GET /v1/compliance/activities

List compliance activities for the authenticated tenant.

The tenant is the caller's parent organization, or — for an organization with no parent — the organization itself. Returns a paginated list of compliance activities that can be filtered by various criteria.

#Query parameters

• activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 511 more

Filter activities by type. See the response data schema for the additional fields each type returns. Cannot be combined with exclude_activity_types[].

• "abuse_decision_received"

An external anti-abuse service reported a consequential decision about a sign-in or sign-up attempt.

• "account_deleted"

User-initiated self-service account deletion.

• "admin_api_key_created"

An admin API key was created.

• "admin_api_key_deleted"

An admin API key was deleted.

• "admin_api_key_updated"

An admin API key was updated (renamed or activated/deactivated).

• "admin_connector_request_resolved"

Admin approved or dismissed pending member requests to enable an MCP connector.

• "admin_request_created"

Admin request created by an org member (seat upgrade, limit increase, join org, end-user invite).

• "admin_setup_checklist_step_delegated"

A step of the Haijun Enterprise admin setup checklist was delegated to a teammate — an organization member, or an email address that has not joined the organization yet — replacing any earlier delegation of that step.

• "admin_setup_checklist_step_delegation_cancelled"

The delegation of a Haijun Enterprise admin setup checklist step was cancelled.

• "age_verified"

User age was verified.

• "anonymous_mobile_login_attempted"

Anonymous mobile login was attempted.

• "api_key_created"

Activity logged when a new API key is created.

• "audit_log_export_accessed"

Audit log export file was accessed/downloaded via signed URL.

• "audit_log_export_started"

Audit log export was initiated.

• "billing_emails_updated"

The organization's billing email recipients were updated.

• "ccr_agent_created"

A Haijun Code agent was created.

• "ccr_agent_deleted"

A Haijun Code agent was deleted.

• "ccr_agent_proxy_juglow_oidc_token_exchanged"

The Haijun Code agent proxy exchanged a minted identity token for short-lived credentials in the organization's own cloud. Recorded for exchange targets only (such as "aws" and "gcp"; the "direct" target has no exchange step). One event is recorded per exchange call; a request served from the proxy's exchanged-credential cache does not exchange again and is not recorded here. Per-request detail for traffic the credentials were injected into is available in the agent proxy network events.

• "ccr_agent_proxy_juglow_oidc_token_minted"

The Haijun Code agent proxy minted a short-lived identity token for an juglow_oidc credential. One event is recorded per fresh token issuance; a request served from the proxy's short-lived token cache does not mint a new token and is not recorded here. Per-request detail for traffic the credential was injected into is available in the agent proxy network events.

• "ccr_agent_proxy_credential_created"

A Haijun Code agent proxy credential was created. Credentials hold the secrets the agent proxy injects into requests Haijun Code sessions send to approved external services; each credential belongs to an agent proxy profile. Audit events carry only credential names and settings, never the secret material itself.

• "ccr_agent_proxy_credential_deleted"

A Haijun Code agent proxy credential was deleted. Its secret material was removed and can no longer be sent to any host.

• "ccr_agent_proxy_credential_rotated"

A Haijun Code agent proxy credential's secret material was replaced. The replacement keeps the same name, profile, and allowed hosts under a new credential identifier, and everything that referenced the old credential now uses the replacement.

• "ccr_agent_proxy_credential_updated"

A Haijun Code agent proxy credential's settings were updated. Only the display name and the allowed host patterns can be updated; the secret material can only be replaced through a rotation.

• "ccr_agent_proxy_destination_deleted"

An agent proxy destination was deleted.

• "ccr_agent_proxy_network_events_listed"

A Haijun Code network activity export was accessed for the given hour.

• "ccr_agent_proxy_profile_bound"

A Haijun Code agent proxy profile was bound to a scope, applying its policy to Haijun Code sessions in that scope.

• "ccr_agent_proxy_profile_created"

A Haijun Code agent proxy profile was created. Agent proxy profiles are named, reusable bundles of access policy that administrators bind to parts of the organization.

• "ccr_agent_proxy_profile_deleted"

A Haijun Code agent proxy profile was deleted, removing its policy from everything it was bound to.

• "ccr_agent_proxy_profile_unbound"

A Haijun Code agent proxy profile was unbound from a scope, removing its policy from Haijun Code sessions in that scope.

• "ccr_agent_proxy_profile_updated"

A Haijun Code agent proxy profile's configuration was updated.

• "ccr_agent_proxy_provisioning_credential_rejected"

An organization owner rejected a credential that a teammate submitted via an agent proxy provisioning link: the credential and its disabled rule were deleted and the link was revoked. The actor is the owner; the submitter is recorded for attribution.

• "ccr_agent_proxy_provisioning_link_enabled"

An organization owner enabled a credential that a teammate submitted via an agent proxy provisioning link: the disabled rule created at submission was switched to enforce, so the credential now takes traffic. The actor is the owner; the submitter is the actor on the prior ccr_agent_proxy_provisioning_link_submitted event.

• "ccr_agent_proxy_provisioning_link_generated"

An organization owner generated a one-time agent proxy credential provisioning link so a teammate can submit a credential into the target agent proxy profile without holding the owner role.

• "ccr_agent_proxy_provisioning_link_revoked"

An organization owner revoked an unfilled agent proxy provisioning link.

• "ccr_agent_proxy_provisioning_link_submitted"

A teammate submitted a credential via an agent proxy provisioning link. The credential and a disabled rule are created; the credential takes traffic only after an organization owner enables the submitted credential. This event records the link-mediated lifecycle; the credential itself additionally emits ccr_agent_proxy_credential_created.

• "ccr_agent_proxy_rule_created"

An agent proxy rule was created. A rule decides what happens to a session's outbound requests that match it.

• "ccr_agent_proxy_rule_deleted"

An agent proxy rule was deleted.

• "ccr_agent_proxy_rule_updated"

An agent proxy rule was updated. An update replaces everything the rule matches and does, so the host name patterns here are the rule's complete set after the update.

• "ccr_agent_slack_access_scope_created"

A Haijun Code agent was granted access to read or write in an additional Slack channel beyond the one it is assigned to.

• "ccr_agent_slack_access_scope_deleted"

A Haijun Code agent's access to an additional Slack channel was revoked.

• "ccr_agent_slack_binding_created"

A Haijun Code agent was assigned to a Slack channel or workspace as its dedicated agent.

• "ccr_agent_slack_binding_deleted"

A Haijun Code agent's assignment to a Slack channel or workspace was removed.

• "ccr_agent_updated"

A Haijun Code agent's configuration was updated. Also emitted with updated_fields ["is_virtual"] alone when an auto-provisioned agent is promoted to a configured one, whether by an update request targeting it or by binding an agent proxy profile to it.

• "ccr_channel_manager_added"

An org owner/admin assigned an organization member to manage the Haijun-in-Slack configuration of one Slack channel.

• "ccr_channel_manager_removed"

An org owner/admin removed an organization member's assignment to manage the Haijun-in-Slack configuration of one Slack channel.

• "ccr_role_channel_assignment_deleted"

CcrRoleChannelAssignmentDeleted is emitted when an org owner/admin removes an RBAC role's channel assignment row (the role reverts to granting zero channels).

• "ccr_role_channel_assignment_updated"

CcrRoleChannelAssignmentUpdated is emitted when an org owner/admin sets or replaces the list of Slack channels an RBAC role's holders may configure via the delegated Haijun-in-Slack channel-manage surface.

• "ccr_session_created"

A Haijun Code session was created. A session is one coding interaction with Haijun.

• "ccr_session_deleted"

A Haijun Code session was deleted.

• "ccr_session_updated"

A Haijun Code session's settings were updated.

• "ccr_slack_channel_joined"

Haijun's Slack app joined a public Slack channel at an organization administrator's request.

• "haijun_artifact_access_failed"

An attempt to access an artifact failed.

• "haijun_artifact_commented"

Comment activity on a published artifact: a comment was added, a thread's resolved state was changed, or a thread was deleted. The actor is the user who performed the action; the comment text itself is stored with the artifact and is not part of this record.

• "haijun_artifact_comments_viewed"

An artifact's comments were viewed.

• "haijun_artifact_created"

An artifact was created.

• "haijun_artifact_duplicated"

A user duplicated an artifact they could view into a new artifact that they own. The actor is the user who created the copy; the source artifact is not modified.

• "haijun_artifact_external_sharing_permission_updated"

An organization admin allowed one artifact to be shared outside the organization by link while the organization-wide external sharing setting was off, or revoked that permission.

• "haijun_artifact_invite_accepted"

Someone outside the organization signed in with a verified account for the invited address and accepted an invitation to an artifact, and can now open it; recorded in the artifact owner's organization. The person who accepted is identified by invitee_email and invitee_user_id.

• "haijun_artifact_invite_created"

A member invited (or re-invited) an email address outside the organization to an artifact; recorded in the artifact owner's organization with the inviting member as the actor.

• "haijun_artifact_invite_revoked"

A member withdrew an invitation to an artifact for someone outside the organization, removing any access that invitation had granted; recorded in the artifact owner's organization with that member as the actor.

• "haijun_artifact_invite_role_updated"

A member changed the access level of an email invitation to an artifact for someone outside the organization, whether the invitation was still pending or had been accepted; recorded in the artifact owner's organization with that member as the actor.

• "haijun_artifact_published"

A new version of an artifact was published — for an artifact created in a chat this is the action that made it publicly viewable; for an artifact created outside a chat it is recorded when the artifact is saved, including saves of private artifacts, except that automatic saves made while a person keeps editing may be recorded periodically for that person rather than once per save; changes to who can access the artifact are recorded separately as haijun_artifact_sharing_updated.

• "haijun_artifact_sharing_updated"

An artifact's sharing settings were updated.

• "haijun_artifact_viewed"

An artifact was viewed.

• "haijun_chat_access_failed"

A user was denied access to a Haijun.ai chat conversation.

• "haijun_chat_created"

User created a chat.

• "haijun_chat_deleted"

A user deleted a Haijun.ai chat conversation.

• "haijun_chat_deletion_failed"

A request to delete a Haijun.ai chat conversation failed.

• "haijun_chat_settings_updated"

User updated the settings for a conversation.

• "haijun_chat_snapshot_created"

User created/shared a chat snapshot.

• "haijun_chat_snapshot_deleted"

User deleted/unshared a chat snapshot.

• "haijun_chat_snapshot_viewed"

User viewed a chat snapshot (authenticated or public/unauthenticated).

• "haijun_chat_sync_source_created"

A sync source was connected for syncing external content into Haijun chats.

• "haijun_chat_sync_source_deleted"

A sync source was disconnected from Haijun chats.

• "haijun_chat_sync_source_updated"

A Haijun chat sync source's configuration was updated.

• "haijun_chat_updated"

User updated the chat metadata (e.g name, model).

• "haijun_chat_viewed"

A user viewed a Haijun.ai chat conversation.

• "haijun_code_credential_revoked"

A Haijun Code credential (runner pool key, runner token, or session token) was revoked. The credential itself is never recorded.

• "haijun_code_review_config_updated"

Haijun Code Review configuration was enabled/disabled for an org.

• "haijun_code_review_repository_added"

A repository was added to org-level Haijun Code Review configuration.

• "haijun_code_review_repository_removed"

A repository was removed from org-level Haijun Code Review configuration.

• "haijun_code_review_repository_updated"

A Haijun Code Review repository configuration was updated.

• "haijun_code_runner_deleted"

A self-hosted runner was forcibly removed from its pool. Sessions assigned to the runner were returned to the pool queue, unless a session had already been requeued repeatedly, in which case it was marked stuck instead of being requeued again.

• "haijun_code_runner_pool_created"

A self-hosted runner pool for Haijun Code was created.

• "haijun_code_runner_pool_deleted"

A self-hosted runner pool was deleted.

• "haijun_code_runner_pool_secret_minted"

A registration key for a self-hosted runner pool was minted. Runners present this key to join the pool. The key itself is never recorded.

• "haijun_code_runner_pool_session_queue_updated"

An admin changed a session's position in its self-hosted runner pool's queue: requeued it onto a different runner, dismissed it from the queue, or re-admitted it for another runner provisioning attempt.

• "haijun_code_runner_pool_updated"

A self-hosted runner pool's settings were updated.

• "haijun_code_security_center_config_updated"

Haijun Code Security Center scanning was enabled/disabled for an org.

• "haijun_code_security_scan_cancelled"

In-flight Haijun Code Security scans were cancelled for a project.

• "haijun_code_security_scan_created"

A Haijun Code Security scan was started.

• "haijun_code_security_scan_project_member_updated"

A person's access to a Haijun Code Security scan project was granted, changed, or revoked.

• "haijun_code_security_scan_project_updated"

A Haijun Code Security scan project was archived, unarchived, created, or migrated to a new product experience.

• "haijun_code_security_scan_project_visibility_updated"

A Haijun Code Security scan project was shared with the organization or made private.

• "haijun_code_security_scan_run_updated"

A single Haijun Code Security scan run was archived, unarchived, or resumed after a billing pause.

• "haijun_code_security_scan_schedule_deleted"

A recurring scan schedule was deleted for a Haijun Code Security project.

• "haijun_code_security_scan_schedule_updated"

A recurring scan schedule was set or replaced for a Haijun Code Security project.

• "haijun_code_security_vulnerability_deleted"

A Haijun Code Security vulnerability finding was permanently deleted.

• "haijun_code_security_vulnerability_fix_session_created"

A Haijun Code remediation session was created for a Haijun Code Security vulnerability finding.

• "haijun_code_security_vulnerability_updated"

A Haijun Code Security vulnerability finding was dismissed, restored, marked fixed, or reopened.

• "haijun_code_security_webhook_created"

A Haijun Code Security outbound webhook was created.

• "haijun_code_security_webhook_deleted"

A Haijun Code Security outbound webhook was deleted.

• "haijun_code_security_webhook_secret_updated"

The HMAC signing secret for a Haijun Code Security webhook was rotated.

• "haijun_code_security_webhook_updated"

A Haijun Code Security outbound webhook was updated.

• "haijun_code_team_memory_acl_updated"

An RBAC group was added to or removed from the Haijun Code team-memory ACL.

• "haijun_code_team_memory_updated"

Haijun Code team memory shared with the organization was updated.

• "haijun_code_team_onboarding_guide_updated"

A Haijun Code team onboarding guide was created, updated, or deleted.

• "haijun_code_user_marketplaces_updated"

A user's Haijun Code plugin marketplace selections were updated on Juglow servers.

• "haijun_code_user_memory_updated"

A user's synced private Haijun Code memory was updated or deleted on Juglow servers.

• "haijun_code_user_plugins_updated"

A user's Haijun Code plugin selections — which plugins are installed and enabled — were updated on Juglow servers.

• "haijun_code_user_settings_updated"

A user's synced Haijun Code settings were updated or deleted on Juglow servers.

• "haijun_command_created"

Command was created.

• "haijun_command_deleted"

Command was deleted.

• "haijun_command_replaced"

Command was replaced.

• "haijun_enterprise_upgrade_credit_updated"

An organization admin cancelled, or turned back on, the monthly usage credit the organization receives for upgrading from the Team plan to the Enterprise plan, together with the recurring monthly charge that accompanies it.

• "haijun_file_access_failed"

A user was denied access to a file in Haijun.ai.

• "haijun_file_deleted"

A file was deleted.

• "haijun_file_exported"

A file was exported from Haijun to an external storage destination.

• "haijun_file_uploaded"

A file was uploaded.

• "haijun_file_viewed"

A user viewed a file in Haijun.ai.

• "haijun_gdrive_integration_created"

A Google Drive integration was enabled for the organization.

• "haijun_gdrive_integration_deleted"

A Google Drive integration was disabled for the organization.

• "haijun_gdrive_integration_updated"

A Google Drive integration's configuration was updated.

• "haijun_github_integration_created"

A GitHub integration was enabled for the organization.

• "haijun_github_integration_deleted"

A GitHub integration was disabled for the organization.

• "haijun_github_integration_updated"

A GitHub integration's configuration was updated.

• "haijun_organization_settings_updated"

Organization settings were updated.

• "haijun_plugin_archive_accessed"

A version archive of a member-owned plugin, containing that member's own files, was downloaded.

• "haijun_plugin_created"

Plugin was created.

• "haijun_plugin_deleted"

Plugin was deleted.

• "haijun_plugin_disabled"

User disabled a plugin for their account.

• "haijun_plugin_enabled"

User enabled a plugin for their account.

• "haijun_plugin_replaced"

Plugin was replaced.

• "haijun_plugin_security_scan_completed"

A security scan of a plugin completed and produced a verdict.

• "haijun_plugin_updated"

Plugin was updated.

• "haijun_project_archived"

A Haijun project was archived.

• "haijun_project_created"

A Haijun project was created.

• "haijun_project_deleted"

A Haijun project was deleted.

• "haijun_project_document_access_failed"

An attempt to access a document in a Haijun project failed.

• "haijun_project_document_bulk_deletion_audit_truncated"

A bulk request to delete documents from a Haijun project failed with more documents requested than were individually recorded in the audit log.

• "haijun_project_document_deleted"

A document was deleted from a Haijun project.

• "haijun_project_document_deletion_failed"

A request to delete a document from a Haijun project failed.

• "haijun_project_document_updated"

The content of a document in a Haijun project was replaced in place.

• "haijun_project_document_uploaded"

A document was uploaded to a Haijun project.

• "haijun_project_document_viewed"

A document in a Haijun project was viewed.

• "haijun_project_file_access_failed"

An attempt to access a file in a Haijun project failed.

• "haijun_project_file_bulk_deletion_audit_truncated"

A bulk request to delete files from a Haijun project failed with more files requested than were individually recorded in the audit log.

• "haijun_project_file_deleted"

A file was deleted from a Haijun project.

• "haijun_project_file_deletion_failed"

A request to delete a file from a Haijun project failed.

• "haijun_project_file_uploaded"

A file was uploaded to a Haijun project.

• "haijun_project_reported"

A Haijun project was reported.

• "haijun_project_sharing_updated"

A Haijun project's sharing settings were updated.

• "haijun_project_sync_source_created"

A sync source was connected to a Haijun project's knowledge base.

• "haijun_project_sync_source_deleted"

A sync source was disconnected from a Haijun project's knowledge base.

• "haijun_project_sync_source_updated"

A Haijun project sync source's configuration was updated.

• "haijun_project_viewed"

A Haijun project was viewed.

• "haijun_published_artifact_deleted"

A published artifact was deleted or unpublished — by its creator, by an organization admin, or by Juglow (for example, when it was removed for a policy violation).

• "haijun_pubsec_identity_configured"

SAML IdP configuration updated for a public sector organization.

• "haijun_skill_created"

Track was created.

• "haijun_skill_deleted"

Track was deleted.

