
`mcp.aws-identity-center.delete`	An AWS IAM Identity Center configuration was removed.

Schedules & triggers

Action	Emitted when
`schedule.create`	A Task Agent was saved with a schedule.
`schedule.update`	A Task Agent’s schedule or plan changed.
`schedule.archive`	A Task Agent was archived.
`schedule.trigger.create`	A run was created — the summary names the source: cron, manual, or webhook.
`webhook_trigger.create`	A webhook trigger was added to a Task Agent.
`webhook_trigger.enable`	A webhook trigger was enabled.
`webhook_trigger.disable`	A webhook trigger was disabled.
`webhook_trigger.rotate_secret`	A trigger’s secret was rotated; the previous secret keeps a grace period.
`webhook_trigger.archive`	A webhook trigger was deleted.

MCP registry

Action	Emitted when
`mcp.registry.org-state.update`	A server was enabled or disabled for the organization, or its overrides changed.
`mcp.registry.capabilities.sync`	A server’s tool list was refreshed.
`mcp.registry.oauth-discovery.refresh`	OAuth discovery was re-run against a server.
`mcp.registry.org-server.create`	A custom server was added.
`mcp.registry.org-server.update`	A custom server was edited.
`mcp.registry.org-server.delete`	A custom server was deleted.

Identity

Action	Emitted when
`identity.session.issue`	A short-lived identity was issued — for a member’s turn or a run acting on their behalf.
`identity.session.revoke`	Identity sessions were revoked — singly, per member, or organization-wide after an access change.