Audit Event Reference

This page lists every audit-log event type the platform can emit, regardless of whether it has appeared in your organization’s logs yet. This catalog is also available programmatically via the Get audit-log event catalog API endpoint. Note that the Get audit-log filter options endpoint is different: it returns only the values that already appear in your organization’s audit logs, for populating filter dropdowns.

User events

Events performed directly by a user (actor: user).

Event	Description
`user.login`	A user signed in.
`user.logout`	A user signed out.
`user.create`	A new user account was created.
`user.update`	A user account was updated.
`user.updatedSamlSettings`	A user changed the organization’s SAML SSO settings.
`user.updatedScimSettings`	A user changed the organization’s SCIM provisioning settings.
`user.updatedSessionSettings`	A user changed the organization’s session length setting.
`user.enrolledTool`	A user connected (authenticated) a tool integration.
`user.updatedIngestCredentials`	A user added or replaced a log-ingest credential for a tool integration.
`user.createdChat`	A user started a new chat.
`user.sentChatMessage`	A user sent a message in a chat.
`user.createdAgent`	A user created an agent.
`user.updatedAgent`	A user updated an agent’s configuration or operational settings.
`user.deletedAgent`	A user deleted an agent.
`user.pausedAgent`	A user paused an agent.
`user.resumedAgent`	A user resumed an agent.
`user.createdAgentTrigger`	A user created an agent trigger.
`user.enabledAgentTrigger`	A user enabled an agent trigger.
`user.disabledAgentTrigger`	A user disabled an agent trigger.
`user.updatedAgentTrigger`	A user updated an agent trigger.
`user.deletedAgentTrigger`	A user deleted an agent trigger.
`user.triggeredAgent`	A user manually triggered an agent run.
`user.resentRunDelivery`	A user resent a failed output delivery or notification from an agent run.
`user.confirmedChatToolUse`	A user approved a tool call requested in a chat.
`user.rejectedChatToolUse`	A user rejected a tool call requested in a chat.
`user.createdCustomModel`	A user created a custom model configuration.
`user.updatedCustomModel`	A user updated a custom model configuration.
`user.deletedCustomModel`	A user deleted a custom model configuration.
`user.deletedUser`	A user deleted another user from the organization.
`user.updatedGroupPermissions`	A user changed the permissions assigned to a role.
`user.startedAgentInstruction`	A user started an agent-instruction feedback session.
`user.submittedAgentInstructionFeedback`	A user submitted feedback in an agent-instruction session.
`user.generatedAgentInstructionDiff`	A user generated proposed instruction changes from feedback.
`user.appliedAgentInstructions`	A user applied proposed instruction changes to an agent.
`chat.shared`	A user shared a chat.
`chat.unshared`	A user unshared a chat.
`user.changedIngestSource`	A user created, updated, removed, paused, or resumed a log source.
`user.changedLogSink`	A user created, edited, tested, paused, resumed, or removed a logging sink that exports logs to customer storage.
`user.updatedSandboxEgress`	A user changed the organization sandbox network policy.
`user.updatedAgentSandboxEgress`	A user customized an agent’s sandbox network policy or reset it to the organization policy.
`user.updatedAlertStatus`	A user changed an alert’s status (for example escalated, closed, or dismissed it).
`user.updatedAlertSeverity`	A user changed an alert’s severity.
`user.updatedUserRole`	A user changed another user’s role.
`user.createdApiKey`	A user created an API key.
`user.revokedApiKey`	A user revoked an API key.
`user.createdRole`	A user created a role.
`user.updatedRole`	A user updated a role’s name or description.
`user.deletedRole`	A user deleted a role.
`user.createdInvite`	A user invited someone to the organization.
`user.canceledInvite`	A user canceled a pending invite.
`user.resentInvite`	A user resent a pending invite.
`user.disconnectedTool`	A user disconnected a tool or CLI integration and removed its credentials.
`user.enabledTool`	A user enabled a tool or CLI integration.
`user.disabledTool`	A user disabled a tool or CLI integration.
`user.createdCustomTool`	A user created a custom MCP tool.
`user.updatedCustomTool`	A user updated a custom MCP tool.
`user.deletedCustomTool`	A user deleted a custom MCP tool.
`user.updatedToolAppConfig`	A user created or changed an integration app configuration (GitHub App, Slack app, or Jira service account).
`user.deletedToolAppConfig`	A user removed an integration app configuration or GitHub installation.
`user.updatedIngestSettings`	A user turned log-ingest streams on or off for a tool integration.

Agent events

Events emitted by autonomous agent runs (actor: agent).

Event	Description
`agent.createdChat`	An agent run created a new chat.
`agent.runStarted`	An agent run started (via UI, API, cron, webhook, job, tool, or detection).
`agent.invokedTool`	An agent invoked a tool during a run.
`agent.runCompleted`	An agent run completed (successfully or with an error).

Chat events

Events emitted during interactive chats (actor: chat).

Event	Description
`chat.runCompleted`	A chat turn completed (successfully or with an error).
`chat.invokedTool`	A tool was invoked during a chat.

Detection events

Events emitted by published code detections (actor: detection).

Event	Description
`detection.invokedTool`	A published code detection invoked a tool during an execution.

SCIM events

Changes pushed by your identity provider through SCIM provisioning (actor: scim). No Cotool user performs these, so the entry has no user or IP address; the affected user is recorded in data.targetUserId.

Event	Description
`scim.createdUser`	The SCIM identity provider provisioned a user.
`scim.updatedUser`	The SCIM identity provider updated a user’s attributes.
`scim.deactivatedUser`	The SCIM identity provider deactivated a user.
`scim.deletedUser`	The SCIM identity provider deleted a user.

Getting Started

Core Concepts

Chat

Agents

Triage

Hunt

Log Ingest

Detections

Improving Agents

Settings

Integrations

User events

Agent events

Chat events

Detection events

SCIM events

​User events

​Agent events

​Chat events

​Detection events

​SCIM events

User events

Agent events

Chat events

Detection events

SCIM events