• "haijun_skill_disabled"

User disabled a track for their account.

• "haijun_skill_enabled"

User enabled a track for their account.

• "haijun_skill_replaced"

Track was replaced.

• "haijun_skill_security_scan_completed"

A security scan of a track completed and produced a verdict.

• "haijun_user_role_updated"

A user's role within the organization was changed, or the user was added to or removed from the organization.

• "haijun_user_seat_tier_updated"

An organization member's seat tier was changed. A null previous_seat_tier means the member previously had no seat assigned; a null current_seat_tier means the seat was removed.

• "haijun_user_settings_updated"

User updated their personal settings.

• "cli_plugin_exec_policy_updated"

Admin set or cleared the per-op permission ceiling for a plugin CLI.

• "compliance_api_accessed"

Logging event auto-generated for each compliance API request.

• "cowork_session_updated"

A Cowork session was updated.

• "design_project_artifact_published"

A Haijun Design project's content was published as a haijun.ai artifact, making a snapshot of one of its files viewable outside the project's sharing settings.

• "design_project_created"

A Haijun Design project was created.

• "design_project_deleted"

A Haijun Design project was deleted.

• "design_project_member_added"

A member was granted access to a Haijun Design project.

• "design_project_member_removed"

A member's access to a Haijun Design project was revoked.

• "design_project_member_role_updated"

A Haijun Design project member's role was changed.

• "design_project_published"

A Haijun Design template or design system was published, making it discoverable by everyone in its organization.

• "design_project_sharing_updated"

A Haijun Design project's link-sharing settings were changed — who the project's link works for, and what people opening it through the link may do. Access granted to individual members is reported separately (see design_project_member_added).

• "design_project_unpublished"

A Haijun Design template or design system was unpublished, removing it from its organization's shared gallery.

• "design_project_updated"

A Haijun Design project's metadata was updated.

• "design_project_version_restored"

A Haijun Design project's working tree was rolled back to a previously saved version, replacing its current files with that version's files.

• "design_project_viewed"

A Haijun Design project's content was read. The surface field records which kind of read — a project open, a full-content read, a single-file read, a saved-version read, or an export request. The actor is the reader.

This activity type is retired: project content reads are no longer recorded. Events of this type may still appear in feeds for reads that occurred while it was active.

• "desktop_extension_allowlisted"

A desktop extension was added to an org's allowlist.

• "desktop_extension_blocklisted"

A desktop extension was added to the global blocklist.

• "desktop_extension_deleted"

A desktop extension was deleted, either globally by an admin or org-scoped by an org owner.

• "desktop_extension_removed_from_allowlist"

A desktop extension was removed from an org's allowlist.

• "desktop_extension_unblocked"

A desktop extension was removed from the global blocklist.

• "desktop_extension_uploaded"

A desktop extension was uploaded, either globally by an admin or org-scoped by an org owner.

• "desktop_extension_version_uploaded"

A new version of an existing org-owned desktop extension was uploaded.

• "domain_claim_initiated"

Domain capture claim initiated over personal accounts on verified domains.

• "end_user_invite_requested"

Non-admin member submitted an invite request for a new org member.

• "extra_usage_billing_enabled"

Usage credit billing was enabled for an organization.

• "extra_usage_credit_granted"

A promotional usage credit grant was claimed.

• "extra_usage_spend_limit_created"

Usage credit spend limit was created.

• "extra_usage_spend_limit_deleted"

Usage credit spend limit was deleted.

• "extra_usage_spend_limit_increase_request_approved"

A usage credit spend limit increase request was approved.

• "extra_usage_spend_limit_increase_request_denied"

A usage credit spend limit increase request was denied.

• "extra_usage_spend_limit_updated"

Usage credit spend limit was updated.

• "ghe_configuration_created"

Admin created a GHE configuration.

• "ghe_configuration_deleted"

Admin deleted a GHE configuration.

• "ghe_configuration_updated"

Admin updated a GHE configuration. Previous/new field pairs are recorded only for settings that changed in the update; secret credentials are never recorded, only whether they were replaced.

• "ghe_user_connected"

User connected to a GHE instance.

• "ghe_user_disconnected"

User disconnected from a GHE instance.

• "ghe_webhook_signature_invalid"

Webhook signature validation failed.

• "github_app_installation_linked"

An installation of the Haijun GitHub App (a GitHub organization or user account where the App is installed) was linked to the organization, letting the organization's Haijun Code features act on that GitHub account's repositories.

• "github_app_installation_unlinked"

An installation of the Haijun GitHub App was unlinked from the organization, so the organization's Haijun Code features can no longer act on that GitHub account's repositories through it.

• "github_token_import"

A user attempted to import a personal GitHub access token for use with Haijun Code. The result field indicates the outcome of the import (imported, rejected, or failed).

• "gitlab_configuration_created"

An organization admin created a self-managed GitLab configuration for syncing plugin marketplaces.

• "gitlab_configuration_deleted"

An organization admin deleted a self-managed GitLab configuration.

• "gitlab_configuration_updated"

An organization admin updated a self-managed GitLab configuration. Previous/new field pairs are recorded only for settings that changed in the update; secret credentials are never recorded, only whether they were replaced.

• "group_created"

A group was created (RBAC admin or SCIM provisioning).

• "group_deleted"

A group was deleted (RBAC admin or SCIM provisioning).

• "group_list_viewed"

Admin viewed the list of RBAC groups.

• "group_member_added"

One or more members were added to a group.

• "group_member_addition_failed"

A request to add members to a group failed. Some of the requested members may have been added before the failure.

• "group_member_list_viewed"

Admin viewed the members of an RBAC group.

• "group_member_removal_failed"

A request to remove members from a group failed. Some of the requested members may have been removed before the failure.

• "group_member_removed"

One or more members were removed from a group.

• "group_project_shares_revoked"

An RBAC group's project shares in one organization were revoked in bulk.

• "group_skill_shares_revoked"

An RBAC group's track shares in one organization were revoked in bulk.

• "group_updated"

A group was updated (RBAC admin or SCIM provisioning).

• "group_viewed"

A group was viewed.

• "group_visibility_updated"

An RBAC group's visibility policy was updated.

• "inference_hooks_circuit_breaker_tripped"

The organization's Inference hooks circuit breaker tripped automatically: calls to the organization's Inference hooks endpoint crossed a failure threshold, and inspection was suspended to protect live traffic. While tripped, requests are handled according to the organization's failure handling setting — allowed through uninspected (fail open) or rejected (fail closed) — and no per-request Inference hooks activities are recorded. The tripped state persists until an administrator re-enables Inference hooks inspection (or explicitly resets the circuit breaker).

• "inference_hooks_config_deleted"

Inference hooks configuration was removed for the organization.

• "inference_hooks_config_updated"

Inference hooks configuration was created or updated for the organization.

• "inference_hooks_request_denied"

Inference hooks inspection denied a request. The request was blocked and no model response was produced.

• "inference_hooks_request_failed_open"

A request proceeded without Inference hooks inspection because a verdict could not be obtained and the organization's Inference hooks configuration is set to fail open.

• "inference_hooks_signing_secret_generated"

A request signing secret was generated for the organization's Inference hooks configuration.

• "integration_user_connected"

User connected to an integration.

• "integration_user_disconnected"

User disconnected from an integration.

• "invoice_collection_method_updated"

Invoice collection method was changed.

• "lti_launch_initiated"

LTI launch was initiated.

• "lti_launch_success"

LTI launch completed successfully.

• "lti_platform_created"

Juglow staff created an LTI platform integration on behalf of an org.

• "lti_platform_updated"

Juglow staff updated an LTI platform integration on behalf of an org.

• "magic_link_login_failed"

A magic link sign-in attempt failed.

• "magic_link_login_initiated"

A user requested a magic link sign-in email.

• "magic_link_login_succeeded"

A user successfully signed in with a magic link email.

• "managed_organization_setup_completed"

Managed (AWS Marketplace) organization setup was completed.

• "marketplace_created"

Admin created an organization marketplace.

• "marketplace_deleted"

Admin deleted an organization marketplace.

• "marketplace_updated"

Admin updated an organization marketplace.

• "marketplace_webhook_deleted"

Admin removed the GitHub push webhook for a marketplace.

• "marketplace_webhook_provisioned"

Admin provisioned a GitHub push webhook for a marketplace.

• "mcp_directory_server_published"

The organization published its approved MCP directory listing.

• "mcp_server_created"

An MCP server was added to the organization.

• "mcp_server_deleted"

An MCP server was removed from the organization.

• "mcp_server_managed_auth_token_exchanged"

A user attempted to obtain an access token for an MCP server via enterprise managed authorization. This event reports the outcomes of attempted token exchanges. Repeated failures with the same cause may be reported once until the cause changes, and requests refused before a token exchange is attempted are not reported, except the "connector_scope_not_granted" and "identity_assertion_refused" failures described under error_type.

• "mcp_server_managed_auth_updated"

An MCP server's enterprise managed authorization settings were set, changed, or cleared, including when they were supplied while the server was being added or edited. Fields without a "previous_" prefix describe the settings after the change and are null when the server has no managed authorization settings afterwards; "previous_" fields describe the settings before the change and are null when the server had none before (always the case for a newly added server).

• "mcp_server_updated"

An MCP server's configuration was updated.

• "mcp_tool_policy_updated"

The permission restriction for an MCP tool was set or cleared.

• "org_analytics_api_capability_updated"

Organization analytics_api capability was enabled or disabled.

• "org_bulk_delete_initiated"

Organization bulk deletion was initiated.

• "org_capability_grant_added"

A capability grant was added to a workspace or role.

• "org_capability_grant_removed"

A capability grant was removed from a workspace or role.

• "org_haijun_code_data_sharing_disabled"

Organization Haijun Code data sharing was disabled.

• "org_haijun_code_data_sharing_enabled"

Organization Haijun Code data sharing was enabled.

• "org_haijun_code_desktop_disabled"

Organization Haijun Code Desktop was disabled.

• "org_haijun_code_desktop_enabled"

Organization Haijun Code Desktop was enabled.

• "org_haijun_code_zero_data_retention_disabled"

A primary owner disabled zero data retention for Haijun Code, so Haijun Code content is retained according to the organization's data retention settings.

• "org_compliance_api_settings_updated"

Organization compliance API settings were updated.

• "org_connector_domain_guard_updated"

Enterprise admin changed whether connectors are restricted to verified domains.

• "org_cowork_act_without_asking_mode_disabled"

The "Act without asking" mode in Cowork was disabled for the organization, so members can no longer let Haijun act without asking for approval.

• "org_cowork_act_without_asking_mode_enabled"

The "Act without asking" mode in Cowork was enabled for the organization, allowing members to let Haijun act without asking for approval.

• "org_cowork_agent_disabled"

Organization Cowork Agent was disabled.

• "org_cowork_agent_enabled"

Organization Cowork Agent was enabled.

• "org_cowork_auto_mode_disabled"

The "Auto" permission mode in Cowork was disabled for the organization, so members can no longer let Haijun approve its own actions after a safety check.

• "org_cowork_auto_mode_enabled"

The "Auto" permission mode in Cowork was enabled for the organization, allowing members to let Haijun approve its own actions after a safety check.

• "org_cowork_browser_pane_disabled"

The in-app browser in Cowork was disabled for the organization, so Haijun can no longer open or use websites in a browser pane during members' Cowork sessions.

• "org_cowork_browser_pane_enabled"

The in-app browser in Cowork was enabled for the organization, letting Haijun open and use websites in a browser pane during members' Cowork sessions.

• "org_cowork_disabled"

Organization cowork was disabled.

• "org_cowork_enabled"

Organization cowork was enabled.

• "org_cowork_mcp_always_allow_disabled"

The "Always allow" option for connector tools in Cowork was disabled for the organization, so each use of a connector tool that can make changes requires approval. Read-only connector tools are not affected by this setting.

• "org_cowork_mcp_always_allow_enabled"

The "Always allow" option for connector tools in Cowork was enabled for the organization, letting members approve a connector tool that can make changes once and allow its later uses automatically. Read-only connector tools are not affected by this setting.

• "org_cowork_otlp_settings_updated"

The organization's Cowork OpenTelemetry monitoring export settings were updated.

• "org_cowork_remote_disabled"

Running Cowork in the cloud was disabled for the organization, so members can no longer run Cowork sessions in Juglow-hosted remote environments.

• "org_cowork_remote_enabled"

Running Cowork in the cloud was enabled for the organization, allowing members to run Cowork sessions in Juglow-hosted remote environments.

• "org_creation_blocked"

Organization creation was blocked.

• "org_data_export_accessed"

Organization data export file was accessed/downloaded via signed URL.

• "org_data_export_completed"

Organization data export was completed.

• "org_data_export_started"

Organization data export was started.

• "org_data_residency_updated"

The organization's inference data residency settings were updated.

• "org_deleted_via_bulk"

Organization was deleted via bulk operation.

• "org_deletion_requested"

Organization deletion was requested.

• "org_directory_resync_completed"

Organization directory resync completed successfully.

• "org_directory_resync_failed"

Organization directory resync failed.

• "org_directory_resync_started"

Organization directory resync was started asynchronously.

• "org_directory_sync_activated"

Organization directory sync was activated.

• "org_directory_sync_add_initiated"

Organization directory sync setup was initiated.

• "org_directory_sync_deleted"

Organization directory sync was deleted.

• "org_discoverability_disabled"

Admin disabled organization discoverability.

• "org_discoverability_enabled"

Admin enabled organization discoverability.

• "org_discoverability_settings_updated"

Admin updated organization discoverability settings.

• "org_domain_add_initiated"

Organization domain verification was initiated.

• "org_domain_removed"

Organization domain was removed.

• "org_domain_verified"

Organization domain was verified.

• "org_external_key_created"

A CMEK external key config was created.

• "org_external_key_deleted"

A CMEK external key config was deleted.

• "org_external_key_updated"

A CMEK external key config was updated.

• "org_external_key_validated"

A CMEK external key config was validated against the customer's KMS.

• "org_hipaa_self_serve_enabled"

A primary owner click-accepted the BAA and enabled HIPAA protections for the organization via the self-serve flow.

• "org_invite_link_disabled"

Organization invite link was disabled.

• "org_invite_link_generated"

Organization invite link was generated.

• "org_invite_link_regenerated"

Organization invite link was regenerated (previous link invalidated).

• "org_invite_viewed"

An organization invite was viewed.

• "org_invites_listed"

Organization invites were listed.

• "org_ip_restriction_created"

Organization IP restriction was created.

• "org_ip_restriction_deleted"

Organization IP restriction was deleted.

• "org_ip_restriction_updated"

Organization IP restriction was updated.

• "org_join_proposal_decided"

Approve or reject decision on a parent-org join proposal.

• "org_join_request_approved"

Admin approved a join request.

• "org_join_request_created"

User requested to join an organization.

• "org_join_request_dismissed"

Admin dismissed a join request.

• "org_join_request_instant_approved"

Join request was instantly approved.

• "org_join_requests_bulk_dismissed"

Admin bulk-dismissed join requests.

• "org_magic_link_second_factor_toggled"

Organization magic link second factor was toggled.

• "org_member_invites_disabled"

Admin disabled member invites for the organization.

• "org_member_invites_enabled"

Admin enabled member invites for the organization.

• "org_members_exported"

Organization members list was exported as CSV.

• "org_model_default_updated"

An organization or role default model setting was changed by an administrator.

• "org_parent_join_proposal_created"

Organization parent join proposal was created.

• "org_parent_search_performed"

Organization parent search was performed.

• "org_sso_add_initiated"

Organization SSO setup was initiated.

• "org_sso_connection_activated"

Organization SSO connection was activated.

• "org_sso_connection_deactivated"

Organization SSO connection was deactivated.

• "org_sso_connection_deleted"

Organization SSO connection was deleted.

• "org_sso_group_role_mappings_updated"

Organization SSO group role mappings were updated.

• "org_sso_provisioning_mode_changed"

Organization SSO provisioning mode was changed.

• "org_sso_scim_welcome_email_toggled"

Organization SCIM-provisioned welcome email was toggled.

• "org_sso_seat_tier_assignment_toggled"

Organization SSO seat tier assignment was toggled.

• "org_sso_seat_tier_mappings_updated"

Organization SSO seat tier mappings were updated.

• "org_sso_toggled"

Organization SSO was toggled on or off.

• "org_sync_deleting_synchronized_files_started"

Organization started deleting synchronized files.

• "org_sync_synchronized_files_deleted"

Organization synchronized files were deleted.

• "org_taint_added"

A taint was added to an organization.

• "org_taint_removed"

A taint was removed from an organization.

• "org_user_deleted"

User was removed from organization.

• "org_user_invite_accepted"

Organization user invite was accepted.

• "org_user_invite_deleted"

Organization user invite was deleted.

• "org_user_invite_re_sent"

Organization user invite was re-sent.

• "org_user_invite_rejected"

Organization user invite was rejected.

• "org_user_invite_sent"

Organization user invite was sent.

• "org_user_left"

User removed themselves from organization.

• "org_user_shares_retained"

A member left or was removed from the organization while projects, tracks, plugins, or chats they had shared were still shared, and those shares were kept.

• "org_user_trusted_devices_revoked"

An organization admin revoked a member's trusted devices and signed the member out of all active sessions.

• "org_user_viewed"

An organization user was viewed.

• "org_users_listed"

Organization users were listed.

• "org_work_across_apps_disabled"

The organization's "Let Haijun work across apps" setting was turned off.

• "org_work_across_apps_enabled"

The organization's "Let Haijun work across apps" setting was turned on.

• "organization_address_updated"

The organization's billing or shipping address was updated.

• "organization_icon_deleted"

Organization's custom icon deleted.

• "organization_icon_updated"

Organization's custom icon uploaded or replaced.

• "owned_projects_access_restored"

Access to owned projects was restored.

• "payment_method_updated"

The organization's default payment method was updated.

• "pending_share_created"

A pending share of a project or track was created for an email address that is not yet an organization member.

• "pending_share_revoked"

A pending share of a project or track was revoked before the invitee joined the organization.

• "phone_code_sent"

User requested a phone verification code.

• "phone_code_verified"

User successfully verified their phone code.

• "platform_agent_archived"

An agent was archived on the API platform.

• "platform_agent_created"

An agent was created on the API platform.

• "platform_agent_deleted"

An agent was deleted from the API platform.

• "platform_agent_deployment_archived"

An agent deployment was archived on the API platform.

• "platform_agent_deployment_created"

An agent deployment was created on the API platform.

• "platform_agent_deployment_deleted"

An agent deployment was deleted from the API platform.

• "platform_agent_deployment_paused"

An agent deployment was paused on the API platform.

• "platform_agent_deployment_run_triggered"

An agent deployment was run on demand on the API platform.

• "platform_agent_deployment_unpaused"

An agent deployment was resumed on the API platform.

