1 of 4

Deprecated Audit Guides

Download Audit Logs

Deprecation notice: The /audit endpoint has been deprecated and replaced by Immuta Detect.

Download audit logs using the API

Generate your API key on the API Keys tab on your profile page and save the API key somewhere secure.

You will pass this API key in the authorization header when you make a request, as illustrated in the example below:

curl \
    --request GET \
    --header "Content-Type: application/json" \
    --header "Authorization: dea464c07bd07300095caa8" \
    https://your-immuta-url.immuta.com/audit

Download your audit logs using the GET /audit endpoint. To filter or sort the audit logs, use the query parameters on the /audit endpoint API reference page. For example, the request below saves 50 audit logs for https://your-immuta-url.immuta.com in the file audit-logs-file.json, with the audit records sorted by time in descending order.
```
curl \
    --request GET \
    --header "Content-Type: application/json" \
    --header "Authorization: dea464c07bd07300095caa8" \
    --output audit-logs-file.json \
    https://your-immuta-url.immuta.com/audit?sortField=dateTime&sortOrder=desc
```

System Audit Logs

Deprecation notice: The /audit endpoint has been deprecated and replaced by Immuta Detect.

All activity in Immuta is audited. This process provides rich audit logs that detail who subscribes to each data source, why they subscribe, when they access data, what SQL queries and blob fetches they run, and which files they access. Audit logs can be used for a number of intentions, including insider threat surveillance and data access monitoring for billing purposes. Audit logs can also be shipped to your enterprise auditing capability.

Audit Record Storage

Best practices: Store audit records outside of Immuta in order to retain the audits long term.

By default, Immuta stores most audit records for 60 days. The following audit record types do not expire after 60 days:

blobFetch
dataSourceSubscription
globalPolicyApproved
globalPolicyApprovalRescinded
globalPolicyChangeRequested
globalPolicyConflictResolved
globalPolicyCreate
globalPolicyDelete
globalPolicyDisabled
globalPolicyUpdate
nativeQuery
policyExemption
policyHandlerCreate
policyHandlerUpdate
prestoQuery
spark
sqlQuery

Log Aggregation for Kubernetes Installations

Immuta writes all logs to stdout in Kubernetes. Users will get all logs here, but should use the Common Message Types to parse for specifics.

Log Aggregation for Docker-Based Installations

When running Immuta on Docker-based installations, all logs from the Immuta Docker containers will be sent to the Docker log driver.

The Immuta log file will contain messages that are one-line JSON, as described in Log Formats.

Log Formats

Logs messages from the Immuta platform typically will be one line JSON and contain all of the common JSON properties. Depending on the message type, more JSON properties may be present. See Common Message Types for more details.

Common JSON Properties

level: This is a string representation of the log level. Acceptable values are "debug", "info", "warning", "error", and "audit".
timestamp: This is a timestamp for when the message occurred. The timestamp format is YYYY-MM-DDTHH:mm:ss.sssZ (ISO 8601).
message: This is the log message, which may be used to determine common message types.

Limitations

Generally, any query that causes multiple background queries will have an audit record created for each. The audited plan should be different, however, for each record. For example, subqueries will generate two audit records: one for the subquery and one for the outer query.
Immuta does not audit any notebook cells that don’t query data.

Common Message Types

Audit Messages

Each audit message from the Immuta platform will be a one-line JSON object containing the common JSON properties and the Audit JSON properties. Depending on the recordType, an audit message may contain additional data.

In order to discover audit messages using your analysis tool, you may search the object using the criteria below:

level: "audit"
message: "Audit - *

Audit JSON Properties

dateTime:
- description: The timestamp for when the record was created. This may be an ISO-8601 timestamp string or a ms since epoch timestamp.
- type: integer or string
- example: 1504188066580 or "2017-08-31T14:01:15.607Z"
component:
- description: The Immuta component that generated this record. Possible values are "console", "featureStore", "dataSource", "bim", "audit", "script", "policy", "project", "plugin", and "governance".
- type: string
instanceId:
- description: The instance ID of the component generating this record.
- type: string
profileId:
- description: The profile ID of the user generating the action.
- type: integer
userId:
- description: The user ID of the user generating the action.
- type: string, null
sqlUser:
- description: The database account generating the action.
- type: string
dataAccess:
- description: Describes access to an individual blob or a query that may grant access to multiple blobs.
- type: object
sessionId:
- description: If this record is generated in response to a user action and if that user's session ID is known, record that session ID here.
- type : string
dataSource:
- description: If the record creation is associated with a data source, the data source name should be recorded here.
- type: string, null
dataSourceId:
- description: If the record creation is associated with a data source, the data source ID should be recorded here.
- type: integer, null
projectName:
- description: If the record creation is associated with a project, the project name should be recorded here.
- type: string, null
projectId:
- description: If the record creation is associated with a project, the project ID should be recorded here.
- type: integer, null
purposeIds:
- description: If the action being taken by the user involves data and is happening for a specific person, the purpose IDs should be recorded here.
- type: array[integer], null
success:
- description: Denotes whether the action being audited was successful.
- type: boolean
failureReason:
- description: Describes the reason that this audit event failed. Possible values are "systemError", "insufficientAuthorizations", "insufficientPermissions", and "userError".
- type: string
failureDetails:
- description: If the audit event failed, details can be provided in this free text field to examine later.
- type: string or object
recordType:
- description: The type of audit event being captured. This also corresponds to the additional information in the record field. Possible values are "auditQuery", "blobVisibility", "blobFetch", "blobIndex", "blobDelete", "blobCatalogFetch", "blobCatalogFetchDate", "blobUpdateFeatures", "blobUpdateTags", "createQuery", "modifyQuery", "consoleDataSourceView", "sqlAccess", "sqlCreateUser", "sqlDeleteUser", "sqlResetPassword", "featureList", "sqlQuery", "dataSourceCreate", "dataSourceDelete", "dataSourceSave", "dataSourceGet", "dataSourceListMine", "dataSourceGetTags", "dataSourceSubscription", "dataSourceGetUsers", "dataSourceTest", "dictionaryCreate", "dictionaryDelete", "dictionaryUpdate", "projectCreate", "projectUpdate", "projectDelete", "addToProject", "removeFromProject", "acknowledgePurposes", "userVisibilities", "accessUser", "accessGroup", "searchAuthorizations", "apiKey", "scriptCopy", "scriptSave", "scriptGet", "scriptGetForks", "scriptGetVersions", "scriptVersionGet", "scriptUpdate", "scriptDelete", "scriptVersionDelete","scriptVersionUpdate", "scriptDataSourceGet", "scriptDataSourceUpdate", "scriptSaveContent", "scriptGetContent", "userKernelCreate", "userKernelUpdate", "userKernelDelete", "querySampleData", "authenticate", "checkPendingRequest", "policyExemption", "governanceUpdate", "purposeCreate", "purposeUpdate", and "purposeDelete".
- type: string
record:
- description: The component-defined type of record. For example, it could be something like 'data source access request'.
- type: object
extra:
- description: A JSON object representing the additional information to be logged/audited.
- type: object

API Key Object

keyIamId:
- description: The IAM ID for the user who owns the API key accessed.
- type: string
keyId:
- description: The API key ID.
- type: integer
keyUserId:
- description: The user who owns the API key accessed.
- type: string
keyAction:
- description: Denotes how the specified user was accessed. Possible values are "get" and "delete".
- type: string

Data Access Object

accessType:
- description: Indicates whether access was granted to an individual blob or if this was a query potentially encompassing many blobs. Possible values are "blob"and "query".
- type: string
blobId:
- description: If accessType==blob, this is the blobId.
visibility:
- description: If the accessType==blob, this is the visibility. If the accessType==query, this is an array of the visibilities the user had when querying.
- type: object, array
query:
- description: If the accessType==blob, this is not present. If the accessType==query, this is the query.
- type: string
dataSourceTableName:
- description: The data source table name queried in the audit record.
- type: string

Blob Fetch Object

blobSize:
- description: The size (in bytes) of the blob being fetched.
- type: integer

Blob Visibility Object

newVisibility:
- description: This is the new visibility for the blob.
- type: object

SQL Access Object

action:
- description: Denotes whether access was granted or revoked. Possible values are "revoked"and "granted".
- type: string
sqlUser:
- description: The username of the user whose access is being manipulated.
- type: string

SQL Create User Object

sqlUser:
- description: The username of the user whose access is being manipulated.
- type: string

Data Source Subscription Object

dataSourceSubscriptionState:
- description: If the record type is dataSourceSubscription, this field must be present and indicate the state to which the record was changed (dataSources.length must be 1 in this case). Possible values are "denied", "subscribed", "expert", "owner", "ingest", and "unsubscribed".
- type: string
accessedId:
- description: The user identifier of the user who is being acted upon.
- type: integer
accessedIdType:
- description: Type of user being acted upon. Possible values are "user" and "group".
- type: string

Data Source Delete Object

hardDelete:
- description: Denotes whether this was a hard delete.
- type: boolean

Access User Object

accessedUserId:
- description: The user being accessed.
- type: string
accessedIamId:
- description: The IAM ID for the user being accessed.
- type: string
accessType:
- description: Denotes how the specified user was accessed. Possible values are "update", "get", "search", "create", "delete", "complete", "newToken", and "clone".
- type: string

Access Group Object

accessedUserId:
- description: The user being accessed.
- type: string
accessedGroupId:
- description: The group being accessed.
- type: integer
groupAccessType:
- description: Denotes how the specified group was accessed. Possible values are "update", "get", "search", "create", "delete", "addUser", and "removeUser".
- type: string
groupIamId:
- description: The IAM ID for the group being accessed.
- type: string

Error Response Messages

Each error message response from the Immuta platform will be a one-line JSON object containing the common JSON properties and the error JSON properties below. Error message responses represent error responses that have been sent to clients.

NOTE: It is possible for a similar message referencing the same error to appear in the logs, as this log message represents only that an error response was sent to a client.

In order to discover error response message using your analysis tool, search the object using the criteria below:

message: Error Response Sent

Error JSON Properties

id:
- description: A unique ID assigned to each request.
- type: string
method:
- The HTTP method used for the request.
- type: string
path:
- description: This is the HTTP path used for the request.
- type: string
query:
- description: An object containing the parsed query string used for the query.
- type: object
responseSentTime:
- description: This is the duration from the time a request was received until the time that the server responded.
- type: integer
responseTime:
- description: This is the duration from the time a request was received until server post-processing.
- type: integer
stack:
- description: This is a string representation of a stack trace if one exists.
- type: string
statusCode:
- description: This is the HTTP status code that was sent to the client.
- type: integer

Request Response Messages

Each request message response from the Immuta platform will be a one-line JSON object containing the common JSON properties and the error JSON properties below. Request message responses represent responses that have been sent to clients.

In order to discover request response messages using your analysis tool, search the object using the criteria below:

message: Response Sent

Request JSON Properties

id:
- description: A unique ID assigned to each request.
- type: string
method:
- The HTTP method used for the request.
- type: string
path:
- description: This is the HTTP path used for the request.
- type: string
query:
- description: An object containing the parsed query string used for the query.
- type: object
responseSentTime:
- description: This is the duration from the time a request was received until the time that the server responded.
- type: integer
responseTime:
- description: This is the duration from the time a request was received until server post-processing.
- type: integer
statusCode:
- description: This is the HTTP status code that was sent to the client.
- type: integer

Example Response Message

{
  "id": "aaa5adf4-5b2b-4c46-974f-dca000bf228b",
  "dateTime": "1628524947022",
  "month": 1459,
  "profileId": 2,
  "userId": "john.doe@immuta.com",
  "dataSourceId": 7,
  "dataSourceName": "Tpc Web Sales",
  "count": 1,
  "recordType": "sqlQuery",
  "success": true,
  "component": "featureStore",
  "accessType": "query",
  "query": "SELECT \"ws_sold_date_sk\", \"ws_sold_time_sk\", \"ws_ship_date_sk\", \"ws_item_sk\", \"ws_bill_customer_sk\", \"ws_bill_cdemo_sk\", \"ws_bill_hdemo_sk\", \"ws_bill_addr_sk\", \"ws_ship_customer_sk\", \"ws_ship_cdemo_sk\", \"ws_ship_hdemo_sk\", \"ws_ship_addr_sk\", \"ws_web_page_sk\", \"ws_web_site_sk\", \"ws_ship_mode_sk\", \"ws_warehouse_sk\", \"ws_promo_sk\", \"ws_order_number\", \"ws_quantity\", \"ws_wholesale_cost\", \"ws_list_price\", \"ws_sales_price\", \"ws_ext_discount_amt\", \"ws_ext_sales_price\", \"ws_ext_wholesale_cost\", \"ws_ext_list_price\", \"ws_ext_tax\", \"ws_coupon_amt\", \"ws_ext_ship_cost\", \"ws_net_paid\", \"ws_net_paid_inc_tax\", \"ws_net_paid_inc_ship\", \"ws_net_paid_inc_ship_tax\", \"ws_net_profit\" FROM \"tpc\".\"web_sales\" LIMIT 100",
  "queryId": "30f65620-f92b-11eb-8205-567f9878b67f",
  "extra": {
    "direct": true,
    "remoteQueries": [
      "SELECT  TOP 100 \"ws_sold_date_sk\", \"ws_sold_time_sk\", \"ws_ship_date_sk\", \"ws_item_sk\", \"ws_bill_customer_sk\", \"ws_bill_cdemo_sk\", \"ws_bill_hdemo_sk\", \"ws_bill_addr_sk\", \"ws_ship_customer_sk\", \"ws_ship_cdemo_sk\", \"ws_ship_hdemo_sk\", \"ws_ship_addr_sk\", \"ws_web_page_sk\", \"ws_web_site_sk\", \"ws_ship_mode_sk\", \"ws_warehouse_sk\", \"ws_promo_sk\", \"ws_order_number\", \"ws_quantity\", \"ws_wholesale_cost\", \"ws_list_price\", \"ws_sales_price\", \"ws_ext_discount_amt\", \"ws_ext_sales_price\", \"ws_ext_wholesale_cost\", \"ws_ext_list_price\", \"ws_ext_tax\", \"ws_coupon_amt\", \"ws_ext_ship_cost\", \"ws_net_paid\", \"ws_net_paid_inc_tax\", \"ws_net_paid_inc_ship\", \"ws_net_paid_inc_ship_tax\", \"ws_net_profit\" FROM \"tpc\".\"web_sales\""
    ]
  },
  "dataSourceSchemaName": "tpc",
  "dataSourceTableName": "web_sales",
  "sqlUser": "immuta_query_impersonator",
  "createdAt": "2021-08-09T16:02:27.023Z",
  "updatedAt": "2021-08-09T16:02:27.023Z"
}

System Audit Logs

Deprecation notice: The /audit endpoint has been deprecated and replaced by Immuta Detect.

Audit Record Storage

Best practices: Store audit records outside of Immuta in order to retain the audits long term.

By default, Immuta stores most audit records for 60 days. The following audit record types do not expire after 60 days:

blobFetch
dataSourceSubscription
globalPolicyApproved
globalPolicyApprovalRescinded
globalPolicyChangeRequested
globalPolicyConflictResolved
globalPolicyCreate
globalPolicyDelete
globalPolicyDisabled
globalPolicyUpdate
nativeQuery
policyExemption
policyHandlerCreate
policyHandlerUpdate
prestoQuery
spark
sqlQuery

Log Aggregation for Kubernetes Installations

Immuta writes all logs to stdout in Kubernetes. Users will get all logs here, but should use the Common Message Types to parse for specifics.

Log Aggregation for Docker-Based Installations

When running Immuta on Docker-based installations, all logs from the Immuta Docker containers will be sent to the Docker log driver.

The Immuta log file will contain messages that are one-line JSON, as described in Log Formats.

Log Formats

Common JSON Properties

level: This is a string representation of the log level. Acceptable values are "debug", "info", "warning", "error", and "audit".
timestamp: This is a timestamp for when the message occurred. The timestamp format is YYYY-MM-DDTHH:mm:ss.sssZ (ISO 8601).
message: This is the log message, which may be used to determine common message types.

Limitations

Generally, any query that causes multiple background queries will have an audit record created for each. The audited plan should be different, however, for each record. For example, subqueries will generate two audit records: one for the subquery and one for the outer query.
Immuta does not audit any notebook cells that don’t query data.

Common Message Types

Audit Messages

In order to discover audit messages using your analysis tool, you may search the object using the criteria below:

level: "audit"
message: "Audit - *

Audit JSON Properties

dateTime:
- description: The timestamp for when the record was created. This may be an ISO-8601 timestamp string or a ms since epoch timestamp.
- type: integer or string
- example: 1504188066580 or "2017-08-31T14:01:15.607Z"
component:
- description: The Immuta component that generated this record. Possible values are "console", "featureStore", "dataSource", "bim", "audit", "script", "policy", "project", "plugin", and "governance".
- type: string
instanceId:
- description: The instance ID of the component generating this record.
- type: string
profileId:
- description: The profile ID of the user generating the action.
- type: integer
userId:
- description: The user ID of the user generating the action.
- type: string, null
sqlUser:
- description: The database account generating the action.
- type: string
dataAccess:
- description: Describes access to an individual blob or a query that may grant access to multiple blobs.
- type: object
sessionId:
- description: If this record is generated in response to a user action and if that user's session ID is known, record that session ID here.
- type : string
dataSource:
- description: If the record creation is associated with a data source, the data source name should be recorded here.
- type: string, null
dataSourceId:
- description: If the record creation is associated with a data source, the data source ID should be recorded here.
- type: integer, null
projectName:
- description: If the record creation is associated with a project, the project name should be recorded here.
- type: string, null
projectId:
- description: If the record creation is associated with a project, the project ID should be recorded here.
- type: integer, null
purposeIds:
- description: If the action being taken by the user involves data and is happening for a specific person, the purpose IDs should be recorded here.
- type: array[integer], null
success:
- description: Denotes whether the action being audited was successful.
- type: boolean
failureReason:
- description: Describes the reason that this audit event failed. Possible values are "systemError", "insufficientAuthorizations", "insufficientPermissions", and "userError".
- type: string
failureDetails:
- description: If the audit event failed, details can be provided in this free text field to examine later.
- type: string or object
recordType:
- description: The type of audit event being captured. This also corresponds to the additional information in the record field. Possible values are "auditQuery", "blobVisibility", "blobFetch", "blobIndex", "blobDelete", "blobCatalogFetch", "blobCatalogFetchDate", "blobUpdateFeatures", "blobUpdateTags", "createQuery", "modifyQuery", "consoleDataSourceView", "sqlAccess", "sqlCreateUser", "sqlDeleteUser", "sqlResetPassword", "featureList", "sqlQuery", "dataSourceCreate", "dataSourceDelete", "dataSourceSave", "dataSourceGet", "dataSourceListMine", "dataSourceGetTags", "dataSourceSubscription", "dataSourceGetUsers", "dataSourceTest", "dictionaryCreate", "dictionaryDelete", "dictionaryUpdate", "projectCreate", "projectUpdate", "projectDelete", "addToProject", "removeFromProject", "acknowledgePurposes", "userVisibilities", "accessUser", "accessGroup", "searchAuthorizations", "apiKey", "scriptCopy", "scriptSave", "scriptGet", "scriptGetForks", "scriptGetVersions", "scriptVersionGet", "scriptUpdate", "scriptDelete", "scriptVersionDelete","scriptVersionUpdate", "scriptDataSourceGet", "scriptDataSourceUpdate", "scriptSaveContent", "scriptGetContent", "userKernelCreate", "userKernelUpdate", "userKernelDelete", "querySampleData", "authenticate", "checkPendingRequest", "policyExemption", "governanceUpdate", "purposeCreate", "purposeUpdate", and "purposeDelete".
- type: string
record:
- description: The component-defined type of record. For example, it could be something like 'data source access request'.
- type: object
extra:
- description: A JSON object representing the additional information to be logged/audited.
- type: object

API Key Object

keyIamId:
- description: The IAM ID for the user who owns the API key accessed.
- type: string
keyId:
- description: The API key ID.
- type: integer
keyUserId:
- description: The user who owns the API key accessed.
- type: string
keyAction:
- description: Denotes how the specified user was accessed. Possible values are "get" and "delete".
- type: string

Data Access Object

accessType:
- description: Indicates whether access was granted to an individual blob or if this was a query potentially encompassing many blobs. Possible values are "blob"and "query".
- type: string
blobId:
- description: If accessType==blob, this is the blobId.
visibility:
- description: If the accessType==blob, this is the visibility. If the accessType==query, this is an array of the visibilities the user had when querying.
- type: object, array
query:
- description: If the accessType==blob, this is not present. If the accessType==query, this is the query.
- type: string
dataSourceTableName:
- description: The data source table name queried in the audit record.
- type: string

Blob Fetch Object

blobSize:
- description: The size (in bytes) of the blob being fetched.
- type: integer

Blob Visibility Object

newVisibility:
- description: This is the new visibility for the blob.
- type: object

SQL Access Object

action:
- description: Denotes whether access was granted or revoked. Possible values are "revoked"and "granted".
- type: string
sqlUser:
- description: The username of the user whose access is being manipulated.
- type: string

SQL Create User Object

sqlUser:
- description: The username of the user whose access is being manipulated.
- type: string

Data Source Subscription Object

dataSourceSubscriptionState:
- description: If the record type is dataSourceSubscription, this field must be present and indicate the state to which the record was changed (dataSources.length must be 1 in this case). Possible values are "denied", "subscribed", "expert", "owner", "ingest", and "unsubscribed".
- type: string
accessedId:
- description: The user identifier of the user who is being acted upon.
- type: integer
accessedIdType:
- description: Type of user being acted upon. Possible values are "user" and "group".
- type: string

Data Source Delete Object

hardDelete:
- description: Denotes whether this was a hard delete.
- type: boolean

Access User Object

accessedUserId:
- description: The user being accessed.
- type: string
accessedIamId:
- description: The IAM ID for the user being accessed.
- type: string
accessType:
- description: Denotes how the specified user was accessed. Possible values are "update", "get", "search", "create", "delete", "complete", "newToken", and "clone".
- type: string

Access Group Object

accessedUserId:
- description: The user being accessed.
- type: string
accessedGroupId:
- description: The group being accessed.
- type: integer
groupAccessType:
- description: Denotes how the specified group was accessed. Possible values are "update", "get", "search", "create", "delete", "addUser", and "removeUser".
- type: string
groupIamId:
- description: The IAM ID for the group being accessed.
- type: string

Error Response Messages

NOTE: It is possible for a similar message referencing the same error to appear in the logs, as this log message represents only that an error response was sent to a client.

