Account activity event reference

The payload of every account activity event, generated from the AsyncAPI contract.

Payload fields for all 96 account activity events. Each sits inside the data property of the standard envelope.

Account

account.client_ip_mode_changed

Client IP address setting changed - An owner or admin changed how client IP addresses are kept on requests: in full, truncated to their network, or not at all.

Severity: notice. Category: account.

data fields:

mode (string, required): How client IP addresses are now kept: full, truncated or off.
previousMode (string, required): How they were kept before the change.

account.close_cancelled

Scheduled account close was cancelled - A close scheduled for the end of the paid period was cancelled, and the subscription will renew.

Severity: notice. Category: account.

This event carries no additional data fields.

account.close_scheduled

Account scheduled to close - The account will close, and its data be deleted, when the paid period ends.

Severity: critical. Category: account.

data fields:

closesAt (string): When the account will close (ISO 8601).

account.closed

Account closed - The account was closed: access and capture stopped. Its captured data is deleted after the grace period (account.data_purge_completed).

Severity: critical. Category: account.

data fields:

subscriptionCancelled (boolean): Whether an active subscription was cancelled by the close.
dataDeletedAfter (string): When the captured data is deleted (ISO 8601).

account.created

Account created - The account was created.

Severity: notice. Category: account.

data fields:

trialEndsAt (string): When the card-free trial every new account starts on ends (ISO 8601).

account.data_purge_completed

Account data deleted - A purge or close finished deleting the account’s data.

Severity: notice. Category: account.

data fields:

purgeSid (string, required): The purge log entry.
operation (string, required): purge or close.
scopes (object[]): What was deleted: any of traffic, saved, settings, automations (a close deletes every kind).
records (object): Records deleted, by kind (collections, exclusions, driftFindings, …).
requestsDeleted (integer, required): Captured requests deleted.
hostSamplesDeleted (integer): Server-sample archives deleted.
bytesDeleted (integer): Bytes of stored data deleted.

account.data_purged

A data purge was started - A purge of the account’s data was started: captured traffic, saved work, rules and settings, or automations, as chosen. account.data_purge_completed follows when it is done. Usage is not reduced.

Severity: critical. Category: account.

data fields:

purgeSid (string, required): The purge, as listed in the account’s purge history.
scopes (object[]): What is being deleted: any of traffic, saved, settings, automations.

account.environment_created

Environment <target> created - A new environment was added.

Severity: info. Category: account.

This event carries no additional data fields.

account.environment_deleted

Environment <target> deleted - An environment was removed.

Severity: notice. Category: account.

This event carries no additional data fields.

account.environment_updated

Environment <target> updated - An environment was changed.

Severity: info. Category: account.

data fields:

changed (object[]): Names of the fields that were changed.

account.name_changed

Account renamed to <target> - The account name was changed.

Severity: info. Category: account.

data fields:

previousName (string): The name before the change.

account.overage_toggled

Overage turned on or off - The account owner turned “Allow overage” on or off. Off, new requests and other metered usage are not recorded past the plan’s allowance until the billing period resets, and no overage is billed.

Severity: notice. Category: account.

data fields:

allowed (boolean, required): Whether usage past the allowance is now captured and billed as overage.

account.query_text_toggled

Query text storage turned on or off - An owner or admin turned on or off storing the text of database queries (and where they were called from) in performance data.

Severity: notice. Category: account.

data fields:

enabled (boolean, required): Whether query text is now stored.

account.sample_data_toggled

Sample data turned on or off - An owner or admin showed or hid the read-only sample bucket for the team.

Severity: info. Category: account.

data fields:

enabled (boolean, required): Whether the sample bucket is now shown.

account.settings_updated

Account settings updated - A setting on the account was changed.

Severity: info. Category: account.

data fields:

changed (object[], required): Names of the settings that were changed.

Alerting

alerting.channel_changed

Alert channel <target> was changed - A notification channel was renamed or its destination or settings changed.

Severity: notice. Category: alerting.

data fields:

provider (string, required): The channel provider type.
fields (object[]): The settings that changed (never their secret values).

alerting.channel_created

Alert channel <target> was created - A notification channel (Slack, webhook, email, …) was added.

Severity: notice. Category: alerting.

data fields:

provider (string, required): The channel provider type.

alerting.channel_deleted

Alert channel <target> was deleted - A notification channel was removed.