• "platform_agent_deployment_updated"

An agent deployment was updated on the API platform.

• "platform_agent_session_archived"

An agent session was archived on the API platform.

• "platform_agent_session_created"

An agent session was created on the API platform.

• "platform_agent_session_deleted"

An agent session was deleted from the API platform.

• "platform_agent_session_resource_added"

A resource was attached to an agent session.

• "platform_agent_session_resource_deleted"

A resource attached to an agent session was removed.

• "platform_agent_session_resource_updated"

A resource attached to an agent session was updated.

• "platform_agent_session_thread_archived"

A thread within an agent session was archived.

• "platform_agent_session_updated"

An agent session was updated on the API platform.

• "platform_agent_updated"

An agent was updated on the API platform.

• "platform_api_key_created"

An API key was created.

• "platform_api_key_updated"

An API key was updated.

• "platform_app_attest_authentication"

An attested mobile device attempted to exchange an Apple App Attest assertion for Juglow API credentials.

• "platform_billing_upgraded_to_prepaid"

The organization's API billing was upgraded to the prepaid plan.

• "platform_clearance_workspace_program_request_cleared"

A workspace's clearance program assignment was removed.

• "platform_clearance_workspace_program_request_set"

A workspace's clearance program assignment was created or updated.

• "platform_cost_report_viewed"

The cost report was viewed.

• "platform_dream_archived"

A Dream (asynchronous memory-consolidation job) was archived.

• "platform_dream_cancelled"

A Dream (asynchronous memory-consolidation job) was cancelled before it completed.

• "platform_dream_created"

A Dream (asynchronous memory-consolidation job) was created.

• "platform_federated_authentication"

A federated workload identity attempted to exchange an OIDC token for Juglow API credentials.

• "platform_federation_issuer_archived"

An OIDC federation issuer was archived.

• "platform_federation_issuer_created"

An OIDC federation issuer was created, registering an external identity provider that federation rules can trust for workload authentication.

• "platform_federation_issuer_updated"

An OIDC federation issuer was updated.

• "platform_federation_rule_archived"

An OIDC federation rule was archived.

• "platform_federation_rule_created"

An OIDC federation rule was created, allowing tokens from a federation issuer to authenticate as a service account or user. Rules may additionally match on token claims or a condition expression, which are not included in this event.

• "platform_federation_rule_updated"

An OIDC federation rule was updated.

• "platform_federation_rule_workspace_added"

A federation rule was enabled for a workspace.

• "platform_federation_rule_workspace_removed"

A federation rule was disabled for a workspace.

• "platform_file_content_downloaded"

Activity logged when file content is downloaded via GET /v1/files/{file_id}/content.

• "platform_file_deleted"

Activity logged when a file is deleted via DELETE /v1/files/{file_id}.

• "platform_file_uploaded"

Activity logged when a file is uploaded via POST /v1/files.

• "platform_memory_created"

An agent memory document was created.

• "platform_memory_deleted"

An agent memory document was deleted.

• "platform_memory_store_archived"

An agent memory store was archived. Archived stores reject new memory writes and cannot be attached to new sessions; deletion and redaction remain permitted for privacy scrubbing.

• "platform_memory_store_created"

An agent memory store was created.

• "platform_memory_store_deleted"

An agent memory store was deleted. Memory content removal may complete asynchronously for very large stores.

• "platform_memory_store_updated"

An agent memory store's name, description, or metadata was updated.

• "platform_memory_updated"

An agent memory document's content or path was updated.

• "platform_memory_version_redacted"

A historical version of an agent memory document was redacted. Redaction scrubs the stored content of a specific version while preserving the version's existence in the history.

• "platform_oauth_app_created"

An OAuth app was created.

• "platform_oauth_app_revoked"

An OAuth app was revoked.

• "platform_oauth_app_updated"

An OAuth app was updated.

• "platform_plugin_directory_submission_created"

A plugin directory submission was created on the API platform. A plugin directory submission is a request to list a plugin in the public plugin directory.

• "platform_plugin_directory_submission_deleted"

A plugin directory submission was deleted on the API platform.

• "platform_plugin_directory_submission_updated"

A plugin directory submission was updated on the API platform.

• "platform_service_account_archived"

A service account was archived.

• "platform_service_account_created"

A service account was created.

• "platform_service_account_updated"

A service account was updated.

• "platform_service_account_workspace_member_added"

A service account was added as a member of a workspace.

• "platform_service_account_workspace_member_removed"

A service account was removed from a workspace.

• "platform_service_account_workspace_member_updated"

A service account's workspace membership role was updated.

• "platform_signing_key_created"

Activity logged when a new request-signing key is registered for the org.

• "platform_signing_key_deleted"

Activity logged when a signing key is permanently deleted.

• "platform_signing_key_rotated"

Activity logged when an in-memory signing key is rotated.

• "platform_skill_version_content_downloaded"

The content of a track version was downloaded through the Tracks API.

• "platform_skill_version_created"

Activity logged when a track version is created via POST /v1/tracks/{skill_id}/versions.

• "platform_skill_version_deleted"

Activity logged when a track version is deleted via DELETE /v1/tracks/{skill_id}/versions/{version}.

• "platform_spend_limit_alert_emails_updated"

Spend limit alert email addresses and role targets were updated for an org.

• "platform_spend_limit_created"

An org-level fixed-dollar spend limit was created.

• "platform_spend_limit_deleted"

An org-level spend limit was removed.

• "platform_spend_limit_updated"

An org-level spend limit snooze/ignore state was changed.

• "platform_usage_report_haijun_code_viewed"

The Haijun Code usage report was viewed.

• "platform_usage_report_messages_viewed"

The messages usage report was viewed.

• "platform_workspace_archived"

A workspace was archived.

• "platform_workspace_created"

A workspace was created.

• "platform_workspace_inference_data_retention_disabled"

The zero data retention override was disabled for a workspace.

• "platform_workspace_inference_data_retention_enabled"

The zero data retention override was enabled for a workspace.

• "platform_workspace_member_added"

A member was added to a workspace.

• "platform_workspace_member_removed"

A member was removed from a workspace.

• "platform_workspace_member_updated"

A workspace member was updated.

• "platform_workspace_member_viewed"

A workspace member was viewed.

• "platform_workspace_members_listed"

Workspace members were listed.

• "platform_workspace_rate_limit_deleted"

A workspace rate limit was deleted.

• "platform_workspace_rate_limit_updated"

A workspace rate limit was created or updated.

• "platform_workspace_updated"

A workspace was updated.

• "plugin_installation_preference_updated"

An org admin changed the installation preference for a plugin.

• "prepaid_auto_recharge_disabled"

Auto-recharge was disabled for API prepaid org.

• "prepaid_auto_recharge_updated"

Auto-recharge settings were updated for API prepaid org.

• "prepaid_extra_usage_auto_reload_disabled"

Prepaid usage credit auto-reload was disabled.

• "prepaid_extra_usage_auto_reload_enabled"

Prepaid usage credit auto-reload was enabled.

• "prepaid_extra_usage_auto_reload_settings_updated"

Prepaid usage credit auto-reload settings were updated.

• "primary_owner_transferred"

Primary owner role was transferred to another org member.

• "rbac_role_assigned"

Admin assigned an RBAC custom role to a principal.

• "rbac_role_created"

Admin created an RBAC custom role.

• "rbac_role_deleted"

Admin deleted an RBAC custom role.

• "rbac_role_grant_updated"

Admin requested a capability grant for an RBAC custom role, or removed it.

Records the admin's change to the role. Whether the grant is currently in effect on the role is reported separately.

• "rbac_role_permission_added"

Admin added a permission to an RBAC custom role.

Emitted once per requested permission, including permissions the role already had, so a retried request still produces a complete audit record.

• "rbac_role_permission_removed"

Admin removed a permission from an RBAC custom role.

Emitted once per requested permission, including permissions the role already lacked, so a retried request still produces a complete audit record.

• "rbac_role_unassigned"

Admin unassigned an RBAC custom role from a principal.

• "rbac_role_updated"

Admin updated an RBAC custom role.

• "role_assignment_granted"

Role assignment was granted.

• "role_assignment_revoked"

Role assignment was revoked.

• "scim_user_created"

A SCIM user was provisioned.

• "scim_user_deleted"

A SCIM user was deleted.

• "scim_user_updated"

A SCIM user was updated.

• "scoped_api_key_deleted"

A scoped API key was deleted.

• "scoped_api_key_updated"

A scoped API key was renamed or its activation state changed.

• "seat_tier_changes_cancelled"

Scheduled seat tier downgrades were cancelled.

• "seat_tiers_purchased"

Seat tiers were purchased or upgraded on a subscription.

• "service_created"

Activity logged when an org service is explicitly created.

• "service_deleted"

Activity logged when an org service is deleted.

• "service_key_created"

Activity logged when a new org service key is created.

• "service_key_revoked"

Activity logged when an org service key is revoked.

• "session_revoked"

User revoked a specific session.

• "session_share_accessed"

Session share was accessed.

• "session_share_created"

Session share was created.

• "session_share_revoked"

Session share was revoked.

• "slack_workspace_claim_revoked"

A Slack workspace or Enterprise Grid organization was disconnected from the organization for Haijun in Slack.

• "slack_workspace_claimed"

A Slack workspace or Enterprise Grid organization was connected to the organization for Haijun in Slack.

• "social_login_succeeded"

A user successfully signed in with a social identity provider (Google, Apple, or Microsoft).

• "sso_login_failed"

An SSO sign-in attempt failed.

• "sso_login_initiated"

A user started an SSO sign-in flow.

• "sso_login_succeeded"

A user successfully signed in with SSO.

• "sso_second_factor_magic_link"

SSO second factor magic link was used.

• "step_up_authentication_failed"

An additional identity check failed.

• "step_up_authentication_succeeded"

The user completed an additional identity check to confirm a sensitive action.

• "step_up_credential_enrolled"

A user enrolled a passkey for confirming sensitive actions on their account.

• "subscription_cancellation_scheduled"

Subscription cancellation was scheduled at end of billing period.

• "subscription_quantity_updated"

Contracted subscription seat quantity was updated.

• "subscription_renewed"

A cancelled subscription was renewed.

• "subscription_resumed"

A scheduled subscription cancellation was reversed.

• "subscription_started"

A new subscription was created (Team or Enterprise).

• "subscription_upgraded"

Subscription plan was upgraded (e.g. Team to Enterprise).

• "trusted_device_credential_rotated"

The identity-verification credential of a trusted device was rotated to a new key.

• "trusted_device_enrolled"

A device was enrolled as a trusted device for the user's account. Trusted devices can be used to confirm the user's identity for sensitive actions.

• "trusted_device_revoked"

A trusted device was removed from the user's account.

• "tunnel_archived"

An MCP tunnel was archived.

• "tunnel_certificate_added"

An inner-TLS CA certificate was added to a tunnel.

• "tunnel_certificate_revoked"

An inner-TLS CA certificate was revoked from a tunnel.

• "tunnel_created"

An MCP tunnel was created.

• "tunnel_token_minted"

An OAuth bearer token for the tunnel management API was minted.

• "tunnel_token_revealed"

The Cloudflare connector secret for a tunnel was revealed to the caller.

• "tunnel_token_revoked"

An OAuth bearer token for the tunnel management API was revoked.

• "tunnel_token_rotated"

The Cloudflare connector secret for a tunnel was rotated.

tunnel_token_id is the id of the newly-issued token. The previous token is invalidated by the rotation and its id is not recorded here.

• "user_consent_recorded"

User granted a consent for a specific entity (e.g. consumer health consent for an MCP server).

• "user_consent_revoked"

User revoked a previously granted consent for a specific entity.

• "user_logged_out"

A user signed out of one or all sessions.

• "verification_evidence_submitted"

Verification evidence was submitted for an organization's verification.

• "verification_program_application_created"

An organization applied to a verification program.

• "workspace_member_spend_limit_created"

A per-member or workspace-default Haijun Code spend limit was created.

• "workspace_member_spend_limit_deleted"

A per-member or workspace-default Haijun Code spend limit was deleted.

• "workspace_member_spend_limit_updated"

A per-member Haijun Code spend limit amount was updated.

• "workspace_spend_limit_alert_emails_updated"

Spend limit alert email recipients were updated for a workspace.

• "workspace_spend_limit_created"

A workspace-level API spend limit was created.

• "workspace_spend_limit_deleted"

A workspace-level API spend limit was deleted.

• actor_ids: optional array of string

Filter activities by actor IDs (currently only user_... IDs are supported). Enumerate IDs via GET /v1/compliance/organizations/{org_uuid}/users.

• after_id: optional string

Pagination cursor for retrieving the next page of results. To paginate, pass the last_id value from the most recent response. Clients should treat this value as an opaque string and not attempt to parse or interpret its contents, as the format may change without notice.

• before_id: optional string

Pagination cursor for retrieving the previous page of results. To paginate, pass the first_id value from the most recent response. Clients should treat this value as an opaque string and not attempt to parse or interpret its contents, as the format may change without notice.

• created_at: optional object

• gt: optional string

Filter activities created after this time (RFC 3339 format)

format: date-time

• gte: optional string

Filter activities created at or after this time (RFC 3339 format)

format: date-time

• lt: optional string

Filter activities created before this time (RFC 3339 format)

format: date-time

• lte: optional string

Filter activities created at or before this time (RFC 3339 format)

format: date-time

• exclude_activity_types: optional array of "abuse_decision_received" or "account_deleted" or "admin_api_key_created" or 511 more

Exclude activities of these types. Cannot be combined with activity_types[].

• "abuse_decision_received"

An external anti-abuse service reported a consequential decision about a sign-in or sign-up attempt.

• "account_deleted"

User-initiated self-service account deletion.

• "admin_api_key_created"

An admin API key was created.

• "admin_api_key_deleted"

An admin API key was deleted.

• "admin_api_key_updated"

An admin API key was updated (renamed or activated/deactivated).

• "admin_connector_request_resolved"

Admin approved or dismissed pending member requests to enable an MCP connector.

• "admin_request_created"

Admin request created by an org member (seat upgrade, limit increase, join org, end-user invite).

• "admin_setup_checklist_step_delegated"

A step of the Haijun Enterprise admin setup checklist was delegated to a teammate — an organization member, or an email address that has not joined the organization yet — replacing any earlier delegation of that step.

• "admin_setup_checklist_step_delegation_cancelled"

The delegation of a Haijun Enterprise admin setup checklist step was cancelled.

• "age_verified"

User age was verified.

• "anonymous_mobile_login_attempted"

Anonymous mobile login was attempted.

• "api_key_created"

Activity logged when a new API key is created.

• "audit_log_export_accessed"

Audit log export file was accessed/downloaded via signed URL.

• "audit_log_export_started"

Audit log export was initiated.

• "billing_emails_updated"

The organization's billing email recipients were updated.

• "ccr_agent_created"

A Haijun Code agent was created.

• "ccr_agent_deleted"

A Haijun Code agent was deleted.

• "ccr_agent_proxy_juglow_oidc_token_exchanged"

The Haijun Code agent proxy exchanged a minted identity token for short-lived credentials in the organization's own cloud. Recorded for exchange targets only (such as "aws" and "gcp"; the "direct" target has no exchange step). One event is recorded per exchange call; a request served from the proxy's exchanged-credential cache does not exchange again and is not recorded here. Per-request detail for traffic the credentials were injected into is available in the agent proxy network events.

• "ccr_agent_proxy_juglow_oidc_token_minted"

The Haijun Code agent proxy minted a short-lived identity token for an juglow_oidc credential. One event is recorded per fresh token issuance; a request served from the proxy's short-lived token cache does not mint a new token and is not recorded here. Per-request detail for traffic the credential was injected into is available in the agent proxy network events.

• "ccr_agent_proxy_credential_created"

A Haijun Code agent proxy credential was created. Credentials hold the secrets the agent proxy injects into requests Haijun Code sessions send to approved external services; each credential belongs to an agent proxy profile. Audit events carry only credential names and settings, never the secret material itself.

• "ccr_agent_proxy_credential_deleted"

A Haijun Code agent proxy credential was deleted. Its secret material was removed and can no longer be sent to any host.

• "ccr_agent_proxy_credential_rotated"

A Haijun Code agent proxy credential's secret material was replaced. The replacement keeps the same name, profile, and allowed hosts under a new credential identifier, and everything that referenced the old credential now uses the replacement.

• "ccr_agent_proxy_credential_updated"

A Haijun Code agent proxy credential's settings were updated. Only the display name and the allowed host patterns can be updated; the secret material can only be replaced through a rotation.

• "ccr_agent_proxy_destination_deleted"

An agent proxy destination was deleted.

• "ccr_agent_proxy_network_events_listed"

A Haijun Code network activity export was accessed for the given hour.

• "ccr_agent_proxy_profile_bound"

A Haijun Code agent proxy profile was bound to a scope, applying its policy to Haijun Code sessions in that scope.

• "ccr_agent_proxy_profile_created"

A Haijun Code agent proxy profile was created. Agent proxy profiles are named, reusable bundles of access policy that administrators bind to parts of the organization.

• "ccr_agent_proxy_profile_deleted"

A Haijun Code agent proxy profile was deleted, removing its policy from everything it was bound to.

• "ccr_agent_proxy_profile_unbound"

A Haijun Code agent proxy profile was unbound from a scope, removing its policy from Haijun Code sessions in that scope.

• "ccr_agent_proxy_profile_updated"

A Haijun Code agent proxy profile's configuration was updated.

• "ccr_agent_proxy_provisioning_credential_rejected"

An organization owner rejected a credential that a teammate submitted via an agent proxy provisioning link: the credential and its disabled rule were deleted and the link was revoked. The actor is the owner; the submitter is recorded for attribution.

• "ccr_agent_proxy_provisioning_link_enabled"

An organization owner enabled a credential that a teammate submitted via an agent proxy provisioning link: the disabled rule created at submission was switched to enforce, so the credential now takes traffic. The actor is the owner; the submitter is the actor on the prior ccr_agent_proxy_provisioning_link_submitted event.

• "ccr_agent_proxy_provisioning_link_generated"

An organization owner generated a one-time agent proxy credential provisioning link so a teammate can submit a credential into the target agent proxy profile without holding the owner role.

• "ccr_agent_proxy_provisioning_link_revoked"

An organization owner revoked an unfilled agent proxy provisioning link.

• "ccr_agent_proxy_provisioning_link_submitted"

A teammate submitted a credential via an agent proxy provisioning link. The credential and a disabled rule are created; the credential takes traffic only after an organization owner enables the submitted credential. This event records the link-mediated lifecycle; the credential itself additionally emits ccr_agent_proxy_credential_created.

• "ccr_agent_proxy_rule_created"

An agent proxy rule was created. A rule decides what happens to a session's outbound requests that match it.

• "ccr_agent_proxy_rule_deleted"

An agent proxy rule was deleted.