In order to discover error response message using your analysis tool, search the object using the criteria below:

message: Error Response Sent

Error JSON Properties

id:
- description: A unique ID assigned to each request.
- type: string
method:
- The HTTP method used for the request.
- type: string
path:
- description: This is the HTTP path used for the request.
- type: string
query:
- description: An object containing the parsed query string used for the query.
- type: object
responseSentTime:
- description: This is the duration from the time a request was received until the time that the server responded.
- type: integer
responseTime:
- description: This is the duration from the time a request was received until server post-processing.
- type: integer
stack:
- description: This is a string representation of a stack trace if one exists.
- type: string
statusCode:
- description: This is the HTTP status code that was sent to the client.
- type: integer

Request Response Messages

In order to discover request response messages using your analysis tool, search the object using the criteria below:

message: Response Sent

Request JSON Properties

id:
- description: A unique ID assigned to each request.
- type: string
method:
- The HTTP method used for the request.
- type: string
path:
- description: This is the HTTP path used for the request.
- type: string
query:
- description: An object containing the parsed query string used for the query.
- type: object
responseSentTime:
- description: This is the duration from the time a request was received until the time that the server responded.
- type: integer
responseTime:
- description: This is the duration from the time a request was received until server post-processing.
- type: integer
statusCode:
- description: This is the HTTP status code that was sent to the client.
- type: integer

Example Response Message

{
  "id": "aaa5adf4-5b2b-4c46-974f-dca000bf228b",
  "dateTime": "1628524947022",
  "month": 1459,
  "profileId": 2,
  "userId": "john.doe@immuta.com",
  "dataSourceId": 7,
  "dataSourceName": "Tpc Web Sales",
  "count": 1,
  "recordType": "sqlQuery",
  "success": true,
  "component": "featureStore",
  "accessType": "query",
  "query": "SELECT \"ws_sold_date_sk\", \"ws_sold_time_sk\", \"ws_ship_date_sk\", \"ws_item_sk\", \"ws_bill_customer_sk\", \"ws_bill_cdemo_sk\", \"ws_bill_hdemo_sk\", \"ws_bill_addr_sk\", \"ws_ship_customer_sk\", \"ws_ship_cdemo_sk\", \"ws_ship_hdemo_sk\", \"ws_ship_addr_sk\", \"ws_web_page_sk\", \"ws_web_site_sk\", \"ws_ship_mode_sk\", \"ws_warehouse_sk\", \"ws_promo_sk\", \"ws_order_number\", \"ws_quantity\", \"ws_wholesale_cost\", \"ws_list_price\", \"ws_sales_price\", \"ws_ext_discount_amt\", \"ws_ext_sales_price\", \"ws_ext_wholesale_cost\", \"ws_ext_list_price\", \"ws_ext_tax\", \"ws_coupon_amt\", \"ws_ext_ship_cost\", \"ws_net_paid\", \"ws_net_paid_inc_tax\", \"ws_net_paid_inc_ship\", \"ws_net_paid_inc_ship_tax\", \"ws_net_profit\" FROM \"tpc\".\"web_sales\" LIMIT 100",
  "queryId": "30f65620-f92b-11eb-8205-567f9878b67f",
  "extra": {
    "direct": true,
    "remoteQueries": [
      "SELECT  TOP 100 \"ws_sold_date_sk\", \"ws_sold_time_sk\", \"ws_ship_date_sk\", \"ws_item_sk\", \"ws_bill_customer_sk\", \"ws_bill_cdemo_sk\", \"ws_bill_hdemo_sk\", \"ws_bill_addr_sk\", \"ws_ship_customer_sk\", \"ws_ship_cdemo_sk\", \"ws_ship_hdemo_sk\", \"ws_ship_addr_sk\", \"ws_web_page_sk\", \"ws_web_site_sk\", \"ws_ship_mode_sk\", \"ws_warehouse_sk\", \"ws_promo_sk\", \"ws_order_number\", \"ws_quantity\", \"ws_wholesale_cost\", \"ws_list_price\", \"ws_sales_price\", \"ws_ext_discount_amt\", \"ws_ext_sales_price\", \"ws_ext_wholesale_cost\", \"ws_ext_list_price\", \"ws_ext_tax\", \"ws_coupon_amt\", \"ws_ext_ship_cost\", \"ws_net_paid\", \"ws_net_paid_inc_tax\", \"ws_net_paid_inc_ship\", \"ws_net_paid_inc_ship_tax\", \"ws_net_profit\" FROM \"tpc\".\"web_sales\""
    ]
  },
  "dataSourceSchemaName": "tpc",
  "dataSourceTableName": "web_sales",
  "sqlUser": "immuta_query_impersonator",
  "createdAt": "2021-08-09T16:02:27.023Z",
  "updatedAt": "2021-08-09T16:02:27.023Z"
}

Legacy to UAM Migration

Universal audit model (UAM) is Immuta's consistent structure for all Immuta system and user query audit logs. This reference guide maps the legacy audit events to the new UAM events and provides example schemas of all the UAM events available in Immuta.

To learn more about Immuta's audit, see the UAM reference page.

Events and descriptions

Legacy event

UAM event

Description

ApiKeyCreated event

Event: ApiKeyCreated
Legacy event: apiKey
Description: An audit event for when an API key is created on the Immuta app settings page or from an Immuta user's profile page.

{
    "relatedResources": [],
    "auditPayload": {
        "type": "ApiKeyCreatedAuditPayload",
        "apiKeyId": "1112158",
        "name": "T1",
        "version": 1
    },
    "action": "CREATE",
    "tenantId": "your-immuta-tenant.com",
    "actionStatus": "SUCCESS",
    "eventTimestamp": "2024-01-25T18:04:58.368Z",
    "actor": {
        "id": "taylor@immuta.com",
        "identityProvider": "bim",
        "profileId": "1",
        "type": "USER_ACTOR",
        "name": "Taylor Smith"
    },
    "targetType": "APIKEY",
    "id": "d9dc3cee-98d0-47d6-ba81-e0b38f9f4014",
    "receivedTimestamp": "2024-01-25T18:04:58.505Z",
    "actorIp": "xxx.xx.xx.xx",
    "targets": [],
    "requestId": "60c68659-ac83-5299-bf3e-14856178a0de",
    "sessionId": "9c553d7ace0aa3ee735fd3c14f737bc6"
}

ApiKeyDeleted event

Event: ApiKeyDeleted
Legacy event: apiKey
Description: An audit event for when an API key is deleted on the Immuta app settings page or from an Immuta user's profile page.

{
    "id": "fe47ddd1-fd22-4dcf-9648-83950a10ef34",
    "targetType": "APIKEY",
    "receivedTimestamp": "2024-01-25T18:08:28.891Z",
    "actor": {
        "type": "USER_ACTOR",
        "identityProvider": "bim",
        "id": "taylor@immuta.com",
        "profileId": "1",
        "name": "Taylor Smith"
    },
    "requestId": "220c7faa-7f56-5d8c-aa31-8ac2212b7707",
    "sessionId": "9c553d7ace0aa3ee735fd3c14f737bc6",
    "targets": [],
    "actorIp": "xxx.xx.xx.xx",
    "relatedResources": [],
    "auditPayload": {
        "type": "ApiKeyDeletedAuditPayload",
        "apiKeyId": "1112158",
        "version": 1
    },
    "eventTimestamp": "2024-01-25T18:08:21.319Z",
    "action": "DELETE",
    "actionStatus": "SUCCESS",
    "tenantId": "your-immuta-tenant.com"
}

AttributeApplied event

Event: AttributeApplied
Legacy events: accessUser and accessGroup
Description: An audit event for an attribute applied to a group or user.
Additional parameter details: targetType will specify whether the attribute was added to a USER or GROUP.

{
    "actorIp": "xxx.xx.xx.xx",
    "targets": [
        {
            "name": "Deepu Murty",
            "id": "deepu@immuta.com",
            "identityProvider": "bim",
            "profileId": "20",
            "type": "USER"
        }
    ],
    "requestId": "e45652cd-4d00-5def-8e8c-aca696822fc2",
    "sessionId": "cdbffff8804103418350947c6586712c",
    "actor": {
        "type": "USER_ACTOR",
        "profileId": "1",
        "id": "taylor@immuta.com",
        "identityProvider": "bim",
        "name": "Taylor Smith"
    },
    "id": "63f111a7-0835-4696-8fdb-188130c44fac",
    "targetType": "USER",
    "receivedTimestamp": "2023-09-13T14:36:02.926Z",
    "action": "ATTRIBUTE_APPLY",
    "tenantId": "your-immuta-tenant.com",
    "actionStatus": "SUCCESS",
    "eventTimestamp": "2023-09-13T14:36:02.688Z",
    "relatedResources": [
        {
            "values": ["Product"],
            "name": "Department",
            "id": "department",
            "type": "ATTRIBUTE"
        }
    ],
    "auditPayload": {
        "entityType": "USER",
        "type": "AttributeAppliedAuditPayload",
        "version": 1,
        "attributes": [
            {
                "values": ["Product"],
                "attribute": "Department"
            }
        ],
        "entityIdProvider": "bim",
        "entityId": "deepu@immuta.com"
    }
}

AttributeRemoved event

Event: AttributeRemoved
Legacy events: accessUser and accessGroup
Description: An audit event for an attribute removed from a group or user.
Additional parameter details: targetType will specify whether the attribute was removed from a USER or GROUP.

{
    "relatedResources": [
        {
            "values": ["UNCLASSIFIED"],
            "name": "classification",
            "id": "classification",
            "type": "ATTRIBUTE"
        }
    ],
    "auditPayload": {
        "type": "AttributeRemovedAuditPayload",
        "entityType": "USER",
        "version": 1,
        "attributes": [
            {
                "values": ["UNCLASSIFIED"],
                "attribute": "classification"
            }
        ],
        "entityIdProvider": "bim",
        "entityId": "deepu@immuta.com"
    },
    "action": "ATTRIBUTE_REMOVE",
    "actionStatus": "SUCCESS",
    "tenantId": "your-immuta-tenant.com",
    "eventTimestamp": "2024-02-20T19:46:50.259Z",
    "actor": {
        "profileId": "1",
        "id": "taylor@immuta.com",
        "identityProvider": "bim",
        "type": "USER_ACTOR",
        "name": "Taylor Smith"
    },
    "id": "0fd77c61-f08a-488c-9d10-c356ffea0d11",
    "targetType": "USER",
    "receivedTimestamp": "2024-02-20T19:46:50.426Z",
    "targets": [
        {
            "name": "Deepu Murty",
            "type": "USER",
            "id": "deepu@immuta.com",
            "identityProvider": "bim",
            "profileId": "20"
        }
    ],
    "actorIp": "xxx.xx.xx.xx",
    "requestId": "146ec771-ec2e-5f40-8551-1dbc38e64078",
    "sessionId": "893db38b8f1977fda75f60d168c4e74e"
}

ConfigurationUpdated event

Event: ConfigurationUpdated
Legacy event: configurationUpdate
Description: An audit event for updates to the configuration on the Immuta app settings page.

{
    "eventTimestamp": "2023-12-04T18:38:25.801Z",
    "tenantId": "your-immuta-tenant.com",
    "actionStatus": "SUCCESS",
    "action": "CONFIGURATION_UPDATED",
    "auditPayload": {
        "version": 1,
        "type": "ConfigurationUpdatedAuditPayload",
        "changeSet": {
            "plugins": {
                "policy": {
                    "approveToPromote": {
                        "requiredApprovalCount": [
                            {
                                "newValue": 1,
                                "oldValue": 2
                            }
                        ]
                    }
                }
            }
        },
        "configurationId": "20"
    },
    "relatedResources": [],
    "sessionId": "aed83ab8b46affcb1169532dada92b72",
    "requestId": "c80f510f-3f55-5450-8dea-d5e243708686",
    "targets": [
        {
            "name": "20",
            "type": "CONFIGURATION",
            "id": "20"
        }
    ],
    "actorIp": "xxx.xx.xx.xx",
    "receivedTimestamp": "2023-12-04T18:38:26.039Z",
    "id": "3989e233-c791-43e9-813f-7738f4c8e26b",
    "targetType": "CONFIGURATION",
    "actor": {
        "identityProvider": "bim",
        "id": "taylor@immuta.com",
        "profileId": "1",
        "type": "USER_ACTOR",
        "name": "Taylor Smith"
    }
}

DatasourceAppliedToProject event

Event: DatasourceAppliedToProject
Legacy event: addToProject
Description: An audit event for adding a data source to an Immuta project.

{
    "auditPayload": {
        "type": "DatasourceAppliedToProjectAuditPayload",
        "errors": [],
        "projectId": "2",
        "version": 1,
        "datasources": [
            {
                "id": "2",
                "name": "Public Case"
            }
        ]
    },
    "sessionId": "6b928653b1411078647a2764a72beca6",
    "targets": [
        {
            "projectKey": "HumanResources",
            "id": "2",
            "type": "PROJECT",
            "name": "Human Resources"
        }
    ],
    "action": "DATASOURCE_APPLY",
    "id": "8106b44f-cf56-4ca2-a111-641d0e80e6ff",
    "targetType": "PROJECT",
    "actionStatus": "SUCCESS",
    "relatedResources": [
        {
            "id": "2",
            "technology": "SNOWFLAKE",
            "type": "DATASOURCE",
            "name": "Public Case"
        }
    ],
    "actor": {
        "id": "taylor@immuta.com",
        "profileId": "1",
        "name": "Taylor Smith",
        "identityProvider": "bim",
        "type": "USER_ACTOR"
    },
    "eventTimestamp": "2023-10-13T14:08:20.427Z",
    "actorIp": "xxx.xx.xx.xx",
    "requestId": "8823f3f0-4e46-590c-bbb2-209cce750ff9",
    "tenantId": "your-immuta-tenant.com",
    "receivedTimestamp": "2023-10-13T14:08:20.660Z"
}

DatasourceCatalogSynced event

Event: DatasourceCatalogSynced
Legacy event: catalogUpdate
Description: An audit event for syncing an external catalog to tag Immuta data sources.

{
    "tenantId": "your-immuta-tenant.com",
    "action": "CATALOG_SYNC",
    "actor": {
        "type": "USER_ACTOR",
        "identityProvider": "bim",
        "name": "Taylor Smith",
        "profileId": "1",
        "id": "taylor@immuta.com"
    },
    "targetType": "DATASOURCE",
    "actionStatus": "SUCCESS",
    "eventTimestamp": "2023-04-14T16:48:21.159Z",
    "id": "159d4299-fca5-47cb-aa6b-81d93bafa526",
    "targets": [
        {
            "id": "9",
            "name": "Public case",
            "technology": "SNOWFLAKE",
            "type": "DATASOURCE"
        }
    ],
    "relatedResources": [],
    "receivedTimestamp": "2023-04-14T16:48:21.209Z",
    "auditPayload": {
        "datasourceId": "9",
        "changes": {
            "before": {
                "catalogId": null,
                "documentation": null,
                "dictionary": [
                    {
                        "tags": [],
                        "columnName": "country"
                    },
                    {
                        "columnName": "date",
                        "tags": []
                    },
                    {
                        "tags": [],
                        "columnName": "fastest_qualifying"
                    },
                    {
                        "columnName": "location",
                        "tags": []
                    },
                    {
                        "columnName": "round",
                        "tags": []
                    },
                    {
                        "columnName": "winning_aircraft",
                        "tags": []
                    },
                    {
                        "tags": [],
                        "columnName": "winning_pilot"
                    }
                ],
                "tableTags": null,
                "description": null
            },
            "after": {
                "description": "",
                "tableTags": null,
                "dictionary": [
                    {
                        "columnName": "country",
                        "description": "",
                        "tags": []
                    },
                    {
                        "tags": [],
                        "description": "",
                        "columnName": "date"
                    },
                    {
                        "tags": [],
                        "columnName": "fastest_qualifying",
                        "description": ""
                    },
                    {
                        "tags": [],
                        "columnName": "location",
                        "description": ""
                    },
                    {
                        "columnName": "round",
                        "description": "",
                        "tags": []
                    },
                    {
                        "tags": [],
                        "description": "",
                        "columnName": "winning_aircraft"
                    },
                    {
                        "columnName": "winning_pilot",
                        "description": "",
                        "tags": []
                    }
                ],
                "catalogId": "immuta-product_engineering"
            }
        },
        "type": "DatasourceCatalogSyncedAuditPayload"
    }
}

DatasourceCreated event

Event: DatasourceCreated
Legacy event: dataSourceCreate
Description: An audit event for registering a table as an Immuta data source.

{
"id": "dc0b7313-ecc9-42f1-ba33-df0a1a753c08",
"action": "CREATE",
"actionStatus": "SUCCESS",
"actor": {
    "name": "Taylor Smith",
    "id": "taylor@immuta.com",
    "identityProvider": "bim",
    "profileId": "1",
    "type": "USER_ACTOR"
},
"tenantId": "your-immuta-tenant.com",
"targetType": "DATASOURCE",
"targets": [
    {
        "type": "DATASOURCE",
        "id": "102",
        "name": "Pgboss Job",
        "technology": "POSTGRESQL"
    }
],
"relatedResources": [
    {
        "type": "CONNECTION",
        "id": "4",
        "name": "data-source-connection-name",
        "connectionKey": "data-source-connection-key"
    }
],
"auditPayload": {
    "type": "DatasourceCreatedAuditPayload",
    "version": 1,
    "description": null,
    "documentation": null,
    "expiration": null,
    "columnDetectionEnabled": true,
    "disabled": false,
    "technology": "POSTGRESQL",
    "connectionId": "4",
    "table": "job",
    "schema": "pgboss",
    "sensitiveDataDiscoveryEnabled": true
},
"eventTimestamp": "2024-02-22T13:59:04.681Z",
"receivedTimestamp": "2024-02-22T13:59:04.715Z"
}

DatasourceDeleted event

Event: DatasourceDeleted
Legacy event: dataSourceDelete
Description: An audit event for deleting a data source in Immuta.

{
"id": "1403b675-70f6-4833-ab4c-a7486c63f494",
"action": "DELETE",
"actionStatus": "SUCCESS",
"actor": {
    "name": "Taylor Smith",
    "id": "taylor@immuta.com",
    "identityProvider": "bim",
    "profileId": "1",
    "type": "USER_ACTOR"
},
"tenantId": "your-immuta-tenant.com",
"targetType": "DATASOURCE",
"targets": [
    {
        "type": "DATASOURCE",
        "id": "93",
        "name": "Audit",
        "technology": "POSTGRESQL"
    }
],
"relatedResources": [],
"auditPayload": {
    "type": "DatasourceDeletedAuditPayload",
    "version": 1,
    "datasourceId": "93",
    "name": "Audit",
    "technology": "POSTGRESQL"
},
"eventTimestamp": "2024-02-22T14:20:42.379Z",
"receivedTimestamp": "2024-02-22T14:20:42.392Z"
}

DatasourceDisabled event

Event: DatasourceDisabled
Legacy event: None
Description: An audit event for disabling a data source in Immuta.

{
    "id": "a09b9bc3-3775-4496-87ec-b808cf649794",
    "sessionId": "0fcaaf9c074330b4b875746c2e52739c",
    "requestId": "153fe145-32a0-5c33-930d-c571c1d7748d",
    "action": "DISABLE",
    "actionStatus": "SUCCESS",
    "actor": {
        "name": "Taylor Smith",
        "id": "taylor@immuta.com",
        "identityProvider": "bim",
        "profileId": "1",
        "type": "USER_ACTOR"
    },
    "actorIp": "xxx.xx.xx.xx",
    "tenantId": "your-immuta-tenant.com",
    "targetType": "DATASOURCE",
    "targets": [
        {
            "type": "DATASOURCE",
            "id": "57",
            "name": "Activity",
            "technology": "POSTGRESQL"
        }
    ],
    "relatedResources": [],
    "auditPayload": {
        "type": "DatasourceDisabledAuditPayload",
        "version": 1,
        "datasourceId": "57",
        "name": "Activity",
        "technology": "POSTGRESQL"
    },
    "eventTimestamp": "2024-02-22T14:22:20.039Z",
    "receivedTimestamp": "2024-02-22T14:22:20.183Z"
}

DatasourceGlobalPolicyApplied event

Event: DatasourceGlobalPolicyApplied
Legacy event: globalPolicyApplied
Description: An audit event for applying a global policy to a data source.