Severity: notice. Category: alerting.

data fields:

provider (string, required): The channel provider type.

alerting.channel_secret_rotated

Signing secret of alert channel <target> was rotated - A channel secret was replaced; the previous one stays valid for 24 hours.

Severity: notice. Category: alerting.

data fields:

provider (string, required): The channel provider type.

alerting.delivery_log_viewed

Delivery log of alert channel <target> was viewed - Someone opened the delivery attempts of a channel, which include response excerpts from the receiver.

Severity: info. Category: alerting.

This event carries no additional data fields.

alerting.delivery_redelivered

A notification was redelivered - A notification was sent again by hand from the delivery log.

Severity: notice. Category: alerting.

data fields:

channelSid (string, required): The channel it was sent to.

alerting.incident_acknowledged

Incident <target> was acknowledged - Someone acknowledged an incident; pending escalation steps are cancelled.

Severity: info. Category: alerting.

data fields:

number (number, required): The incident number.

alerting.incident_owner_changed

Owner of incident <target> was changed - An incident was assigned to someone else.

Severity: info. Category: alerting.

data fields:

number (number, required): The incident number.
ownerUserSid (string): The new owner, or null when unassigned.

alerting.incident_reopened

Incident <target> was reopened - An incident was reopened or returned to open by hand.

Severity: info. Category: alerting.

data fields:

number (number, required): The incident number.

alerting.incident_resolved

Incident <target> was resolved by hand - An incident was resolved manually.

Severity: info. Category: alerting.

data fields:

number (number, required): The incident number.

alerting.route_changed

Alert route <target> was changed - A routing policy was created, updated, reordered or removed.

Severity: notice. Category: alerting.

data fields:

operation (string, required): created, updated, reordered or deleted.

alerting.silence_created

Alerts were silenced - A silence was created: matching alerts still fire but are not delivered.

Severity: notice. Category: alerting.

data fields:

endsAt (string, required): When the silence ends.
matchers (object, required): What the silence applies to.

alerting.silence_expired

A silence was ended early - A silence was expired before its end time.

Severity: info. Category: alerting.

This event carries no additional data fields.

Billing

billing.ingest_rate_limited

Traffic went over the ingest rate limit - Records were not recorded this billing period because the account sent more than its plan’s records per second. Fires once per period.

Severity: notice. Category: billing.

data fields:

notRecorded (integer, required): Records not recorded so far this period (sampled out by SDKs or refused by ingest).

billing.overage_resumed

Overage resumed - Every overage invoice is settled; overage is billed again as the account allows.

Severity: notice. Category: billing.

This event carries no additional data fields.

billing.overage_suspended

Overage paused: an overage invoice is unpaid - Usage past an overage-billed allowance stops at the allowance until every overage invoice is paid.

Severity: critical. Category: billing.

data fields:

reason (string): What suspended it.

billing.payment_failed

A payment failed - A charge against the payment method failed.

Severity: critical. Category: billing.

data fields:

reason (string): The reason given by the payment provider.
amountDue (integer): The outstanding amount in the smallest currency unit.
currency (string): The ISO 4217 currency of amountDue, lower case (usd).
overage (boolean): True when the invoice bills monthly overage of an annual plan.

billing.payment_method_updated

The payment method was updated - The card or payment method on file was changed.

Severity: notice. Category: billing.

data fields:

brand (string): Card brand, where the method is a card.
last4 (string): The last four digits, where the method is a card.

billing.plan_changed

Plan changed to <planName> - The subscription moved to a different plan.

Severity: notice. Category: billing.

data fields:

planName (string, required): The plan now in effect.
planId (string): The Stripe price id.
previousPlanName (string): The plan that was in effect before.
previousPlanId (string): The Stripe price id of the plan that was in effect before, when the subscription itself changed plan.
replacesSubscriptionId (string): Set when this subscription replaced another one (a switch from monthly to annual billing): the account was already on a plan. Absent with previousPlanId too, a plan is starting.
direction (string): upgrade or downgrade: by the plans’ order on the pricing grid, else by what each costs per month. Absent for a change of billing interval on the same plan, and when it cannot be told.

billing.plan_over_limit

<planName> started; the account is over its limits - A scheduled plan change took effect while the account held more of a resource than the new plan includes. Nothing was removed; new ones cannot be created until it is back within the limit.