• "ccr_agent_proxy_rule_updated"

An agent proxy rule was updated. An update replaces everything the rule matches and does, so the host name patterns here are the rule's complete set after the update.

• "ccr_agent_slack_access_scope_created"

A Haijun Code agent was granted access to read or write in an additional Slack channel beyond the one it is assigned to.

• "ccr_agent_slack_access_scope_deleted"

A Haijun Code agent's access to an additional Slack channel was revoked.

• "ccr_agent_slack_binding_created"

A Haijun Code agent was assigned to a Slack channel or workspace as its dedicated agent.

• "ccr_agent_slack_binding_deleted"

A Haijun Code agent's assignment to a Slack channel or workspace was removed.

• "ccr_agent_updated"

A Haijun Code agent's configuration was updated. Also emitted with updated_fields ["is_virtual"] alone when an auto-provisioned agent is promoted to a configured one, whether by an update request targeting it or by binding an agent proxy profile to it.

• "ccr_channel_manager_added"

An org owner/admin assigned an organization member to manage the Haijun-in-Slack configuration of one Slack channel.

• "ccr_channel_manager_removed"

An org owner/admin removed an organization member's assignment to manage the Haijun-in-Slack configuration of one Slack channel.

• "ccr_role_channel_assignment_deleted"

CcrRoleChannelAssignmentDeleted is emitted when an org owner/admin removes an RBAC role's channel assignment row (the role reverts to granting zero channels).

• "ccr_role_channel_assignment_updated"

CcrRoleChannelAssignmentUpdated is emitted when an org owner/admin sets or replaces the list of Slack channels an RBAC role's holders may configure via the delegated Haijun-in-Slack channel-manage surface.

• "ccr_session_created"

A Haijun Code session was created. A session is one coding interaction with Haijun.

• "ccr_session_deleted"

A Haijun Code session was deleted.

• "ccr_session_updated"

A Haijun Code session's settings were updated.

• "ccr_slack_channel_joined"

Haijun's Slack app joined a public Slack channel at an organization administrator's request.

• "haijun_artifact_access_failed"

An attempt to access an artifact failed.

• "haijun_artifact_commented"

Comment activity on a published artifact: a comment was added, a thread's resolved state was changed, or a thread was deleted. The actor is the user who performed the action; the comment text itself is stored with the artifact and is not part of this record.

• "haijun_artifact_comments_viewed"

An artifact's comments were viewed.

• "haijun_artifact_created"

An artifact was created.

• "haijun_artifact_duplicated"

A user duplicated an artifact they could view into a new artifact that they own. The actor is the user who created the copy; the source artifact is not modified.

• "haijun_artifact_external_sharing_permission_updated"

An organization admin allowed one artifact to be shared outside the organization by link while the organization-wide external sharing setting was off, or revoked that permission.

• "haijun_artifact_invite_accepted"

Someone outside the organization signed in with a verified account for the invited address and accepted an invitation to an artifact, and can now open it; recorded in the artifact owner's organization. The person who accepted is identified by invitee_email and invitee_user_id.

• "haijun_artifact_invite_created"

A member invited (or re-invited) an email address outside the organization to an artifact; recorded in the artifact owner's organization with the inviting member as the actor.

• "haijun_artifact_invite_revoked"

A member withdrew an invitation to an artifact for someone outside the organization, removing any access that invitation had granted; recorded in the artifact owner's organization with that member as the actor.

• "haijun_artifact_invite_role_updated"

A member changed the access level of an email invitation to an artifact for someone outside the organization, whether the invitation was still pending or had been accepted; recorded in the artifact owner's organization with that member as the actor.

• "haijun_artifact_published"

A new version of an artifact was published — for an artifact created in a chat this is the action that made it publicly viewable; for an artifact created outside a chat it is recorded when the artifact is saved, including saves of private artifacts, except that automatic saves made while a person keeps editing may be recorded periodically for that person rather than once per save; changes to who can access the artifact are recorded separately as haijun_artifact_sharing_updated.

• "haijun_artifact_sharing_updated"

An artifact's sharing settings were updated.

• "haijun_artifact_viewed"

An artifact was viewed.

• "haijun_chat_access_failed"

A user was denied access to a Haijun.ai chat conversation.

• "haijun_chat_created"

User created a chat.

• "haijun_chat_deleted"

A user deleted a Haijun.ai chat conversation.

• "haijun_chat_deletion_failed"

A request to delete a Haijun.ai chat conversation failed.

• "haijun_chat_settings_updated"

User updated the settings for a conversation.

• "haijun_chat_snapshot_created"

User created/shared a chat snapshot.

• "haijun_chat_snapshot_deleted"

User deleted/unshared a chat snapshot.

• "haijun_chat_snapshot_viewed"

User viewed a chat snapshot (authenticated or public/unauthenticated).

• "haijun_chat_sync_source_created"

A sync source was connected for syncing external content into Haijun chats.

• "haijun_chat_sync_source_deleted"

A sync source was disconnected from Haijun chats.

• "haijun_chat_sync_source_updated"

A Haijun chat sync source's configuration was updated.

• "haijun_chat_updated"

User updated the chat metadata (e.g name, model).

• "haijun_chat_viewed"

A user viewed a Haijun.ai chat conversation.

• "haijun_code_credential_revoked"

A Haijun Code credential (runner pool key, runner token, or session token) was revoked. The credential itself is never recorded.

• "haijun_code_review_config_updated"

Haijun Code Review configuration was enabled/disabled for an org.

• "haijun_code_review_repository_added"

A repository was added to org-level Haijun Code Review configuration.

• "haijun_code_review_repository_removed"

A repository was removed from org-level Haijun Code Review configuration.

• "haijun_code_review_repository_updated"

A Haijun Code Review repository configuration was updated.

• "haijun_code_runner_deleted"

A self-hosted runner was forcibly removed from its pool. Sessions assigned to the runner were returned to the pool queue, unless a session had already been requeued repeatedly, in which case it was marked stuck instead of being requeued again.

• "haijun_code_runner_pool_created"

A self-hosted runner pool for Haijun Code was created.

• "haijun_code_runner_pool_deleted"

A self-hosted runner pool was deleted.

• "haijun_code_runner_pool_secret_minted"

A registration key for a self-hosted runner pool was minted. Runners present this key to join the pool. The key itself is never recorded.

• "haijun_code_runner_pool_session_queue_updated"

An admin changed a session's position in its self-hosted runner pool's queue: requeued it onto a different runner, dismissed it from the queue, or re-admitted it for another runner provisioning attempt.

• "haijun_code_runner_pool_updated"

A self-hosted runner pool's settings were updated.

• "haijun_code_security_center_config_updated"

Haijun Code Security Center scanning was enabled/disabled for an org.

• "haijun_code_security_scan_cancelled"

In-flight Haijun Code Security scans were cancelled for a project.

• "haijun_code_security_scan_created"

A Haijun Code Security scan was started.

• "haijun_code_security_scan_project_member_updated"

A person's access to a Haijun Code Security scan project was granted, changed, or revoked.

• "haijun_code_security_scan_project_updated"

A Haijun Code Security scan project was archived, unarchived, created, or migrated to a new product experience.

• "haijun_code_security_scan_project_visibility_updated"

A Haijun Code Security scan project was shared with the organization or made private.

• "haijun_code_security_scan_run_updated"

A single Haijun Code Security scan run was archived, unarchived, or resumed after a billing pause.

• "haijun_code_security_scan_schedule_deleted"

A recurring scan schedule was deleted for a Haijun Code Security project.

• "haijun_code_security_scan_schedule_updated"

A recurring scan schedule was set or replaced for a Haijun Code Security project.

• "haijun_code_security_vulnerability_deleted"

A Haijun Code Security vulnerability finding was permanently deleted.

• "haijun_code_security_vulnerability_fix_session_created"

A Haijun Code remediation session was created for a Haijun Code Security vulnerability finding.

• "haijun_code_security_vulnerability_updated"

A Haijun Code Security vulnerability finding was dismissed, restored, marked fixed, or reopened.

• "haijun_code_security_webhook_created"

A Haijun Code Security outbound webhook was created.

• "haijun_code_security_webhook_deleted"

A Haijun Code Security outbound webhook was deleted.

• "haijun_code_security_webhook_secret_updated"

The HMAC signing secret for a Haijun Code Security webhook was rotated.

• "haijun_code_security_webhook_updated"

A Haijun Code Security outbound webhook was updated.

• "haijun_code_team_memory_acl_updated"

An RBAC group was added to or removed from the Haijun Code team-memory ACL.

• "haijun_code_team_memory_updated"

Haijun Code team memory shared with the organization was updated.

• "haijun_code_team_onboarding_guide_updated"

A Haijun Code team onboarding guide was created, updated, or deleted.

• "haijun_code_user_marketplaces_updated"

A user's Haijun Code plugin marketplace selections were updated on Juglow servers.

• "haijun_code_user_memory_updated"

A user's synced private Haijun Code memory was updated or deleted on Juglow servers.

• "haijun_code_user_plugins_updated"

A user's Haijun Code plugin selections — which plugins are installed and enabled — were updated on Juglow servers.

• "haijun_code_user_settings_updated"

A user's synced Haijun Code settings were updated or deleted on Juglow servers.

• "haijun_command_created"

Command was created.

• "haijun_command_deleted"

Command was deleted.

• "haijun_command_replaced"

Command was replaced.

• "haijun_enterprise_upgrade_credit_updated"

An organization admin cancelled, or turned back on, the monthly usage credit the organization receives for upgrading from the Team plan to the Enterprise plan, together with the recurring monthly charge that accompanies it.

• "haijun_file_access_failed"

A user was denied access to a file in Haijun.ai.

• "haijun_file_deleted"

A file was deleted.

• "haijun_file_exported"

A file was exported from Haijun to an external storage destination.

• "haijun_file_uploaded"

A file was uploaded.

• "haijun_file_viewed"

A user viewed a file in Haijun.ai.

• "haijun_gdrive_integration_created"

A Google Drive integration was enabled for the organization.

• "haijun_gdrive_integration_deleted"

A Google Drive integration was disabled for the organization.

• "haijun_gdrive_integration_updated"

A Google Drive integration's configuration was updated.

• "haijun_github_integration_created"

A GitHub integration was enabled for the organization.

• "haijun_github_integration_deleted"

A GitHub integration was disabled for the organization.

• "haijun_github_integration_updated"

A GitHub integration's configuration was updated.

• "haijun_organization_settings_updated"

Organization settings were updated.

• "haijun_plugin_archive_accessed"

A version archive of a member-owned plugin, containing that member's own files, was downloaded.

• "haijun_plugin_created"

Plugin was created.

• "haijun_plugin_deleted"

Plugin was deleted.

• "haijun_plugin_disabled"

User disabled a plugin for their account.

• "haijun_plugin_enabled"

User enabled a plugin for their account.

• "haijun_plugin_replaced"

Plugin was replaced.

• "haijun_plugin_security_scan_completed"

A security scan of a plugin completed and produced a verdict.

• "haijun_plugin_updated"

Plugin was updated.

• "haijun_project_archived"

A Haijun project was archived.

• "haijun_project_created"

A Haijun project was created.

• "haijun_project_deleted"

A Haijun project was deleted.

• "haijun_project_document_access_failed"

An attempt to access a document in a Haijun project failed.

• "haijun_project_document_bulk_deletion_audit_truncated"

A bulk request to delete documents from a Haijun project failed with more documents requested than were individually recorded in the audit log.

• "haijun_project_document_deleted"

A document was deleted from a Haijun project.

• "haijun_project_document_deletion_failed"

A request to delete a document from a Haijun project failed.

• "haijun_project_document_updated"

The content of a document in a Haijun project was replaced in place.

• "haijun_project_document_uploaded"

A document was uploaded to a Haijun project.

• "haijun_project_document_viewed"

A document in a Haijun project was viewed.

• "haijun_project_file_access_failed"

An attempt to access a file in a Haijun project failed.

• "haijun_project_file_bulk_deletion_audit_truncated"

A bulk request to delete files from a Haijun project failed with more files requested than were individually recorded in the audit log.

• "haijun_project_file_deleted"

A file was deleted from a Haijun project.

• "haijun_project_file_deletion_failed"

A request to delete a file from a Haijun project failed.

• "haijun_project_file_uploaded"

A file was uploaded to a Haijun project.

• "haijun_project_reported"

A Haijun project was reported.

• "haijun_project_sharing_updated"

A Haijun project's sharing settings were updated.

• "haijun_project_sync_source_created"

A sync source was connected to a Haijun project's knowledge base.

• "haijun_project_sync_source_deleted"

A sync source was disconnected from a Haijun project's knowledge base.

• "haijun_project_sync_source_updated"

A Haijun project sync source's configuration was updated.

• "haijun_project_viewed"

A Haijun project was viewed.

• "haijun_published_artifact_deleted"

A published artifact was deleted or unpublished — by its creator, by an organization admin, or by Juglow (for example, when it was removed for a policy violation).

• "haijun_pubsec_identity_configured"

SAML IdP configuration updated for a public sector organization.

• "haijun_skill_created"

Track was created.

• "haijun_skill_deleted"

Track was deleted.

• "haijun_skill_disabled"

User disabled a track for their account.

• "haijun_skill_enabled"

User enabled a track for their account.

• "haijun_skill_replaced"

Track was replaced.

• "haijun_skill_security_scan_completed"

A security scan of a track completed and produced a verdict.

• "haijun_user_role_updated"

A user's role within the organization was changed, or the user was added to or removed from the organization.

• "haijun_user_seat_tier_updated"

An organization member's seat tier was changed. A null previous_seat_tier means the member previously had no seat assigned; a null current_seat_tier means the seat was removed.

• "haijun_user_settings_updated"

User updated their personal settings.

• "cli_plugin_exec_policy_updated"

Admin set or cleared the per-op permission ceiling for a plugin CLI.

• "compliance_api_accessed"

Logging event auto-generated for each compliance API request.

• "cowork_session_updated"

A Cowork session was updated.

• "design_project_artifact_published"

A Haijun Design project's content was published as a haijun.ai artifact, making a snapshot of one of its files viewable outside the project's sharing settings.

• "design_project_created"

A Haijun Design project was created.

• "design_project_deleted"

A Haijun Design project was deleted.

• "design_project_member_added"

A member was granted access to a Haijun Design project.

• "design_project_member_removed"

A member's access to a Haijun Design project was revoked.

• "design_project_member_role_updated"

A Haijun Design project member's role was changed.

• "design_project_published"

A Haijun Design template or design system was published, making it discoverable by everyone in its organization.

• "design_project_sharing_updated"

A Haijun Design project's link-sharing settings were changed — who the project's link works for, and what people opening it through the link may do. Access granted to individual members is reported separately (see design_project_member_added).

• "design_project_unpublished"

A Haijun Design template or design system was unpublished, removing it from its organization's shared gallery.

• "design_project_updated"

A Haijun Design project's metadata was updated.

• "design_project_version_restored"

A Haijun Design project's working tree was rolled back to a previously saved version, replacing its current files with that version's files.

• "design_project_viewed"

A Haijun Design project's content was read. The surface field records which kind of read — a project open, a full-content read, a single-file read, a saved-version read, or an export request. The actor is the reader.

This activity type is retired: project content reads are no longer recorded. Events of this type may still appear in feeds for reads that occurred while it was active.

• "desktop_extension_allowlisted"

A desktop extension was added to an org's allowlist.

• "desktop_extension_blocklisted"

A desktop extension was added to the global blocklist.

• "desktop_extension_deleted"

A desktop extension was deleted, either globally by an admin or org-scoped by an org owner.

• "desktop_extension_removed_from_allowlist"

A desktop extension was removed from an org's allowlist.

• "desktop_extension_unblocked"

A desktop extension was removed from the global blocklist.

• "desktop_extension_uploaded"

A desktop extension was uploaded, either globally by an admin or org-scoped by an org owner.

• "desktop_extension_version_uploaded"

A new version of an existing org-owned desktop extension was uploaded.

• "domain_claim_initiated"

Domain capture claim initiated over personal accounts on verified domains.

• "end_user_invite_requested"

Non-admin member submitted an invite request for a new org member.

• "extra_usage_billing_enabled"

Usage credit billing was enabled for an organization.

• "extra_usage_credit_granted"

A promotional usage credit grant was claimed.

• "extra_usage_spend_limit_created"

Usage credit spend limit was created.

• "extra_usage_spend_limit_deleted"

Usage credit spend limit was deleted.

• "extra_usage_spend_limit_increase_request_approved"

A usage credit spend limit increase request was approved.

• "extra_usage_spend_limit_increase_request_denied"

A usage credit spend limit increase request was denied.

• "extra_usage_spend_limit_updated"

Usage credit spend limit was updated.

• "ghe_configuration_created"

Admin created a GHE configuration.

• "ghe_configuration_deleted"

Admin deleted a GHE configuration.

• "ghe_configuration_updated"

Admin updated a GHE configuration. Previous/new field pairs are recorded only for settings that changed in the update; secret credentials are never recorded, only whether they were replaced.

• "ghe_user_connected"

User connected to a GHE instance.

• "ghe_user_disconnected"

User disconnected from a GHE instance.

• "ghe_webhook_signature_invalid"

Webhook signature validation failed.

• "github_app_installation_linked"

An installation of the Haijun GitHub App (a GitHub organization or user account where the App is installed) was linked to the organization, letting the organization's Haijun Code features act on that GitHub account's repositories.

• "github_app_installation_unlinked"

An installation of the Haijun GitHub App was unlinked from the organization, so the organization's Haijun Code features can no longer act on that GitHub account's repositories through it.

• "github_token_import"

A user attempted to import a personal GitHub access token for use with Haijun Code. The result field indicates the outcome of the import (imported, rejected, or failed).

• "gitlab_configuration_created"

An organization admin created a self-managed GitLab configuration for syncing plugin marketplaces.

• "gitlab_configuration_deleted"

An organization admin deleted a self-managed GitLab configuration.

• "gitlab_configuration_updated"

An organization admin updated a self-managed GitLab configuration. Previous/new field pairs are recorded only for settings that changed in the update; secret credentials are never recorded, only whether they were replaced.

• "group_created"

A group was created (RBAC admin or SCIM provisioning).

• "group_deleted"

A group was deleted (RBAC admin or SCIM provisioning).

• "group_list_viewed"

Admin viewed the list of RBAC groups.

• "group_member_added"

One or more members were added to a group.

• "group_member_addition_failed"

A request to add members to a group failed. Some of the requested members may have been added before the failure.

• "group_member_list_viewed"

Admin viewed the members of an RBAC group.

• "group_member_removal_failed"

A request to remove members from a group failed. Some of the requested members may have been removed before the failure.

• "group_member_removed"

One or more members were removed from a group.