{
    "receivedTimestamp": "2023-10-24T18:06:27.645Z",
    "auditPayload": {
        "conflict": null,
        "version": 1,
        "policy": {
            "actions": [
                {
                    "dataPolicyType": "MASKING",
                    "rules": [
                        {
                            "exceptions": null,
                            "type": "MASKING_HASH",
                            "fields": ["AWARD_ID"],
                            "ruleAppliedForUser": false
                        }
                    ],
                    "type": "DATA",
                    "global": false,
                    "rationale": null
                }
            ],
            "type": "DATA"
        },
        "type": "DatasourceGlobalPolicyAppliedAuditPayload"
    },
    "relatedResources": [
        {
            "policyKey": "Mask PII",
            "name": "Mask PII",
            "type": "GLOBAL_POLICY",
            "id": "7"
        }
    ],
    "id": "7f57d63a-5db8-412a-ad93-c6baa61384b3",
    "targetType": "DATASOURCE",
    "actor": {
        "profileId": "1",
        "identityProvider": "bim",
        "id": "taylor@immuta.com",
        "type": "USER_ACTOR",
        "name": "Taylor Smith"
    },
    "eventTimestamp": "2023-10-24T18:06:27.617Z",
    "tenantId": "your-immuta-tenant.com",
    "actionStatus": "SUCCESS",
    "targets": [
        {
            "id": "47",
            "type": "DATASOURCE",
            "technology": "SNOWFLAKE",
            "name": "Public case"
        }
    ],
    "action": "POLICY_APPLIED"
}

DatasourceGlobalPolicyConflictResolved event

Event: DatasourceGlobalPolicyConflictResolved
Legacy event: globalPolicyConflictResolved
Description: An audit event for a global policy conflict being resolved on a data source.

{
    "actor": {
        "name": "Taylor Smith",
        "profileId": "1",
        "identityProvider": "bim",
        "id": "taylor@immuta.com",
        "type": "USER_ACTOR"
    },
    "id": "ac9c699a-aad0-4899-964c-279cd7eba125",
    "targetType": "DATASOURCE",
    "relatedResources": [],
    "auditPayload": {
        "type": "DatasourceGlobalPolicyConflictResolvedAuditPayload",
        "version": 1
    },
    "receivedTimestamp": "2023-10-24T18:34:04.330Z",
    "action": "POLICY_CONFLICT_RESOLVED",
    "targets": [
        {
            "name": "Public case",
            "technology": "SNOWFLAKE",
            "id": "47",
            "type": "DATASOURCE"
        }
    ],
    "actionStatus": "SUCCESS",
    "tenantId": "your-immuta-tenant.com",
    "eventTimestamp": "2023-10-24T18:34:04.301Z"
}

DatasourceGlobalPolicyDisabled event

Event: DatasourceGlobalPolicyDisabled
Legacy event: globalPolicyDisabled
Description: An audit event for a data owner disabling a global policy from their data source.

{
    "relatedResources": [
        {
            "id": "7",
            "type": "GLOBAL_POLICY",
            "name": "Mask PII",
            "policyKey": "mask pii"
        }
    ],
    "targetType": "DATASOURCE",
    "id": "4853154c-8825-4138-800d-913cbab56af6",
    "receivedTimestamp": "2023-10-24T18:13:25.004Z",
    "auditPayload": {
        "version": 1,
        "type": "DatasourceGlobalPolicyDisabledAuditPayload"
    },
    "actor": {
        "id": "taylor@immuta.com",
        "identityProvider": "bim",
        "profileId": "1",
        "type": "USER_ACTOR",
        "name": "Taylor Smith"
    },
    "eventTimestamp": "2023-10-24T18:13:24.975Z",
    "action": "POLICY_DISABLED",
    "targets": [
        {
            "id": "47",
            "type": "DATASOURCE",
            "name": "Public case",
            "technology": "SNOWFLAKE"
        }
    ],
    "actionStatus": "SUCCESS",
    "tenantId": "your-immuta-tenant.com"
}

DatasourceGlobalPolicyRemoved event

Event: DatasourceGlobalPolicyRemoved
Legacy event: globalPolicyRemoved
Description: An audit event for a data owner removing a global policy from their data source.

{
    "actor": {
        "name": "Taylor Smith",
        "type": "USER_ACTOR",
        "identityProvider": "bim",
        "id": "taylor@immuta.com",
        "profileId": "1"
    },
    "auditPayload": {
        "type": "DatasourceGlobalPolicyRemovedAuditPayload",
        "conflict": null,
        "policy": {
            "type": "DATA",
            "actions": [
                {
                    "dataPolicyType": "MASKING",
                    "rationale": null,
                    "global": false,
                    "type": "DATA",
                    "rules": [
                        {
                            "type": "MASKING_HASH",
                            "exceptions": null,
                            "ruleAppliedForUser": false,
                            "fields": ["PII"]
                        }
                    ]
                }
            ]
        },
        "version": 1
    },
    "receivedTimestamp": "2023-10-24T18:06:27.635Z",
    "id": "4a27ab2f-156e-4cff-a3bc-65184d74ccd5",
    "targetType": "DATASOURCE",
    "relatedResources": [
        {
            "policyKey": "mask pii",
            "name": "Mask PII",
            "id": "7",
            "type": "GLOBAL_POLICY"
        }
    ],
    "tenantId": "your-immuta-tenant.com",
    "actionStatus": "SUCCESS",
    "targets": [
        {
            "type": "DATASOURCE",
            "id": "47",
            "name": "Public case",
            "technology": "SNOWFLAKE"
        }
    ],
    "action": "POLICY_REMOVED",
    "eventTimestamp": "2023-10-24T18:06:27.617Z"
}

DatasourcePolicyCertificationExpired event

Event: DatasourcePolicyCertificationExpired
Legacy event: policyCertificationExpired
Description: An audit event for a global policy certification expiring on a data source.

{
    "actionStatus": "SUCCESS",
    "tenantId": "your-immuta-tenant.com",
    "targets": [
        {
            "technology": "SNOWFLAKE",
            "name": "Public case",
            "type": "DATASOURCE",
            "id": "47"
        }
    ],
    "action": "DECERTIFY_POLICY",
    "eventTimestamp": "2023-10-16T19:49:25.365Z",
    "actor": {
        "type": "SYSTEM_ACCOUNT",
        "id": "immuta_system_account",
        "name": "Immuta System Account"
    },
    "auditPayload": {
        "expirationDate": "2023-10-16T19:49:25.365Z",
        "type": "DatasourcePolicyCertificationExpiredAuditPayload",
        "version": 1
    },
    "receivedTimestamp": "2023-10-16T19:49:25.387Z",
    "targetType": "DATASOURCE",
    "id": "aedc4025-d888-4407-b837-659dca4d0e80",
    "relatedResources": [
        {
            "type": "GLOBAL_POLICY",
            "id": "7",
            "policyKey": "mask pii",
            "name": "Mask PII"
        }
    ]
}

DatasourcePolicyCertified event

Event: DatasourcePolicyCertified
Legacy event: globalPolicyCertify
Description: An audit event for a global policy being certified by a data owner for their data source.

{
    "receivedTimestamp": "2023-10-03T18:35:32.666Z",
    "id": "04947a9b-0206-4c2d-bce0-0d969b68350b",
    "targetType": "DATASOURCE",
    "actor": {
        "type": "USER_ACTOR",
        "profileId": "1",
        "id": "taylor@immuta.com",
        "identityProvider": "bim",
        "name": "Taylor Smith"
    },
    "sessionId": "95ca3d7f5d3d2a2b82cecb3ff1051b63",
    "requestId": "bf443424-2e49-5a13-9009-8b527a3f65f3",
    "targets": [
        {
            "id": "44",
            "type": "DATASOURCE",
            "technology": "SNOWFLAKE",
            "name": "Public case"
        }
    ],
    "actorIp": "xxx.xx.xx.xx",
    "auditPayload": {
        "type": "DatasourcePolicyCertifiedAuditPayload",
        "columns": [
            {
                "name": "Full name",
                "tags": [
                    {
                        "deleted": false,
                        "id": "23",
                        "type": "TAG",
                        "context": "manual",
                        "source": "curated",
                        "name": "PII"
                    }
                ]
            }
        ],
        "certificationDate": "2023-10-03T18:35:32.607Z",
        "version": 1
    },
    "relatedResources": [
        {
            "type": "GLOBAL_POLICY",
            "id": "3",
            "name": "Mask PHI",
            "policyKey": "Mask PHI"
        }
    ],
    "eventTimestamp": "2023-10-03T18:35:32.484Z",
    "actionStatus": "SUCCESS",
    "tenantId": "your-immuta-tenant.com",
    "action": "POLICY_CERTIFY"
}

DatasourcePolicyDecertified event

Event: DatasourcePolicyDecertified
Legacy events: None
Description: An audit event for a global policy being decertified on a data source.

{
    "actorIp": "xxx.xx.xx.xx",
    "targets": [
        {
            "id": "44",
            "type": "DATASOURCE",
            "technology": "SNOWFLAKE",
            "name": "Public case"
        }
    ],
    "requestId": "270aa26c-e424-53cf-af06-d290c8bfa308",
    "sessionId": "95ca3d7f5d3d2a2b82cecb3ff1051b63",
    "actor": {
        "identityProvider": "bim",
        "id": "taylor@immuta.com",
        "profileId": "1",
        "type": "USER_ACTOR",
        "name": "Taylor Smith"
    },
    "targetType": "DATASOURCE",
    "id": "31c902a8-5cbc-4171-baaa-2428080fac91",
    "receivedTimestamp": "2023-10-03T19:25:34.166Z",
    "action": "DECERTIFY_POLICY",
    "actionStatus": "SUCCESS",
    "tenantId": "your-immuta-tenant.com",
    "eventTimestamp": "2023-10-03T19:25:34.094Z",
    "relatedResources": [
        {
            "name": "Mask PII",
            "policyKey": "mask pii",
            "id": "7",
            "type": "GLOBAL_POLICY"
        }
    ],
    "auditPayload": {
        "version": 1,
        "type": "DatasourcePolicyDecertifiedAuditPayload",
        "decertificationDate": "2023-10-03T19:25:34.121Z"
    }
}

DatasourceRemovedFromProject event

Event: DatasourceRemovedFromProject
Legacy event: removeFromProject
Description: An audit event for removing a data source from a project.

{
    "id": "77de32df-1655-4618-b0bf-e6883483a151",
    "sessionId": "285574f9f1fd35b1fc7dba060e0786a2",
    "requestId": "e35f9736-f206-53fd-ab02-043bce216e52",
    "action": "DATASOURCE_REMOVE",
    "actionStatus": "SUCCESS",
    "actor": {
        "name": "Taylor Smith",
        "id": "taylor@immuta.com",
        "identityProvider": "bim",
        "profileId": "1",
        "type": "USER_ACTOR"
    },
    "actorIp": "xxx.xx.xx.xx",
    "tenantId": "your-immuta-tenant.com",
    "targetType": "PROJECT",
    "targets": [
        {
            "type": "PROJECT",
            "name": "Human Resources",
            "id": "13",
            "projectKey": "humanresources"
        }
    ],
    "relatedResources": [
        {
            "type": "DATASOURCE",
            "id": "54",
            "name": "Customers",
            "technology": "POSTGRESQL"
        }
    ],
    "auditPayload": {
        "type": "DatasourceRemovedFromProjectAuditPayload",
        "version": 1,
        "projectId": "13",
        "datasources": [
            {
                "id": "54",
                "name": "Customers"
            }
        ],
        "errors": []
    },
    "eventTimestamp": "2024-02-29T18:19:08.881Z",
    "receivedTimestamp": "2024-02-29T18:19:09.071Z"
}

DatasourceUpdated event

Event: DatasourceUpdated
Legacy events: dataSourceUpdate and dataSourceSave
Description: An audit event for updating a data source with the new data source details.

{
    "id": "d6e6115a-e508-4ace-83af-5b6da9a25884",
    "action": "UPDATE",
    "actionStatus": "SUCCESS",
    "actor": {
        "name": "Taylor Smith",
        "id": "taylor@immuta.com",
        "identityProvider": "bim",
        "profileId": "1",
        "type": "USER_ACTOR"
    },
    "tenantId": "your-immuta-tenant.com",
    "targetType": "DATASOURCE",
    "targets": [
        {
            "type": "DATASOURCE",
            "id": "66",
            "name": "Public case",
            "technology": "POSTGRESQL"
        }
    ],
    "relatedResources": [],
    "auditPayload": {
        "type": "DatasourceUpdatedAuditPayload",
        "version": 1,
        "name": "Public case",
        "description": null,
        "documentation": "New documentation to descripe the table.",
        "expiration": null,
        "columnDetectionEnabled": true,
        "disabled": false,
        "datasourceId": "66"
    },
    "eventTimestamp": "2024-02-22T14:24:45.048Z",
    "receivedTimestamp": "2024-02-22T14:24:45.069Z"
}

DomainCreated event

Event: DomainCreated
Legacy event: collectionCreated
Description: An audit event for creating a domain.

{
    "sessionId": "227c3dbbbfe78ecd693c84979a930c22",
    "actionStatus": "SUCCESS",
    "targetType": "DOMAIN",
    "actorIp": "xxx.xx.xx.xx",
    "receivedTimestamp": "2023-12-20T20:01:03.651Z",
    "requestId": "460ce02b-30d5-5e68-bff0-b31e6ea44ba0",
    "id": "f99bc30e-13f6-4041-a0ad-20750a27519e",
    "actor": {
        "id": "taylor@immuta.com",
        "name": "Taylor Smith",
        "identityProvider": "bim",
        "profileId": "1",
        "type": "USER_ACTOR"
    },
    "action": "CREATE",
    "tenantId": "your-immuta-tenant.com",
    "auditPayload": {
        "domain": {
            "description": "A domain for financial data.",
            "name": "Finance Domain",
            "domainType": "DOMAIN",
            "id": "11e7011d-a365-4933-abcb-d5febc03d310"
        },
        "version": 1,
        "type": "DomainCreatedAuditPayload"
    },
    "relatedResources": [],
    "targets": [
        {
            "name": "Finance Domain",
            "domainType": "domain",
            "type": "DOMAIN",
            "id": "11e7011d-a365-4933-abcb-d5febc03d310"
        }
    ],
    "eventTimestamp": "2023-12-20T20:01:03.065Z"
}

DomainDataSourcesUpdated event

Event: DomainDataSourcesUpdated
Legacy events: collectionDataSourceAdded, collectionDataSourceRemoved, and collectionDataSourceUpdated
Description: An audit event for updating a domain's data sources.
Additional parameter details: auditPayload.updateType will specify whether the data source was added to or removed from the domain.

{
    "action": "MODIFY_DOMAIN",
    "tenantId": "your-immuta-tenant.com",
    "actionStatus": "SUCCESS",
    "targetType": "DOMAIN",
    "modifiedResourceType": "DATASOURCE",
    "actor": {
        "type": "USER_ACTOR",
        "profileId": "1",
        "identityProvider": "bim",
        "name": "Taylor Smith",
        "id": "taylor@immuta.com"
    },
    "id": "bef14718-5fa8-4891-bb9e-47f7a332a70b",
    "eventTimestamp": "2023-12-20T20:23:14.432Z",
    "auditPayload": {
        "updateType": "ADD",
        "version": 1,
        "type": "DomainDataSourcesUpdatedAuditPayload"
    },
    "receivedTimestamp": "2023-12-20T20:23:14.456Z",
    "relatedResources": [
        {
            "name": "Public case",
            "type": "DATASOURCE",
            "technology": "POSTGRESQL",
            "id": "381"
        }
    ],
    "targets": [
        {
            "id": "11e7011d-a365-4933-abcb-d5febc03d310",
            "name": "Finance Domain",
            "domainType": "domain",
            "type": "DOMAIN"
        }
    ]
}

DomainDeleted event

Event: DomainDeleted
Legacy event: collectionDeleted
Description: An audit event for deleting a domain.

{
    "relatedResources": [],
    "targets": [
        {
            "type": "DOMAIN",
            "name": "Finance Domain",
            "domainType": "DOMAIN",
            "id": "6eb5a6df-67d8-4de7-adbd-24eb7271eaea"
        }
    ],
    "auditPayload": {
        "version": 1,
        "domain": {
            "id": "6eb5a6df-67d8-4de7-adbd-24eb7271eaea",
            "name": "Finance Domain",
            "domainType": "DOMAIN"
        },
        "type": "DomainDeletedAuditPayload"
    },
    "eventTimestamp": "2023-12-20T20:21:13.981Z",
    "actor": {
        "id": "kris@immuta.com",
        "identityProvider": "bim",
        "name": "Taylor Smith",
        "profileId": "1",
        "type": "USER_ACTOR"
    },
    "tenantId": "your-immuta-tenant.com",
    "action": "DELETE",
    "requestId": "7884603d-8911-5f33-a9a7-d8560eb49a89",
    "receivedTimestamp": "2023-12-20T20:21:14.077Z",
    "id": "3a82ceb6-6592-4ddf-9055-6920d87bba32",
    "actionStatus": "SUCCESS",
    "targetType": "DOMAIN",
    "sessionId": "227c3dbbbfe78ecd693c84979a930c22",
    "actorIp": "xxx.xx.xx.xx"
}

DomainPermissionsUpdated event

Event: DomainPermissionsUpdated
Legacy events: collectionPermissionGranted and collectionPermissionRevoked
Description: An audit event for granting or revoking a user's domain-related permissions.
Additional parameter details: auditPayload.updateType will specify whether the permission was granted to or revoked from a user.

{
    "eventTimestamp": "2023-12-20T20:01:03.065Z",
    "relatedResources": [
        {
            "type": "USER",
            "name": "Taylor Smith",
            "identityProvider": "bim",
            "profileId": "1",
            "id": "taylor@immuta.com"
        },
        {
            "type": "USER",
            "profileId": "1",
            "name": "Taylor Smith",
            "identityProvider": "bim",
            "id": "taylor@immuta.com"
        }
    ],
    "targets": [
        {
            "name": "Finance Domain",
            "domainType": "domain",
            "type": "DOMAIN",
            "id": "11e7011d-a365-4933-abcb-d5febc03d310"
        }
    ],
    "auditPayload": {
        "updateType": "GRANT",
        "version": 1,
        "permissionUpdates": [
            {
                "permission": "MANAGE_POLICIES",
                "profileId": "1"
            }
        ],
        "type": "DomainPermissionsUpdatedAuditPayload"
    },
    "tenantId": "your-immuta-tenant.com",
    "action": "MODIFY_DOMAIN",
    "actor": {
        "identityProvider": "bim",
        "name": "Taylor Smith",
        "profileId": "1",
        "type": "USER_ACTOR",
        "id": "taylor@immuta.com"
    },
    "modifiedResourceType": "USER",
    "id": "377ee78b-74da-4466-bdc1-22d531c1f61c",
    "requestId": "460ce02b-30d5-5e68-bff0-b31e6ea44ba0",
    "receivedTimestamp": "2023-12-20T20:01:03.576Z",
    "actorIp": "xxx.xx.xx.xx",
    "sessionId": "227c3dbbbfe78ecd693c84979a930c22",
    "targetType": "DOMAIN",
    "actionStatus": "SUCCESS"
}

DomainUpdated event

Event: DomainUpdated
Legacy event: collectionUpdated
Description: An audit event for updating an Immuta domain.

{
    "id": "d61d6ac9-2897-4d34-84f3-16181ddb9212",
    "sessionId": "adba345c6949d7f7761367c0769b983d",
    "requestId": "9a64147e-5b57-5905-9e7c-54b5a5c461c8",
    "action": "UPDATE",
    "actionStatus": "SUCCESS",
    "actor": {
        "name": "Taylor Smith",
        "id": "taylor@immuta.com",
        "identityProvider": "bim",
        "profileId": "1",
        "type": "USER_ACTOR"
    },
    "actorIp": "xxx.xx.xx.xx",
    "tenantId": "your-immuta-tenant.com",
    "targetType": "DOMAIN",
    "targets": [
        {
            "type": "DOMAIN",
            "id": "69347b14-1cda-41e1-9186-e85853158299",
            "name": "Finance Domain v2",
            "domainType": "domain"
        }
    ],
    "relatedResources": [],
    "auditPayload": {
        "type": "DomainUpdatedAuditPayload",
        "modifiedFields": [
            "name",
            "description"
        ],
        "domain": {
            "id": "69347b14-1cda-41e1-9186-e85853158299",
            "name": "Finance Domain v2",
            "description": "Only use for finance tables."
        },
        "version": 1
    },
    "eventTimestamp": "2023-12-12T18:26:29.618Z",
    "receivedTimestamp": "2023-12-12T18:26:32.472Z"
}

GlobalPolicyApprovalRescinded event

Event: GlobalPolicyApprovalRescinded
Legacy event: globalPolicyApprovalRescinded
Description: An audit event for a global policy approval rescinded in the approve to promote workflow.

{
    "targets": [
        {
            "id": "12",
            "type": "GLOBAL_POLICY",
            "name": "Mask PII",
            "policyKey": "mask pii"
        }
    ],
    "actorIp": "xxx.xx.xx.xx",
    "sessionId": "c6eb428b869864f798f17fd7d5d0215a",
    "requestId": "10a78dee-6181-52dd-8b68-5461b6172e40",
    "actor": {
        "name": "Deepu Murty",
        "profileId": "999111223",
        "identityProvider": "bim",
        "id": "deepu@immuta.com",
        "type": "USER_ACTOR"
    },
    "receivedTimestamp": "2023-11-03T18:23:25.966Z",
    "id": "5ff5640f-4fc3-4634-a0e2-c625e0ffb447",
    "targetType": "GLOBAL_POLICY",
    "tenantId": "your-immuta-tenant.com",
    "actionStatus": "SUCCESS",
    "action": "GLOBAL_POLICY_APPROVAL_RESCINDED",
    "eventTimestamp": "2023-11-03T18:23:25.861Z",
    "auditPayload": {
        "comment": "This policy isn't ready for production. Please mask PII.",
        "type": "GlobalPolicyApprovalRescindedAuditPayload",
        "approvalRequestId": "2",
        "version": 1
    },
    "relatedResources": []
}

GlobalPolicyApproved event

Event: GlobalPolicyApproved
Legacy event: globalPolicyApproved
Description: An audit event for a global policy approved in the approve to promote workflow.

