> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cognite.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit log event types reference

> Complete reference of all eventType values recorded in Cognite Data Fusion (CDF) audit log entries, grouped by service name.

Every audit log entry includes a `serviceName` and an `eventType` field that together categorize the action performed. This reference documents each event type, its description, and the structure of the `requestParameters` and `responseParameters` fields.

Use the summary tables to find an event. Expand an accordion below a table for full parameter schemas.

<Note>
  Use exact string matching when filtering audit logs by `projectName`, `serviceName`, and `eventType`.
</Note>

## Authentication events

Authentication events are emitted by the `AUTHENTICATION` service whenever a principal exchanges a credential for a CDF ticket. The response parameters are identical for all authentication event types — a base64-encoded CDF ticket.

| Service name     | Event type | Description                                                                                                                                               | Request parameters                                                                                                                                                         | Response parameters |
| ---------------- | ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------- |
| `AUTHENTICATION` | `OIDC`     | Logged when CDF authenticates a principal using an external OpenID Connect (OIDC) identity provider, such as Microsoft Entra ID, Auth0, or Keycloak.      | `host`, `path`, `sourceIPAddress`, `loggedTokenClaims` (`oid`, `appid`, `appidacr`, `email`, `azp`, `azpacr`, `tid`, `app`, `idp`, `iss`, `gty`, `clientId`, `clientHost`) | `ticket`            |
| `AUTHENTICATION` | `CAS`      | Logged when CDF authenticates a principal using the Cognite Authorization Server (CAS).                                                                   | `host`, `path`, `sourceIPAddress`, `loggedTokenClaims` (`email`, `ext.org`, `ext.ext_group_ids`, `ext.isc`, `ext.ptn`)                                                     | `ticket`            |
| `AUTHENTICATION` | `SESSION`  | Logged when CDF validates a session token, typically used by internal services acting on behalf of a user.                                                | `host`, `path`, `sourceIPAddress`, `loggedTokenClaims` (`Internal-Service-Name`, `Project-Id`, `Subject-Ticket`, `Internal-Service-Ticket`, `Session-Id`)                  | `ticket`            |
| `AUTHENTICATION` | `TICKET`   | Logged when CDF exchanges an existing credential for a CDF ticket. Query string parameters are excluded from the logged path as they may contain secrets. | `host`, `path`, `sourceIPAddress`                                                                                                                                          | `ticket`            |

<AccordionGroup>
  <Accordion title="OIDC — request and response parameters">
    **Request parameters**

    ```json theme={"languages":{"custom":["/_languages/kuiper.json","../_languages/kuiper.json"]}}
    {
      // URI authority the request was sent to
      "host": string,
      // Request path
      "path": string,
      // Client IP address the request originated from
      "sourceIPAddress": string,
      // Safe-to-log claims from the validated external OIDC JWT.
      // Each claim maps to an array of values; a claim is only
      // present if the IdP issued it.
      "loggedTokenClaims": {
        // Entra ID: immutable user object ID (profile scope)
        "oid": string[],
        // Entra ID: application ID, v1.0 tokens
        "appid": string[],
        // Entra ID: app authentication method, v1.0 tokens
        "appidacr": string[],
        // User email
        "email": string[],
        // Entra ID: application ID, v2.0 tokens
        "azp": string[],
        // Entra ID: app authentication method, v2.0 tokens
        "azpacr": string[],
        // Entra ID: target tenant ID
        "tid": string[],
        // Entra ID: marks an app-only token (idtyp scope)
        "app": string[],
        // Entra ID: STS that authenticated the user
        "idp": string[],
        // Token issuer
        "iss": string[],
        // Auth0: grant type used
        "gty": string[],
        // Keycloak: custom service-account marker field
        "clientId": string[],
        // Keycloak: custom service-account marker field
        "clientHost": string[]
      }
    }
    ```

    **Response parameters**

    ```json theme={"languages":{"custom":["/_languages/kuiper.json","../_languages/kuiper.json"]}}
    {
      // The issued CDF ticket as a base64-encoded protobuf message.
      // Set to "TooBigToEncode==" when the ticket exceeds 512 KiB.
      "ticket": string
    }
    ```
  </Accordion>

  <Accordion title="CAS — request and response parameters">
    **Request parameters**

    ```json theme={"languages":{"custom":["/_languages/kuiper.json","../_languages/kuiper.json"]}}
    {
      // URI authority the request was sent to
      "host": string,
      // Request path
      "path": string,
      // Client IP address the request originated from
      "sourceIPAddress": string,
      // Safe-to-log claims from the validated JWT
      "loggedTokenClaims": {
        // User email address
        "email": string[],
        // CAS organization the principal belongs to
        "ext.org": string[],
        // External IdP group IDs resolved for the principal
        "ext.ext_group_ids": string[],
        // CAS internal session context
        "ext.isc": string[],
        // CAS internal partition/tenant marker
        "ext.ptn": string[]
      }
    }
    ```