• "group_project_shares_revoked"

An RBAC group's project shares in one organization were revoked in bulk.

• "group_skill_shares_revoked"

An RBAC group's track shares in one organization were revoked in bulk.

• "group_updated"

A group was updated (RBAC admin or SCIM provisioning).

• "group_viewed"

A group was viewed.

• "group_visibility_updated"

An RBAC group's visibility policy was updated.

• "inference_hooks_circuit_breaker_tripped"

The organization's Inference hooks circuit breaker tripped automatically: calls to the organization's Inference hooks endpoint crossed a failure threshold, and inspection was suspended to protect live traffic. While tripped, requests are handled according to the organization's failure handling setting — allowed through uninspected (fail open) or rejected (fail closed) — and no per-request Inference hooks activities are recorded. The tripped state persists until an administrator re-enables Inference hooks inspection (or explicitly resets the circuit breaker).

• "inference_hooks_config_deleted"

Inference hooks configuration was removed for the organization.

• "inference_hooks_config_updated"

Inference hooks configuration was created or updated for the organization.

• "inference_hooks_request_denied"

Inference hooks inspection denied a request. The request was blocked and no model response was produced.

• "inference_hooks_request_failed_open"

A request proceeded without Inference hooks inspection because a verdict could not be obtained and the organization's Inference hooks configuration is set to fail open.

• "inference_hooks_signing_secret_generated"

A request signing secret was generated for the organization's Inference hooks configuration.

• "integration_user_connected"

User connected to an integration.

• "integration_user_disconnected"

User disconnected from an integration.

• "invoice_collection_method_updated"

Invoice collection method was changed.

• "lti_launch_initiated"

LTI launch was initiated.

• "lti_launch_success"

LTI launch completed successfully.

• "lti_platform_created"

Juglow staff created an LTI platform integration on behalf of an org.

• "lti_platform_updated"

Juglow staff updated an LTI platform integration on behalf of an org.

• "magic_link_login_failed"

A magic link sign-in attempt failed.

• "magic_link_login_initiated"

A user requested a magic link sign-in email.

• "magic_link_login_succeeded"

A user successfully signed in with a magic link email.

• "managed_organization_setup_completed"

Managed (AWS Marketplace) organization setup was completed.

• "marketplace_created"

Admin created an organization marketplace.

• "marketplace_deleted"

Admin deleted an organization marketplace.

• "marketplace_updated"

Admin updated an organization marketplace.

• "marketplace_webhook_deleted"

Admin removed the GitHub push webhook for a marketplace.

• "marketplace_webhook_provisioned"

Admin provisioned a GitHub push webhook for a marketplace.

• "mcp_directory_server_published"

The organization published its approved MCP directory listing.

• "mcp_server_created"

An MCP server was added to the organization.

• "mcp_server_deleted"

An MCP server was removed from the organization.

• "mcp_server_managed_auth_token_exchanged"

A user attempted to obtain an access token for an MCP server via enterprise managed authorization. This event reports the outcomes of attempted token exchanges. Repeated failures with the same cause may be reported once until the cause changes, and requests refused before a token exchange is attempted are not reported, except the "connector_scope_not_granted" and "identity_assertion_refused" failures described under error_type.

• "mcp_server_managed_auth_updated"

An MCP server's enterprise managed authorization settings were set, changed, or cleared, including when they were supplied while the server was being added or edited. Fields without a "previous_" prefix describe the settings after the change and are null when the server has no managed authorization settings afterwards; "previous_" fields describe the settings before the change and are null when the server had none before (always the case for a newly added server).

• "mcp_server_updated"

An MCP server's configuration was updated.

• "mcp_tool_policy_updated"

The permission restriction for an MCP tool was set or cleared.

• "org_analytics_api_capability_updated"

Organization analytics_api capability was enabled or disabled.

• "org_bulk_delete_initiated"

Organization bulk deletion was initiated.

• "org_capability_grant_added"

A capability grant was added to a workspace or role.

• "org_capability_grant_removed"

A capability grant was removed from a workspace or role.

• "org_haijun_code_data_sharing_disabled"

Organization Haijun Code data sharing was disabled.

• "org_haijun_code_data_sharing_enabled"

Organization Haijun Code data sharing was enabled.

• "org_haijun_code_desktop_disabled"

Organization Haijun Code Desktop was disabled.

• "org_haijun_code_desktop_enabled"

Organization Haijun Code Desktop was enabled.

• "org_haijun_code_zero_data_retention_disabled"

A primary owner disabled zero data retention for Haijun Code, so Haijun Code content is retained according to the organization's data retention settings.

• "org_compliance_api_settings_updated"

Organization compliance API settings were updated.

• "org_connector_domain_guard_updated"

Enterprise admin changed whether connectors are restricted to verified domains.

• "org_cowork_act_without_asking_mode_disabled"

The "Act without asking" mode in Cowork was disabled for the organization, so members can no longer let Haijun act without asking for approval.

• "org_cowork_act_without_asking_mode_enabled"

The "Act without asking" mode in Cowork was enabled for the organization, allowing members to let Haijun act without asking for approval.

• "org_cowork_agent_disabled"

Organization Cowork Agent was disabled.

• "org_cowork_agent_enabled"

Organization Cowork Agent was enabled.

• "org_cowork_auto_mode_disabled"

The "Auto" permission mode in Cowork was disabled for the organization, so members can no longer let Haijun approve its own actions after a safety check.

• "org_cowork_auto_mode_enabled"

The "Auto" permission mode in Cowork was enabled for the organization, allowing members to let Haijun approve its own actions after a safety check.

• "org_cowork_browser_pane_disabled"

The in-app browser in Cowork was disabled for the organization, so Haijun can no longer open or use websites in a browser pane during members' Cowork sessions.

• "org_cowork_browser_pane_enabled"

The in-app browser in Cowork was enabled for the organization, letting Haijun open and use websites in a browser pane during members' Cowork sessions.

• "org_cowork_disabled"

Organization cowork was disabled.

• "org_cowork_enabled"

Organization cowork was enabled.

• "org_cowork_mcp_always_allow_disabled"

The "Always allow" option for connector tools in Cowork was disabled for the organization, so each use of a connector tool that can make changes requires approval. Read-only connector tools are not affected by this setting.

• "org_cowork_mcp_always_allow_enabled"

The "Always allow" option for connector tools in Cowork was enabled for the organization, letting members approve a connector tool that can make changes once and allow its later uses automatically. Read-only connector tools are not affected by this setting.

• "org_cowork_otlp_settings_updated"

The organization's Cowork OpenTelemetry monitoring export settings were updated.

• "org_cowork_remote_disabled"

Running Cowork in the cloud was disabled for the organization, so members can no longer run Cowork sessions in Juglow-hosted remote environments.

• "org_cowork_remote_enabled"

Running Cowork in the cloud was enabled for the organization, allowing members to run Cowork sessions in Juglow-hosted remote environments.

• "org_creation_blocked"

Organization creation was blocked.

• "org_data_export_accessed"

Organization data export file was accessed/downloaded via signed URL.

• "org_data_export_completed"

Organization data export was completed.

• "org_data_export_started"

Organization data export was started.

• "org_data_residency_updated"

The organization's inference data residency settings were updated.

• "org_deleted_via_bulk"

Organization was deleted via bulk operation.

• "org_deletion_requested"

Organization deletion was requested.

• "org_directory_resync_completed"

Organization directory resync completed successfully.

• "org_directory_resync_failed"

Organization directory resync failed.

• "org_directory_resync_started"

Organization directory resync was started asynchronously.

• "org_directory_sync_activated"

Organization directory sync was activated.

• "org_directory_sync_add_initiated"

Organization directory sync setup was initiated.

• "org_directory_sync_deleted"

Organization directory sync was deleted.

• "org_discoverability_disabled"

Admin disabled organization discoverability.

• "org_discoverability_enabled"

Admin enabled organization discoverability.

• "org_discoverability_settings_updated"

Admin updated organization discoverability settings.

• "org_domain_add_initiated"

Organization domain verification was initiated.

• "org_domain_removed"

Organization domain was removed.

• "org_domain_verified"

Organization domain was verified.

• "org_external_key_created"

A CMEK external key config was created.

• "org_external_key_deleted"

A CMEK external key config was deleted.

• "org_external_key_updated"

A CMEK external key config was updated.

• "org_external_key_validated"

A CMEK external key config was validated against the customer's KMS.

• "org_hipaa_self_serve_enabled"

A primary owner click-accepted the BAA and enabled HIPAA protections for the organization via the self-serve flow.

• "org_invite_link_disabled"

Organization invite link was disabled.

• "org_invite_link_generated"

Organization invite link was generated.

• "org_invite_link_regenerated"

Organization invite link was regenerated (previous link invalidated).

• "org_invite_viewed"

An organization invite was viewed.

• "org_invites_listed"

Organization invites were listed.

• "org_ip_restriction_created"

Organization IP restriction was created.

• "org_ip_restriction_deleted"

Organization IP restriction was deleted.

• "org_ip_restriction_updated"

Organization IP restriction was updated.

• "org_join_proposal_decided"

Approve or reject decision on a parent-org join proposal.

• "org_join_request_approved"

Admin approved a join request.

• "org_join_request_created"

User requested to join an organization.

• "org_join_request_dismissed"

Admin dismissed a join request.

• "org_join_request_instant_approved"

Join request was instantly approved.

• "org_join_requests_bulk_dismissed"

Admin bulk-dismissed join requests.

• "org_magic_link_second_factor_toggled"

Organization magic link second factor was toggled.

• "org_member_invites_disabled"

Admin disabled member invites for the organization.

• "org_member_invites_enabled"

Admin enabled member invites for the organization.

• "org_members_exported"

Organization members list was exported as CSV.

• "org_model_default_updated"

An organization or role default model setting was changed by an administrator.

• "org_parent_join_proposal_created"

Organization parent join proposal was created.

• "org_parent_search_performed"

Organization parent search was performed.

• "org_sso_add_initiated"

Organization SSO setup was initiated.

• "org_sso_connection_activated"

Organization SSO connection was activated.

• "org_sso_connection_deactivated"

Organization SSO connection was deactivated.

• "org_sso_connection_deleted"

Organization SSO connection was deleted.

• "org_sso_group_role_mappings_updated"

Organization SSO group role mappings were updated.

• "org_sso_provisioning_mode_changed"

Organization SSO provisioning mode was changed.

• "org_sso_scim_welcome_email_toggled"

Organization SCIM-provisioned welcome email was toggled.

• "org_sso_seat_tier_assignment_toggled"

Organization SSO seat tier assignment was toggled.

• "org_sso_seat_tier_mappings_updated"

Organization SSO seat tier mappings were updated.

• "org_sso_toggled"

Organization SSO was toggled on or off.

• "org_sync_deleting_synchronized_files_started"

Organization started deleting synchronized files.

• "org_sync_synchronized_files_deleted"

Organization synchronized files were deleted.

• "org_taint_added"

A taint was added to an organization.

• "org_taint_removed"

A taint was removed from an organization.

• "org_user_deleted"

User was removed from organization.

• "org_user_invite_accepted"

Organization user invite was accepted.

• "org_user_invite_deleted"

Organization user invite was deleted.

• "org_user_invite_re_sent"

Organization user invite was re-sent.

• "org_user_invite_rejected"

Organization user invite was rejected.

• "org_user_invite_sent"

Organization user invite was sent.

• "org_user_left"

User removed themselves from organization.

• "org_user_shares_retained"

A member left or was removed from the organization while projects, tracks, plugins, or chats they had shared were still shared, and those shares were kept.

• "org_user_trusted_devices_revoked"

An organization admin revoked a member's trusted devices and signed the member out of all active sessions.

• "org_user_viewed"

An organization user was viewed.

• "org_users_listed"

Organization users were listed.

• "org_work_across_apps_disabled"

The organization's "Let Haijun work across apps" setting was turned off.

• "org_work_across_apps_enabled"

The organization's "Let Haijun work across apps" setting was turned on.

• "organization_address_updated"

The organization's billing or shipping address was updated.

• "organization_icon_deleted"

Organization's custom icon deleted.

• "organization_icon_updated"

Organization's custom icon uploaded or replaced.

• "owned_projects_access_restored"

Access to owned projects was restored.

• "payment_method_updated"

The organization's default payment method was updated.

• "pending_share_created"

A pending share of a project or track was created for an email address that is not yet an organization member.

• "pending_share_revoked"

A pending share of a project or track was revoked before the invitee joined the organization.

• "phone_code_sent"

User requested a phone verification code.

• "phone_code_verified"

User successfully verified their phone code.

• "platform_agent_archived"

An agent was archived on the API platform.

• "platform_agent_created"

An agent was created on the API platform.

• "platform_agent_deleted"

An agent was deleted from the API platform.

• "platform_agent_deployment_archived"

An agent deployment was archived on the API platform.

• "platform_agent_deployment_created"

An agent deployment was created on the API platform.

• "platform_agent_deployment_deleted"

An agent deployment was deleted from the API platform.

• "platform_agent_deployment_paused"

An agent deployment was paused on the API platform.

• "platform_agent_deployment_run_triggered"

An agent deployment was run on demand on the API platform.

• "platform_agent_deployment_unpaused"

An agent deployment was resumed on the API platform.

• "platform_agent_deployment_updated"

An agent deployment was updated on the API platform.

• "platform_agent_session_archived"

An agent session was archived on the API platform.

• "platform_agent_session_created"

An agent session was created on the API platform.

• "platform_agent_session_deleted"

An agent session was deleted from the API platform.

• "platform_agent_session_resource_added"

A resource was attached to an agent session.

• "platform_agent_session_resource_deleted"

A resource attached to an agent session was removed.

• "platform_agent_session_resource_updated"

A resource attached to an agent session was updated.

• "platform_agent_session_thread_archived"

A thread within an agent session was archived.

• "platform_agent_session_updated"

An agent session was updated on the API platform.

• "platform_agent_updated"

An agent was updated on the API platform.

• "platform_api_key_created"

An API key was created.

• "platform_api_key_updated"

An API key was updated.

• "platform_app_attest_authentication"

An attested mobile device attempted to exchange an Apple App Attest assertion for Juglow API credentials.

• "platform_billing_upgraded_to_prepaid"

The organization's API billing was upgraded to the prepaid plan.

• "platform_clearance_workspace_program_request_cleared"

A workspace's clearance program assignment was removed.

• "platform_clearance_workspace_program_request_set"

A workspace's clearance program assignment was created or updated.

• "platform_cost_report_viewed"

The cost report was viewed.

• "platform_dream_archived"

A Dream (asynchronous memory-consolidation job) was archived.

• "platform_dream_cancelled"

A Dream (asynchronous memory-consolidation job) was cancelled before it completed.

• "platform_dream_created"

A Dream (asynchronous memory-consolidation job) was created.

• "platform_federated_authentication"

A federated workload identity attempted to exchange an OIDC token for Juglow API credentials.

• "platform_federation_issuer_archived"

An OIDC federation issuer was archived.

• "platform_federation_issuer_created"

An OIDC federation issuer was created, registering an external identity provider that federation rules can trust for workload authentication.

• "platform_federation_issuer_updated"

An OIDC federation issuer was updated.

• "platform_federation_rule_archived"

An OIDC federation rule was archived.

• "platform_federation_rule_created"

An OIDC federation rule was created, allowing tokens from a federation issuer to authenticate as a service account or user. Rules may additionally match on token claims or a condition expression, which are not included in this event.

• "platform_federation_rule_updated"

An OIDC federation rule was updated.

• "platform_federation_rule_workspace_added"

A federation rule was enabled for a workspace.

• "platform_federation_rule_workspace_removed"

A federation rule was disabled for a workspace.

• "platform_file_content_downloaded"

Activity logged when file content is downloaded via GET /v1/files/{file_id}/content.

• "platform_file_deleted"

Activity logged when a file is deleted via DELETE /v1/files/{file_id}.

• "platform_file_uploaded"

Activity logged when a file is uploaded via POST /v1/files.

• "platform_memory_created"

An agent memory document was created.

• "platform_memory_deleted"

An agent memory document was deleted.

• "platform_memory_store_archived"

An agent memory store was archived. Archived stores reject new memory writes and cannot be attached to new sessions; deletion and redaction remain permitted for privacy scrubbing.

• "platform_memory_store_created"

An agent memory store was created.

• "platform_memory_store_deleted"

An agent memory store was deleted. Memory content removal may complete asynchronously for very large stores.

• "platform_memory_store_updated"

An agent memory store's name, description, or metadata was updated.

• "platform_memory_updated"

An agent memory document's content or path was updated.

• "platform_memory_version_redacted"

A historical version of an agent memory document was redacted. Redaction scrubs the stored content of a specific version while preserving the version's existence in the history.

• "platform_oauth_app_created"

An OAuth app was created.

• "platform_oauth_app_revoked"

An OAuth app was revoked.

• "platform_oauth_app_updated"

An OAuth app was updated.

• "platform_plugin_directory_submission_created"

A plugin directory submission was created on the API platform. A plugin directory submission is a request to list a plugin in the public plugin directory.

• "platform_plugin_directory_submission_deleted"

A plugin directory submission was deleted on the API platform.

• "platform_plugin_directory_submission_updated"

A plugin directory submission was updated on the API platform.

• "platform_service_account_archived"

A service account was archived.

• "platform_service_account_created"

A service account was created.

• "platform_service_account_updated"

A service account was updated.

• "platform_service_account_workspace_member_added"

A service account was added as a member of a workspace.

• "platform_service_account_workspace_member_removed"

A service account was removed from a workspace.

• "platform_service_account_workspace_member_updated"

A service account's workspace membership role was updated.

• "platform_signing_key_created"

Activity logged when a new request-signing key is registered for the org.

• "platform_signing_key_deleted"

Activity logged when a signing key is permanently deleted.

• "platform_signing_key_rotated"

Activity logged when an in-memory signing key is rotated.

• "platform_skill_version_content_downloaded"

The content of a track version was downloaded through the Tracks API.

• "platform_skill_version_created"

Activity logged when a track version is created via POST /v1/tracks/{skill_id}/versions.

• "platform_skill_version_deleted"

Activity logged when a track version is deleted via DELETE /v1/tracks/{skill_id}/versions/{version}.

• "platform_spend_limit_alert_emails_updated"

Spend limit alert email addresses and role targets were updated for an org.

• "platform_spend_limit_created"

An org-level fixed-dollar spend limit was created.

• "platform_spend_limit_deleted"

An org-level spend limit was removed.

• "platform_spend_limit_updated"

An org-level spend limit snooze/ignore state was changed.

• "platform_usage_report_haijun_code_viewed"

The Haijun Code usage report was viewed.

• "platform_usage_report_messages_viewed"

The messages usage report was viewed.

• "platform_workspace_archived"

A workspace was archived.

• "platform_workspace_created"

A workspace was created.