{
    "auditPayload": {
        "comment": "This policy looks good for production.",
        "approvalRequestId": "2",
        "type": "GlobalPolicyApprovedAuditPayload",
        "version": 1
    },
    "relatedResources": [],
    "tenantId": "your-immuta-tenant.com",
    "actionStatus": "SUCCESS",
    "action": "GLOBAL_POLICY_APPROVED",
    "eventTimestamp": "2023-11-03T18:22:12.040Z",
    "actor": {
        "name": "Deepu Murty",
        "type": "USER_ACTOR",
        "id": "deepu@immuta.com",
        "identityProvider": "bim",
        "profileId": "999111223"
    },
    "receivedTimestamp": "2023-11-03T18:22:12.153Z",
    "id": "271dc5ff-b23e-4da6-8066-91a35fda02e4",
    "targetType": "GLOBAL_POLICY",
    "targets": [
        {
            "name": "Mask PII",
            "policyKey": "mask pii",
            "type": "GLOBAL_POLICY",
            "id": "12"
        }
    ],
    "actorIp": "xxx.xx.xx.xx",
    "sessionId": "c6eb428b869864f798f17fd7d5d0215a",
    "requestId": "50863cf9-6a8a-5299-89e2-200771eab62c"
}

GlobalPolicyChangeRequested event

Event: GlobalPolicyChangeRequested
Legacy event: globalPolicyChangeRequested
Description: An audit event for requested edits on a global policy in the approve to promote workflow.

{
    "eventTimestamp": "2023-11-03T18:20:16.483Z",
    "action": "GLOBAL_POLICY_CHANGE_REQUESTED",
    "tenantId": "your-immuta-tenant.com",
    "actionStatus": "SUCCESS",
    "relatedResources": [],
    "auditPayload": {
        "approvalRequestId": "1",
        "type": "GlobalPolicyChangeRequestedAuditPayload",
        "comment": "Please add additional controls on personal data.",
        "version": 1
    },
    "requestId": "4afc86e6-dee6-5756-b02e-b22e92d237c4",
    "sessionId": "be1e7a02ba2a5e65a6848c752ee0838b",
    "targets": [
        {
            "name": "Mask PII",
            "policyKey": "mask pii",
            "type": "GLOBAL_POLICY",
            "id": "12"
        }
    ],
    "actorIp": "xxx.xx.xx.xx",
    "id": "77277757-331a-4a13-ba21-cbfeab01d47f",
    "targetType": "GLOBAL_POLICY",
    "receivedTimestamp": "2023-11-03T18:20:16.581Z",
    "actor": {
        "profileId": "999111223",
        "id": "deepu@immuta.com",
        "identityProvider": "bim",
        "type": "USER_ACTOR",
        "name": "Deepu Murty"
    }
}

GlobalPolicyCreated event

Event: GlobalPolicyCreated
Legacy event: globalPolicyCreate
Description: An audit event for creating a global policy.

{
    "targetType": "GLOBAL_POLICY",
    "id": "aac7cb75-c6ec-48ed-a11e-f6d8bf29dfe6",
    "relatedResources": [],
    "actor": {
        "id": "taylor@immuta.com",
        "profileId": "1",
        "identityProvider": "bim",
        "name": "Taylor Smith",
        "type": "USER_ACTOR"
    },
    "actionStatus": "SUCCESS",
    "sessionId": "517a11643dcdbba0b5ba30d49ee7a334",
    "auditPayload": {
        "type": "GlobalPolicyCreatedAuditPayload",
        "policy": {
            "type": "DATA",
            "actions": [
                {
                    "type": "DATA",
                    "rules": [
                        {
                            "type": "MASKING_HASH",
                            "columnCondition": {
                                "type": "TAG",
                                "tags": ["Testing"]
                            },
                            "exceptions": null
                        }
                    ],
                    "dataPolicyType": "MASKING",
                    "rationale": null
                }
            ],
            "circumstance": {
                "conditions": [
                    {
                        "type": "TAG",
                        "tagType": "COLUMN",
                        "tag": "Testing"
                    }
                ],
                "operator": "any",
                "type": "CONDITIONAL"
            }
        }
    },
    "targets": [
        {
            "policyKey": "mask pii",
            "type": "GLOBAL_POLICY",
            "name": "Mask PII",
            "id": "5"
        }
    ],
    "action": "CREATE",
    "eventTimestamp": "2023-05-10T18:29:39.438Z",
    "actorIp": "xxx.xx.xx.xx",
    "requestId": "2b126931-7a15-5678-99c4-11f0c5b40365",
    "receivedTimestamp": "2023-05-10T18:29:39.636Z",
    "tenantId": "your-immuta-tenant.com"
}

GlobalPolicyDeleted event

Event: GlobalPolicyDeleted
Legacy event: globalPolicyDelete
Description: An audit event for deleting a global policy.

{
    "requestId": "12674fb7-4b90-5500-906f-7277a240e0f8",
    "eventTimestamp": "2023-09-13T19:42:53.029Z",
    "actorIp": "xxx.xx.xx.xx",
    "tenantId": "your-immuta-tenant.com",
    "receivedTimestamp": "2023-09-13T19:42:53.157Z",
    "id": "d8cb76a2-516d-41f7-98d9-1cb616b759a4",
    "targetType": "GLOBAL_POLICY",
    "actionStatus": "SUCCESS",
    "actor": {
        "name": "Taylor Smith",
        "identityProvider": "bim",
        "type": "USER_ACTOR",
        "id": "taylor@immuta.com",
        "profileId": "1"
    },
    "relatedResources": [],
    "auditPayload": {
        "version": 1,
        "policy": {
            "actions": [
                {
                    "subscriptionPolicyType": "AUTOMATIC",
                    "type": "SUBSCRIPTION",
                    "rationale": null,
                    "accessGrant": "READ"
                }
            ],
            "type": "SUBSCRIPTION",
            "circumstance": {
                "type": "WHEN_SELECTED"
            }
        },
        "type": "GlobalPolicyDeletedAuditPayload"
    },
    "sessionId": "2d48cc8df46b3b3eedf543f4192b6726",
    "action": "DELETE",
    "targets": [
        {
            "policyKey": "mask pii",
            "type": "GLOBAL_POLICY",
            "name": "Mask PII",
            "id": "6"
        }
    ]
}

GlobalPolicyPromoted event

Event: GlobalPolicyPromoted
Legacy event: globalPolicyPromoted
Description: An audit event for when a global policy is fully approved and promoted to production in the approve to promote workflow.

{
    "sessionId": "89fc6c8f7b6e04d9b9d4f720dbd84890",
    "requestId": "6abef8eb-6acb-5364-9a88-7479b03227cf",
    "actorIp": "xxx.xx.xx.xx",
    "targets": [
        {
            "name": "Mask PII",
            "policyKey": "maks pii",
            "type": "GLOBAL_POLICY",
            "id": "12"
        }
    ],
    "receivedTimestamp": "2023-11-08T14:57:36.465Z",
    "targetType": "GLOBAL_POLICY",
    "id": "990f260b-eef6-4eed-8f71-f48c8e9b88cb",
    "actor": {
        "name": "Taylor Smith",
        "identityProvider": "bim",
        "id": "taylor@immuta.com",
        "profileId": "1",
        "type": "USER_ACTOR"
    },
    "eventTimestamp": "2023-11-08T14:57:36.387Z",
    "tenantId": "your-immuta-tenant.com",
    "actionStatus": "SUCCESS",
    "action": "GLOBAL_POLICY_PROMOTED",
    "auditPayload": {
        "type": "GlobalPolicyPromotedAuditPayload",
        "policyName": "Mask PII",
        "version": 1,
        "policyId": "12"
    },
    "relatedResources": []
}

GlobalPolicyReviewRequested event

Event: GlobalPolicyReviewRequested
Legacy event: globalPolicyReviewRequested
Description: An audit event for when a global policy is ready and requests a review in the approve to promote workflow.

{
    "targetType": "GLOBAL_POLICY",
    "id": "a26fa653-e545-4a34-9488-d7f1b92379d0",
    "receivedTimestamp": "2023-11-03T18:16:30.588Z",
    "actor": {
        "name": "Taylor Smith",
        "type": "USER_ACTOR",
        "profileId": "1",
        "identityProvider": "bim",
        "id": "taylor@immuta.com"
    },
    "requestId": "9a03030a-09ef-5d2b-abea-b65305901e9b",
    "sessionId": "1f468d12a437bceb59b71054d6ad8bf8",
    "actorIp": "xxx.xx.xx.xx",
    "targets": [
        {
            "name": "Mask PII",
            "policyKey": "mask pii",
            "type": "GLOBAL_POLICY",
            "id": "12"
        }
    ],
    "relatedResources": [],
    "auditPayload": {
        "type": "GlobalPolicyReviewRequestedAuditPayload",
        "approvalRequestId": "1",
        "version": 1
    },
    "eventTimestamp": "2023-11-03T18:16:30.281Z",
    "action": "GLOBAL_POLICY_REVIEW_REQUESTED",
    "tenantId": "your-immuta-tenant.com",
    "actionStatus": "SUCCESS"
}

GlobalPolicyUpdated event

Event: GlobalPolicyUpdated
Legacy event: globalPolicyUpdate
Description: An audit event for a global policy being updated with details about the policy.

{
    "tenantId": "your-immuta-tenant.com",
    "receivedTimestamp": "2023-10-24T18:06:21.278Z",
    "eventTimestamp": "2023-10-24T18:06:21.155Z",
    "actorIp": "xxx.xx.xx.xx",
    "requestId": "c2554ade-fbea-54b4-bfa5-a652d8a34309",
    "actionStatus": "SUCCESS",
    "relatedResources": [],
    "actor": {
        "type": "USER_ACTOR",
        "name": "Taylor Smith",
        "identityProvider": "bim",
        "profileId": "1",
        "id": "taylor@immuta.com"
    },
    "id": "f2346f5b-07b3-4f71-a0e1-9635e3b7cacc",
    "targetType": "GLOBAL_POLICY",
    "targets": [
        {
            "id": "7",
            "policyKey": "mask pii",
            "type": "GLOBAL_POLICY",
            "name": "Mask PII"
        }
    ],
    "action": "UPDATE",
    "auditPayload": {
        "version": 1,
        "policy": {
            "circumstance": {
                "type": "WHEN_SELECTED"
            },
            "actions": [
                {
                    "dataPolicyType": "MASKING",
                    "type": "DATA",
                    "rules": [
                        {
                            "type": "MASKING_HASH",
                            "columnCondition": {
                                "tags": ["AuditTesting"],
                                "type": "TAG"
                            },
                            "exceptions": null
                        }
                    ],
                    "rationale": null
                }
            ],
            "type": "DATA",
            "certification": {
                "label": "Personal information certification",
                "tags": ["AuditTesting"],
                "description": "I certify that I understand this data source contains personally identifiable information and will use the data appropriately and responsibly to the company policies."
            }
        },
        "type": "GlobalPolicyUpdatedAuditPayload"
    },
    "sessionId": "1a8a16c58f29172d9a59224030617184"
}

GroupCreated event

Event: GroupCreated
Legacy event: accessGroup
Description: An audit event for a group created in Immuta.

{
    "sessionId": "c3e76e5f809b74fabe0975bcac5e0fca",
    "auditPayload": {
        "version": 1,
        "groupIdProvider": "bim",
        "name": "HR",
        "groupId": "6",
        "type": "GroupCreatedAuditPayload"
    },
    "action": "CREATE",
    "targets": [
        {
            "id": "6",
            "identityProvider": "bim",
            "name": "HR",
            "type": "GROUP"
        }
    ],
    "targetType": "GROUP",
    "id": "24b9bce7-e255-47ed-8aa1-fefde19be539",
    "relatedResources": [],
    "actor": {
        "type": "USER_ACTOR",
        "identityProvider": "bim",
        "name": "Taylor Smith",
        "profileId": "1",
        "id": "taylor@immuta.com"
    },
    "actionStatus": "SUCCESS",
    "eventTimestamp": "2023-12-19T21:18:23.711Z",
    "actorIp": "xxx.xx.xx.xx",
    "requestId": "a37ee299-cc6b-531b-8af1-891d853af995",
    "receivedTimestamp": "2023-12-19T21:18:24.040Z",
    "tenantId": "your-immuta-tenant.com"
}

GroupDeleted event

Event: GroupDeleted
Legacy event: accessGroup
Description: An audit event for a group deleted in Immuta.

{
    "actorIp": "xxx.xx.xx.xx",
    "eventTimestamp": "2023-12-19T21:18:25.891Z",
    "requestId": "92e7ba98-144b-502d-beae-48ceb865cdcf",
    "receivedTimestamp": "2023-12-19T21:18:26.161Z",
    "tenantId": "your-immuta-tenant.com",
    "sessionId": "60e86f7be389dc21b11bdc4a5b6d6974",
    "auditPayload": {
        "name": "HR",
        "groupIdProvider": "bim",
        "groupId": "6",
        "type": "GroupDeletedAuditPayload",
        "version": 1
    },
    "targets": [
        {
            "id": "6",
            "type": "GROUP",
            "name": "HR",
            "identityProvider": "bim"
        }
    ],
    "action": "DELETE",
    "targetType": "GROUP",
    "id": "45efee34-2147-4ea9-bc3f-9f88addaaa2a",
    "relatedResources": [],
    "actor": {
        "identityProvider": "bim",
        "name": "Taylor Smith",
        "type": "USER_ACTOR",
        "id": "taylor@immuta.com",
        "profileId": "1"
    },
    "actionStatus": "SUCCESS"
}

GroupMemberAdded event

Event: GroupMemberAdded
Legacy event: accessGroup
Description: An audit event for a member added to a group in Immuta.

{
    "sessionId": "5ff64ed8fe0a194b074415a73d4f9201",
    "id": "93e2dade-fd6f-4c13-8274-e9dd843bb990",
    "actorIp": "xxx.xx.xx.xx",
    "tenantId": "your-immuta-tenant.com",
    "targets": [
        {
            "name": "HR",
            "id": "3",
            "identityProvider": "bim",
            "type": "GROUP"
        }
    ],
    "receivedTimestamp": "2024-01-17T13:32:15.929Z",
    "actionStatus": "SUCCESS",
    "eventTimestamp": "2024-01-17T13:32:15.755Z",
    "relatedResources": [
        {
            "type": "USER",
            "identityProvider": "bim",
            "name": "Deepu Murty",
            "id": "deepu@immuta.com",
            "profileId": "999111223"
        }
    ],
    "targetType": "GROUP",
    "actor": {
        "identityProvider": "bim",
        "type": "USER_ACTOR",
        "profileId": "1",
        "id": "taylor@immuta.com",
        "name": "Taylor Smith"
    },
    "action": "MEMBER_ADD",
    "auditPayload": {
        "type": "GroupMemberAddedAuditPayload",
        "version": 1,
        "userIdProvider": "bim",
        "groupId": "3",
        "userId": "deepu@immuta.com"
    },
    "requestId": "e12e42ab-5ba5-54f4-9ff9-61e27c131d6d"
}

GroupMemberRemoved event

Event: GroupMemberRemoved
Legacy event: accessGroup
Description: An audit event for a group member removed from the group in Immuta.

{
    "targetType": "GROUP",
    "receivedTimestamp": "2024-01-17T13:27:04.061Z",
    "actionStatus": "SUCCESS",
    "relatedResources": [],
    "eventTimestamp": "2024-01-17T13:27:03.841Z",
    "auditPayload": {
        "groupId": "3",
        "version": 1,
        "type": "GroupMemberRemovedAuditPayload"
    },
    "requestId": "73a295d1-504a-507c-ba6d-9a72f2b34b16",
    "actor": {
        "identityProvider": "bim",
        "type": "USER_ACTOR",
        "profileId": "1",
        "id": "taylor@immuta.com",
        "name": "Taylor Smith"
    },
    "action": "MEMBER_REMOVE",
    "actorIp": "xxx.xx.xx.xx",
    "targets": [
        {
            "id": "3",
            "name": "HR",
            "type": "GROUP",
            "identityProvider": "bim"
        }
    ],
    "tenantId": "your-immuta-tenant.com",
    "sessionId": "5ff64ed8fe0a194b074415a73d4f9201",
    "id": "5201799f-2472-4b9d-ba5c-db32e06a0bfa"
}

GroupUpdated event

Event: GroupUpdated
Legacy event: accessGroup
Description: An audit event for a group updated in Immuta.

{
    "targetType": "GROUP",
    "actionStatus": "SUCCESS",
    "relatedResources": [],
    "eventTimestamp": "2023-12-19T21:18:32.490Z",
    "receivedTimestamp": "2023-12-19T21:18:32.767Z",
    "requestId": "09ecbab3-803e-5eff-bc15-b07fcf57260b",
    "auditPayload": {
        "name": "Human Resources Department",
        "groupIdProvider": "bim",
        "groupId": "8",
        "version": 1,
        "type": "GroupUpdatedAuditPayload"
    },
    "action": "UPDATE",
    "actor": {
        "profileId": "1",
        "id": "taylor@immuta.com",
        "name": "Taylor Smith",
        "identityProvider": "bim",
        "type": "USER_ACTOR"
    },
    "tenantId": "your-immuta-tenant.com",
    "targets": [
        {
            "type": "GROUP",
            "identityProvider": "bim",
            "name": "Human Resources Department",
            "id": "8"
        }
    ],
    "actorIp": "xxx.xx.xx.xx",
    "id": "f4cd509d-587e-4bc4-9c0f-87ca6e122d1a",
    "sessionId": "320b8c29c32ce2407b00e0de98546528"
}

LicenseCreated event

Event: LicenseCreated
Legacy event: licenseCreate
Description: An audit event for creating an Immuta license.

{
    "id": "c1a74870-ff01-43bf-8b2e-928b6fccb6ae",
    "sessionId": "bdf4e26e67f4e3ceeb93705b639f8768",
    "requestId": "4c48deb8-4e4d-5705-be82-fae9e165967a",
    "action": "CREATE",
    "actionStatus": "SUCCESS",
    "actor": {
        "name": "Taylor Smith",
        "id": "taylor@immuta.com",
        "identityProvider": "bim",
        "profileId": "1",
        "type": "USER_ACTOR"
    },
    "actorIp": "xxx.xx.xx.xx",
    "tenantId": "your-immuta-tenant.com",
    "targetType": "LICENSE",
    "targets": [
        {
            "type": "LICENSE",
            "id": "2",
            "name": "2"
        }
    ],
    "relatedResources": [],
    "auditPayload": {
        "type": "LicenseCreatedAuditPayload",
        "version": 1,
        "licenseKey": "a-unique-license-key"
    },
    "eventTimestamp": "2024-03-08T18:34:30.028Z",
    "receivedTimestamp": "2024-03-08T18:34:30.475Z"
}

LicenseDeleted event

Event: LicenseDeleted
Legacy event: licenseDelete
Description: An audit event for deleting an Immuta license.

{
    "id": "e7a22a3c-8b08-48e7-a648-3b6946b085e4",
    "sessionId": "0c52d87dd0437dd90b48bfd66e7cf3dd",
    "requestId": "50c29e76-6f24-5a66-9acb-1c298496377e",
    "action": "DELETE",
    "actionStatus": "SUCCESS",
    "actor": {
        "name": "Taylor Smith",
        "id": "taylor@immuta.com",
        "identityProvider": "bim",
        "profileId": "1",
        "type": "USER_ACTOR"
    },
    "actorIp": "xxx.xx.xx.xx",
    "tenantId": "your-immuta-tenant.com",
    "targetType": "LICENSE",
    "targets": [
        {
            "type": "LICENSE",
            "id": "2",
            "name": "2"
        }
    ],
    "relatedResources": [],
    "auditPayload": {
        "type": "LicenseDeletedAuditPayload",
        "version": 1,
        "id": "2"
    },
    "eventTimestamp": "2024-03-08T18:38:12.382Z",
    "receivedTimestamp": "2024-03-08T18:38:12.457Z"
}

LocalPolicyCreated event

Event: LocalPolicyCreated
Legacy event: policyHandlerCreate
Description: An audit event for creating a local policy for an Immuta data source.