Severity: critical. Category: billing.

data fields:

planName (string, required): The plan now in effect.
planId (string): The Stripe price id.
overages (object[], required): Each resource over the limit: featureKey, allowance, current, remove.

billing.promotion_reward_ended

Promotion reward ended - A promotion reward expired or was withdrawn.

Severity: notice. Category: billing.

data fields:

promotionName (string): The campaign it came from.
outcome (string): expired or revoked.
reason (string): Why, when it was revoked rather than expired.

billing.promotion_reward_granted

Promotion reward applied - A referral or advocacy reward was applied to this account.

Severity: notice. Category: billing.

data fields:

promotionName (string): The campaign it came from.
role (string): referrer, referee or advocate.
expiresAt (string): When it lapses. Absent if perpetual.

billing.subscription_cancelled

Subscription cancelled - The subscription was cancelled.

Severity: critical. Category: billing.

data fields:

cancelAtPeriodEnd (boolean): True when access continues until the period ends.
effectiveAt (string): When the cancellation takes effect, ISO 8601.

billing.subscription_resumed

Subscription resumed - A cancellation was reversed.

Severity: notice. Category: billing.

data fields:

planName (string): The plan the subscription resumed on.

billing.trial_ended

Trial ended - A trial period ended.

Severity: notice. Category: billing.

data fields:

converted (boolean): Whether the trial became a paid subscription.

billing.trial_started

Trial started - A trial period began.

Severity: info. Category: billing.

data fields:

expiresAt (string): When the trial ends, ISO 8601.

billing.usage_limit_reached

The included request allowance was reached - Usage hit the plan allowance.

Severity: critical. Category: billing.

data fields:

usage (integer, required): Requests captured this period.
allowance (integer, required): The included allowance for the plan.
hardCapped (boolean): True when capture stops rather than billing overage.

Bucket

bucket.created

Bucket <target> was created - A new bucket was created.

Severity: info. Category: bucket.

This event carries no additional data fields.

bucket.deleted

Bucket <target> was deleted - A bucket and its configuration were deleted.

Severity: critical. Category: bucket.

This event carries no additional data fields.

bucket.updated

Bucket <target> was updated - A bucket setting was changed.

Severity: info. Category: bucket.

data fields:

changed (object[], required): Names of the settings that were changed.

Data

data.catalog_changed

Catalogue of tag key <target> was changed - Customer catalogue entries (labels and attributes of tag values) were added, replaced or removed.

Severity: info. Category: data.

data fields:

key (string, required): The tag key.
source (string, required): api or csv.
inserted (number): Entries added.
updated (number): Entries replaced.
deleted (number): Entries removed.
skipped (number): CSV rows skipped as invalid.

data.dashboard_created

Dashboard <target> was created - A report dashboard was created.

Severity: info. Category: data.

data fields:

visibility (string, required): private or account.
tiles (number, required): Tiles on the dashboard.

data.dashboard_deleted

Dashboard <target> was deleted - A report dashboard was deleted (its reports are kept).

Severity: info. Category: data.

data fields:

visibility (string, required): private or account.

data.dashboard_updated

Dashboard <target> was changed - A dashboard was renamed, rearranged, refiltered or shared differently.

Severity: info. Category: data.

data fields:

visibility (string, required): private or account.
fields (object[], required): The fields that changed (name, description, visibility, filter, scope, timeRange, layout).

data.dimension_classified

Tag key <target> was classified - A tag key’s classification changed (which decides masking and where its values may go), or it became or stopped being the customer key.

Severity: notice. Category: data.

data fields:

key (string, required): The tag key.
classification (string, required): none, pseudonymous, personal or secret.
previousClassification (string, required): The classification before.
role (string, required): customer or none.
previousCustomerKey (string): The key that was the customer key before, when it moved.

data.dimension_demoted

Tag key <target> was demoted - A tag key is no longer aggregated; reports on it read raw rows.

Severity: notice. Category: data.

data fields:

key (string, required): The tag key.

data.dimension_promoted

Tag key <target> was promoted - A tag key was promoted to fast, pre-aggregated reports.

Severity: notice. Category: data.

data fields:

key (string, required): The tag key.

data.dimension_updated

Tag key <target> was described - A tag key was renamed, described, hidden or shown again.

