Skip to content

Events catalog

Axowl publishes a sealed event for each consequential change; events feed the hash-chained audit log (see Seals & integrity). The values below are what the audit log returns in eventType (see Audit). Event-specific data is in the record’s businessData.

By domain

Domain	`eventType` values
Users	`user.lifecycle.registered` · `created` · `updated` · `email_verified` · `deletion_requested` · `deletion_canceled` · `deleted` (on completion, with the system as actor); `user.security.logged_in` · `logged_out` · `login_failed` · `login_failure_spike`; `user.identity.account_linked` · `account_unlinked` · `account_switched` · `korean_verified`
Sessions	`user.session.created` · `terminated` · `expired` · `unlocked` · `concurrent_detected` · `impersonation_started` · `impersonation_ended` · `impersonation_mutation_blocked`; `connectedId.session.created` · `terminated` · `expired` · `unlocked` · `bulk_revoked` · `concurrent_detected`; `session.activity.heartbeat`; `org.session.entered` · `exited`
Seals (passkeys)	`seal.lifecycle.registered` · `used` · `revoked`; `seal.integrity.clone_detected`
Roles & permissions	`auth.role.created` · `updated` · `deleted` · `assigned` · `unassigned` · `permission_added` · `permission_removed` · `propagated`; `auth.perm.created` · `granted`; `auth.sod.conflict_detected` · `assignment_blocked`; `custom.event.registered`
Applications	`app.lifecycle.created` · `updated` · `deleted` · `status_changed`; `app.sec.secret_regenerated`; `app.repository.connected` · `disconnected`
App groups	`appgroup.lifecycle.created` · `updated` · `deleted`; `appgroup.stage.promoted`; `appgroup.monetization.enabled` · `disabled`; `appgroup.payment_service.changed`; `appgroup.payment_gateway.connected` · `disconnected`; `appgroup.datasource.connected` · `updated` · `tested` · `reconnected` · `disconnected` · `deleted` · `primary_changed` · `password_rotated` · `credential_revealed`; `appgroup.kakao.channel_linked` · `channel_changed` · `channel_unlinked` · `member_joined`; `appgroup.pm_ai.connected` · `disconnected`
Agents	`agent.hired` · `suspended` · `revoked` · `operator_assigned` · `permission_changed` · `action_denied` · `code_proposed` · `question_asked` · `question_answered`; `deployment.published` (emitted for a failed deployment as well as a successful one)
Organization	`org.lifecycle.created` · `updated` · `deleted` · `deletion_scheduled` · `deletion_cancelled` · `purged` · `inactivity_warned` · `suspended_by_platform` · `resumed_by_platform` · `suspension_reason_changed` · `ownership_transfer_requested` · `ownership_transfer_declined` · `ownership_transferred` · `billing_transfer_requested` · `billing_transfer_accepted` · `billing_transfer_declined`
Members	`org.member.invited` · `invite_resent` · `invite_cancelled` · `joined` · `declined` · `activated` · `suspended` · `removed` · `left` · `access_revoked` · `signature_changed`
Org settings & keys	`org.settings.updated`; `org.policy.updated` · `security_updated`; `org.keys.api_key_created` · `api_key_revoked` · `signing_key_rotated` · `webhook_secret_regenerated` · `plugin_token_created` · `plugin_token_revoked`
Integrations	`org.integration.enabled` · `disconnected` · `permission_granted`
Projects	`org.project.created` · `updated` · `status_changed` · `archived` · `restored` · `member_assigned` · `member_unassigned` · `invite_sent`
Reporting	`reporting.team.created` · `deleted` · `lead_changed`; `reporting.relationship.added` · `removed`; `reporting.membership.added` · `removed`; `reporting.template.changed`; `reporting.workitem.changed`; `reporting.approvalline.changed` · `template_changed`; `reporting.report.acknowledged`; `reporting.attachment.downloaded`
Approvals	`reporting.approval.requested` · `approved` · `rejected` · `revision_requested` · `withdrawn` · `completed` · `archived` · `deleted` · `op_executed`. `op_executed` records what actually ran after an approval. Its actor is the system; the approver who stamped it is in the data (`ApprovedByConnectedId`, `DecisionStepId`). Approval rows raised or stamped by an AI agent are recorded with the actor type `agent`, not `member`
Org files	`org.file.uploaded` · `download_issued` · `share_mode_changed` · `share_token_rotated` · `share_viewed` · `trashed` · `restored` · `purged` · `sealed`. `org.file.sealed` carries `FileId`, `FileName`, `SizeBytes`, `Sha256` (re-read from storage at seal time), `AnchorId`, `RequestedByConnectedId`, `ApprovedByConnectedId`, `ApprovalInstanceId`, `ApprovalDocumentNumber`, `ReplacesFileId`. Sealed through an approval, the actor is the system; sealed directly with a passkey, the actor is that person. See Storage → Sealing
Storage	`org.storage.lifecycle_rule_changed` · `lifecycle_applied` · `worm_mirrored` · `drift_detected`
Payments	`payments.credit.topup_requested` (actor = the person who opened checkout) and `payments.credit.topup_completed` (actor = system, when the payment arrives) — both carry `usd`, `bonus` and the provider session id `sess`, which links the two rows; `payments.billing.plan_changed`; `payments.invoice.created` · `paid`; `payments.taxdoc.issued` · `cancelled` · `failed`; `payments.cashreceipt.issued` · `cancelled`
Devices	`device.lifecycle.registered` · `status_changed`; `device.enrollment.token_issued` · `asset_claimed` · `mismatch`
End users	`enduser.lifecycle.created` · `registered` · `deleted`; `enduser.status.activated` · `suspended`; `enduser.security.logged_in` · `logged_out` · `login_failed`
Integrity	`integrity.data.tampering_detected` · `violation_resolved` · `restore_performed`
Audit	`audit.retention.grace_started` · `purged` · `override_changed`; `audit.rollup.created` · `analytics_created` · `behavior_created`
Meetings	`business.meeting.created` · `updated` · `cancelled` · `attendance_marked` · `agenda_voted`
Roost	`roost.*` — see Roost

enduser.security.login_failed is emitted on every rejected end-user sign-in, so you can chart a failure rate rather than successes alone. It carries a reason code in the record’s rc field:

Group	Reason codes
Credential	`invalid_credentials`, `unknown_credential`, `assertion_failed`, `invalid_token`, `mfa_failed`
Policy	`suspended`, `badge_inactive`, `access_revoked`, `registration_closed`, `bot_check_failed`

Count only the credential group when watching for credential-stuffing spikes — the policy group means the credential was fine and a rule rejected the sign-in, so mixing them inflates the rate.

Emission is gated by the app group’s end-user event toggle, the same switch that governs enduser.security.logged_in.

Member (dashboard) sign-in failures are recorded as user.security.login_failed.