---
title: "Event types"
description: "All 156 audit event types, and the 32 you can subscribe a webhook to."
label: "Events"
generated: "the event registry in packages/types/src/events.ts"
---


Every state change writes an audit event. A subset is also deliverable over webhooks — the subset is deliberately smaller, because a webhook leaves your perimeter and an audit event does not.

:::warning A webhook is a notification, not an authorization
Verify the signature, then read the resource back from the API before acting on it. A delivery can be delayed, duplicated or replayed by anything on the path; the API is the only authority on current state.
:::

The live list is served at `GET /v1/meta/event-types`, split into `all` and `webhook_subscribable`.

## By resource

`◆` marks an event a webhook can subscribe to.

| Event | Webhook |
| --- | --- |
| **a2a** | |
| `a2a.connection_created` |  |
| `a2a.connection_updated` |  |
| `a2a.connection_blocked` | ◆ |
| `a2a.passport_verified` |  |
| `a2a.interaction_allowed` |  |
| `a2a.interaction_blocked` |  |
| **action** | |
| `action.requested` | ◆ |
| `action.allowed` | ◆ |
| `action.blocked` | ◆ |
| `action.limited` |  |
| `action.masked` |  |
| `action.approval_required` | ◆ |
| `action.completed` | ◆ |
| `action.failed` |  |
| `action.observed` |  |
| `action.simulated` |  |
| **agent** | |
| `agent.created` | ◆ |
| `agent.updated` | ◆ |
| `agent.paused` | ◆ |
| `agent.resumed` | ◆ |
| `agent.suspended` | ◆ |
| `agent.revoked` | ◆ |
| `agent.decommissioned` |  |
| `agent.expired` |  |
| `agent.isolated` |  |
| `agent.capability_granted` |  |
| `agent.capability_revoked` |  |
| `agent.identity_rotated` |  |
| **apikey** | |
| `apikey.created` |  |
| `apikey.revoked` |  |
| **approval** | |
| `approval.requested` | ◆ |
| `approval.approved` | ◆ |
| `approval.denied` | ◆ |
| `approval.expired` | ◆ |
| `approval.cancelled` |  |
| `approval.escalated` |  |
| `approval.info_requested` |  |
| `approval.delegated` |  |
| **audit** | |
| `audit.exported` |  |
| `audit.retention_updated` |  |
| `audit.integrity_verified` |  |
| **cli** | |
| `cli.authorization_approved` |  |
| `cli.authorization_denied` |  |
| `cli.session_issued` |  |
| **code_assist** | |
| `code_assist.requested` |  |
| **compliance** | |
| `compliance.control_updated` |  |
| **credential** | |
| `credential.created` |  |
| `credential.issued` | ◆ |
| `credential.rotated` | ◆ |
| `credential.revoked` | ◆ |
| `credential.lease_expired` |  |
| `credential.rotation_failed` |  |
| **delegation** | |
| `delegation.created` | ◆ |
| `delegation.reduced` |  |
| `delegation.extended` |  |
| `delegation.revoked` | ◆ |
| `delegation.expired` |  |
| `delegation.escalation_blocked` |  |
| **environment** | |
| `environment.created` |  |
| `environment.updated` |  |
| `environment.mode_changed` |  |
| `environment.paused` |  |
| `environment.resumed` |  |
| **fx_rate** | |
| `fx_rate.created` |  |
| `fx_rate.deleted` |  |
| `fx_rate.refreshed` |  |
| `fx_rate.refresh_failed` |  |
| **incident** | |
| `incident.created` | ◆ |
| `incident.updated` |  |
| `incident.contained` |  |
| `incident.resolved` | ◆ |
| `incident.closed` |  |
| **integration** | |
| `integration.created` |  |
| `integration.updated` |  |
| **mcp** | |
| `mcp.server_registered` |  |
| `mcp.server_updated` |  |
| `mcp.server_disabled` |  |
| `mcp.server_quarantined` |  |
| `mcp.tools_discovered` |  |
| `mcp.tool_authorized` |  |
| `mcp.tool_disabled` | ◆ |
| `mcp.tool_invoked` |  |
| **member** | |
| `member.invited` |  |
| `member.joined` |  |
| `member.role_changed` |  |
| `member.removed` |  |
| **notification** | |
| `notification.created` |  |
| **onboarding** | |
| `onboarding.completed` |  |
| **organization** | |
| `organization.created` |  |
| `organization.updated` |  |
| `organization.base_currency_changed` |  |
| **passport** | |
| `passport.issued` |  |
| `passport.verified` |  |
| `passport.rotated` |  |
| `passport.revoked` |  |
| `passport.expired` |  |
| `passport.exported` |  |
| **policy** | |
| `policy.created` | ◆ |
| `policy.updated` | ◆ |
| `policy.deleted` |  |
| `policy.validated` |  |
| `policy.simulated` |  |
| `policy.activated` | ◆ |
| `policy.suspended` |  |
| `policy.rolled_back` | ◆ |
| `policy.bound` |  |
| `policy.unbound` |  |
| `policy.test_run` |  |
| **registry** | |
| `registry.listing_published` |  |
| `registry.listing_unpublished` |  |
| **risk** | |
| `risk.event_created` |  |
| `risk.threshold_exceeded` | ◆ |
| `risk.acknowledged` |  |
| `risk.configuration_updated` |  |
| **role** | |
| `role.created` |  |
| `role.updated` |  |
| `role.deleted` |  |
| **scim** | |
| `scim.configuration_updated` |  |
| **security** | |
| `security.emergency_action_executed` | ◆ |
| `security.break_glass_granted` |  |
| `security.break_glass_expired` |  |
| `security.destination_blocked` |  |
| **session** | |
| `session.revoked` |  |
| **sso** | |
| `sso.connection_updated` |  |
| **subscription** | |
| `subscription.updated` |  |
| **tool** | |
| `tool.created` |  |
| `tool.updated` |  |
| `tool.disabled` |  |
| `tool.enabled` |  |
| `tool.restricted` |  |
| **trust** | |
| `trust.evidence_added` | ◆ |
| `trust.evidence_revoked` |  |
| `trust.evidence_expiring` |  |
| `trust.evidence_expired` | ◆ |
| `trust.provider_created` |  |
| **usage** | |
| `usage.recorded` |  |
| **user** | |
| `user.login_succeeded` |  |
| `user.login_failed` |  |
| `user.logged_out` |  |
| `user.mfa_enrolled` |  |
| `user.mfa_factor_added` |  |
| `user.mfa_factor_removed` |  |
| `user.mfa_recovery_codes_regenerated` |  |
| `user.mfa_device_approval_requested` |  |
| `user.mfa_device_approval_decided` |  |
| `user.step_up_completed` |  |
| `user.password_changed` |  |
| `user.identity_linked` |  |
| `user.identity_unlinked` |  |
| `user.profile_updated` |  |
| **webhook** | |
| `webhook.subscription_created` |  |
| `webhook.subscription_updated` |  |
| `webhook.secret_rotated` |  |
| `webhook.delivery_failed` |  |
| **workspace** | |
| `workspace.created` |  |
| `workspace.updated` |  |