Severity: info. Category: data.

data fields:

key (string, required): The tag key.
fields (object[], required): displayName, description and/or hidden.

data.embed_disabled

Embedding was turned off for <target> - A report or dashboard stopped allowing embedding (turned off, or made private); its embeds stop showing it.

Severity: notice. Category: data.

data fields:

kind (string, required): report or dashboard.

data.embed_enabled

Embedding was allowed for <target> - A report or dashboard can now be shown by embed tokens the account signs.

Severity: critical. Category: data.

data fields:

kind (string, required): report or dashboard.

data.exclusion_changed

Capture exclusion rules changed - A rule governing which traffic is captured was changed.

Severity: notice. Category: data.

data fields:

operation (string, required): created, updated or deleted.

data.redaction_changed

Redaction rules changed - A rule governing what data is redacted before storage was changed.

Severity: critical. Category: data.

data fields:

operation (string, required): created, updated or deleted.

data.report_created

Report <target> was saved - A custom report was saved, from scratch or from a template.

Severity: info. Category: data.

data fields:

visibility (string, required): private or account.
visualization (string, required): table, line, stacked_area, bar, stacked_bar or number.
templateKey (string): The template it was created from.

data.report_deleted

Report <target> was deleted - A saved report was deleted, with its revisions; dashboard tiles showing it were removed.

Severity: info. Category: data.

data fields:

visibility (string, required): private or account.
dashboardsChanged (number, required): Dashboards a tile was removed from.

data.report_updated

Report <target> was changed - A saved report was renamed, redefined, redrawn, moved, pinned or shared differently.

Severity: info. Category: data.

data fields:

visibility (string, required): private or account.
fields (object[], required): The fields that changed (name, description, definition, visualization, display, visibility, folder, pinned, templateKey, embeddable).
definitionVersion (number, required): The report’s version after the change.

data.retention_changed

Data retention changed - How long captured traffic is kept was changed.

Severity: notice. Category: data.

data fields:

retentionDays (integer): The new retention window in days.

A share link was created for <target> - Data was made reachable through a share link.

Severity: critical. Category: data.

data fields:

expiresIn (string): The requested lifetime: 24h, 7d, 30d or never.
bucketSid (string): The bucket the shared request belongs to.

A share link was revoked - A share link was disabled.

Severity: notice. Category: data.

This event carries no additional data fields.

Integration

integration.git_connected

Git provider <target> was connected - A git provider was connected to the account.

Severity: notice. Category: integration.

data fields:

provider (string, required): github, gitlab or bitbucket.

integration.git_disconnected

Git provider <target> was disconnected - A git provider connection was removed.

Severity: notice. Category: integration.

data fields:

provider (string, required): The provider that was disconnected.

integration.webhook_changed

Webhook <target> was changed - An outbound webhook was created, updated or removed.

Severity: notice. Category: integration.

data fields:

operation (string, required): created, updated or deleted.

integration.workflow_changed

Workflow <target> was changed - A workflow was created, updated or removed.

Severity: info. Category: integration.

data fields:

operation (string, required): created, updated or deleted.

Security

security.api_token_access_changed

Access of API token <target> was changed - An API token’s role or access scopes were changed.

Severity: critical. Category: security.

data fields:

role (string, required): The role the token now carries.
previousRole (string, required): The role it carried before.
scopes (object[]): The access scopes it is now limited to; absent when it has everything its role allows.
previousScopes (object[]): The access scopes it was limited to before; absent when it had everything its role allowed.

security.api_token_created

API token <target> was created - A new API token was minted.

Severity: critical. Category: security.

data fields:

role (string, required): The role the token carries.
scopes (object[]): The access scopes the token is limited to; absent when it has everything its role allows.
environmentSid (string): The environment the token is scoped to, if any.

security.api_token_revoked

API token <target> was revoked - An API token was revoked.

Severity: notice. Category: security.

This event carries no additional data fields.

security.mcp_token_created

MCP token <target> was created - A new MCP token was minted.

Severity: critical. Category: security.

data fields:

bucketSids (object[]): The buckets the token may reach.

security.mcp_token_revoked

MCP token <target> was revoked - An MCP token was revoked.

Severity: notice. Category: security.

This event carries no additional data fields.

security.mfa_disabled

<target> disabled multi-factor authentication - A member turned MFA off.

Severity: critical. Category: security.

This event carries no additional data fields.

security.mfa_enabled

<target> enabled multi-factor authentication - A member enrolled in MFA.