• "platform_workspace_inference_data_retention_disabled"

The zero data retention override was disabled for a workspace.

• "platform_workspace_inference_data_retention_enabled"

The zero data retention override was enabled for a workspace.

• "platform_workspace_member_added"

A member was added to a workspace.

• "platform_workspace_member_removed"

A member was removed from a workspace.

• "platform_workspace_member_updated"

A workspace member was updated.

• "platform_workspace_member_viewed"

A workspace member was viewed.

• "platform_workspace_members_listed"

Workspace members were listed.

• "platform_workspace_rate_limit_deleted"

A workspace rate limit was deleted.

• "platform_workspace_rate_limit_updated"

A workspace rate limit was created or updated.

• "platform_workspace_updated"

A workspace was updated.

• "plugin_installation_preference_updated"

An org admin changed the installation preference for a plugin.

• "prepaid_auto_recharge_disabled"

Auto-recharge was disabled for API prepaid org.

• "prepaid_auto_recharge_updated"

Auto-recharge settings were updated for API prepaid org.

• "prepaid_extra_usage_auto_reload_disabled"

Prepaid usage credit auto-reload was disabled.

• "prepaid_extra_usage_auto_reload_enabled"

Prepaid usage credit auto-reload was enabled.

• "prepaid_extra_usage_auto_reload_settings_updated"

Prepaid usage credit auto-reload settings were updated.

• "primary_owner_transferred"

Primary owner role was transferred to another org member.

• "rbac_role_assigned"

Admin assigned an RBAC custom role to a principal.

• "rbac_role_created"

Admin created an RBAC custom role.

• "rbac_role_deleted"

Admin deleted an RBAC custom role.

• "rbac_role_grant_updated"

Admin requested a capability grant for an RBAC custom role, or removed it.

Records the admin's change to the role. Whether the grant is currently in effect on the role is reported separately.

• "rbac_role_permission_added"

Admin added a permission to an RBAC custom role.

Emitted once per requested permission, including permissions the role already had, so a retried request still produces a complete audit record.

• "rbac_role_permission_removed"

Admin removed a permission from an RBAC custom role.

Emitted once per requested permission, including permissions the role already lacked, so a retried request still produces a complete audit record.

• "rbac_role_unassigned"

Admin unassigned an RBAC custom role from a principal.

• "rbac_role_updated"

Admin updated an RBAC custom role.

• "role_assignment_granted"

Role assignment was granted.

• "role_assignment_revoked"

Role assignment was revoked.

• "scim_user_created"

A SCIM user was provisioned.

• "scim_user_deleted"

A SCIM user was deleted.

• "scim_user_updated"

A SCIM user was updated.

• "scoped_api_key_deleted"

A scoped API key was deleted.

• "scoped_api_key_updated"

A scoped API key was renamed or its activation state changed.

• "seat_tier_changes_cancelled"

Scheduled seat tier downgrades were cancelled.

• "seat_tiers_purchased"

Seat tiers were purchased or upgraded on a subscription.

• "service_created"

Activity logged when an org service is explicitly created.

• "service_deleted"

Activity logged when an org service is deleted.

• "service_key_created"

Activity logged when a new org service key is created.

• "service_key_revoked"

Activity logged when an org service key is revoked.

• "session_revoked"

User revoked a specific session.

• "session_share_accessed"

Session share was accessed.

• "session_share_created"

Session share was created.

• "session_share_revoked"

Session share was revoked.

• "slack_workspace_claim_revoked"

A Slack workspace or Enterprise Grid organization was disconnected from the organization for Haijun in Slack.

• "slack_workspace_claimed"

A Slack workspace or Enterprise Grid organization was connected to the organization for Haijun in Slack.

• "social_login_succeeded"

A user successfully signed in with a social identity provider (Google, Apple, or Microsoft).

• "sso_login_failed"

An SSO sign-in attempt failed.

• "sso_login_initiated"

A user started an SSO sign-in flow.

• "sso_login_succeeded"

A user successfully signed in with SSO.

• "sso_second_factor_magic_link"

SSO second factor magic link was used.

• "step_up_authentication_failed"

An additional identity check failed.

• "step_up_authentication_succeeded"

The user completed an additional identity check to confirm a sensitive action.

• "step_up_credential_enrolled"

A user enrolled a passkey for confirming sensitive actions on their account.

• "subscription_cancellation_scheduled"

Subscription cancellation was scheduled at end of billing period.

• "subscription_quantity_updated"

Contracted subscription seat quantity was updated.

• "subscription_renewed"

A cancelled subscription was renewed.

• "subscription_resumed"

A scheduled subscription cancellation was reversed.

• "subscription_started"

A new subscription was created (Team or Enterprise).

• "subscription_upgraded"

Subscription plan was upgraded (e.g. Team to Enterprise).

• "trusted_device_credential_rotated"

The identity-verification credential of a trusted device was rotated to a new key.

• "trusted_device_enrolled"

A device was enrolled as a trusted device for the user's account. Trusted devices can be used to confirm the user's identity for sensitive actions.

• "trusted_device_revoked"

A trusted device was removed from the user's account.

• "tunnel_archived"

An MCP tunnel was archived.

• "tunnel_certificate_added"

An inner-TLS CA certificate was added to a tunnel.

• "tunnel_certificate_revoked"

An inner-TLS CA certificate was revoked from a tunnel.

• "tunnel_created"

An MCP tunnel was created.

• "tunnel_token_minted"

An OAuth bearer token for the tunnel management API was minted.

• "tunnel_token_revealed"

The Cloudflare connector secret for a tunnel was revealed to the caller.

• "tunnel_token_revoked"

An OAuth bearer token for the tunnel management API was revoked.

• "tunnel_token_rotated"

The Cloudflare connector secret for a tunnel was rotated.

tunnel_token_id is the id of the newly-issued token. The previous token is invalidated by the rotation and its id is not recorded here.

• "user_consent_recorded"

User granted a consent for a specific entity (e.g. consumer health consent for an MCP server).

• "user_consent_revoked"

User revoked a previously granted consent for a specific entity.

• "user_logged_out"

A user signed out of one or all sessions.

• "verification_evidence_submitted"

Verification evidence was submitted for an organization's verification.

• "verification_program_application_created"

An organization applied to a verification program.

• "workspace_member_spend_limit_created"

A per-member or workspace-default Haijun Code spend limit was created.

• "workspace_member_spend_limit_deleted"

A per-member or workspace-default Haijun Code spend limit was deleted.

• "workspace_member_spend_limit_updated"

A per-member Haijun Code spend limit amount was updated.

• "workspace_spend_limit_alert_emails_updated"

Spend limit alert email recipients were updated for a workspace.

• "workspace_spend_limit_created"

A workspace-level API spend limit was created.

• "workspace_spend_limit_deleted"

A workspace-level API spend limit was deleted.

• limit: optional number

Maximum results (default: 100, max: 5000)

default: 100, minimum: 1, maximum: 5000

• order: optional "asc" or "desc"

Sort direction by created_at. desc (default) returns newest-first; asc returns oldest-first for incremental sync. Activities become queryable after a short asynchronous ingestion delay. When using asc with after_id for incremental sync, late-arriving rows with timestamps behind the cursor will be skipped; consumers that need at-least-once delivery should periodically re-poll an overlap window via created_at.gte and deduplicate by id. after_id and before_id are relative to this order.

default: desc

• "asc"

• "desc"

• organization_ids: optional array of string

Filter activities by organization IDs (accepts org_... or organization UUID). Enumerate IDs via GET /v1/compliance/organizations.

• user_ids: optional array of string

Alias for actor_ids[], for consistency with other compliance routes. If both are provided, the lists are merged.

#Headers

• "x-api-key": optional string

#Returns

• data: optional array of AbuseDecisionReceived or AccountDeleted or AdminAPIKeyCreated or 511 more

List of activity records. Each element's type field identifies which activity it is and which additional fields are present.

• AbuseDecisionReceived object

An external anti-abuse service reported a consequential decision about a sign-in or sign-up attempt.

• type: optional "abuse_decision_received"

default: abuse_decision_received

• actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more

• APIActor object

• type: optional "api_actor"

default: api_actor

• api_key_id: string

• ip_address: string

• user_agent: string

• UserActor object

• type: optional "user_actor"

default: user_actor

• email_address: string

format: email

• ip_address: string

• user_agent: string

• user_id: string

• UnauthenticatedUserActor object

• type: optional "unauthenticated_user_actor"

default: unauthenticated_user_actor

• ip_address: string

• user_agent: string

• unauthenticated_email_address: optional string or null

format: email

• JuglowActor object

• type: optional "juglow_actor"

default: juglow_actor

• email_address: optional string or null

format: email

• SystemActor object

Automated background processing performed by Juglow systems, acting without a user or customer credential.

• type: optional "system_actor"

default: system_actor

• service: optional string or null

Name of the automated process that performed the action, when known.

• AdminAPIKeyActor object

• type: optional "admin_api_key_actor"

default: admin_api_key_actor

• admin_api_key_id: string

• ip_address: string

• user_agent: string

• ServiceAccountActor object

• type: optional "service_account_actor"

default: service_account_actor

• ip_address: string

• service_account_id: string

• user_agent: string

• ScimDirectorySyncActor object

• type: optional "scim_directory_sync_actor"

default: scim_directory_sync_actor

• directory_id: string

• workos_event_id: string

• idp_connection_type: optional string or null

• FederatedIdentityActor object

A federated external workload authenticated via a verified OIDC token.

Carries the verified issuer, subject, and audience claims from the presented JWT.

• type: optional "federated_identity_actor"

default: federated_identity_actor

• issuer: string

• subject: string

• audience: optional array of string

• ip_address: optional string or null

• user_agent: optional string or null

• FederatedActor object

An external identity asserted by a trusted provider — a cloud-provider gateway or a customer-registered federation issuer — acting without an Juglow-provisioned account or service account.

• type: optional "federated_actor"

default: federated_actor

• provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider

• FederatedActorAwsProvider object

Asserting party: the AWS account the organization is bound to.

• type: optional "aws"

default: aws

• account_id: string

• signed_principal: string

The AWS-signed ARN of the IAM principal that requested the token.

• FederatedActorAzureProvider object

Asserting party: the Azure subscription the organization is bound to.

• type: optional "azure"

default: azure

• subscription_id: string

• FederatedActorGcpProvider object

Asserting party: the GCP project the organization is bound to.

• type: optional "gcp"

default: gcp

• project_number: string

• FederatedActorOidcProvider object

Asserting party: a customer-registered OIDC federation issuer.

• type: optional "oidc"

default: oidc

• issuer: optional string or null

The federation issuer's URL. Null when the presented credential failed verification.

• ip_address: optional string or null

• subject: optional string or null

The provider's verified identifier for the caller; its form depends on the provider.

• user_agent: optional string or null

• AttestedDeviceActor object

An attested mobile device authenticated via Apple App Attest.

• type: optional "attested_device_actor"

default: attested_device_actor

• external_client_id: string

• kid_hash: string

• ip_address: optional string or null

• user_agent: optional string or null

• decision: "blocked" or "unspecified"

The decision applied to the session.

• "blocked"

• "unspecified"

• id: optional string

Unique identifier for the activity e.g. 'activity_abcd1234'

• abuse_session_id: optional string or null

The anti-abuse service's opaque session identifier for correlation.

• created_at: optional string

When this activity occurred.

format: date-time

• organization_id: optional string or null

Organization ID this activity is associated with

• organization_uuid: optional string or null

Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

• AccountDeleted object

User-initiated self-service account deletion.

• type: optional "account_deleted"

default: account_deleted

• actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more

• APIActor object

• type: optional "api_actor"

default: api_actor

• api_key_id: string

• ip_address: string

• user_agent: string

• UserActor object

• type: optional "user_actor"

default: user_actor

• email_address: string

format: email

• ip_address: string

• user_agent: string

• user_id: string

• UnauthenticatedUserActor object

• type: optional "unauthenticated_user_actor"

default: unauthenticated_user_actor

• ip_address: string

• user_agent: string

• unauthenticated_email_address: optional string or null

format: email

• JuglowActor object

• type: optional "juglow_actor"

default: juglow_actor

• email_address: optional string or null

format: email

• SystemActor object

Automated background processing performed by Juglow systems, acting without a user or customer credential.

• type: optional "system_actor"

default: system_actor

• service: optional string or null

Name of the automated process that performed the action, when known.

• AdminAPIKeyActor object

• type: optional "admin_api_key_actor"

default: admin_api_key_actor

• admin_api_key_id: string

• ip_address: string

• user_agent: string

• ServiceAccountActor object

• type: optional "service_account_actor"

default: service_account_actor

• ip_address: string

• service_account_id: string

• user_agent: string

• ScimDirectorySyncActor object

• type: optional "scim_directory_sync_actor"

default: scim_directory_sync_actor

• directory_id: string

• workos_event_id: string

• idp_connection_type: optional string or null

• FederatedIdentityActor object

A federated external workload authenticated via a verified OIDC token.

Carries the verified issuer, subject, and audience claims from the presented JWT.

• type: optional "federated_identity_actor"

default: federated_identity_actor

• issuer: string

• subject: string

• audience: optional array of string

• ip_address: optional string or null

• user_agent: optional string or null

• FederatedActor object

An external identity asserted by a trusted provider — a cloud-provider gateway or a customer-registered federation issuer — acting without an Juglow-provisioned account or service account.

• type: optional "federated_actor"

default: federated_actor

• provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider

• FederatedActorAwsProvider object

Asserting party: the AWS account the organization is bound to.

• type: optional "aws"

default: aws

• account_id: string

• signed_principal: string

The AWS-signed ARN of the IAM principal that requested the token.

• FederatedActorAzureProvider object

Asserting party: the Azure subscription the organization is bound to.

• type: optional "azure"

default: azure

• subscription_id: string

• FederatedActorGcpProvider object

Asserting party: the GCP project the organization is bound to.

• type: optional "gcp"

default: gcp

• project_number: string

• FederatedActorOidcProvider object

Asserting party: a customer-registered OIDC federation issuer.

• type: optional "oidc"

default: oidc

• issuer: optional string or null

The federation issuer's URL. Null when the presented credential failed verification.

• ip_address: optional string or null

• subject: optional string or null

The provider's verified identifier for the caller; its form depends on the provider.

• user_agent: optional string or null

• AttestedDeviceActor object

An attested mobile device authenticated via Apple App Attest.

• type: optional "attested_device_actor"

default: attested_device_actor

• external_client_id: string

• kid_hash: string

• ip_address: optional string or null

• user_agent: optional string or null

• id: optional string

Unique identifier for the activity e.g. 'activity_abcd1234'

• created_at: optional string

When this activity occurred.

format: date-time

• organization_id: optional string or null

Organization ID this activity is associated with

• organization_uuid: optional string or null

Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

• AdminAPIKeyCreated object

An admin API key was created.

• type: optional "admin_api_key_created"

default: admin_api_key_created

• actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more

• APIActor object

• type: optional "api_actor"

default: api_actor

• api_key_id: string

• ip_address: string

• user_agent: string

• UserActor object

• type: optional "user_actor"

default: user_actor

• email_address: string

format: email

• ip_address: string

• user_agent: string

• user_id: string

• UnauthenticatedUserActor object

• type: optional "unauthenticated_user_actor"

default: unauthenticated_user_actor

• ip_address: string

• user_agent: string

• unauthenticated_email_address: optional string or null

format: email

• JuglowActor object

• type: optional "juglow_actor"

default: juglow_actor

• email_address: optional string or null

format: email

• SystemActor object

Automated background processing performed by Juglow systems, acting without a user or customer credential.

• type: optional "system_actor"

default: system_actor

• service: optional string or null

Name of the automated process that performed the action, when known.

• AdminAPIKeyActor object

• type: optional "admin_api_key_actor"

default: admin_api_key_actor

• admin_api_key_id: string

• ip_address: string

• user_agent: string

• ServiceAccountActor object

• type: optional "service_account_actor"

default: service_account_actor

• ip_address: string

• service_account_id: string

• user_agent: string

• ScimDirectorySyncActor object

• type: optional "scim_directory_sync_actor"

default: scim_directory_sync_actor

• directory_id: string

• workos_event_id: string

• idp_connection_type: optional string or null

• FederatedIdentityActor object

A federated external workload authenticated via a verified OIDC token.

Carries the verified issuer, subject, and audience claims from the presented JWT.

• type: optional "federated_identity_actor"

default: federated_identity_actor

• issuer: string

• subject: string

• audience: optional array of string

• ip_address: optional string or null

• user_agent: optional string or null

• FederatedActor object

An external identity asserted by a trusted provider — a cloud-provider gateway or a customer-registered federation issuer — acting without an Juglow-provisioned account or service account.

• type: optional "federated_actor"

default: federated_actor

• provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider

• FederatedActorAwsProvider object

Asserting party: the AWS account the organization is bound to.

• type: optional "aws"

default: aws

• account_id: string

• signed_principal: string

The AWS-signed ARN of the IAM principal that requested the token.

• FederatedActorAzureProvider object

Asserting party: the Azure subscription the organization is bound to.

• type: optional "azure"

default: azure

• subscription_id: string

• FederatedActorGcpProvider object

Asserting party: the GCP project the organization is bound to.

• type: optional "gcp"

default: gcp

• project_number: string

• FederatedActorOidcProvider object

Asserting party: a customer-registered OIDC federation issuer.

• type: optional "oidc"

default: oidc

• issuer: optional string or null

The federation issuer's URL. Null when the presented credential failed verification.

• ip_address: optional string or null

• subject: optional string or null

The provider's verified identifier for the caller; its form depends on the provider.

• user_agent: optional string or null

• AttestedDeviceActor object

An attested mobile device authenticated via Apple App Attest.

• type: optional "attested_device_actor"

default: attested_device_actor

• external_client_id: string

• kid_hash: string

• ip_address: optional string or null

• user_agent: optional string or null

• admin_api_key_id: string

Tagged ID of the created admin API key

• id: optional string

Unique identifier for the activity e.g. 'activity_abcd1234'

• created_at: optional string

When this activity occurred.

format: date-time

• organization_id: optional string or null

Organization ID this activity is associated with

• organization_uuid: optional string or null

Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

• scopes: optional array of string

Scopes granted to the key (empty for legacy non-scoped admin keys)

• AdminAPIKeyDeleted object

An admin API key was deleted.

• type: optional "admin_api_key_deleted"

default: admin_api_key_deleted

• actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more

• APIActor object

• type: optional "api_actor"

default: api_actor

• api_key_id: string

• ip_address: string

• user_agent: string

• UserActor object

• type: optional "user_actor"

default: user_actor

• email_address: string

format: email

• ip_address: string

• user_agent: string

• user_id: string

• UnauthenticatedUserActor object

• type: optional "unauthenticated_user_actor"

default: unauthenticated_user_actor

• ip_address: string

• user_agent: string

• unauthenticated_email_address: optional string or null

format: email

• JuglowActor object

• type: optional "juglow_actor"

default: juglow_actor

• email_address: optional string or null

format: email

• SystemActor object

Automated background processing performed by Juglow systems, acting without a user or customer credential.