{
    "targetType": "LOCAL_POLICY",
    "actionStatus": "SUCCESS",
    "eventTimestamp": "2023-10-13T18:16:19.643Z",
    "relatedResources": [
        {
            "id": "129",
            "name": "Public case",
            "type": "DATASOURCE",
            "technology": "POSTGRESQL"
        }
    ],
    "receivedTimestamp": "2023-10-13T18:16:19.680Z",
    "auditPayload": {
        "type": "LocalPolicyCreatedAuditPayload",
        "policy": {
            "actions": [
                {
                    "rationale": null,
                    "rules": [
                        {
                            "exceptions": null,
                            "type": "MASKING_K_ANONYMIZATION",
                            "fields": ["c_birth_year", "c_birth_month", "c_birth_day"],
                            "kLevel": 8,
                            "ruleAppliedForUser": false
                        }
                    ],
                    "type": "DATA",
                    "global": false,
                    "dataPolicyType": "MASKING"
                }
            ],
            "type": "DATA"
        },
        "version": 1
    },
    "action": "CREATE",
    "actor": {
        "name": "Taylor Smith",
        "id": "taylor@immuta.com",
        "profileId": "1",
        "type": "USER_ACTOR",
        "identityProvider": "bim"
    },
    "tenantId": "your-immuta-tenant.com",
    "targets": [
        {
            "type": "LOCAL_POLICY",
            "name": "4",
            "id": "4",
            "datasource": {
                "id": "129",
                "name": "Public case",
                "type": "DATASOURCE",
                "technology": "POSTGRESQL"
            }
        }
    ],
    "id": "761a4044-1dec-4b9b-815f-d83c056ff61e"
}

LocalPolicyUpdated event

Event: LocalPolicyUpdated
Legacy event: policyHandlerUpdate
Description: An audit event for updating a local policy on an Immuta data source.

{
    "id": "c8066842-4c90-4b12-a108-232c93a5fe63",
    "targets": [],
    "tenantId": "your-immuta-tenant.com",
    "action": "UPDATE",
    "actor": {
        "profileId": "1",
        "name": "Taylor Smith",
        "id": "taylor@immuta.com",
        "identityProvider": "bim",
        "type": "USER_ACTOR"
    },
    "auditPayload": {
        "version": 1,
        "policyHandlerUpdateAction": "UPDATE",
        "policy": {
            "actions": [
                {
                    "subscriptionPolicyType": "AUTOMATIC",
                    "rationale": null,
                    "type": "SUBSCRIPTION",
                    "accessGrant": "READ",
                    "global": false,
                    "ruleAppliedForUser": true
                }
            ],
            "type": "SUBSCRIPTION"
        },
        "policyUpdateType": "SUBSCRIPTION",
        "type": "LocalPolicyUpdatedAuditPayload"
    },
    "actionStatus": "SUCCESS",
    "eventTimestamp": "2024-02-07T19:26:54.447Z",
    "relatedResources": [
        {
            "id": "1124",
            "name": "Public case",
            "technology": "SNOWFLAKE",
            "type": "DATASOURCE"
        }
    ],
    "receivedTimestamp": "2024-02-07T19:26:54.478Z",
    "targetType": "LOCAL_POLICY"
}

PermissionApplied event

Event: PermissionApplied
Legacy event: accessUser
Description: An audit event for a permission applied to an Immuta user.

{
    "id": "d18cbe70-a620-4ae4-a82a-a24249832e12",
    "sessionId": "86d602c9d57fcc55e103ee7a5fa650dc",
    "requestId": "749dd9dd-e06f-5781-ad7e-91c002ed5043",
    "action": "PERMISSION_APPLY",
    "actionStatus": "SUCCESS",
    "actor": {
        "name": "Taylor Smith",
        "id": "taylor@immuta.com",
        "identityProvider": "bim",
        "profileId": "1",
        "type": "USER_ACTOR"
    },
    "actorIp": "xxx.xx.xx.xx",
    "tenantId": "your-immuta-tenant.com",
    "targetType": "USER",
    "targets": [
        {
            "name": "Deepu Murty",
            "id": "deepu@immuta.com",
            "identityProvider": "bim",
            "profileId": "999111223",
            "type": "USER"
        }
    ],
    "relatedResources": [
        {
            "name": "GOVERNANCE",
            "id": "GOVERNANCE",
            "type": "PERMISSION"
        }
    ],
    "auditPayload": {
        "type": "PermissionAppliedAuditPayload",
        "version": 1
    },
    "eventTimestamp": "2024-01-09T20:18:53.451Z",
    "receivedTimestamp": "2024-01-09T20:18:53.578Z"
}

PermissionRemoved event

Event: PermissionRemoved
Legacy event: accessUser
Description: An audit event for a permission removed from an Immuta user.

{
    "id": "51481c15-e40d-419d-b510-bd8c47028069",
    "sessionId": "86d602c9d57fcc55e103ee7a5fa650dc",
    "requestId": "bd789b1a-580f-5d59-a6e0-d805a1464114",
    "action": "PERMISSION_REMOVE",
    "actionStatus": "SUCCESS",
    "actor": {
        "name": "Taylor Smith",
        "id": "taylor@immuta.com",
        "identityProvider": "bim",
        "profileId": "1",
        "type": "USER_ACTOR"
    },
    "actorIp": "xxx.xx.xx.xx",
    "tenantId": "your-immuta-tenant.com",
    "targetType": "USER",
    "targets": [
        {
            "name": "Deepu Murty",
            "id": "deepu@immuta.com",
            "identityProvider": "bim",
            "profileId": "999111223",
            "type": "USER"
        }
    ],
    "relatedResources": [
        {
            "name": "CREATE_PROJECT",
            "id": "CREATE_PROJECT",
            "type": "PERMISSION"
        },
        {
            "name": "GOVERNANCE",
            "id": "GOVERNANCE",
            "type": "PERMISSION"
        }
    ],
    "auditPayload": {
        "type": "PermissionRemovedAuditPayload",
        "version": 1
    },
    "eventTimestamp": "2024-01-09T20:22:02.326Z",
    "receivedTimestamp": "2024-01-09T20:22:02.451Z"
}

PolicyAdjustmentCreated event

Event: PolicyAdjustmentCreated
Legacy event: policyAdjustmentCreate
Description: An audit event for creating a policy adjustment in an Immuta project.

{
    "actionStatus": "SUCCESS",
    "tenantId": "your-immuta-tenant.com",
    "action": "CREATE_POLICY_ADJUSTMENT",
    "eventTimestamp": "2023-10-13T18:33:45.664Z",
    "auditPayload": {
        "type": "PolicyAdjustmentCreatedAuditPayload",
        "version": 1,
        "certified": true,
        "adjustmentSettings": {
            "kAnonNoiseReduction": "Very Small",
            "ruleIndex": 0,
            "columns": [
                {
                    "weight": 33,
                    "columnName": "c_birth_day",
                    "percentNull": "0.035129999999999995"
                },
                {
                    "percentNull": "0.03449000000000002",
                    "weight": 36,
                    "columnName": "c_birth_month"
                },
                {
                    "percentNull": "0.035050000000000026",
                    "weight": 31,
                    "columnName": "c_birth_year"
                }
            ]
        }
    },
    "relatedResources": [
        {
            "name": "HR",
            "id": "2",
            "type": "PROJECT",
            "projectKey": "HR"
        },
        {
            "name": "masking(^_^)(^_^)c_birth_day(^_^)c_birth_month(^_^)c_birth_year(^_^)k-anonymization(^_^)(^_^)(^_^)2395a061dd5889e9688ece8cc0e16ee2dde20bb2",
            "datasource": {
                "id": "129",
                "type": "DATASOURCE",
                "name": "Public case",
                "technology": "POSTGRESQL"
            },
            "type": "LOCAL_POLICY",
            "id": "masking(^_^)(^_^)c_birth_day(^_^)c_birth_month(^_^)c_birth_year(^_^)k-anonymization(^_^)(^_^)(^_^)2395a061dd5889e9688ece8cc0e16ee2dde20bb2"
        }
    ],
    "actorIp": "xxx.xx.xx.xx",
    "targets": [
        {
            "type": "DATASOURCE",
            "id": "129",
            "name": "Public case",
            "technology": "POSTGRESQL"
        }
    ],
    "sessionId": "fe33c1886a9c75a4962a4ffed2efd918",
    "requestId": "7ae6fdbe-304e-5542-b2b3-e47c9a58917d",
    "actor": {
        "name": "Taylor Smith",
        "profileId": "1",
        "identityProvider": "bim",
        "id": "taylor@immuta.com",
        "type": "USER_ACTOR"
    },
    "receivedTimestamp": "2023-10-13T18:33:45.913Z",
    "id": "d0030540-a2f3-4cc0-ac22-7bb28a1daa62",
    "targetType": "DATASOURCE"
}

PolicyAdjustmentDeleted event

Event: PolicyAdjustmentDeleted
Legacy event: policyAdjustmentDelete
Description: An audit event for deleting a policy adjustment in an Immuta project.

{
    "requestId": "myRequestId",
    "actorIp": "xxx.xx.xx.xx",
    "targets": [
        {
            "technology": "SNOWFLAKE",
            "name": "Public case",
            "type": "DATASOURCE",
            "id": "2"
        }
    ],
    "receivedTimestamp": "2023-10-23T19:28:40.649Z",
    "actionStatusReason": null,
    "id": "8279d551-d040-4f4a-bbfb-e8ebfc3ef770",
    "targetType": "DATASOURCE",
    "actor": {
        "profileId": "1",
        "identityProvider": "bim",
        "id": "taylor@immuta.com",
        "type": "USER_ACTOR",
        "name": "Taylor Smith"
    },
    "eventTimestamp": "2022-07-28T03:52:03.790Z",
    "tenantId": "your-immuta-tenant.com",
    "actionStatus": "SUCCESS",
    "action": "DELETE_POLICY_ADJUSTMENT",
    "auditPayload": {
        "type": "PolicyAdjustmentDeletedAuditPayload",
        "adjustmentSettings": {
            "kAnonNoiseReduction": "Masking",
            "ruleIndex": 0,
            "columns": [
                {
                    "columnName": "first_name",
                    "weight": 10,
                    "percentNull": "3",
                    "unmasked": true
                }
            ]
        },
        "policyId": "2",
        "hardDelete": true,
        "version": 1
    },
    "relatedResources": [
        {
            "name": "HR",
            "type": "PROJECT",
            "projectKey": "HR",
            "id": "2"
        }
    ]
}

ProjectCreated event

Event: ProjectCreated
Legacy event: projectCreate
Description: An audit event for creating a project in Immuta.

{
    "action": "CREATE",
    "tenantId": "your-immuta-tenant.com",
    "actor": {
        "type": "USER_ACTOR",
        "identityProvider": "bim",
        "name": "Taylor Smith",
        "profileId": "1",
        "id": "taylor@immuta.com"
    },
    "eventTimestamp": "2023-09-13T13:43:04.225Z",
    "auditPayload": {
        "equalization": null,
        "projectKey": "hr",
        "purposes": [],
        "disabled": false,
        "type": "ProjectCreatedAuditPayload",
        "datasources": [],
        "allowMaskedJoins": false,
        "stagedPurposes": [],
        "projectId": "6",
        "version": 1,
        "name": "HR",
        "description": null,
        "tags": [],
        "documentation": "# A project for all internal employee data for HR use."
    },
    "targets": [
        {
            "id": "6",
            "type": "PROJECT",
            "projectKey": "hr",
            "name": "HR"
        }
    ],
    "relatedResources": [],
    "actorIp": "xxx.xx.xx.xx",
    "sessionId": "cdbffff8804103418350947c6586712c",
    "actionStatus": "SUCCESS",
    "targetType": "PROJECT",
    "id": "8d6da097-b5d8-4f19-8737-9c1d8e453f93",
    "receivedTimestamp": "2023-09-13T13:43:04.515Z",
    "requestId": "49b37341-83d2-576c-a560-29b224654c4e"
}

ProjectDeleted event

Event: ProjectDeleted
Legacy event: projectDelete
Description: An audit event for deleting a project in Immuta.

{
    "auditPayload": {
        "projectId": "2",
        "projectKey": "hr",
        "type": "ProjectDeletedAuditPayload",
        "name": "HR"
    },
    "requestId": "47ea1ce0-6464-54e3-8e0c-f7afaccd75a0",
    "actor": {
        "profileId": "1",
        "id": "taylor@immuta.com",
        "name": "Taylor Smith",
        "identityProvider": "bim",
        "type": "USER_ACTOR"
    },
    "action": "DELETE",
    "targetType": "PROJECT",
    "receivedTimestamp": "2023-04-14T16:07:13.416Z",
    "relatedResources": [],
    "eventTimestamp": "2023-04-14T16:07:12.647Z",
    "actionStatus": "SUCCESS",
    "actorIp": "127.0.0.1",
    "tenantId": "your-immuta-tenant.com",
    "targets": [
        {
            "name": "HR",
            "id": "2",
            "type": "PROJECT",
            "projectKey": "hr"
        }
    ],
    "sessionId": "635b928a3ba5001076f2ca6da4328be0",
    "id": "37350b53-6e39-4ff9-bdb8-300df04aa1e0"
}

ProjectDisabled event

Event: ProjectDisabled
Legacy events: None
Description: An audit event for disabling a project in Immuta.

{
    "id": "d890dfb0-72ed-4c29-8a06-68ba5868a1ca",
    "sessionId": "dda1a16c5446bc2309df1e37d8483e2c",
    "tenantId": "your-immuta-tenant.com",
    "targets": [
        {
            "name": "HR",
            "id": "7",
            "projectKey": "hr",
            "type": "PROJECT"
        }
    ],
    "actorIp": "xxx.xx.xx.xx",
    "action": "DISABLE",
    "actor": {
        "profileId": "1",
        "id": "taylor@immuta.com",
        "name": "Taylor Smith",
        "identityProvider": "bim",
        "type": "USER_ACTOR"
    },
    "requestId": "ff7875f4-07ff-5349-a321-d9e59aaf97b5",
    "auditPayload": {
        "type": "ProjectDisabledAuditPayload",
        "projectKey": "hr",
        "version": 1,
        "projectId": "7",
        "name": "HR"
    },
    "actionStatus": "SUCCESS",
    "relatedResources": [],
    "eventTimestamp": "2023-12-23T13:32:57.895Z",
    "receivedTimestamp": "2023-12-23T13:32:58.072Z",
    "targetType": "PROJECT"
}

ProjectPurposeApproved event

Event: ProjectPurposeApproved
Legacy event: projectPurposeApprove
Description: An audit event for approving a purpose for a project in Immuta.

{
    "targetType": "PROJECT",
    "receivedTimestamp": "2023-12-19T17:23:31.075Z",
    "eventTimestamp": "2023-12-19T17:23:17.425Z",
    "relatedResources": [
        {
            "type": "PURPOSE",
            "name": "NoiseReduced.Small",
            "id": "14"
        }
    ],
    "actionStatus": "SUCCESS",
    "auditPayload": {
        "purposeId": "14",
        "projectId": "2",
        "version": 1,
        "type": "ProjectPurposeApprovedAuditPayload"
    },
    "requestId": "ab8dcd0c-49d3-57ec-83a9-09516a9cc919",
    "actor": {
        "name": "Taylor Smith",
        "id": "taylor@immuta.com",
        "profileId": "1",
        "type": "USER_ACTOR",
        "identityProvider": "bim"
    },
    "action": "PURPOSE_APPROVE",
    "actorIp": "xxx.xx.xx.xx",
    "targets": [
        {
            "id": "2",
            "name": "HR",
            "type": "PROJECT",
            "projectKey": "hr"
        }
    ],
    "tenantId": "your-immuta-tenant.com",
    "sessionId": "ed785f4e8bffe89a43f815dd66a3c401",
    "id": "681e743c-0674-4e1f-bbc6-f64ac1b404bc"
}

ProjectPurposeDenied event

Event: ProjectPurposeDenied
Legacy event: projectPurposeDeny
Description: An audit event for denying a purpose for a project in Immuta.

{
    "action": "PURPOSE_DENY",
    "actor": {
        "identityProvider": "bim",
        "type": "USER_ACTOR",
        "profileId": "1",
        "name": "Taylor Smith",
        "id": "taylor@immuta.com"
    },
    "requestId": "3a186491-f497-567c-8715-49a1e6b37077",
    "auditPayload": {
        "version": 1,
        "projectId": "11",
        "purposeId": "6",
        "type": "ProjectPurposeDeniedAuditPayload"
    },
    "relatedResources": [
        {
            "name": "Activities",
            "id": "6",
            "type": "PURPOSE"
        }
    ],
    "eventTimestamp": "2023-12-19T17:30:29.543Z",
    "actionStatus": "SUCCESS",
    "receivedTimestamp": "2023-12-19T17:30:32.388Z",
    "targetType": "PROJECT",
    "id": "f32dfb5e-f865-4c17-a25e-7ea37d568c03",
    "sessionId": "ed785f4e8bffe89a43f815dd66a3c401",
    "targets": [
        {
            "type": "PROJECT",
            "projectKey": "hr",
            "name": "HR",
            "id": "11"
        }
    ],
    "tenantId": "your-immuta-tenant.com",
    "actorIp": "xxx.xx.xx.xx"
}

ProjectPurposesAcknowledged event

Event: ProjectPurposesAcknowledged
Legacy event: acknowledgePurposes
Description: An audit event for acknowledging a purpose for a project in Immuta.

{
    "requestId": "ea287df8-2fd2-57c2-86c3-cdb421ec3f64",
    "auditPayload": {
        "purposes": [
            {
                "id": "5",
                "name": "Re-identification Prohibited.Expert Determination",
                "acknowledgement": "I agree to use the data associated with this project for the stated purpose of the project, and for that purpose only, as listed in the project's homepage, and to refrain from sharing that data outside of the project or Immuta, unless the data recipient is required to adhere to a data sharing protocol specifying relevant security arrangements.\n\nI acknowledge that combining the project data (and derivations thereof) with other data, including data produced in different projects or under different utility adjustments within the same project, can undermine the expert determination, and is therefore outside its scope.\n\nI also agree not to re-identify or take any steps to re-identify the individuals whose health information is contained in the data sources attached to the project. In the event that these individuals have been identified or that I discover risks that I believe could lead to their identification, I agree to immediately notify the project owner or governance team and take immediate action to address and mitigate such risks. I further agree to refrain from contacting any individuals who might be identified."
            }
        ],
        "subscriptionId": "8",
        "type": "ProjectPurposesAcknowledgedAuditPayload",
        "version": 1,
        "projectId": "2"
    },
    "action": "PURPOSE_ACKNOWLEDGE",
    "actor": {
        "id": "taylor@immuta.com",
        "name": "Taylor Smith",
        "profileId": "1",
        "type": "USER_ACTOR",
        "identityProvider": "bim"
    },
    "targetType": "PROJECT",
    "eventTimestamp": "2023-10-13T14:12:18.083Z",
    "relatedResources": [
        {
            "id": "5",
            "name": "Re-identification Prohibited.Expert Determination",
            "type": "PURPOSE"
        }
    ],
    "actionStatus": "SUCCESS",
    "receivedTimestamp": "2023-10-13T14:12:18.216Z",
    "tenantId": "your-immuta-tenant.com",
    "targets": [
        {
            "id": "2",
            "name": "HR",
            "type": "PROJECT",
            "projectKey": "hr"
        }
    ],
    "actorIp": "xxx.xx.xx.xx",
    "id": "d21f9673-7b96-4bbe-abca-8d0aaec67c87",
    "sessionId": "6b928653b1411078647a2764a72beca6"
}

ProjectUpdated event

Event: ProjectUpdated
Legacy event: projectPurposeDeny
Description: An audit event for updating a project in Immuta.

{
    "sessionId": "6b928653b1411078647a2764a72beca6",
    "id": "b39e1295-bcd6-4117-8551-e2663a2541cb",
    "actorIp": "xxx.xx.xx.xx",
    "tenantId": "your-immuta-tenant.com",
    "targets": [
        {
            "id": "1",
            "name": "HR",
            "projectKey": "hr",
            "type": "PROJECT"
        }
    ],
    "receivedTimestamp": "2023-10-13T13:07:36.937Z",
    "eventTimestamp": "2023-10-13T13:07:36.626Z",
    "relatedResources": [],
    "actionStatus": "SUCCESS",
    "targetType": "PROJECT",
    "actor": {
        "type": "USER_ACTOR",
        "identityProvider": "bim",
        "id": "taylor@immuta.com",
        "name": "Taylor Smith",
        "profileId": "1"
    },
    "action": "UPDATE",
    "auditPayload": {
        "equalization": null,
        "type": "ProjectUpdatedAuditPayload",
        "projectId": "1",
        "version": 1
    },
    "requestId": "e162dd46-11d1-544b-af68-d71d4e033af5"
}

PurposeDeleted event

Event: PurposeDeleted
Legacy event: purposeDelete
Description: An audit event for deleting a purpose in Immuta.

{
"id": "eafa29d6-d61f-4aab-a958-106f25bbfa0b",
"sessionId": "e3e0aba1e69c06dbf64710c889b3f2d8",
"requestId": "f5ef5320-2237-56cb-bc56-929a5e6f8299",
"action": "DELETE",
"actionStatus": "SUCCESS",
"actor": {
    "name": "Taylor Smith",
    "id": "taylor@immuta.com",
    "identityProvider": "bim",
    "profileId": "1",
    "type": "USER_ACTOR"
},
"actorIp": "xxx.xx.xx.xx",
"tenantId": "your-immuta-tenant.com",
"targetType": "PURPOSE",
"targets": [
    {
    "type": "PURPOSE",
    "id": "1",
    "name": "Human resources use"
    }
],
"relatedResources": [],
"auditPayload": {
    "id": "1",
    "name": "Human resources use"
},
"eventTimestamp": "2024-04-18T18:25:40.623Z",
"receivedTimestamp": "2024-04-18T18:25:40.864Z",
"type": "PurposeDeleted",
"version": "1.0.0"
}

PurposeUpdated event

Event: PurposeUpdated
Legacy event: purposeUpdate
Description: An audit event for updating a purpose in Immuta.

