# AuditEvent

> Append-only, hash-chained audit record.

Append-only, hash-chained audit record. `hash = sha256(prev_hash || canonical_json(event without hash))`,
hex encoded. Each workspace has its own chain; `chain_seq` increases by one with no gaps.

## Fields

| Field | Type | Description |
| --- | --- | --- |
| `id` * | string |  |
| `chain` * | string | Workspace id, or `platform`. |
| `chain_seq` * | integer |  |
| `occurred_at` * | string (date-time) |  |
| `actor` * | [Actor](/docs/api/objects/actor/) |  |
| `action` * | string |  |
| `resource` | [ResourceRef](/docs/api/objects/resource-ref/) or any or null |  |
| `project_id` | string or null |  |
| `outcome` * | `success`, `failure`, `denied`, `approval_required` |  |
| `request_id` | string or null |  |
| `ip` | string or null |  |
| `user_agent` | string or null |  |
| `data` | object | Action details. Never contains secret values. |
| `prev_hash` * | string |  |
| `hash` * | string |  |

\* always present

## Example

```json
{
  "id": "evt_01jbx2m9k7q4r8t5v6w3y0z1pr",
  "chain": "string",
  "chain_seq": 1,
  "occurred_at": "2026-10-22T13:05:00Z",
  "actor": {
    "type": "agent",
    "id": "tok_01jbx2m9k7q4r8t5v6w3y0z1tk",
    "display": "Stewart Webb via agent claude-code-on-stewart-laptop",
    "via_agent": {
      "id": "tok_01jbx2m9k7q4r8t5v6w3y0z1tk",
      "name": "claude-code-on-stewart-laptop"
    },
    "on_behalf_of": {
      "id": "usr_01jbx2m9k7q4r8t5v6w3y0z1us",
      "display": "Stewart Webb"
    }
  },
  "action": "string",
  "resource": {
    "type": "service",
    "id": "svc_01jbx2m9k7q4r8t5v6w3y0z1sv",
    "name": "web",
    "url": "/v1/projects/primecarers/services/web"
  },
  "project_id": "string",
  "outcome": "success",
  "request_id": "string",
  "ip": "string",
  "user_agent": "string",
  "data": {},
  "prev_hash": "string",
  "hash": "string"
}
```