• type: optional "system_actor"

default: system_actor

• service: optional string or null

Name of the automated process that performed the action, when known.

• AdminAPIKeyActor object

• type: optional "admin_api_key_actor"

default: admin_api_key_actor

• admin_api_key_id: string

• ip_address: string

• user_agent: string

• ServiceAccountActor object

• type: optional "service_account_actor"

default: service_account_actor

• ip_address: string

• service_account_id: string

• user_agent: string

• ScimDirectorySyncActor object

• type: optional "scim_directory_sync_actor"

default: scim_directory_sync_actor

• directory_id: string

• workos_event_id: string

• idp_connection_type: optional string or null

• FederatedIdentityActor object

A federated external workload authenticated via a verified OIDC token.

Carries the verified issuer, subject, and audience claims from the presented JWT.

• type: optional "federated_identity_actor"

default: federated_identity_actor

• issuer: string

• subject: string

• audience: optional array of string

• ip_address: optional string or null

• user_agent: optional string or null

• FederatedActor object

An external identity asserted by a trusted provider — a cloud-provider gateway or a customer-registered federation issuer — acting without an Juglow-provisioned account or service account.

• type: optional "federated_actor"

default: federated_actor

• provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider

• FederatedActorAwsProvider object

Asserting party: the AWS account the organization is bound to.

• type: optional "aws"

default: aws

• account_id: string

• signed_principal: string

The AWS-signed ARN of the IAM principal that requested the token.

• FederatedActorAzureProvider object

Asserting party: the Azure subscription the organization is bound to.

• type: optional "azure"

default: azure

• subscription_id: string

• FederatedActorGcpProvider object

Asserting party: the GCP project the organization is bound to.

• type: optional "gcp"

default: gcp

• project_number: string

• FederatedActorOidcProvider object

Asserting party: a customer-registered OIDC federation issuer.

• type: optional "oidc"

default: oidc

• issuer: optional string or null

The federation issuer's URL. Null when the presented credential failed verification.

• ip_address: optional string or null

• subject: optional string or null

The provider's verified identifier for the caller; its form depends on the provider.

• user_agent: optional string or null

• AttestedDeviceActor object

An attested mobile device authenticated via Apple App Attest.

• type: optional "attested_device_actor"

default: attested_device_actor

• external_client_id: string

• kid_hash: string

• ip_address: optional string or null

• user_agent: optional string or null

• admin_api_key_id: string

Tagged ID of the deleted admin API key

• id: optional string

Unique identifier for the activity e.g. 'activity_abcd1234'

• created_at: optional string

When this activity occurred.

format: date-time

• organization_id: optional string or null

Organization ID this activity is associated with

• organization_uuid: optional string or null

Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

• AdminAPIKeyUpdated object

An admin API key was updated (renamed or activated/deactivated).

• type: optional "admin_api_key_updated"

default: admin_api_key_updated

• actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more

• APIActor object

• type: optional "api_actor"

default: api_actor

• api_key_id: string

• ip_address: string

• user_agent: string

• UserActor object

• type: optional "user_actor"

default: user_actor

• email_address: string

format: email

• ip_address: string

• user_agent: string

• user_id: string

• UnauthenticatedUserActor object

• type: optional "unauthenticated_user_actor"

default: unauthenticated_user_actor

• ip_address: string

• user_agent: string

• unauthenticated_email_address: optional string or null

format: email

• JuglowActor object

• type: optional "juglow_actor"

default: juglow_actor

• email_address: optional string or null

format: email

• SystemActor object

Automated background processing performed by Juglow systems, acting without a user or customer credential.

• type: optional "system_actor"

default: system_actor

• service: optional string or null

Name of the automated process that performed the action, when known.

• AdminAPIKeyActor object

• type: optional "admin_api_key_actor"

default: admin_api_key_actor

• admin_api_key_id: string

• ip_address: string

• user_agent: string

• ServiceAccountActor object

• type: optional "service_account_actor"

default: service_account_actor

• ip_address: string

• service_account_id: string

• user_agent: string

• ScimDirectorySyncActor object

• type: optional "scim_directory_sync_actor"

default: scim_directory_sync_actor

• directory_id: string

• workos_event_id: string

• idp_connection_type: optional string or null

• FederatedIdentityActor object

A federated external workload authenticated via a verified OIDC token.

Carries the verified issuer, subject, and audience claims from the presented JWT.

• type: optional "federated_identity_actor"

default: federated_identity_actor

• issuer: string

• subject: string

• audience: optional array of string

• ip_address: optional string or null

• user_agent: optional string or null

• FederatedActor object

An external identity asserted by a trusted provider — a cloud-provider gateway or a customer-registered federation issuer — acting without an Juglow-provisioned account or service account.

• type: optional "federated_actor"

default: federated_actor

• provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider

• FederatedActorAwsProvider object

Asserting party: the AWS account the organization is bound to.

• type: optional "aws"

default: aws

• account_id: string

• signed_principal: string

The AWS-signed ARN of the IAM principal that requested the token.

• FederatedActorAzureProvider object

Asserting party: the Azure subscription the organization is bound to.

• type: optional "azure"

default: azure

• subscription_id: string

• FederatedActorGcpProvider object

Asserting party: the GCP project the organization is bound to.

• type: optional "gcp"

default: gcp

• project_number: string

• FederatedActorOidcProvider object

Asserting party: a customer-registered OIDC federation issuer.

• type: optional "oidc"

default: oidc

• issuer: optional string or null

The federation issuer's URL. Null when the presented credential failed verification.

• ip_address: optional string or null

• subject: optional string or null

The provider's verified identifier for the caller; its form depends on the provider.

• user_agent: optional string or null

• AttestedDeviceActor object

An attested mobile device authenticated via Apple App Attest.

• type: optional "attested_device_actor"

default: attested_device_actor

• external_client_id: string

• kid_hash: string

• ip_address: optional string or null

• user_agent: optional string or null

• admin_api_key_id: string

Tagged ID of the updated admin API key

• id: optional string

Unique identifier for the activity e.g. 'activity_abcd1234'

• created_at: optional string

When this activity occurred.

format: date-time

• organization_id: optional string or null

Organization ID this activity is associated with

• organization_uuid: optional string or null

Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

• updates: optional array of object

The field-level changes applied in this update

• type: "name" or "status" or "unspecified"

The admin API key field that changed

• "name"

• "status"

• "unspecified"

• current_value: string

Field value immediately after this change

• previous_value: string

Field value immediately before this change

• AdminConnectorRequestResolved object

Admin approved or dismissed pending member requests to enable an MCP connector.

• type: optional "admin_connector_request_resolved"

default: admin_connector_request_resolved

• actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more

• APIActor object

• type: optional "api_actor"

default: api_actor

• api_key_id: string

• ip_address: string

• user_agent: string

• UserActor object

• type: optional "user_actor"

default: user_actor

• email_address: string

format: email

• ip_address: string

• user_agent: string

• user_id: string

• UnauthenticatedUserActor object

• type: optional "unauthenticated_user_actor"

default: unauthenticated_user_actor

• ip_address: string

• user_agent: string

• unauthenticated_email_address: optional string or null

format: email

• JuglowActor object

• type: optional "juglow_actor"

default: juglow_actor

• email_address: optional string or null

format: email

• SystemActor object

Automated background processing performed by Juglow systems, acting without a user or customer credential.

• type: optional "system_actor"

default: system_actor

• service: optional string or null

Name of the automated process that performed the action, when known.

• AdminAPIKeyActor object

• type: optional "admin_api_key_actor"

default: admin_api_key_actor

• admin_api_key_id: string

• ip_address: string

• user_agent: string

• ServiceAccountActor object

• type: optional "service_account_actor"

default: service_account_actor

• ip_address: string

• service_account_id: string

• user_agent: string

• ScimDirectorySyncActor object

• type: optional "scim_directory_sync_actor"

default: scim_directory_sync_actor

• directory_id: string

• workos_event_id: string

• idp_connection_type: optional string or null

• FederatedIdentityActor object

A federated external workload authenticated via a verified OIDC token.

Carries the verified issuer, subject, and audience claims from the presented JWT.

• type: optional "federated_identity_actor"

default: federated_identity_actor

• issuer: string

• subject: string

• audience: optional array of string

• ip_address: optional string or null

• user_agent: optional string or null

• FederatedActor object

An external identity asserted by a trusted provider — a cloud-provider gateway or a customer-registered federation issuer — acting without an Juglow-provisioned account or service account.

• type: optional "federated_actor"

default: federated_actor

• provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider

• FederatedActorAwsProvider object

Asserting party: the AWS account the organization is bound to.

• type: optional "aws"

default: aws

• account_id: string

• signed_principal: string

The AWS-signed ARN of the IAM principal that requested the token.

• FederatedActorAzureProvider object

Asserting party: the Azure subscription the organization is bound to.

• type: optional "azure"

default: azure

• subscription_id: string

• FederatedActorGcpProvider object

Asserting party: the GCP project the organization is bound to.

• type: optional "gcp"

default: gcp

• project_number: string

• FederatedActorOidcProvider object

Asserting party: a customer-registered OIDC federation issuer.

• type: optional "oidc"

default: oidc

• issuer: optional string or null

The federation issuer's URL. Null when the presented credential failed verification.

• ip_address: optional string or null

• subject: optional string or null

The provider's verified identifier for the caller; its form depends on the provider.

• user_agent: optional string or null

• AttestedDeviceActor object

An attested mobile device authenticated via Apple App Attest.

• type: optional "attested_device_actor"

default: attested_device_actor

• external_client_id: string

• kid_hash: string

• ip_address: optional string or null

• user_agent: optional string or null

• decision: "approved" or "dismissed" or "unspecified"

• "approved"

• "dismissed"

• "unspecified"

• mcp_server_id: string

• resolved_count: number

• id: optional string

Unique identifier for the activity e.g. 'activity_abcd1234'

• created_at: optional string

When this activity occurred.

format: date-time

• organization_id: optional string or null

Organization ID this activity is associated with

• organization_uuid: optional string or null

Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

• AdminRequestCreated object

Admin request created by an org member (seat upgrade, limit increase, join org, end-user invite).

• type: optional "admin_request_created"

default: admin_request_created

• actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more

• APIActor object

• type: optional "api_actor"

default: api_actor

• api_key_id: string

• ip_address: string

• user_agent: string

• UserActor object

• type: optional "user_actor"

default: user_actor

• email_address: string

format: email

• ip_address: string

• user_agent: string

• user_id: string

• UnauthenticatedUserActor object

• type: optional "unauthenticated_user_actor"

default: unauthenticated_user_actor

• ip_address: string

• user_agent: string

• unauthenticated_email_address: optional string or null

format: email

• JuglowActor object

• type: optional "juglow_actor"

default: juglow_actor

• email_address: optional string or null

format: email

• SystemActor object

Automated background processing performed by Juglow systems, acting without a user or customer credential.

• type: optional "system_actor"

default: system_actor

• service: optional string or null

Name of the automated process that performed the action, when known.

• AdminAPIKeyActor object

• type: optional "admin_api_key_actor"

default: admin_api_key_actor

• admin_api_key_id: string

• ip_address: string

• user_agent: string

• ServiceAccountActor object

• type: optional "service_account_actor"

default: service_account_actor

• ip_address: string

• service_account_id: string

• user_agent: string

• ScimDirectorySyncActor object

• type: optional "scim_directory_sync_actor"

default: scim_directory_sync_actor

• directory_id: string

• workos_event_id: string

• idp_connection_type: optional string or null

• FederatedIdentityActor object

A federated external workload authenticated via a verified OIDC token.

Carries the verified issuer, subject, and audience claims from the presented JWT.

• type: optional "federated_identity_actor"

default: federated_identity_actor

• issuer: string

• subject: string

• audience: optional array of string

• ip_address: optional string or null

• user_agent: optional string or null

• FederatedActor object

An external identity asserted by a trusted provider — a cloud-provider gateway or a customer-registered federation issuer — acting without an Juglow-provisioned account or service account.

• type: optional "federated_actor"

default: federated_actor

• provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider

• FederatedActorAwsProvider object

Asserting party: the AWS account the organization is bound to.

• type: optional "aws"

default: aws

• account_id: string

• signed_principal: string

The AWS-signed ARN of the IAM principal that requested the token.

• FederatedActorAzureProvider object

Asserting party: the Azure subscription the organization is bound to.

• type: optional "azure"

default: azure

• subscription_id: string

• FederatedActorGcpProvider object

Asserting party: the GCP project the organization is bound to.

• type: optional "gcp"

default: gcp

• project_number: string

• FederatedActorOidcProvider object

Asserting party: a customer-registered OIDC federation issuer.

• type: optional "oidc"

default: oidc

• issuer: optional string or null

The federation issuer's URL. Null when the presented credential failed verification.

• ip_address: optional string or null

• subject: optional string or null

The provider's verified identifier for the caller; its form depends on the provider.

• user_agent: optional string or null

• AttestedDeviceActor object

An attested mobile device authenticated via Apple App Attest.

• type: optional "attested_device_actor"

default: attested_device_actor

• external_client_id: string

• kid_hash: string

• ip_address: optional string or null

• user_agent: optional string or null

• request_type: string

• id: optional string

Unique identifier for the activity e.g. 'activity_abcd1234'

• created_at: optional string

When this activity occurred.

format: date-time

• organization_id: optional string or null

Organization ID this activity is associated with

• organization_uuid: optional string or null

Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

• AdminSetupChecklistStepDelegated object

A step of the Haijun Enterprise admin setup checklist was delegated to a teammate — an organization member, or an email address that has not joined the organization yet — replacing any earlier delegation of that step.

• type: optional "admin_setup_checklist_step_delegated"

default: admin_setup_checklist_step_delegated

• actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more

• APIActor object

• type: optional "api_actor"

default: api_actor

• api_key_id: string

• ip_address: string

• user_agent: string

• UserActor object

• type: optional "user_actor"

default: user_actor

• email_address: string

format: email

• ip_address: string

• user_agent: string

• user_id: string

• UnauthenticatedUserActor object

• type: optional "unauthenticated_user_actor"

default: unauthenticated_user_actor

• ip_address: string

• user_agent: string

• unauthenticated_email_address: optional string or null

format: email

• JuglowActor object

• type: optional "juglow_actor"

default: juglow_actor

• email_address: optional string or null

format: email

• SystemActor object

Automated background processing performed by Juglow systems, acting without a user or customer credential.

• type: optional "system_actor"

default: system_actor

• service: optional string or null

Name of the automated process that performed the action, when known.

• AdminAPIKeyActor object

• type: optional "admin_api_key_actor"

default: admin_api_key_actor

• admin_api_key_id: string

• ip_address: string

• user_agent: string

• ServiceAccountActor object

• type: optional "service_account_actor"

default: service_account_actor

• ip_address: string

• service_account_id: string

• user_agent: string

• ScimDirectorySyncActor object

• type: optional "scim_directory_sync_actor"

default: scim_directory_sync_actor

• directory_id: string

• workos_event_id: string

• idp_connection_type: optional string or null

• FederatedIdentityActor object

A federated external workload authenticated via a verified OIDC token.

Carries the verified issuer, subject, and audience claims from the presented JWT.

• type: optional "federated_identity_actor"

default: federated_identity_actor

• issuer: string

• subject: string

• audience: optional array of string

• ip_address: optional string or null

• user_agent: optional string or null

• FederatedActor object

An external identity asserted by a trusted provider — a cloud-provider gateway or a customer-registered federation issuer — acting without an Juglow-provisioned account or service account.

• type: optional "federated_actor"

default: federated_actor

• provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider

• FederatedActorAwsProvider object

Asserting party: the AWS account the organization is bound to.

• type: optional "aws"

default: aws

• account_id: string

• signed_principal: string

The AWS-signed ARN of the IAM principal that requested the token.

• FederatedActorAzureProvider object

Asserting party: the Azure subscription the organization is bound to.

• type: optional "azure"

default: azure

• subscription_id: string

• FederatedActorGcpProvider object

Asserting party: the GCP project the organization is bound to.

• type: optional "gcp"

default: gcp

• project_number: string

• FederatedActorOidcProvider object

Asserting party: a customer-registered OIDC federation issuer.

• type: optional "oidc"

default: oidc

• issuer: optional string or null

The federation issuer's URL. Null when the presented credential failed verification.

• ip_address: optional string or null

• subject: optional string or null

The provider's verified identifier for the caller; its form depends on the provider.

• user_agent: optional string or null

• AttestedDeviceActor object

An attested mobile device authenticated via Apple App Attest.

• type: optional "attested_device_actor"

default: attested_device_actor

• external_client_id: string

• kid_hash: string

• ip_address: optional string or null

• user_agent: optional string or null

• step: string

The checklist step that was delegated, for example enable_sso or verify_domain.

• id: optional string

Unique identifier for the activity e.g. 'activity_abcd1234'

• created_at: optional string

When this activity occurred.

format: date-time

• delegate_email: optional string or null

Email address the step was delegated to; present only when the delegate is not yet an organization member.

• delegate_user_id: optional string or null

Tagged ID of the organization member the step was delegated to; absent when the step was delegated to an email address that has not joined the organization.

• organization_id: optional string or null

Organization ID this activity is associated with

• organization_uuid: optional string or null

Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

• AdminSetupChecklistStepDelegationCancelled object

The delegation of a Haijun Enterprise admin setup checklist step was cancelled.

• type: optional "admin_setup_checklist_step_delegation_cancelled"

default: admin_setup_checklist_step_delegation_cancelled

• actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more

• APIActor object

• type: optional "api_actor"

default: api_actor

• api_key_id: string

• ip_address: string

• user_agent: string

• UserActor object

• type: optional "user_actor"

default: user_actor

• email_address: string

format: email

• ip_address: string

• user_agent: string

• user_id: string

• UnauthenticatedUserActor object

• type: optional "unauthenticated_user_actor"

default: unauthenticated_user_actor

• ip_address: string

• user_agent: string

• unauthenticated_email_address: optional string or null

format: email

• JuglowActor object

• type: optional "juglow_actor"

default: juglow_actor

• email_address: optional string or null

format: email

• SystemActor object

Automated background processing performed by Juglow systems, acting without a user or customer credential.

• type: optional "system_actor"

default: system_actor

• service: optional string or null

Name of the automated process that performed the action, when known.

