AuditEvent

Append-only, hash-chained audit record. hash = sha256(prev_hash || canonical_json(event without hash)), hex encoded. Each workspace has its own chain; chain_seq increases by one with no gaps.

Fields

Field	Type	Description
id *	string
chain *	string	Workspace id, or platform.
chain_seq *	integer
occurred_at *	string (date-time)
actor *	Actor
action *	string
resource	ResourceRef or any or null
project_id	string or null
outcome *	success, failure, denied, approval_required
request_id	string or null
ip	string or null
user_agent	string or null
data	object	Action details. Never contains secret values.
prev_hash *	string
hash *	string

* always present

Example

{
  "id": "evt_01jbx2m9k7q4r8t5v6w3y0z1pr",
  "chain": "string",
  "chain_seq": 1,
  "occurred_at": "2026-10-22T13:05:00Z",
  "actor": {
    "type": "agent",
    "id": "tok_01jbx2m9k7q4r8t5v6w3y0z1tk",
    "display": "Stewart Webb via agent claude-code-on-stewart-laptop",
    "via_agent": {
      "id": "tok_01jbx2m9k7q4r8t5v6w3y0z1tk",
      "name": "claude-code-on-stewart-laptop"
    },
    "on_behalf_of": {
      "id": "usr_01jbx2m9k7q4r8t5v6w3y0z1us",
      "display": "Stewart Webb"
    }
  },
  "action": "string",
  "resource": {
    "type": "service",
    "id": "svc_01jbx2m9k7q4r8t5v6w3y0z1sv",
    "name": "web",
    "url": "/v1/projects/primecarers/services/web"
  },
  "project_id": "string",
  "outcome": "success",
  "request_id": "string",
  "ip": "string",
  "user_agent": "string",
  "data": {},
  "prev_hash": "string",
  "hash": "string"
}