{
"id": "eafa29d6-d61f-4aab-a958-106f25bbfa0b",
"sessionId": "e3e0aba1e69c06dbf64710c889b3f2d8",
"requestId": "f5ef5320-2237-56cb-bc56-929a5e6f8299",
"action": "UPDATE",
"actionStatus": "SUCCESS",
"actor": {
    "name": "Taylor Smith",
    "id": "taylor@immuta.com",
    "identityProvider": "bim",
    "profileId": "1",
    "type": "USER_ACTOR"
},
"actorIp": "xxx.xx.xx.xx",
"tenantId": "your-immuta-tenant.com",
"targetType": "PURPOSE",
"targets": [
    {
    "type": "PURPOSE",
    "id": "1",
    "name": "Human resources use"
    }
],
"relatedResources": [],
"auditPayload": {
    "type": "PurposeUpdatedAuditPayload",
    "description": "The data covered by the purpose should only be used by users within HR who will use this data for human resources purposes.",
    "kAnonNoiseReduction": "Medium",
    "adjustmentCertificationText": "Cert statement",
    "name": "Human resources use",
    "acknowledgement": "I agree to use this data for internal human resources needs.",
    "subpurposes": []
},
"eventTimestamp": "2024-04-18T18:25:40.623Z",
"receivedTimestamp": "2024-04-18T18:25:40.864Z",
"type": "PurposeUpdated",
"version": "1.0.0"
}

PurposeUpserted event

Event: PurposeUpserted
Legacy event: purposeCreate
Description: An audit event for creating a purpose in Immuta.

{
"id": "eafa29d6-d61f-4aab-a958-106f25bbfa0b",
"sessionId": "e3e0aba1e69c06dbf64710c889b3f2d8",
"requestId": "f5ef5320-2237-56cb-bc56-929a5e6f8299",
"action": "UPSERT",
"actionStatus": "SUCCESS",
"actor": {
    "name": "Taylor Smith",
    "id": "taylor@immuta.com",
    "identityProvider": "bim",
    "profileId": "1",
    "type": "USER_ACTOR"
},
"actorIp": "xxx.xx.xx.xx",
"tenantId": "your-immuta-tenant.com",
"targetType": "PURPOSE",
"targets": [
    {
    "type": "PURPOSE",
    "id": "1",
    "name": "Human resources use"
    }
],
"relatedResources": [],
"auditPayload": {
    "type": "PurposeUpsertedAuditPayload",
    "description": "The data covered by the purpose should only be used by users within HR who will use this data for human resources purposes.",
    "kAnonNoiseReduction": "Small",
    "adjustmentCertificationText": "Cert statement",
    "name": "Human resources use",
    "acknowledgement": "I agree to use this data for internal human resources needs.",
    "subpurposes": []
},
"eventTimestamp": "2024-04-18T18:25:40.623Z",
"receivedTimestamp": "2024-04-18T18:25:40.864Z",
"type": "PurposeUpserted",
"version": "1.0.0"
}

SDDClassifierCreated event

Event: SDDClassifierCreated
Legacy event: sddClassifierCreated
Description: An audit event for creating a sensitive data discovery (SDD) column name regex, regex, or dictionary pattern.
Additional parameter details:
- auditPayload.config.columnNameRegex: For column name regex patterns, the regex to match against column names.
- auditPayload.config.values: For dictionary patterns, the values within the dictionary pattern to match against column values.
- auditPayload.config.regex: For regex patterns, the regex to match against column values.

{
    "receivedTimestamp": "2023-12-22T20:37:08.243Z",
    "actor": {
        "type": "USER_ACTOR",
        "name": "Taylor Smith",
        "identityProvider": "bim",
        "id": "taylor@immuta.com",
        "profileId": "1"
    },
    "actorIp": "xxx.xx.xx.xx",
    "sessionId": "a21eddce1c9c1e18443ae04437e7c9c0",
    "action": "CREATE",
    "eventTimestamp": "2023-12-22T20:37:08.009Z",
    "actionStatus": "SUCCESS",
    "tenantId": "your-immuta-tenant.com",
    "targetType": "SDD_CLASSIFIER",
    "id": "b4aaefc0-2880-41cb-b3af-26f2fb83fd1f",
    "requestId": "f741e950-0a72-5c8a-8e18-5bd7af7d3d92",
    "auditPayload": {
        "displayName": "My Column Name Regex Rule",
        "name": "MY_COLUMN_NAME_REGEX_RULE",
        "classifierId": "73",
        "config": {
            "columnNameRegex": "salary",
            "tags": [
                {
                    "id": "22402",
                    "name": "Discovered.column-name-regex-salary",
                    "type": "TAG",
                    "source": "curated"
                }
            ]
        },
        "version": 1,
        "type": "SDDClassifierCreatedAuditPayload"
    },
    "relatedResources": [
        {
            "id": "22402",
            "name": "Discovered.column-name-regex-salary",
            "type": "TAG",
            "source": "curated"
        }
    ],
    "targets": [
        {
            "name": "MY_COLUMN_NAME_REGEX_RULE",
            "id": "73",
            "type": "SDD_CLASSIFIER"
        }
    ]
}

SDDClassifierDeleted event

Event: SDDClassifierDeleted
Legacy event: sddClassifierDeleted
Description: An audit event for deleting a sensitive data discovery (SDD) pattern.

{
    "id": "253cf57a-7fe7-4be8-bdd8-9d2f8860bb21",
    "targetType": "SDD_CLASSIFIER",
    "actionStatus": "SUCCESS",
    "tenantId": "your-immuta-tenant.com",
    "relatedResources": [],
    "auditPayload": {
        "classifierId": "69",
        "name": "MY_DICTIONARY_RULE",
        "version": 1,
        "type": "SDDClassifierDeletedAuditPayload"
    },
    "requestId": "29e410fc-bdbe-528c-aaa0-6b75c42ad618",
    "actorIp": "xxx.xx.xx.xx",
    "receivedTimestamp": "2023-12-18T23:09:33.882Z",
    "actor": {
        "type": "USER_ACTOR",
        "id": "taylor@immuta.com",
        "name": "Taylor Smith",
        "identityProvider": "bim",
        "profileId": "1"
    },
    "eventTimestamp": "2023-12-18T23:09:33.792Z",
    "action": "DELETE",
    "sessionId": "78fe82a7524125f911881de1721cfca4"
}

SDDClassifierUpdated event

Event: SDDClassifierUpdated
Legacy event: sddClassifierUpdated
Description: An audit event for updating a sensitive data discovery (SDD) column name regex, regex, or dictionary pattern.
Additional parameter details:
- auditPayload.config.columnNameRegex: For column name regex patterns, the regex to match against column names.
- auditPayload.config.values: For dictionary patterns, the values within the dictionary pattern to match against column values.
- auditPayload.config.regex: For regex patterns, the regex to match against column values.

{
    "id": "4cae883b-9236-4052-a41a-893e3a734285",
    "sessionId": "3541001fcfa1e1e3dd7c26398cdfd3c6",
    "requestId": "e75761e9-c778-5e38-9933-f9ffd4192cb3",
    "action": "UPDATE",
    "actionStatus": "SUCCESS",
    "actor": {
        "name": "Taylor Smith",
        "id": "taylor@immuta.com",
        "identityProvider": "bim",
        "profileId": "1",
        "type": "USER_ACTOR"
    },
    "actorIp": "xxx.xx.xx.xx",
    "tenantId": "your-immuta-tenant.com",
    "targetType": "SDD_CLASSIFIER",
    "targets": [
        {
            "type": "SDD_CLASSIFIER",
            "id": "68",
            "name": "Email pattern"
        }
    ],
    "relatedResources": [
        {
            "type": "TAG",
            "name": "Discovered.Identifier Undetermined",
            "id": "8",
            "source": "curated"
        }
    ],
    "auditPayload": {
        "type": "SDDClassifierUpdatedAuditPayload",
        "version": 1,
        "classifierId": "68",
        "name": "Email pattern",
        "displayName": "A really cool classifier new updated",
        "config": {
            "tags": [
                {
                    "type": "TAG",
                    "name": "Discovered.Identifier Undetermined",
                    "id": "8",
                    "source": "curated"
                }
            ],
            "columnNameRegex": "^[A-Z_0-9]+$"
        }
    },
    "eventTimestamp": "2024-03-08T19:07:57.304Z",
    "receivedTimestamp": "2024-03-08T19:07:57.409Z"
}

SDDDatasourceTagUpdated event

Event: SDDDatasourceTagUpdated
Legacy event: sddDatasourceTagUpdate
Description: An audit event for the results from a sensitive data discovery (SDD) run that updates the tags on Immuta data sources.