Severity: notice. Category: security.

data fields:

method (string): totp, sms or passkey.

security.mfa_required_changed

Account-wide MFA requirement changed - The account changed whether MFA is mandatory for everyone.

Severity: critical. Category: security.

data fields:

required (boolean, required): Whether MFA is now mandatory for everyone on the account.

security.mfa_reset

MFA was reset for <target> - A member’s MFA enrolment was reset, usually by support.

Severity: critical. Category: security.

data fields:

passkeysRemoved (integer): How many passkeys were removed as part of the reset.

security.oauth_app_authorized

<actor> connected <target> - A person authorized an application to access the account.

Severity: critical. Category: security.

data fields:

clientId (string, required): The application’s OAuth client id.
resource (string, required): What the application may reach: mcp (the MCP server) or api (the REST API).
scopes (object[], required): The scopes granted.
environmentSid (string): The environment access is limited to, if any.
bucketSids (object[]): The buckets access is limited to; empty means all.
verified (boolean): Whether ApiTraffic has verified the application.

security.oauth_app_revoked

<target> was disconnected - An application’s access to the account was revoked.

Severity: notice. Category: security.

data fields:

clientId (string, required): The application’s OAuth client id.
resource (string, required): What the application could reach: mcp or api.
reason (string): Why: user or admin (disconnected), sessions_revoked, membership_removed, environment_deleted, refresh_token_reuse, code_reuse, client_revoked, or client_disabled (ApiTraffic disabled the application).

security.passkey_added

<target> registered a new passkey - A new passkey was registered as a sign-in method.

Severity: critical. Category: security.

data fields:

name (string): The label the passkey was registered under.

security.passkey_removed

Passkey <target> was removed - A passkey was removed as a sign-in method.

Severity: notice. Category: security.

This event carries no additional data fields.

security.password_changed

<target> changed their password - A member changed their password.

Severity: notice. Category: security.

This event carries no additional data fields.

security.signed_in

<target> signed in - Somebody signed in to the account.

Severity: info. Category: security.

data fields:

method (string): How they authenticated: password, passkey, oauth, mfa, signup or email_verification.
provider (string): The social provider, when the method was oauth.

security.signed_out

<target> signed out - Somebody deliberately ended their session.

Severity: info. Category: security.

This event carries no additional data fields.

security.sms_added

<target> added a phone number for verification codes - A phone number was verified and registered as a sign-in method.

Severity: critical. Category: security.

data fields:

last4 (string): The last four digits of the number.

<target> agreed to receive verification codes by text message - Consent to receive text-message verification codes was given, before any message was sent.

Severity: notice. Category: security.

data fields:

last4 (string): The last four digits of the number.
consentVersion (string): Version of the disclosure that was shown.
source (string): Which screen collected it: settings or enrollment.

security.sms_removed

<target> removed their verification phone number - A phone number was removed as a sign-in method.

Severity: notice. Category: security.

This event carries no additional data fields.

Support

support.access_granted

Support access was granted until <expiresAt> - The account opened a staff-access consent window.

Severity: critical. Category: support.

data fields:

duration (string, required): The requested window: 6h, 1d, 3d or 7d.
expiresAt (string, required): When the consent window closes, ISO 8601.

support.access_revoked

Support access was revoked - The account closed its staff-access consent window.

Severity: notice. Category: support.

This event carries no additional data fields.

support.session_started

A support session was opened by <actor> - A member of staff began an impersonated session.

Severity: critical. Category: support.

data fields:

consentExpiresAt (string, required): When the consent window backing this session closes, ISO 8601.

Team

team.invitation_accepted

<target> joined the account - An invitation was accepted and the person joined.

Severity: notice. Category: team.

data fields:

email (string, required): The address that accepted.

team.invitation_revoked

The invitation for <target> was revoked - A pending invitation was withdrawn.

Severity: notice. Category: team.

data fields:

email (string, required): The address whose invitation was withdrawn.

team.member_added

<target> was added to the account - Somebody was granted access to the account.

Severity: notice. Category: team.

data fields:

email (string, required): The address that was granted access.
role (string): The role they were given.

team.member_invited

<target> was invited to the account - Somebody was invited to join the account.

Severity: notice. Category: team.

data fields:

email (string, required): The address the invitation was sent to.
role (string): The role the invitee will hold once they accept.

team.member_removed

<target> was removed from the account - Somebody lost access to the account.