    **Response parameters**

    ```json theme={"languages":{"custom":["/_languages/kuiper.json","../_languages/kuiper.json"]}}
    {
      // The issued CDF ticket as a base64-encoded protobuf message.
      // Set to "TooBigToEncode==" when the ticket exceeds 512 KiB.
      "ticket": string
    }
    ```
  </Accordion>

  <Accordion title="SESSION — request and response parameters">
    **Request parameters**

    ```json theme={"languages":{"custom":["/_languages/kuiper.json","../_languages/kuiper.json"]}}
    {
      // URI authority the request was sent to
      "host": string,
      // Request path
      "path": string,
      // Client IP address the request originated from
      "sourceIPAddress": string,
      // Safe-to-log claims from the session token
      "loggedTokenClaims": {
        // Name of the internal service the session acts on behalf of
        "Internal-Service-Name": string[],
        // CDF project ID the session is scoped to
        "Project-Id": string[],
        // Embedded subject (user) ticket, as a raw JWT
        "Subject-Ticket": string[],
        // Embedded internal-service ticket, as a raw JWT
        "Internal-Service-Ticket": string[],
        // Identifier of the session
        "Session-Id": string[]
      }
    }
    ```

    **Response parameters**

    ```json theme={"languages":{"custom":["/_languages/kuiper.json","../_languages/kuiper.json"]}}
    {
      // The issued CDF ticket as a base64-encoded protobuf message.
      // Set to "TooBigToEncode==" when the ticket exceeds 512 KiB.
      "ticket": string
    }
    ```
  </Accordion>

  <Accordion title="TICKET — request and response parameters">
    **Request parameters**

    ```json theme={"languages":{"custom":["/_languages/kuiper.json","../_languages/kuiper.json"]}}
    {
      // URI authority the request was sent to (Host header)
      "host": string,
      // Request path; query string is excluded as it may contain secrets
      "path": string,
      // Client IP address the request originated from
      "sourceIPAddress": string
    }
    ```

    **Response parameters**

    ```json theme={"languages":{"custom":["/_languages/kuiper.json","../_languages/kuiper.json"]}}
    {
      // The issued CDF ticket as a base64-encoded protobuf message.
      // Set to "TooBigToEncode==" when the ticket exceeds 512 KiB.
      "ticket": string
    }
    ```
  </Accordion>
</AccordionGroup>

## IAM events

IAM events are emitted by the `IAM` service when principals, groups, or access configurations are created, updated, or deleted.

| Service name | Event type      | Description                                                                                           | Request parameters                                         | Response parameters       |
| ------------ | --------------- | ----------------------------------------------------------------------------------------------------- | ---------------------------------------------------------- | ------------------------- |
| `IAM`        | `CREATE_GROUPS` | Logged when one or more CDF groups are created, including their assigned capabilities and membership. | `groups[]` (`name`, `sourceId`, `capabilities`, `members`) | `groups[]` (`name`, `id`) |
| `IAM`        | `DELETE_GROUPS` | Logged when one or more CDF groups are deleted by ID.                                                 | `groups[]` (`id`)                                          | `groups[]` (`id`)         |

<AccordionGroup>
  <Accordion title="CREATE_GROUPS — request and response parameters">
    **Request parameters**

    ```json theme={"languages":{"custom":["/_languages/kuiper.json","../_languages/kuiper.json"]}}
    {
      "groups": [{
        // Name of the group
        "name": string,
        // Group ID of the external IdP, or empty if managed in CDF
        "sourceId": string,
        // Collection of capabilities assigned to this group
        "capabilities"?: Capability[],
        // User IDs if this group is managed in CDF
        "members"?: Members
      }]
    }
    ```

    **Response parameters**

    ```json theme={"languages":{"custom":["/_languages/kuiper.json","../_languages/kuiper.json"]}}
    {
      "groups": [{
        // Name of the group
        "name": string,
        // CDF-assigned group ID
        "id": string
      }]
    }
    ```
  </Accordion>

  <Accordion title="DELETE_GROUPS — request and response parameters">
    **Request parameters**

    ```json theme={"languages":{"custom":["/_languages/kuiper.json","../_languages/kuiper.json"]}}
    {
      "groups": [
        // IDs of groups to delete
        "<group_id>"
      ]
    }
    ```

    **Response parameters**

    ```json theme={"languages":{"custom":["/_languages/kuiper.json","../_languages/kuiper.json"]}}
    {
      "groups": [
        // IDs of the deleted groups
        "<group_id>"
      ]
    }
    ```
  </Accordion>
</AccordionGroup>

## Further reading

* [About CDF audit logs](/cdf/admin/audit/about) — Overview and schema reference
* [Audit log query reference](/cdf/admin/audit/queries) — Filter by event type in practice
* [Set up audit log streaming](/cdf/admin/audit/streaming) — Configure delivery to your cloud storage