{
    "eventTimestamp": "2023-12-21T19:26:05.053Z",
    "id": "bd1e1c3e-adeb-4a26-b694-4bac0bbfc713",
    "targets": [
        {
            "name": "Public case",
            "technology": "SNOWFLAKE",
            "type": "DATASOURCE",
            "id": "385"
        }
    ],
    "relatedResources": [
        {
            "type": "SDD_CLASSIFIER",
            "name": "AGE",
            "id": "3"
        },
        {
            "type": "SDD_CLASSIFIER",
            "name": "ARGENTINA_DNI_NUMBER",
            "id": "4"
        },
        {
            "id": "5",
            "name": "AUSTRALIA_MEDICARE_NUMBER",
            "type": "SDD_CLASSIFIER"
        },
        {
            "id": "26",
            "type": "SDD_CLASSIFIER",
            "name": "AUSTRALIA_PASSPORT"
        },
        {
            "id": "6",
            "type": "SDD_CLASSIFIER",
            "name": "AUSTRALIA_TAX_FILE_NUMBER"
        },
        {
            "name": "BELGIUM_NATIONAL_ID_CARD_NUMBER",
            "type": "SDD_CLASSIFIER",
            "id": "7"
        },
        {
            "type": "SDD_CLASSIFIER",
            "name": "BITCOIN_INVOICE_ADDRESS",
            "id": "67"
        },
        {
            "type": "SDD_CLASSIFIER",
            "name": "BRAZIL_CPF_NUMBER",
            "id": "8"
        },
        {
            "name": "CANADA_BC_PHN",
            "type": "SDD_CLASSIFIER",
            "id": "9"
        },
        {
            "type": "SDD_CLASSIFIER",
            "name": "CANADA_DRIVERS_LICENSE_NUMBER",
            "id": "42"
        },
        {
            "id": "27",
            "name": "CANADA_OHIP",
            "type": "SDD_CLASSIFIER"
        },
        {
            "id": "28",
            "name": "CANADA_PASSPORT",
            "type": "SDD_CLASSIFIER"
        },
        {
            "id": "29",
            "name": "CANADA_QUEBEC_HIN",
            "type": "SDD_CLASSIFIER"
        },
        {
            "id": "43",
            "type": "SDD_CLASSIFIER",
            "name": "CANADA_SOCIAL_INSURANCE_NUMBER"
        },
        {
            "id": "10",
            "name": "CREDIT_CARD_NUMBER",
            "type": "SDD_CLASSIFIER"
        },
        {
            "id": "45",
            "type": "SDD_CLASSIFIER",
            "name": "DATE"
        },
        {
            "id": "44",
            "name": "DATE_OF_BIRTH",
            "type": "SDD_CLASSIFIER"
        },
        {
            "id": "11",
            "name": "DENMARK_CPR_NUMBER",
            "type": "SDD_CLASSIFIER"
        },
        {
            "id": "46",
            "name": "DOMAIN_NAME",
            "type": "SDD_CLASSIFIER"
        },
        {
            "type": "SDD_CLASSIFIER",
            "name": "EMAIL_ADDRESS",
            "id": "47"
        },
        {
            "type": "SDD_CLASSIFIER",
            "name": "ETHNIC_GROUP",
            "id": "1"
        },
        {
            "type": "SDD_CLASSIFIER",
            "name": "FDA_CODE",
            "id": "12"
        },
        {
            "id": "48",
            "type": "SDD_CLASSIFIER",
            "name": "FINLAND_NATIONAL_ID_NUMBER"
        },
        {
            "type": "SDD_CLASSIFIER",
            "name": "FRANCE_CNI",
            "id": "13"
        },
        {
            "type": "SDD_CLASSIFIER",
            "name": "FRANCE_NIR",
            "id": "14"
        },
        {
            "id": "30",
            "type": "SDD_CLASSIFIER",
            "name": "FRANCE_PASSPORT"
        },
        {
            "name": "GENDER",
            "type": "SDD_CLASSIFIER",
            "id": "2"
        },
        {
            "id": "31",
            "name": "GERMANY_DRIVERS_LICENSE_NUMBER",
            "type": "SDD_CLASSIFIER"
        },
        {
            "id": "32",
            "type": "SDD_CLASSIFIER",
            "name": "GERMANY_IDENTITY_CARD_NUMBER"
        },
        {
            "id": "33",
            "type": "SDD_CLASSIFIER",
            "name": "IBAN_CODE"
        },
        {
            "type": "SDD_CLASSIFIER",
            "name": "ICD10_CODE",
            "id": "50"
        },
        {
            "id": "15",
            "type": "SDD_CLASSIFIER",
            "name": "IMEI_HARDWARE_ID"
        },
        {
            "id": "49",
            "name": "IP_ADDRESS",
            "type": "SDD_CLASSIFIER"
        },
        {
            "type": "SDD_CLASSIFIER",
            "name": "LOCATION",
            "id": "51"
        },
        {
            "id": "53",
            "type": "SDD_CLASSIFIER",
            "name": "MAC_ADDRESS"
        },
        {
            "id": "52",
            "type": "SDD_CLASSIFIER",
            "name": "MAC_ADDRESS_LOCAL"
        },
        {
            "id": "54",
            "type": "SDD_CLASSIFIER",
            "name": "PERSON_NAME"
        },
        {
            "type": "SDD_CLASSIFIER",
            "name": "PHONE_NUMBER",
            "id": "57"
        },
        {
            "name": "POSTAL_CODE",
            "type": "SDD_CLASSIFIER",
            "id": "60"
        },
        {
            "id": "55",
            "type": "SDD_CLASSIFIER",
            "name": "SPAIN_DRIVERS_LICENSE_NUMBER"
        },
        {
            "type": "SDD_CLASSIFIER",
            "name": "SPAIN_NIE_NUMBER",
            "id": "34"
        },
        {
            "id": "35",
            "name": "SPAIN_NIF_NUMBER",
            "type": "SDD_CLASSIFIER"
        },
        {
            "id": "56",
            "type": "SDD_CLASSIFIER",
            "name": "SPAIN_PASSPORT"
        },
        {
            "name": "STREET_ADDRESS",
            "type": "SDD_CLASSIFIER",
            "id": "41"
        },
        {
            "id": "16",
            "name": "SWEDEN_NATIONAL_ID_NUMBER",
            "type": "SDD_CLASSIFIER"
        },
        {
            "id": "17",
            "type": "SDD_CLASSIFIER",
            "name": "SWEDEN_PASSPORT"
        },
        {
            "name": "SWIFT_CODE",
            "type": "SDD_CLASSIFIER",
            "id": "36"
        },
        {
            "type": "SDD_CLASSIFIER",
            "name": "THAILAND_NATIONAL_ID_NUMBER",
            "id": "58"
        },
        {
            "id": "59",
            "type": "SDD_CLASSIFIER",
            "name": "TIME"
        },
        {
            "id": "37",
            "name": "UK_DRIVERS_LICENSE_NUMBER",
            "type": "SDD_CLASSIFIER"
        },
        {
            "name": "UK_NATIONAL_INSURANCE_NUMBER",
            "type": "SDD_CLASSIFIER",
            "id": "38"
        },
        {
            "id": "18",
            "name": "UK_PASSPORT",
            "type": "SDD_CLASSIFIER"
        },
        {
            "id": "61",
            "name": "UK_TAXPAYER_REFERENCE",
            "type": "SDD_CLASSIFIER"
        },
        {
            "type": "SDD_CLASSIFIER",
            "name": "URL",
            "id": "62"
        },
        {
            "id": "19",
            "name": "US_ADOPTION_TAXPAYER_IDENTIFICATION_NUMBER",
            "type": "SDD_CLASSIFIER"
        },
        {
            "id": "20",
            "name": "US_BANK_ROUTING_MICR",
            "type": "SDD_CLASSIFIER"
        },
        {
            "id": "39",
            "type": "SDD_CLASSIFIER",
            "name": "US_DEA_NUMBER"
        },
        {
            "id": "63",
            "name": "US_DRIVERS_LICENSE_NUMBER",
            "type": "SDD_CLASSIFIER"
        },
        {
            "id": "21",
            "name": "US_EMPLOYER_IDENTIFICATION_NUMBER",
            "type": "SDD_CLASSIFIER"
        },
        {
            "type": "SDD_CLASSIFIER",
            "name": "US_HEALTHCARE_NPI",
            "id": "22"
        },
        {
            "id": "23",
            "name": "US_INDIVIDUAL_TAXPAYER_IDENTIFICATION_NUMBER",
            "type": "SDD_CLASSIFIER"
        },
        {
            "type": "SDD_CLASSIFIER",
            "name": "US_PASSPORT",
            "id": "64"
        },
        {
            "type": "SDD_CLASSIFIER",
            "name": "US_PREPARER_TAXPAYER_IDENTIFICATION_NUMBER",
            "id": "40"
        },
        {
            "name": "US_SOCIAL_SECURITY_NUMBER",
            "type": "SDD_CLASSIFIER",
            "id": "24"
        },
        {
            "name": "US_STATE",
            "type": "SDD_CLASSIFIER",
            "id": "65"
        },
        {
            "type": "SDD_CLASSIFIER",
            "name": "US_TOLLFREE_PHONE_NUMBER",
            "id": "25"
        },
        {
            "id": "66",
            "name": "US_VEHICLE_IDENTIFICATION_NUMBER",
            "type": "SDD_CLASSIFIER"
        }
    ],
    "auditPayload": {
        "tags": [
            {
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.Entity.Age",
                "id": "105"
            },
            {
                "id": "7",
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.Identifier Indirect"
            },
            {
                "id": "5",
                "name": "Discovered.PHI",
                "source": "curated",
                "type": "TAG"
            },
            {
                "name": "Discovered.PII",
                "source": "curated",
                "type": "TAG",
                "id": "4"
            },
            {
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.Country.Argentina",
                "id": "3"
            },
            {
                "id": "9",
                "name": "Discovered.Entity.DNI Number",
                "source": "curated",
                "type": "TAG"
            },
            {
                "id": "6",
                "name": "Discovered.Identifier Direct",
                "source": "curated",
                "type": "TAG"
            },
            {
                "id": "5",
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.PHI"
            },
            {
                "name": "Discovered.PII",
                "source": "curated",
                "type": "TAG",
                "id": "4"
            },
            {
                "id": "10",
                "name": "Discovered.Country.Australia",
                "type": "TAG",
                "source": "curated"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Entity.Medicare Number",
                "id": "12"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Identifier Direct",
                "id": "6"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.PHI",
                "id": "5"
            },
            {
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.PII",
                "id": "4"
            },
            {
                "id": "10",
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.Country.Australia"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Entity.Passport",
                "id": "13"
            },
            {
                "id": "6",
                "name": "Discovered.Identifier Direct",
                "type": "TAG",
                "source": "curated"
            },
            {
                "id": "5",
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.PHI"
            },
            {
                "id": "4",
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.PII"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Country.Australia",
                "id": "10"
            },
            {
                "id": "11",
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Entity.Tax File Number"
            },
            {
                "id": "6",
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.Identifier Direct"
            },
            {
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.PHI",
                "id": "5"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.PII",
                "id": "4"
            },
            {
                "id": "14",
                "name": "Discovered.Country.Belgium",
                "type": "TAG",
                "source": "curated"
            },
            {
                "name": "Discovered.Entity.National ID Card Number",
                "source": "curated",
                "type": "TAG",
                "id": "15"
            },
            {
                "name": "Discovered.Identifier Direct",
                "source": "curated",
                "type": "TAG",
                "id": "6"
            },
            {
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.PHI",
                "id": "5"
            },
            {
                "id": "4",
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.PII"
            },
            {
                "name": "Discovered.Entity.CRYPTO",
                "source": "curated",
                "type": "TAG",
                "id": "116"
            },
            {
                "id": "93",
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.PCI"
            },
            {
                "id": "16",
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Country.Brazil"
            },
            {
                "name": "Discovered.Entity.CPF Number",
                "source": "curated",
                "type": "TAG",
                "id": "17"
            },
            {
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.Identifier Direct",
                "id": "6"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.PHI",
                "id": "5"
            },
            {
                "name": "Discovered.PII",
                "source": "curated",
                "type": "TAG",
                "id": "4"
            },
            {
                "name": "Discovered.Country.Canada",
                "source": "curated",
                "type": "TAG",
                "id": "18"
            },
            {
                "id": "20",
                "name": "Discovered.Entity.British Columbia Health Network Number",
                "type": "TAG",
                "source": "curated"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Identifier Direct",
                "id": "6"
            },
            {
                "id": "5",
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.PHI"
            },
            {
                "id": "4",
                "name": "Discovered.PII",
                "type": "TAG",
                "source": "curated"
            },
            {
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.Country.Canada",
                "id": "18"
            },
            {
                "id": "19",
                "name": "Discovered.Entity.Drivers License Number",
                "type": "TAG",
                "source": "curated"
            },
            {
                "id": "6",
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Identifier Direct"
            },
            {
                "id": "5",
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.PHI"
            },
            {
                "name": "Discovered.PII",
                "type": "TAG",
                "source": "curated",
                "id": "4"
            },
            {
                "id": "18",
                "name": "Discovered.Country.Canada",
                "source": "curated",
                "type": "TAG"
            },
            {
                "name": "Discovered.Entity.Ontario Health Insurance Number",
                "source": "curated",
                "type": "TAG",
                "id": "21"
            },
            {
                "id": "6",
                "name": "Discovered.Identifier Direct",
                "type": "TAG",
                "source": "curated"
            },
            {
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.PHI",
                "id": "5"
            },
            {
                "name": "Discovered.PII",
                "source": "curated",
                "type": "TAG",
                "id": "4"
            },
            {
                "id": "18",
                "name": "Discovered.Country.Canada",
                "source": "curated",
                "type": "TAG"
            },
            {
                "name": "Discovered.Entity.Passport",
                "source": "curated",
                "type": "TAG",
                "id": "13"
            },
            {
                "id": "6",
                "name": "Discovered.Identifier Direct",
                "type": "TAG",
                "source": "curated"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.PHI",
                "id": "5"
            },
            {
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.PII",
                "id": "4"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Country.Canada",
                "id": "18"
            },
            {
                "id": "22",
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Entity.Quebec Health Insurance Number"
            },
            {
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.Identifier Direct",
                "id": "6"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.PHI",
                "id": "5"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.PII",
                "id": "4"
            },
            {
                "id": "18",
                "name": "Discovered.Country.Canada",
                "type": "TAG",
                "source": "curated"
            },
            {
                "name": "Discovered.Entity.Social Insurance Number",
                "source": "curated",
                "type": "TAG",
                "id": "23"
            },
            {
                "id": "6",
                "name": "Discovered.Identifier Direct",
                "type": "TAG",
                "source": "curated"
            },
            {
                "name": "Discovered.PHI",
                "type": "TAG",
                "source": "curated",
                "id": "5"
            },
            {
                "id": "4",
                "name": "Discovered.PII",
                "source": "curated",
                "type": "TAG"
            },
            {
                "id": "94",
                "name": "Discovered.Entity.Credit Card Number",
                "type": "TAG",
                "source": "curated"
            },
            {
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.PCI",
                "id": "93"
            },
            {
                "name": "Discovered.Entity.Date",
                "source": "curated",
                "type": "TAG",
                "id": "97"
            },
            {
                "name": "Discovered.Entity.Date of Birth",
                "source": "curated",
                "type": "TAG",
                "id": "98"
            },
            {
                "id": "7",
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Identifier Indirect"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.PHI",
                "id": "5"
            },
            {
                "id": "4",
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.PII"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Country.Denmark",
                "id": "30"
            },
            {
                "id": "31",
                "name": "Discovered.Entity.CPR Number",
                "source": "curated",
                "type": "TAG"
            },
            {
                "id": "6",
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.Identifier Direct"
            },
            {
                "id": "5",
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.PHI"
            },
            {
                "name": "Discovered.PII",
                "source": "curated",
                "type": "TAG",
                "id": "4"
            },
            {
                "id": "108",
                "name": "Discovered.Entity.Domain Name",
                "source": "curated",
                "type": "TAG"
            },
            {
                "id": "102",
                "name": "Discovered.Entity.Electronic Mail Address",
                "type": "TAG",
                "source": "curated"
            },
            {
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.Identifier Direct",
                "id": "6"
            },
            {
                "id": "5",
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.PHI"
            },
            {
                "id": "113",
                "name": "Discovered.Entity.Ethnic Group",
                "source": "curated",
                "type": "TAG"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.PII",
                "id": "4"
            },
            {
                "name": "Discovered.Country.US",
                "source": "curated",
                "type": "TAG",
                "id": "78"
            },
            {
                "id": "91",
                "name": "Discovered.Entity.FDA Code",
                "source": "curated",
                "type": "TAG"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Country.Finland",
                "id": "32"
            },
            {
                "id": "33",
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.Entity.National ID Number"
            },
            {
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.Identifier Direct",
                "id": "6"
            },
            {
                "id": "5",
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.PHI"
            },
            {
                "id": "4",
                "name": "Discovered.PII",
                "type": "TAG",
                "source": "curated"
            },
            {
                "id": "34",
                "name": "Discovered.Country.France",
                "source": "curated",
                "type": "TAG"
            },
            {
                "id": "35",
                "name": "Discovered.Entity.CNI",
                "source": "curated",
                "type": "TAG"
            },
            {
                "id": "6",
                "name": "Discovered.Identifier Direct",
                "type": "TAG",
                "source": "curated"
            },
            {
                "id": "5",
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.PHI"
            },
            {
                "id": "4",
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.PII"
            },
            {
                "id": "34",
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Country.France"
            },
            {
                "name": "Discovered.Entity.NIR",
                "type": "TAG",
                "source": "curated",
                "id": "36"
            },
            {
                "id": "6",
                "name": "Discovered.Identifier Direct",
                "type": "TAG",
                "source": "curated"
            },
            {
                "id": "5",
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.PHI"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.PII",
                "id": "4"
            },
            {
                "name": "Discovered.Country.France",
                "source": "curated",
                "type": "TAG",
                "id": "34"
            },
            {
                "id": "13",
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Entity.Passport"
            },
            {
                "id": "6",
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.Identifier Direct"
            },
            {
                "id": "5",
                "name": "Discovered.PHI",
                "type": "TAG",
                "source": "curated"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.PII",
                "id": "4"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Entity.Gender",
                "id": "106"
            },
            {
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.Identifier Indirect",
                "id": "7"
            },
            {
                "name": "Discovered.PHI",
                "type": "TAG",
                "source": "curated",
                "id": "5"
            },
            {
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.PII",
                "id": "4"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Country.Germany",
                "id": "37"
            },
            {
                "id": "19",
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.Entity.Drivers License Number"
            },
            {
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.Identifier Direct",
                "id": "6"
            },
            {
                "id": "5",
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.PHI"
            },
            {
                "id": "4",
                "name": "Discovered.PII",
                "type": "TAG",
                "source": "curated"
            },
            {
                "id": "37",
                "name": "Discovered.Country.Germany",
                "source": "curated",
                "type": "TAG"
            },
            {
                "id": "38",
                "name": "Discovered.Entity.Identity Card Number",
                "source": "curated",
                "type": "TAG"
            },
            {
                "id": "6",
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Identifier Direct"
            },
            {
                "id": "5",
                "name": "Discovered.PHI",
                "type": "TAG",
                "source": "curated"
            },
            {
                "id": "4",
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.PII"
            },
            {
                "name": "Discovered.Entity.IBAN Code",
                "source": "curated",
                "type": "TAG",
                "id": "110"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Entity.ICD10 Code",
                "id": "111"
            },
            {
                "id": "99",
                "name": "Discovered.Entity.IMEI",
                "source": "curated",
                "type": "TAG"
            },
            {
                "name": "Discovered.Entity.IP Address",
                "source": "curated",
                "type": "TAG",
                "id": "103"
            },
            {
                "id": "96",
                "name": "Discovered.Entity.Location",
                "type": "TAG",
                "source": "curated"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Entity.MAC Address",
                "id": "100"
            },
            {
                "id": "101",
                "name": "Discovered.Entity.MAC Address Local",
                "source": "curated",
                "type": "TAG"
            },
            {
                "id": "104",
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Entity.Person Name"
            },
            {
                "id": "7",
                "name": "Discovered.Identifier Indirect",
                "source": "curated",
                "type": "TAG"
            },
            {
                "id": "5",
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.PHI"
            },
            {
                "id": "4",
                "name": "Discovered.PII",
                "type": "TAG",
                "source": "curated"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Entity.Telephone Number",
                "id": "107"
            },
            {
                "id": "114",
                "name": "Discovered.Entity.Postal Code",
                "type": "TAG",
                "source": "curated"
            },
            {
                "id": "66",
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Country.Spain"
            },
            {
                "id": "19",
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Entity.Drivers License Number"
            },
            {
                "name": "Discovered.Identifier Direct",
                "source": "curated",
                "type": "TAG",
                "id": "6"
            },
            {
                "name": "Discovered.PHI",
                "type": "TAG",
                "source": "curated",
                "id": "5"
            },
            {
                "id": "4",
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.PII"
            },
            {
                "id": "66",
                "name": "Discovered.Country.Spain",
                "type": "TAG",
                "source": "curated"
            },
            {
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.Entity.NIE Number",
                "id": "67"
            },
            {
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.Identifier Direct",
                "id": "6"
            },
            {
                "name": "Discovered.PHI",
                "source": "curated",
                "type": "TAG",
                "id": "5"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.PII",
                "id": "4"
            },
            {
                "name": "Discovered.Country.Spain",
                "source": "curated",
                "type": "TAG",
                "id": "66"
            },
            {
                "id": "68",
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.Entity.NIF Number"
            },
            {
                "id": "6",
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Identifier Direct"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.PHI",
                "id": "5"
            },
            {
                "id": "4",
                "name": "Discovered.PII",
                "source": "curated",
                "type": "TAG"
            },
            {
                "id": "66",
                "name": "Discovered.Country.Spain",
                "type": "TAG",
                "source": "curated"
            },
            {
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.Entity.Passport",
                "id": "13"
            },
            {
                "id": "6",
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.Identifier Direct"
            },
            {
                "name": "Discovered.PHI",
                "type": "TAG",
                "source": "curated",
                "id": "5"
            },
            {
                "id": "4",
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.PII"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Entity.Location",
                "id": "96"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Country.Sweden",
                "id": "69"
            },
            {
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.Entity.National ID Number",
                "id": "33"
            },
            {
                "id": "6",
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Identifier Direct"
            },
            {
                "id": "5",
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.PHI"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.PII",
                "id": "4"
            },
            {
                "id": "69",
                "name": "Discovered.Country.Sweden",
                "source": "curated",
                "type": "TAG"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Entity.Passport",
                "id": "13"
            },
            {
                "id": "6",
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.Identifier Direct"
            },
            {
                "name": "Discovered.PHI",
                "source": "curated",
                "type": "TAG",
                "id": "5"
            },
            {
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.PII",
                "id": "4"
            },
            {
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.Entity.Swift Code",
                "id": "95"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Country.Thailand",
                "id": "71"
            },
            {
                "name": "Discovered.Entity.National ID Number",
                "type": "TAG",
                "source": "curated",
                "id": "33"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Identifier Direct",
                "id": "6"
            },
            {
                "name": "Discovered.PHI",
                "source": "curated",
                "type": "TAG",
                "id": "5"
            },
            {
                "id": "4",
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.PII"
            },
            {
                "id": "97",
                "name": "Discovered.Entity.Date",
                "source": "curated",
                "type": "TAG"
            },
            {
                "id": "73",
                "name": "Discovered.Country.UK",
                "source": "curated",
                "type": "TAG"
            },
            {
                "id": "19",
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Entity.Drivers License Number"
            },
            {
                "id": "6",
                "name": "Discovered.Identifier Direct",
                "type": "TAG",
                "source": "curated"
            },
            {
                "name": "Discovered.PHI",
                "source": "curated",
                "type": "TAG",
                "id": "5"
            },
            {
                "name": "Discovered.PII",
                "source": "curated",
                "type": "TAG",
                "id": "4"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Country.UK",
                "id": "73"
            },
            {
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.Entity.National Insurance Number",
                "id": "74"
            },
            {
                "name": "Discovered.Identifier Direct",
                "type": "TAG",
                "source": "curated",
                "id": "6"
            },
            {
                "name": "Discovered.PHI",
                "source": "curated",
                "type": "TAG",
                "id": "5"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.PII",
                "id": "4"
            },
            {
                "id": "73",
                "name": "Discovered.Country.UK",
                "type": "TAG",
                "source": "curated"
            },
            {
                "id": "13",
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.Entity.Passport"
            },
            {
                "id": "6",
                "name": "Discovered.Identifier Direct",
                "source": "curated",
                "type": "TAG"
            },
            {
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.PHI",
                "id": "5"
            },
            {
                "id": "4",
                "name": "Discovered.PII",
                "type": "TAG",
                "source": "curated"
            },
            {
                "id": "73",
                "name": "Discovered.Country.UK",
                "type": "TAG",
                "source": "curated"
            },
            {
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.Entity.Taxpayer Reference",
                "id": "76"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Identifier Direct",
                "id": "6"
            },
            {
                "name": "Discovered.PHI",
                "type": "TAG",
                "source": "curated",
                "id": "5"
            },
            {
                "name": "Discovered.PII",
                "source": "curated",
                "type": "TAG",
                "id": "4"
            },
            {
                "id": "109",
                "name": "Discovered.Entity.URL",
                "type": "TAG",
                "source": "curated"
            },
            {
                "id": "78",
                "name": "Discovered.Country.US",
                "source": "curated",
                "type": "TAG"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Entity.Adoption Taxpayer ID Number",
                "id": "82"
            },
            {
                "name": "Discovered.Identifier Direct",
                "type": "TAG",
                "source": "curated",
                "id": "6"
            },
            {
                "id": "5",
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.PHI"
            },
            {
                "id": "4",
                "name": "Discovered.PII",
                "type": "TAG",
                "source": "curated"
            },
            {
                "id": "78",
                "name": "Discovered.Country.US",
                "source": "curated",
                "type": "TAG"
            },
            {
                "name": "Discovered.Entity.Bank Routing MICR",
                "type": "TAG",
                "source": "curated",
                "id": "80"
            },
            {
                "id": "78",
                "name": "Discovered.Country.US",
                "type": "TAG",
                "source": "curated"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Entity.DEA Number",
                "id": "90"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Identifier Direct",
                "id": "6"
            },
            {
                "name": "Discovered.PII",
                "type": "TAG",
                "source": "curated",
                "id": "4"
            },
            {
                "id": "78",
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Country.US"
            },
            {
                "id": "19",
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Entity.Drivers License Number"
            },
            {
                "name": "Discovered.Identifier Direct",
                "type": "TAG",
                "source": "curated",
                "id": "6"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.PHI",
                "id": "5"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.PII",
                "id": "4"
            },
            {
                "id": "78",
                "name": "Discovered.Country.US",
                "type": "TAG",
                "source": "curated"
            },
            {
                "id": "83",
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Entity.Employer ID Number"
            },
            {
                "id": "78",
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Country.US"
            },
            {
                "name": "Discovered.Entity.Healthcare NPI",
                "type": "TAG",
                "source": "curated",
                "id": "89"
            },
            {
                "id": "8",
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Identifier Undetermined"
            },
            {
                "id": "4",
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.PII"
            },
            {
                "id": "78",
                "name": "Discovered.Country.US",
                "source": "curated",
                "type": "TAG"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Entity.Individual Taxpayer ID Number",
                "id": "81"
            },
            {
                "id": "6",
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Identifier Direct"
            },
            {
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.PHI",
                "id": "5"
            },
            {
                "id": "4",
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.PII"
            },
            {
                "id": "78",
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Country.US"
            },
            {
                "id": "13",
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Entity.Passport"
            },
            {
                "id": "6",
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Identifier Direct"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.PHI",
                "id": "5"
            },
            {
                "name": "Discovered.PII",
                "source": "curated",
                "type": "TAG",
                "id": "4"
            },
            {
                "id": "78",
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.Country.US"
            },
            {
                "name": "Discovered.Entity.Preparer Taxpayer ID Number",
                "source": "curated",
                "type": "TAG",
                "id": "88"
            },
            {
                "id": "6",
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.Identifier Direct"
            },
            {
                "id": "4",
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.PII"
            },
            {
                "id": "78",
                "name": "Discovered.Country.US",
                "type": "TAG",
                "source": "curated"
            },
            {
                "name": "Discovered.Entity.Social Security Number",
                "source": "curated",
                "type": "TAG",
                "id": "85"
            },
            {
                "id": "6",
                "name": "Discovered.Identifier Direct",
                "type": "TAG",
                "source": "curated"
            },
            {
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.PHI",
                "id": "5"
            },
            {
                "name": "Discovered.PII",
                "type": "TAG",
                "source": "curated",
                "id": "4"
            },
            {
                "id": "78",
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Country.US"
            },
            {
                "id": "84",
                "name": "Discovered.Entity.State",
                "type": "TAG",
                "source": "curated"
            },
            {
                "id": "78",
                "name": "Discovered.Country.US",
                "type": "TAG",
                "source": "curated"
            },
            {
                "id": "86",
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.Entity.Tollfree Telephone Number"
            },
            {
                "source": "curated",
                "type": "TAG",
                "name": "Discovered.Country.US",
                "id": "78"
            },
            {
                "type": "TAG",
                "source": "curated",
                "name": "Discovered.Entity.Vehicle Identifier or Serial Number",
                "id": "87"
            }
        ],
        "sampleSize": 500,
        "type": "SDDDatasourceTagUpdatedAuditPayload",
        "sddTagResult": {
            "sex": ["Discovered.Entity.Gender", "Discovered.Identifier Indirect", "Discovered.PHI", "Discovered.PII"],
            "lname": [
                "Discovered.Entity.Person Name",
                "Discovered.Identifier Indirect",
                "Discovered.PHI",
                "Discovered.PII"
            ],
            "fname": [
                "Discovered.Entity.Person Name",
                "Discovered.Identifier Indirect",
                "Discovered.PHI",
                "Discovered.PII"
            ]
        },
        "version": 1,
        "templateName": "DEFAULT_FRAMEWORK",
        "tagChangeSet": {
            "removedTags": {},
            "addedTags": {
                "sex": [
                    "Discovered.Entity.Gender",
                    "Discovered.Identifier Indirect",
                    "Discovered.PHI",
                    "Discovered.PII"
                ],
                "lname": [
                    "Discovered.Entity.Person Name",
                    "Discovered.Identifier Indirect",
                    "Discovered.PHI",
                    "Discovered.PII"
                ],
                "fname": [
                    "Discovered.Entity.Person Name",
                    "Discovered.Identifier Indirect",
                    "Discovered.PHI",
                    "Discovered.PII"
                ]
            }
        }
    },
    "receivedTimestamp": "2023-12-21T19:26:05.338Z",
    "tenantId": "your-immuta-tenant.com",
    "action": "TAG_APPLY",
    "actor": {
        "type": "SYSTEM_ACCOUNT",
        "name": "Immuta System Account",
        "id": "immuta_system_account"
    },
    "targetType": "DATASOURCE",
    "actionStatus": "SUCCESS"
}

SDDTemplateApplied event

Event: SDDTemplateApplied
Legacy event: sddTemplateApplied
Description: An audit event for applying an identification framework to data sources.

{
    "eventTimestamp": "2023-12-08T19:16:53.217Z",
    "auditPayload": {
        "version": 1,
        "templateId": "8",
        "name": "FINANCIAL_DATA_IDENTIFICATION_FRAMEWORK",
        "type": "SDDTemplateAppliedAuditPayload"
    },
    "targets": [
        {
            "name": "Public case",
            "type": "DATASOURCE",
            "technology": "POSTGRESQL",
            "id": "8"
        }
    ],
    "relatedResources": [],
    "action": "SDD_TEMPLATE_APPLIED",
    "tenantId": "your-immuta-tenant.com",
    "actor": {
        "profileId": "1",
        "identityProvider": "bim",
        "name": "Taylor Smith",
        "type": "USER_ACTOR",
        "id": "taylor@immuta.com"
    },
    "id": "7635960b-0d17-44c1-b9c2-dfe8dae9e44c",
    "receivedTimestamp": "2023-12-08T19:16:53.288Z",
    "requestId": "11d8f166-b39d-5423-bf27-6575ddeda285",
    "actorIp": "xxx.xx.xx.xx",
    "targetType": "DATASOURCE",
    "actionStatus": "SUCCESS",
    "sessionId": "7a745a6aa10c4b24be9eed69ce2ef7ed"
}

SDDTemplateCloned event

Event: SDDTemplateCloned
Legacy event: sddTemplateCreated
Description: An audit event for cloning an identification framework from another framework.

{
    "id": "ac736d41-14af-4bcc-b742-0fdc1752d420",
    "requestId": "3f7db240-5c15-5632-9d80-5f29dda81ce6",
    "receivedTimestamp": "2023-12-08T19:18:21.937Z",
    "actorIp": "xxx.xx.xx.xx",
    "sessionId": "6b8d31369cdcc0f6a01fa02888fb3203",
    "actionStatus": "SUCCESS",
    "targetType": "SDD_TEMPLATE",
    "eventTimestamp": "2023-12-08T19:18:21.861Z",
    "targets": [
        {
            "id": "9",
            "name": "FINANCIAL_DATA_IDENTIFICATION_FRAMEWORK_V2",
            "type": "SDD_TEMPLATE"
        }
    ],
    "relatedResources": [],
    "auditPayload": {
        "displayName": "Financial data identification framework v2",
        "sourceTemplate": "FINANCIAL_DATA_IDENTIFICATION_FRAMEWORK",
        "templateId": "9",
        "type": "SDDTemplateClonedAuditPayload",
        "version": 1,
        "name": "FINANCIAL_DATA_IDENTIFICATION_FRAMEWORK_V2",
        "description": "This is the first framework I've created."
    },
    "tenantId": "your-immuta-tenant.com",
    "action": "SDD_TEMPLATE_CLONED",
    "actor": {
        "id": "taylor@immuta.com",
        "type": "USER_ACTOR",
        "identityProvider": "bim",
        "name": "Taylor Smith",
        "profileId": "1"
    }
}

SDDTemplateCreated event

Event: SDDTemplateCreated
Legacy event: sddTemplateCreated
Description: An audit event for creating an identification framework.