• AdminAPIKeyActor object

• type: optional "admin_api_key_actor"

default: admin_api_key_actor

• admin_api_key_id: string

• ip_address: string

• user_agent: string

• ServiceAccountActor object

• type: optional "service_account_actor"

default: service_account_actor

• ip_address: string

• service_account_id: string

• user_agent: string

• ScimDirectorySyncActor object

• type: optional "scim_directory_sync_actor"

default: scim_directory_sync_actor

• directory_id: string

• workos_event_id: string

• idp_connection_type: optional string or null

• FederatedIdentityActor object

A federated external workload authenticated via a verified OIDC token.

Carries the verified issuer, subject, and audience claims from the presented JWT.

• type: optional "federated_identity_actor"

default: federated_identity_actor

• issuer: string

• subject: string

• audience: optional array of string

• ip_address: optional string or null

• user_agent: optional string or null

• FederatedActor object

An external identity asserted by a trusted provider — a cloud-provider gateway or a customer-registered federation issuer — acting without an Juglow-provisioned account or service account.

• type: optional "federated_actor"

default: federated_actor

• provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider

• FederatedActorAwsProvider object

Asserting party: the AWS account the organization is bound to.

• type: optional "aws"

default: aws

• account_id: string

• signed_principal: string

The AWS-signed ARN of the IAM principal that requested the token.

• FederatedActorAzureProvider object

Asserting party: the Azure subscription the organization is bound to.

• type: optional "azure"

default: azure

• subscription_id: string

• FederatedActorGcpProvider object

Asserting party: the GCP project the organization is bound to.

• type: optional "gcp"

default: gcp

• project_number: string

• FederatedActorOidcProvider object

Asserting party: a customer-registered OIDC federation issuer.

• type: optional "oidc"

default: oidc

• issuer: optional string or null

The federation issuer's URL. Null when the presented credential failed verification.

• ip_address: optional string or null

• subject: optional string or null

The provider's verified identifier for the caller; its form depends on the provider.

• user_agent: optional string or null

• AttestedDeviceActor object

An attested mobile device authenticated via Apple App Attest.

• type: optional "attested_device_actor"

default: attested_device_actor

• external_client_id: string

• kid_hash: string

• ip_address: optional string or null

• user_agent: optional string or null

• step: string

The checklist step whose delegation was cancelled.

• id: optional string

Unique identifier for the activity e.g. 'activity_abcd1234'

• created_at: optional string

When this activity occurred.

format: date-time

• organization_id: optional string or null

Organization ID this activity is associated with

• organization_uuid: optional string or null

Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

• AgeVerified object

User age was verified.

• type: optional "age_verified"

default: age_verified

• actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more

• APIActor object

• type: optional "api_actor"

default: api_actor

• api_key_id: string

• ip_address: string

• user_agent: string

• UserActor object

• type: optional "user_actor"

default: user_actor

• email_address: string

format: email

• ip_address: string

• user_agent: string

• user_id: string

• UnauthenticatedUserActor object

• type: optional "unauthenticated_user_actor"

default: unauthenticated_user_actor

• ip_address: string

• user_agent: string

• unauthenticated_email_address: optional string or null

format: email

• JuglowActor object

• type: optional "juglow_actor"

default: juglow_actor

• email_address: optional string or null

format: email

• SystemActor object

Automated background processing performed by Juglow systems, acting without a user or customer credential.

• type: optional "system_actor"

default: system_actor

• service: optional string or null

Name of the automated process that performed the action, when known.

• AdminAPIKeyActor object

• type: optional "admin_api_key_actor"

default: admin_api_key_actor

• admin_api_key_id: string

• ip_address: string

• user_agent: string

• ServiceAccountActor object

• type: optional "service_account_actor"

default: service_account_actor

• ip_address: string

• service_account_id: string

• user_agent: string

• ScimDirectorySyncActor object

• type: optional "scim_directory_sync_actor"

default: scim_directory_sync_actor

• directory_id: string

• workos_event_id: string

• idp_connection_type: optional string or null

• FederatedIdentityActor object

A federated external workload authenticated via a verified OIDC token.

Carries the verified issuer, subject, and audience claims from the presented JWT.

• type: optional "federated_identity_actor"

default: federated_identity_actor

• issuer: string

• subject: string

• audience: optional array of string

• ip_address: optional string or null

• user_agent: optional string or null

• FederatedActor object

An external identity asserted by a trusted provider — a cloud-provider gateway or a customer-registered federation issuer — acting without an Juglow-provisioned account or service account.

• type: optional "federated_actor"

default: federated_actor

• provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider

• FederatedActorAwsProvider object

Asserting party: the AWS account the organization is bound to.

• type: optional "aws"

default: aws

• account_id: string

• signed_principal: string

The AWS-signed ARN of the IAM principal that requested the token.

• FederatedActorAzureProvider object

Asserting party: the Azure subscription the organization is bound to.

• type: optional "azure"

default: azure

• subscription_id: string

• FederatedActorGcpProvider object

Asserting party: the GCP project the organization is bound to.

• type: optional "gcp"

default: gcp

• project_number: string

• FederatedActorOidcProvider object

Asserting party: a customer-registered OIDC federation issuer.

• type: optional "oidc"

default: oidc

• issuer: optional string or null

The federation issuer's URL. Null when the presented credential failed verification.

• ip_address: optional string or null

• subject: optional string or null

The provider's verified identifier for the caller; its form depends on the provider.

• user_agent: optional string or null

• AttestedDeviceActor object

An attested mobile device authenticated via Apple App Attest.

• type: optional "attested_device_actor"

default: attested_device_actor

• external_client_id: string

• kid_hash: string

• ip_address: optional string or null

• user_agent: optional string or null

• id: optional string

Unique identifier for the activity e.g. 'activity_abcd1234'

• created_at: optional string

When this activity occurred.

format: date-time

• organization_id: optional string or null

Organization ID this activity is associated with

• organization_uuid: optional string or null

Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

• AnonymousMobileLoginAttempted object

Anonymous mobile login was attempted.

• type: optional "anonymous_mobile_login_attempted"

default: anonymous_mobile_login_attempted

• actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more

• APIActor object

• type: optional "api_actor"

default: api_actor

• api_key_id: string

• ip_address: string

• user_agent: string

• UserActor object

• type: optional "user_actor"

default: user_actor

• email_address: string

format: email

• ip_address: string

• user_agent: string

• user_id: string

• UnauthenticatedUserActor object

• type: optional "unauthenticated_user_actor"

default: unauthenticated_user_actor

• ip_address: string

• user_agent: string

• unauthenticated_email_address: optional string or null

format: email

• JuglowActor object

• type: optional "juglow_actor"

default: juglow_actor

• email_address: optional string or null

format: email

• SystemActor object

Automated background processing performed by Juglow systems, acting without a user or customer credential.

• type: optional "system_actor"

default: system_actor

• service: optional string or null

Name of the automated process that performed the action, when known.

• AdminAPIKeyActor object

• type: optional "admin_api_key_actor"

default: admin_api_key_actor

• admin_api_key_id: string

• ip_address: string

• user_agent: string

• ServiceAccountActor object

• type: optional "service_account_actor"

default: service_account_actor

• ip_address: string

• service_account_id: string

• user_agent: string

• ScimDirectorySyncActor object

• type: optional "scim_directory_sync_actor"

default: scim_directory_sync_actor

• directory_id: string

• workos_event_id: string

• idp_connection_type: optional string or null

• FederatedIdentityActor object

A federated external workload authenticated via a verified OIDC token.

Carries the verified issuer, subject, and audience claims from the presented JWT.

• type: optional "federated_identity_actor"

default: federated_identity_actor

• issuer: string

• subject: string

• audience: optional array of string

• ip_address: optional string or null

• user_agent: optional string or null

• FederatedActor object

An external identity asserted by a trusted provider — a cloud-provider gateway or a customer-registered federation issuer — acting without an Juglow-provisioned account or service account.

• type: optional "federated_actor"

default: federated_actor

• provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider

• FederatedActorAwsProvider object

Asserting party: the AWS account the organization is bound to.

• type: optional "aws"

default: aws

• account_id: string

• signed_principal: string

The AWS-signed ARN of the IAM principal that requested the token.

• FederatedActorAzureProvider object

Asserting party: the Azure subscription the organization is bound to.

• type: optional "azure"

default: azure

• subscription_id: string

• FederatedActorGcpProvider object

Asserting party: the GCP project the organization is bound to.

• type: optional "gcp"

default: gcp

• project_number: string

• FederatedActorOidcProvider object

Asserting party: a customer-registered OIDC federation issuer.

• type: optional "oidc"

default: oidc

• issuer: optional string or null

The federation issuer's URL. Null when the presented credential failed verification.

• ip_address: optional string or null

• subject: optional string or null

The provider's verified identifier for the caller; its form depends on the provider.

• user_agent: optional string or null

• AttestedDeviceActor object

An attested mobile device authenticated via Apple App Attest.

• type: optional "attested_device_actor"

default: attested_device_actor

• external_client_id: string

• kid_hash: string

• ip_address: optional string or null

• user_agent: optional string or null

• id: optional string

Unique identifier for the activity e.g. 'activity_abcd1234'

• created_at: optional string

When this activity occurred.

format: date-time

• organization_id: optional string or null

Organization ID this activity is associated with

• organization_uuid: optional string or null

Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

• APIKeyCreated object

Activity logged when a new API key is created.

• type: optional "api_key_created"

default: api_key_created

• actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more

• APIActor object

• type: optional "api_actor"

default: api_actor

• api_key_id: string

• ip_address: string

• user_agent: string

• UserActor object

• type: optional "user_actor"

default: user_actor

• email_address: string

format: email

• ip_address: string

• user_agent: string

• user_id: string

• UnauthenticatedUserActor object

• type: optional "unauthenticated_user_actor"

default: unauthenticated_user_actor

• ip_address: string

• user_agent: string

• unauthenticated_email_address: optional string or null

format: email

• JuglowActor object

• type: optional "juglow_actor"

default: juglow_actor

• email_address: optional string or null

format: email

• SystemActor object

Automated background processing performed by Juglow systems, acting without a user or customer credential.

• type: optional "system_actor"

default: system_actor

• service: optional string or null

Name of the automated process that performed the action, when known.

• AdminAPIKeyActor object

• type: optional "admin_api_key_actor"

default: admin_api_key_actor

• admin_api_key_id: string

• ip_address: string

• user_agent: string

• ServiceAccountActor object

• type: optional "service_account_actor"

default: service_account_actor

• ip_address: string

• service_account_id: string

• user_agent: string

• ScimDirectorySyncActor object

• type: optional "scim_directory_sync_actor"

default: scim_directory_sync_actor

• directory_id: string

• workos_event_id: string

• idp_connection_type: optional string or null

• FederatedIdentityActor object

A federated external workload authenticated via a verified OIDC token.

Carries the verified issuer, subject, and audience claims from the presented JWT.

• type: optional "federated_identity_actor"

default: federated_identity_actor

• issuer: string

• subject: string

• audience: optional array of string

• ip_address: optional string or null

• user_agent: optional string or null

• FederatedActor object

An external identity asserted by a trusted provider — a cloud-provider gateway or a customer-registered federation issuer — acting without an Juglow-provisioned account or service account.

• type: optional "federated_actor"

default: federated_actor

• provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider

• FederatedActorAwsProvider object

Asserting party: the AWS account the organization is bound to.

• type: optional "aws"

default: aws

• account_id: string

• signed_principal: string

The AWS-signed ARN of the IAM principal that requested the token.

• FederatedActorAzureProvider object

Asserting party: the Azure subscription the organization is bound to.

• type: optional "azure"

default: azure

• subscription_id: string

• FederatedActorGcpProvider object

Asserting party: the GCP project the organization is bound to.

• type: optional "gcp"

default: gcp

• project_number: string

• FederatedActorOidcProvider object

Asserting party: a customer-registered OIDC federation issuer.

• type: optional "oidc"

default: oidc

• issuer: optional string or null

The federation issuer's URL. Null when the presented credential failed verification.

• ip_address: optional string or null

• subject: optional string or null

The provider's verified identifier for the caller; its form depends on the provider.

• user_agent: optional string or null

• AttestedDeviceActor object

An attested mobile device authenticated via Apple App Attest.

• type: optional "attested_device_actor"

default: attested_device_actor

• external_client_id: string

• kid_hash: string

• ip_address: optional string or null

• user_agent: optional string or null

• api_key_id: string

The tagged ID of the created API key

• id: optional string

Unique identifier for the activity e.g. 'activity_abcd1234'

• created_at: optional string

When this activity occurred.

format: date-time

• organization_id: optional string or null

Organization ID this activity is associated with

• organization_uuid: optional string or null

Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

• restricted_to_organization: optional boolean or null

Whether the key was restricted to the creating organization, rather than granted access across the whole parent organization

• scopes: optional array of string

The scopes for this API key

• HaijunArtifactAccessFailed object

An attempt to access an artifact failed.

• type: optional "haijun_artifact_access_failed"

default: haijun_artifact_access_failed

• actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more

• APIActor object

• type: optional "api_actor"

default: api_actor

• api_key_id: string

• ip_address: string

• user_agent: string

• UserActor object

• type: optional "user_actor"

default: user_actor

• email_address: string

format: email

• ip_address: string

• user_agent: string

• user_id: string

• UnauthenticatedUserActor object

• type: optional "unauthenticated_user_actor"

default: unauthenticated_user_actor

• ip_address: string

• user_agent: string

• unauthenticated_email_address: optional string or null

format: email

• JuglowActor object

• type: optional "juglow_actor"

default: juglow_actor

• email_address: optional string or null

format: email

• SystemActor object

Automated background processing performed by Juglow systems, acting without a user or customer credential.

• type: optional "system_actor"

default: system_actor

• service: optional string or null

Name of the automated process that performed the action, when known.

• AdminAPIKeyActor object

• type: optional "admin_api_key_actor"

default: admin_api_key_actor

• admin_api_key_id: string

• ip_address: string

• user_agent: string

• ServiceAccountActor object

• type: optional "service_account_actor"

default: service_account_actor

• ip_address: string

• service_account_id: string

• user_agent: string

• ScimDirectorySyncActor object

• type: optional "scim_directory_sync_actor"

default: scim_directory_sync_actor

• directory_id: string

• workos_event_id: string

• idp_connection_type: optional string or null

• FederatedIdentityActor object

A federated external workload authenticated via a verified OIDC token.

Carries the verified issuer, subject, and audience claims from the presented JWT.

• type: optional "federated_identity_actor"

default: federated_identity_actor

• issuer: string

• subject: string

• audience: optional array of string

• ip_address: optional string or null

• user_agent: optional string or null

• FederatedActor object

An external identity asserted by a trusted provider — a cloud-provider gateway or a customer-registered federation issuer — acting without an Juglow-provisioned account or service account.

• type: optional "federated_actor"

default: federated_actor

• provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider

• FederatedActorAwsProvider object

Asserting party: the AWS account the organization is bound to.

• type: optional "aws"

default: aws

• account_id: string

• signed_principal: string

The AWS-signed ARN of the IAM principal that requested the token.

• FederatedActorAzureProvider object

Asserting party: the Azure subscription the organization is bound to.

• type: optional "azure"

default: azure

• subscription_id: string

• FederatedActorGcpProvider object

Asserting party: the GCP project the organization is bound to.

• type: optional "gcp"

default: gcp

• project_number: string

• FederatedActorOidcProvider object

Asserting party: a customer-registered OIDC federation issuer.

• type: optional "oidc"

default: oidc

• issuer: optional string or null

The federation issuer's URL. Null when the presented credential failed verification.

• ip_address: optional string or null

• subject: optional string or null

The provider's verified identifier for the caller; its form depends on the provider.

• user_agent: optional string or null

• AttestedDeviceActor object

An attested mobile device authenticated via Apple App Attest.

• type: optional "attested_device_actor"

default: attested_device_actor

• external_client_id: string

• kid_hash: string

• ip_address: optional string or null

• user_agent: optional string or null

• id: optional string

Unique identifier for the activity e.g. 'activity_abcd1234'

• haijun_artifact_id: optional string or null

The artifact's identifier, when known.

• haijun_artifact_version_id: optional string or null

The version of the artifact the user attempted to access, when known.

• created_at: optional string

When this activity occurred.

format: date-time

• organization_id: optional string or null

Organization ID this activity is associated with

• organization_uuid: optional string or null

Organization UUID where the activity occurred. Null when the activity is not tied to an organization (for example, login and logout events or calls to the Compliance API).

• reason: optional string or null

The reason access was denied, when recorded.

• HaijunArtifactCommented object

Comment activity on a published artifact: a comment was added, a thread's resolved state was changed, or a thread was deleted. The actor is the user who performed the action; the comment text itself is stored with the artifact and is not part of this record.

• type: optional "haijun_artifact_commented"

default: haijun_artifact_commented

• actor: APIActor or UserActor or UnauthenticatedUserActor or 8 more

• APIActor object

• type: optional "api_actor"

default: api_actor

• api_key_id: string

• ip_address: string

• user_agent: string

• UserActor object

• type: optional "user_actor"

default: user_actor

• email_address: string

format: email

• ip_address: string

• user_agent: string

• user_id: string

• UnauthenticatedUserActor object

• type: optional "unauthenticated_user_actor"

default: unauthenticated_user_actor

• ip_address: string

• user_agent: string

• unauthenticated_email_address: optional string or null

format: email

• JuglowActor object

• type: optional "juglow_actor"

default: juglow_actor

• email_address: optional string or null

format: email

• SystemActor object

Automated background processing performed by Juglow systems, acting without a user or customer credential.

• type: optional "system_actor"

default: system_actor

• service: optional string or null

Name of the automated process that performed the action, when known.

• AdminAPIKeyActor object

• type: optional "admin_api_key_actor"

default: admin_api_key_actor

• admin_api_key_id: string

• ip_address: string

• user_agent: string

• ServiceAccountActor object

• type: optional "service_account_actor"

default: service_account_actor

• ip_address: string

• service_account_id: string

• user_agent: string

• ScimDirectorySyncActor object

• type: optional "scim_directory_sync_actor"

default: scim_directory_sync_actor

• directory_id: string

• workos_event_id: string

• idp_connection_type: optional string or null

• FederatedIdentityActor object

A federated external workload authenticated via a verified OIDC token.

Carries the verified issuer, subject, and audience claims from the presented JWT.

• type: optional "federated_identity_actor"

default: federated_identity_actor

• issuer: string

• subject: string

• audience: optional array of string

• ip_address: optional string or null

• user_agent: optional string or null

• FederatedActor object

An external identity asserted by a trusted provider — a cloud-provider gateway or a customer-registered federation issuer — acting without an Juglow-provisioned account or service account.

• type: optional "federated_actor"

default: federated_actor

• provider: FederatedActorAwsProvider or FederatedActorAzureProvider or FederatedActorGcpProvider or FederatedActorOidcProvider

• FederatedActorAwsProvider object

Asserting party: the AWS account the organization is bound to.

• type: optional "aws"

default: aws

• account_id: string