Audit log event types reference

Every audit log entry includes a serviceName and an eventType field that together categorize the action performed. This reference documents each event type, its description, and the structure of the requestParameters and responseParameters fields. Use the summary tables to find an event. Expand an accordion below a table for full parameter schemas.

Use exact string matching when filtering audit logs by projectName, serviceName, and eventType.

Authentication events

Authentication events are emitted by the AUTHENTICATION service whenever a principal exchanges a credential for a CDF ticket. The response parameters are identical for all authentication event types — a base64-encoded CDF ticket.

Service name	Event type	Description	Request parameters	Response parameters
`AUTHENTICATION`	`OIDC`	Logged when CDF authenticates a principal using an external OpenID Connect (OIDC) identity provider, such as Microsoft Entra ID, Auth0, or Keycloak.	`host`, `path`, `sourceIPAddress`, `loggedTokenClaims` (`oid`, `appid`, `appidacr`, `email`, `azp`, `azpacr`, `tid`, `app`, `idp`, `iss`, `gty`, `clientId`, `clientHost`)	`ticket`
`AUTHENTICATION`	`CAS`	Logged when CDF authenticates a principal using the Cognite Authorization Server (CAS).	`host`, `path`, `sourceIPAddress`, `loggedTokenClaims` (`email`, `ext.org`, `ext.ext_group_ids`, `ext.isc`, `ext.ptn`)	`ticket`
`AUTHENTICATION`	`SESSION`	Logged when CDF validates a session token, typically used by internal services acting on behalf of a user.	`host`, `path`, `sourceIPAddress`, `loggedTokenClaims` (`Internal-Service-Name`, `Project-Id`, `Subject-Ticket`, `Internal-Service-Ticket`, `Session-Id`)	`ticket`
`AUTHENTICATION`	`TICKET`	Logged when CDF exchanges an existing credential for a CDF ticket. Query string parameters are excluded from the logged path as they may contain secrets.	`host`, `path`, `sourceIPAddress`	`ticket`

OIDC — request and response parameters

Request parameters

{
  // URI authority the request was sent to
  "host": string,
  // Request path
  "path": string,
  // Client IP address the request originated from
  "sourceIPAddress": string,
  // Safe-to-log claims from the validated external OIDC JWT.
  // Each claim maps to an array of values; a claim is only
  // present if the IdP issued it.
  "loggedTokenClaims": {
    // Entra ID: immutable user object ID (profile scope)
    "oid": string[],
    // Entra ID: application ID, v1.0 tokens
    "appid": string[],
    // Entra ID: app authentication method, v1.0 tokens
    "appidacr": string[],
    // User email
    "email": string[],
    // Entra ID: application ID, v2.0 tokens
    "azp": string[],
    // Entra ID: app authentication method, v2.0 tokens
    "azpacr": string[],
    // Entra ID: target tenant ID
    "tid": string[],
    // Entra ID: marks an app-only token (idtyp scope)
    "app": string[],
    // Entra ID: STS that authenticated the user
    "idp": string[],
    // Token issuer
    "iss": string[],
    // Auth0: grant type used
    "gty": string[],
    // Keycloak: custom service-account marker field
    "clientId": string[],
    // Keycloak: custom service-account marker field
    "clientHost": string[]
  }
}

Response parameters

{
  // The issued CDF ticket as a base64-encoded protobuf message.
  // Set to "TooBigToEncode==" when the ticket exceeds 512 KiB.
  "ticket": string
}

CAS — request and response parameters

Request parameters

{
  // URI authority the request was sent to
  "host": string,
  // Request path
  "path": string,
  // Client IP address the request originated from
  "sourceIPAddress": string,
  // Safe-to-log claims from the validated JWT
  "loggedTokenClaims": {
    // User email address
    "email": string[],
    // CAS organization the principal belongs to
    "ext.org": string[],
    // External IdP group IDs resolved for the principal
    "ext.ext_group_ids": string[],
    // CAS internal session context
    "ext.isc": string[],
    // CAS internal partition/tenant marker
    "ext.ptn": string[]
  }
}

Response parameters

{
  // The issued CDF ticket as a base64-encoded protobuf message.
  // Set to "TooBigToEncode==" when the ticket exceeds 512 KiB.
  "ticket": string
}

SESSION — request and response parameters

Request parameters

{
  // URI authority the request was sent to
  "host": string,
  // Request path
  "path": string,
  // Client IP address the request originated from
  "sourceIPAddress": string,
  // Safe-to-log claims from the session token
  "loggedTokenClaims": {
    // Name of the internal service the session acts on behalf of
    "Internal-Service-Name": string[],
    // CDF project ID the session is scoped to
    "Project-Id": string[],
    // Embedded subject (user) ticket, as a raw JWT
    "Subject-Ticket": string[],
    // Embedded internal-service ticket, as a raw JWT
    "Internal-Service-Ticket": string[],
    // Identifier of the session
    "Session-Id": string[]
  }
}

Response parameters

{
  // The issued CDF ticket as a base64-encoded protobuf message.
  // Set to "TooBigToEncode==" when the ticket exceeds 512 KiB.
  "ticket": string
}

TICKET — request and response parameters

Request parameters

{
  // URI authority the request was sent to (Host header)
  "host": string,
  // Request path; query string is excluded as it may contain secrets
  "path": string,
  // Client IP address the request originated from
  "sourceIPAddress": string
}

Response parameters

{
  // The issued CDF ticket as a base64-encoded protobuf message.
  // Set to "TooBigToEncode==" when the ticket exceeds 512 KiB.
  "ticket": string
}

IAM events

IAM events are emitted by the IAM service when principals, groups, or access configurations are created, updated, or deleted.

Service name	Event type	Description	Request parameters	Response parameters
`IAM`	`CREATE_GROUPS`	Logged when one or more CDF groups are created, including their assigned capabilities and membership.	`groups[]` (`name`, `sourceId`, `capabilities`, `members`)	`groups[]` (`name`, `id`)
`IAM`	`DELETE_GROUPS`	Logged when one or more CDF groups are deleted by ID.	`groups[]` (`id`)	`groups[]` (`id`)

CREATE_GROUPS — request and response parameters

Request parameters

{
  "groups": [{
    // Name of the group
    "name": string,
    // Group ID of the external IdP, or empty if managed in CDF
    "sourceId": string,
    // Collection of capabilities assigned to this group
    "capabilities"?: Capability[],
    // User IDs if this group is managed in CDF
    "members"?: Members
  }]
}

Response parameters

{
  "groups": [{
    // Name of the group
    "name": string,
    // CDF-assigned group ID
    "id": string
  }]
}

DELETE_GROUPS — request and response parameters

Request parameters

{
  "groups": [
    // IDs of groups to delete
    "<group_id>"
  ]
}

Response parameters

{
  "groups": [
    // IDs of the deleted groups
    "<group_id>"
  ]
}

Administration

Audit log event types reference

Authentication events

IAM events

Further reading

​Authentication events

​IAM events

​Further reading

Authentication events

IAM events

Further reading