Event types

All 156 audit event types, and the 32 you can subscribe a webhook to.

Every state change writes an audit event. A subset is also deliverable over webhooks — the subset is deliberately smaller, because a webhook leaves your perimeter and an audit event does not.

A webhook is a notification, not an authorization

Verify the signature, then read the resource back from the API before acting on it. A delivery can be delayed, duplicated or replayed by anything on the path; the API is the only authority on current state.

The live list is served at GET /v1/meta/event-types, split into all and webhook_subscribable.

#By resource

◆ marks an event a webhook can subscribe to.

Event	Webhook
a2a
`a2a.connection_created`
`a2a.connection_updated`
`a2a.connection_blocked`	◆
`a2a.passport_verified`
`a2a.interaction_allowed`
`a2a.interaction_blocked`
action
`action.requested`	◆
`action.allowed`	◆
`action.blocked`	◆
`action.limited`
`action.masked`
`action.approval_required`	◆
`action.completed`	◆
`action.failed`
`action.observed`
`action.simulated`
agent
`agent.created`	◆
`agent.updated`	◆
`agent.paused`	◆
`agent.resumed`	◆
`agent.suspended`	◆
`agent.revoked`	◆
`agent.decommissioned`
`agent.expired`
`agent.isolated`
`agent.capability_granted`
`agent.capability_revoked`
`agent.identity_rotated`
apikey
`apikey.created`
`apikey.revoked`
approval
`approval.requested`	◆
`approval.approved`	◆
`approval.denied`	◆
`approval.expired`	◆
`approval.cancelled`
`approval.escalated`
`approval.info_requested`
`approval.delegated`
audit
`audit.exported`
`audit.retention_updated`
`audit.integrity_verified`
cli
`cli.authorization_approved`
`cli.authorization_denied`
`cli.session_issued`
code_assist
`code_assist.requested`
compliance
`compliance.control_updated`
credential
`credential.created`
`credential.issued`	◆
`credential.rotated`	◆
`credential.revoked`	◆
`credential.lease_expired`
`credential.rotation_failed`
delegation
`delegation.created`	◆
`delegation.reduced`
`delegation.extended`
`delegation.revoked`	◆
`delegation.expired`
`delegation.escalation_blocked`
environment
`environment.created`
`environment.updated`
`environment.mode_changed`
`environment.paused`
`environment.resumed`
fx_rate
`fx_rate.created`
`fx_rate.deleted`
`fx_rate.refreshed`
`fx_rate.refresh_failed`
incident
`incident.created`	◆
`incident.updated`
`incident.contained`
`incident.resolved`	◆
`incident.closed`
integration
`integration.created`
`integration.updated`
mcp
`mcp.server_registered`
`mcp.server_updated`
`mcp.server_disabled`
`mcp.server_quarantined`
`mcp.tools_discovered`
`mcp.tool_authorized`
`mcp.tool_disabled`	◆
`mcp.tool_invoked`
member
`member.invited`
`member.joined`
`member.role_changed`
`member.removed`
notification
`notification.created`
onboarding
`onboarding.completed`
organization
`organization.created`
`organization.updated`
`organization.base_currency_changed`
passport
`passport.issued`
`passport.verified`
`passport.rotated`
`passport.revoked`
`passport.expired`
`passport.exported`
policy
`policy.created`	◆
`policy.updated`	◆
`policy.deleted`
`policy.validated`
`policy.simulated`
`policy.activated`	◆
`policy.suspended`
`policy.rolled_back`	◆
`policy.bound`
`policy.unbound`
`policy.test_run`
registry
`registry.listing_published`
`registry.listing_unpublished`
risk
`risk.event_created`
`risk.threshold_exceeded`	◆
`risk.acknowledged`
`risk.configuration_updated`
role
`role.created`
`role.updated`
`role.deleted`
scim
`scim.configuration_updated`
security
`security.emergency_action_executed`	◆
`security.break_glass_granted`
`security.break_glass_expired`
`security.destination_blocked`
session
`session.revoked`
sso
`sso.connection_updated`
subscription
`subscription.updated`
tool
`tool.created`
`tool.updated`
`tool.disabled`
`tool.enabled`
`tool.restricted`
trust
`trust.evidence_added`	◆
`trust.evidence_revoked`
`trust.evidence_expiring`
`trust.evidence_expired`	◆
`trust.provider_created`
usage
`usage.recorded`
user
`user.login_succeeded`
`user.login_failed`
`user.logged_out`
`user.mfa_enrolled`
`user.mfa_factor_added`
`user.mfa_factor_removed`
`user.mfa_recovery_codes_regenerated`
`user.mfa_device_approval_requested`
`user.mfa_device_approval_decided`
`user.step_up_completed`
`user.password_changed`
`user.identity_linked`
`user.identity_unlinked`
`user.profile_updated`
webhook
`webhook.subscription_created`
`webhook.subscription_updated`
`webhook.secret_rotated`
`webhook.delivery_failed`
workspace
`workspace.created`
`workspace.updated`