Severity: notice. Category: team.

data fields:

email (string, required): The address that lost access.

team.primary_changed

<target> became the primary owner of the account - Ownership of the account moved to a different person.

Severity: critical. Category: team.

data fields:

previousOwnerUserSid (string): The sid of the person who held ownership before.

team.role_changed

<target>'s role changed to <role> - A member’s role was changed.

Severity: notice. Category: team.

data fields:

role (string, required): The new role.
previousRole (string): The role held before the change.

Account activity event reference

Account #

account.client_ip_mode_changed #

account.close_cancelled #

account.close_scheduled #

account.closed #

account.created #

account.data_purge_completed #

account.data_purged #

account.environment_created #

account.environment_deleted #

account.environment_updated #

account.name_changed #

account.overage_toggled #

account.query_text_toggled #

account.sample_data_toggled #

account.settings_updated #

Alerting #

alerting.channel_changed #

alerting.channel_created #

alerting.channel_deleted #

alerting.channel_secret_rotated #

alerting.delivery_log_viewed #

alerting.delivery_redelivered #

alerting.incident_acknowledged #

alerting.incident_owner_changed #

alerting.incident_reopened #

alerting.incident_resolved #

alerting.route_changed #

alerting.silence_created #

alerting.silence_expired #

Billing #

billing.ingest_rate_limited #

billing.overage_resumed #

billing.overage_suspended #

billing.payment_failed #

billing.payment_method_updated #

billing.plan_changed #

billing.plan_over_limit #

billing.promotion_reward_ended #

billing.promotion_reward_granted #

billing.subscription_cancelled #

billing.subscription_resumed #

billing.trial_ended #

billing.trial_started #

billing.usage_limit_reached #

Bucket #

bucket.created #

bucket.deleted #

bucket.updated #

Data #

data.catalog_changed #

data.dashboard_created #

data.dashboard_deleted #

data.dashboard_updated #

data.dimension_classified #

data.dimension_demoted #

data.dimension_promoted #

data.dimension_updated #

data.embed_disabled #

data.embed_enabled #

data.exclusion_changed #

data.redaction_changed #

data.report_created #

data.report_deleted #

data.report_updated #

data.retention_changed #

data.share_created #

data.share_revoked #

Integration #

integration.git_connected #

integration.git_disconnected #

integration.webhook_changed #

integration.workflow_changed #

Security #

security.api_token_access_changed #

security.api_token_created #

security.api_token_revoked #

security.mcp_token_created #

security.mcp_token_revoked #

Account

account.client_ip_mode_changed

account.close_cancelled

account.close_scheduled

account.closed

account.created

account.data_purge_completed

account.data_purged

account.environment_created

account.environment_deleted

account.environment_updated

account.name_changed

account.overage_toggled

account.query_text_toggled

account.sample_data_toggled

account.settings_updated

Alerting

alerting.channel_changed

alerting.channel_created

alerting.channel_deleted

alerting.channel_secret_rotated

alerting.delivery_log_viewed

alerting.delivery_redelivered

alerting.incident_acknowledged

alerting.incident_owner_changed

alerting.incident_reopened

alerting.incident_resolved

alerting.route_changed

alerting.silence_created

alerting.silence_expired

Billing

billing.ingest_rate_limited

billing.overage_resumed

billing.overage_suspended

billing.payment_failed

billing.payment_method_updated

billing.plan_changed

billing.plan_over_limit

billing.promotion_reward_ended

billing.promotion_reward_granted

billing.subscription_cancelled

billing.subscription_resumed

billing.trial_ended

billing.trial_started

billing.usage_limit_reached

Bucket

bucket.created

bucket.deleted

bucket.updated

Data

data.catalog_changed

data.dashboard_created

data.dashboard_deleted

data.dashboard_updated

data.dimension_classified

data.dimension_demoted

data.dimension_promoted

data.dimension_updated

data.embed_disabled

data.embed_enabled

data.exclusion_changed

data.redaction_changed

data.report_created

data.report_deleted

data.report_updated

data.retention_changed

data.share_created

data.share_revoked

Integration

integration.git_connected

integration.git_disconnected

integration.webhook_changed

integration.workflow_changed

Security

security.api_token_access_changed

security.api_token_created

security.api_token_revoked

security.mcp_token_created

security.mcp_token_revoked

security.mfa_disabled