{
    "relatedResources": [],
    "targets": [
        {
            "name": "FINANCIAL_DATA_IDENTIFICATION_FRAMEWORK",
            "type": "SDD_TEMPLATE",
            "id": "6"
        }
    ],
    "auditPayload": {
        "displayName": "Financial data identification framework",
        "classifiers": [
            {
                "overrides": {
                    "tags": [
                        {
                            "id": "1419",
                            "name": "Discovered.Entity.Age",
                            "type": "TAG",
                            "source": "curated"
                        }
                    ]
                },
                "name": "AGE"
            }
        ],
        "templateId": "6",
        "type": "SDDTemplateCreatedAuditPayload",
        "version": 1,
        "name": "FINANCIAL_DATA_IDENTIFICATION_FRAMEWORK",
        "description": "This framework should be used for financial data."
    },
    "eventTimestamp": "2023-12-08T19:02:42.029Z",
    "actor": {
        "type": "USER_ACTOR",
        "name": "Taylor Smith",
        "identityProvider": "bim",
        "profileId": "1",
        "id": "taylor@immuta.com"
    },
    "tenantId": "your-immuta-tenant.com",
    "action": "SDD_TEMPLATE_CREATED",
    "requestId": "00a895bb-4666-546d-97f7-ae1c2599345d",
    "receivedTimestamp": "2023-12-08T19:02:42.151Z",
    "id": "ee0e77db-8778-4953-a450-405ce909f309",
    "sessionId": "335ebcc37ceebd25abf64fbfa36746b5",
    "targetType": "SDD_TEMPLATE",
    "actionStatus": "SUCCESS",
    "actorIp": "xxx.xx.xx.xx"
}

SDDTemplateDeleted event

Event: SDDTemplateDeleted
Legacy event: sddTemplateDeleted
Description: An audit event for deleting an identification framework.

{
    "actorIp": "xxx.xx.xx.xx",
    "targetType": "SDD_TEMPLATE",
    "actionStatus": "SUCCESS",
    "sessionId": "f45fd5e9318a982c381e4ebb7734482e",
    "id": "2740601a-d60f-41d7-8b8e-2e72e13ef1c0",
    "receivedTimestamp": "2023-12-08T19:06:55.867Z",
    "requestId": "d534111e-9d78-54fa-862d-bcd9572a3367",
    "action": "SDD_TEMPLATE_DELETED",
    "tenantId": "your-immuta-tenant.com",
    "actor": {
        "id": "taylor@immuta.com",
        "profileId": "1",
        "identityProvider": "bim",
        "name": "Taylor Smith",
        "type": "USER_ACTOR"
    },
    "eventTimestamp": "2023-12-08T19:06:55.807Z",
    "auditPayload": {
        "name": "FINANCIAL_DATA_IDENTIFICATION_FRAMEWORK",
        "templateId": "6",
        "type": "SDDTemplateDeletedAuditPayload",
        "version": 1
    },
    "targets": [
        {
            "type": "SDD_TEMPLATE",
            "name": "FINANCIAL_DATA_IDENTIFICATION_FRAMEWORK",
            "id": "6"
        }
    ],
    "relatedResources": []
}

SDDTemplateUpdated event

Event: SDDTemplateUpdated
Legacy event: sddTemplateUpdated
Description: An audit event for updating an identification framework.

{
    "eventTimestamp": "2023-12-08T19:13:13.802Z",
    "auditPayload": {
        "name": "FINANCIAL_DATA_IDENTIFICATION_FRAMEWORK",
        "description": "This framework should be used for financial data.",
        "version": 1,
        "templateId": "7",
        "type": "SDDTemplateUpdatedAuditPayload",
        "displayName": "FINANCIAL_DATA_IDENTIFICATION_FRAMEWORK",
        "classifiers": [
            {
                "overrides": {
                    "tags": [
                        {
                            "id": "1419",
                            "name": "Discovered.Entity.Age",
                            "source": "curated",
                            "type": "TAG"
                        }
                    ]
                },
                "name": "AGE"
            }
        ]
    },
    "targets": [
        {
            "type": "SDD_TEMPLATE",
            "name": "FINANCIAL_DATA_IDENTIFICATION_FRAMEWORK",
            "id": "7"
        }
    ],
    "relatedResources": [],
    "action": "SDD_TEMPLATE_UPDATED",
    "tenantId": "your-immuta-tenant.com",
    "actor": {
        "id": "taylor@immuta.com",
        "profileId": "1",
        "identityProvider": "bim",
        "name": "Taylor Smith",
        "type": "USER_ACTOR"
    },
    "id": "e5174cfe-2870-49a7-b4e2-edcb120eedc0",
    "receivedTimestamp": "2023-12-08T19:13:13.876Z",
    "requestId": "3ae4e492-8e2e-512e-9ca4-8d3038ffb98a",
    "actorIp": "xxx.xx.xx.xx",
    "sessionId": "ee944851f853c79c0e3442fc0a938780",
    "targetType": "SDD_TEMPLATE",
    "actionStatus": "SUCCESS"
}

SubscriptionCreated event

Event: SubscriptionCreated
Legacy events: dataSourceSubscription and projectSubscription
Description: An audit event for subscribing a user to a data source or project.
Additional parameter details: auditPayload.modelType will specify whether the user was subscribed to a DATASOURCE or PROJECT.

{
    "actor": {
        "id": "taylor@immuta.com",
        "profileId": "1",
        "name": "Taylor Smith",
        "identityProvider": "bim",
        "type": "USER_ACTOR"
    },
    "actionStatus": "SUCCESS",
    "targetType": "SUBSCRIPTION",
    "tenantId": "your-immuta-tenant.com",
    "action": "CREATE",
    "relatedResources": [
        {
            "id": "9",
            "name": "Public case",
            "type": "DATASOURCE",
            "technology": "SNOWFLAKE"
        },
        {
            "type": "USER",
            "name": "Taylor Smith",
            "identityProvider": "bim",
            "profileId": "1",
            "id": "taylor@immuta.com"
        }
    ],
    "targets": [
        {
            "subscriber": {
                "type": "USER",
                "identityProvider": "bim",
                "name": "Taylor Smith",
                "profileId": "1",
                "id": "taylor@immuta.com"
            },
            "model": {
                "id": "9",
                "type": "DATASOURCE",
                "technology": "SNOWFLAKE",
                "name": "Public case"
            },
            "id": "13",
            "type": "SUBSCRIPTION",
            "name": "13"
        }
    ],
    "auditPayload": {
        "modelType": "DATASOURCE",
        "subscriberId": "1",
        "subscriberType": "USER",
        "modelId": "9",
        "role": "OWNER",
        "isEntitlementsPolicyOverride": false,
        "type": "SubscriptionCreatedAuditPayload",
        "status": "APPROVED"
    },
    "receivedTimestamp": "2023-04-14T16:48:21.198Z",
    "eventTimestamp": "2023-04-14T16:48:21.159Z",
    "id": "1a0f362a-f1fd-417e-85c6-0fa7751a887e"
}

SubscriptionDeleted event

Event: SubscriptionUpdated
Legacy events: dataSourceSubscription and projectSubscription
Description: An audit event for removing a user's subscription to a data source or project.
Additional parameter details: auditPayload.modelType will specify whether the user's subscription was removed from a DATASOURCE or PROJECT.

{
    "sessionId": "d8f9584665be06ae1a8e3b881c2eb635",
    "targetType": "SUBSCRIPTION",
    "actionStatus": "SUCCESS",
    "actorIp": "xxx.xx.xx.xx",
    "receivedTimestamp": "2023-04-28T17:25:15.268Z",
    "requestId": "495a22d6-bea0-5758-a8a3-7f5cc3d7b8d6",
    "id": "b6d2108e-fe93-4f05-a347-cb84c51fa528",
    "actor": {
        "id": "taylor@immuta.com",
        "identityProvider": "bim",
        "name": "Taylor Smith",
        "profileId": "1",
        "type": "USER_ACTOR"
    },
    "action": "DELETE",
    "tenantId": "your-immuta-tenant.com",
    "auditPayload": {
        "subscriptionId": "28",
        "subscriberType": "USER",
        "subscriberId": "20",
        "modelType": "DATASOURCE",
        "type": "SubscriptionDeletedAuditPayload",
        "modelId": "15",
        "denialReason": "Subscription policy removed"
    },
    "targets": [
        {
            "type": "SUBSCRIPTION",
            "name": "28",
            "subscriber": {
                "id": "taylor@immuta.com",
                "type": "USER",
                "identityProvider": "bim",
                "name": "Taylor Smith",
                "profileId": "20"
            },
            "model": {
                "id": "15",
                "name": "Public case",
                "technology": "DATABRICKS",
                "type": "DATASOURCE"
            },
            "id": "28"
        }
    ],
    "relatedResources": [
        {
            "type": "DATASOURCE",
            "technology": "DATABRICKS",
            "name": "Public case",
            "id": "15"
        },
        {
            "id": "taylor@immuta.com",
            "type": "USER",
            "profileId": "20",
            "name": "Taylor Smith",
            "identityProvider": "bim"
        }
    ],
    "eventTimestamp": "2023-04-28T17:25:14.837Z"
}

SubscriptionRequestApproved event

Event: SubscriptionUpdated
Legacy events: dataSourceSubscription and projectSubscription
Description: An audit event for a user's request to subscribe to a data source or project.
Additional parameter details: targets.model.type will specify whether the subscription was approved for a DATASOURCE or PROJECT.

{
    "id": "f6162acd-f66c-4316-8e55-92bc89f03ab0",
    "sessionId": "17c01a6d5413eadaa831a1ccec2ce823",
    "requestId": "201d39f9-44b2-5346-bd0b-ef587651e2ce",
    "action": "SUBSCRIPTION_REQUEST_APPROVE",
    "actionStatus": "SUCCESS",
    "actor": {
        "name": "Taylor Smith",
        "id": "taylor@immuta.com",
        "identityProvider": "bim",
        "profileId": "1",
        "type": "USER_ACTOR"
    },
    "actorIp": "xxx.xx.xx.xx",
    "tenantId": "your-immuta-tenant.com",
    "targetType": "SUBSCRIPTION",
    "targets": [
        {
            "type": "SUBSCRIPTION",
            "id": "10",
            "name": "10",
            "model": {
                "type": "DATASOURCE",
                "id": "8",
                "name": "Public case",
                "technology": "STARBURST_TRINO"
            },
            "subscriber": {
                "name": "Deepu Murty",
                "id": "deepu@immuta.com",
                "identityProvider": "bim",
                "profileId": "13",
                "type": "USER"
            }
        }
    ],
    "relatedResources": [
        {
            "type": "DATASOURCE",
            "id": "8",
            "name": "Public case",
            "technology": "STARBURST_TRINO"
        },
        {
            "name": "Deepu Murty",
            "id": "deepu@immuta.com",
            "identityProvider": "bim",
            "profileId": "13",
            "type": "USER"
        }
    ],
    "auditPayload": {
        "type": "SubscriptionRequestApprovedAuditPayload",
        "version": 1,
        "subscriptionId": "10",
        "status": "APPROVED",
        "approverPermissions": ["OWNER"]
    },
    "eventTimestamp": "2024-03-08T15:53:54.800Z",
    "receivedTimestamp": "2024-03-08T15:53:54.922Z"
}

SubscriptionRequestDenied event

Event: SubscriptionUpdated
Legacy events: dataSourceSubscription and projectSubscription
Description: An audit event for denying a user's request to subscribe to a data source or project.
Additional parameter details: auditPayload.modelType will specify whether the user's subscription was denied for a DATASOURCE or PROJECT.

{
    "targets": [
        {
            "type": "SUBSCRIPTION",
            "name": "127",
            "subscriber": {
                "profileId": "13",
                "identityProvider": "bim",
                "name": "Deepu Murty",
                "type": "USER",
                "id": "deepu@immuta.com"
            },
            "model": {
                "id": "1",
                "projectKey": "HR",
                "name": "HR",
                "type": "PROJECT"
            },
            "id": "127"
        }
    ],
    "relatedResources": [
        {
            "id": "1",
            "type": "PROJECT",
            "name": "HR",
            "projectKey": "HR"
        },
        {
            "profileId": "13",
            "identityProvider": "bim",
            "name": "Deepu Murty",
            "type": "USER",
            "id": "deepu@immuta.com"
        }
    ],
    "auditPayload": {
        "subscriberId": "13",
        "subscriberType": "USER",
        "subscriptionId": "127",
        "modelType": "PROJECT",
        "type": "SubscriptionRequestDeniedAuditPayload",
        "modelId": "1",
        "denialReason": "Not part of the appropriate department",
        "version": 1,
        "approverPermissions": ["OWNER"]
    },
    "eventTimestamp": "2024-02-23T19:53:09.004Z",
    "actor": {
        "type": "USER_ACTOR",
        "profileId": "1",
        "identityProvider": "bim",
        "name": "Taylor Smith",
        "id": "taylor@immuta.com"
    },
    "tenantId": "your-immuta-tenant.com",
    "action": "SUBSCRIPTION_REQUEST_DENY",
    "requestId": "fcaf22c8-82ad-58d6-9443-ade4863ee11e",
    "receivedTimestamp": "2024-02-23T19:53:09.153Z",
    "id": "a3ed191a-6e8b-4429-a596-cbe1263695c8",
    "sessionId": "9040b6cf4b2368534dab8735038453c7",
    "targetType": "SUBSCRIPTION",
    "actionStatus": "SUCCESS",
    "actorIp": "xxx.xx.xx.xx"
}

SubscriptionRequested event

Event: SubscriptionRequested
Legacy events: dataSourceSubscription and projectSubscription
Description: An audit event for a user requesting to subscribe to a data source or project.
Additional parameter details: auditPayload.modelType will specify whether the user requested to subscribe to a DATASOURCE or PROJECT.

{
    "auditPayload": {
        "status": "PENDING",
        "version": 1,
        "modelId": "75",
        "type": "SubscriptionRequestedAuditPayload",
        "modelType": "DATASOURCE",
        "subscriberType": "USER",
        "subscriberId": "13",
        "subscriptionId": "126"
    },
    "targets": [
        {
            "name": "Public case",
            "technology": "POSTGRESQL",
            "type": "DATASOURCE",
            "id": "75"
        }
    ],
    "relatedResources": [
        {
            "id": "126",
            "subscriber": {
                "type": "USER",
                "name": "Deepu Murty",
                "identityProvider": "bim",
                "profileId": "13",
                "id": "deepu@immuta.com"
            },
            "model": {
                "id": "75",
                "name": "Public case",
                "type": "DATASOURCE",
                "technology": "POSTGRESQL"
            },
            "name": "126",
            "type": "SUBSCRIPTION"
        },
        {
            "type": "USER",
            "profileId": "13",
            "identityProvider": "bim",
            "name": "Deepu Murty",
            "id": "deepu@immuta.com"
        }
    ],
    "eventTimestamp": "2024-02-23T19:51:24.669Z",
    "actor": {
        "type": "USER_ACTOR",
        "profileId": "13",
        "name": "Deepu Murty",
        "identityProvider": "bim",
        "id": "deepu@immuta.com"
    },
    "action": "SUBSCRIPTION_REQUESTED",
    "tenantId": "your-immuta-tenant.com",
    "receivedTimestamp": "2024-02-23T19:51:24.810Z",
    "requestId": "e1de955f-b233-5d37-a964-d5851b769dd4",
    "id": "8bd099da-2082-4447-aa9f-961319593a4c",
    "sessionId": "6ba328eafcbf736223a47b5ef3662f34",
    "targetType": "DATASOURCE",
    "actionStatus": "SUCCESS",
    "actorIp": "xxx.xx.xx.xx"
}

SubscriptionUpdated event

Event: SubscriptionUpdated
Legacy events: dataSourceSubscription and projectSubscription
Description: An audit event for a user subscribing to a data source or project.
Additional parameter details: targets.model.type will specify whether the subscription was updated on a DATASOURCE or PROJECT.

{
    "actor": {
        "type": "USER_ACTOR",
        "profileId": "1",
        "identityProvider": "bim",
        "name": "Taylor Smith",
        "id": "taylor@immuta.com"
    },
    "tenantId": "your-immuta-tenant.com",
    "action": "UPDATE",
    "relatedResources": [
        {
            "name": "Public case",
            "type": "DATASOURCE",
            "technology": "DATABRICKS",
            "id": "17"
        },
        {
            "name": "Deepu Murty",
            "identityProvider": "bim",
            "profileId": "999111223",
            "type": "USER",
            "id": "deepu@immuta.com"
        }
    ],
    "targets": [
        {
            "subscriber": {
                "name": "Deepu Murty",
                "identityProvider": "bim",
                "profileId": "999111223",
                "type": "USER",
                "id": "deepu@immuta.com"
            },
            "model": {
                "name": "Public case",
                "technology": "DATABRICKS",
                "type": "DATASOURCE",
                "id": "17"
            },
            "id": "64",
            "type": "SUBSCRIPTION",
            "name": "64"
        }
    ],
    "auditPayload": {
        "subscriptionId": "64",
        "role": "OWNER",
        "version": 1,
        "type": "SubscriptionUpdatedAuditPayload"
    },
    "eventTimestamp": "2023-05-16T20:24:04.360Z",
    "actionStatus": "SUCCESS",
    "targetType": "SUBSCRIPTION",
    "sessionId": "8c81a018617a6aa8501597dd2c57c9c6",
    "actorIp": "xxx.xx.xx.xx",
    "requestId": "b7a717f9-7187-5889-a715-2f00ab63b160",
    "receivedTimestamp": "2023-05-16T20:24:04.475Z",
    "id": "24f5184c-ee43-40d4-8606-7dabcfb9ce23"
}

TagApplied event

Event: TagApplied
Legacy event: tagAdded
Description: An audit event for applying a tag to an object in Immuta.

{
    "id": "b10a0dd9-1a09-4e93-a6cd-0cd232a275a0",
    "sessionId": "0fcaaf9c074330b4b875746c2e52739c",
    "requestId": "e45f1d89-69cf-5ae6-b33a-fbc94b147d7a",
    "action": "TAG_APPLY",
    "actionStatus": "SUCCESS",
    "actor": {
        "name": "Taylor Smith",
        "id": "taylor@immuta.com",
        "identityProvider": "bim",
        "profileId": "1",
        "type": "USER_ACTOR"
    },
    "actorIp": "xxx.xx.xx.xx",
    "tenantId": "your-immuta-tenant.com",
    "targetType": "DATASOURCE",
    "targets": [
        {
            "type": "DATASOURCE",
            "id": "27",
            "name": "Public case",
            "technology": "POSTGRESQL"
        }
    ],
    "relatedResources": [
        {
            "type": "TAG",
            "name": "Discovered",
            "id": "451",
            "source": "curated",
            "context": "manual"
        }
    ],
    "auditPayload": {
        "type": "TagAppliedAuditPayload",
        "version": 1,
        "appliedTags": [
            {
                "targetName": "Public case",
                "targetType": "DATASOURCE",
                "tags": [
                    {
                        "type": "TAG",
                        "name": "Discovered",
                        "id": "451",
                        "source": "curated",
                        "context": "manual"
                    }
                ]
            }
        ]
    },
    "eventTimestamp": "2024-02-22T14:39:01.342Z",
    "receivedTimestamp": "2024-02-22T14:39:01.514Z"
}

TagCreated event

Event: TagCreated
Legacy event: tagCreated
Description: An audit event for creating a tag in Immuta.

{
    "id": "7605ac37-fa98-4cf8-a736-cbed84af2d6c",
    "sessionId": "0fcaaf9c074330b4b875746c2e52739c",
    "requestId": "3a32672b-5b26-5e4b-914e-bb7217d02e43",
    "action": "CREATE",
    "actionStatus": "SUCCESS",
    "actor": {
        "name": "Taylor Smith",
        "id": "taylor@immuta.com",
        "identityProvider": "bim",
        "profileId": "1",
        "type": "USER_ACTOR"
    },
    "actorIp": "xxx.xx.xx.xx",
    "tenantId": "your-immuta-tenant.com",
    "targetType": "TAG",
    "targets": [
        {
            "type": "TAG",
            "name": "First name",
            "id": "452",
            "source": "curated"
        }
    ],
    "relatedResources": [],
    "auditPayload": {
        "type": "TagCreatedAuditPayload",
        "version": 1,
        "tags": [
            {
                "id": "452",
                "name": "First name",
                "source": "curated",
                "type": "TAG"
            }
        ]
    },
    "eventTimestamp": "2024-02-22T14:39:50.845Z",
    "receivedTimestamp": "2024-02-22T14:39:50.918Z"
}

TagDeleted event

Event: TagDeleted
Legacy event: tagDeleted
Description: An audit event for deleting a tag in Immuta.

{
    "id": "5e2e04df-0abb-4af9-bed6-a0b037777732",
    "sessionId": "0fcaaf9c074330b4b875746c2e52739c",
    "requestId": "de982c4f-ec8c-56e6-9d20-34fdcc2114f4",
    "action": "DELETE",
    "actionStatus": "SUCCESS",
    "actor": {
        "name": "Taylor Smith",
        "id": "taylor@immuta.com",
        "identityProvider": "bim",
        "profileId": "1",
        "type": "USER_ACTOR"
    },
    "actorIp": "xxx.xx.xx.xx,"
    "tenantId": "your-immuta-tenant.com",
    "targetType": "TAG",
    "targets": [
        {
            "type": "TAG",
            "name": "Last name",
            "id": "452",
            "source": "curated"
        }
    ],
    "relatedResources": [],
    "auditPayload": {
        "type": "TagDeletedAuditPayload",
        "version": 1,
        "name": "Last name",
        "deleteHierarchy": false,
        "tags": [
            {
                "id": "452",
                "name": "Last name",
                "source": "curated",
                "type": "TAG"
            }
        ]
    },
    "eventTimestamp": "2024-02-22T14:44:50.986Z",
    "receivedTimestamp": "2024-02-22T14:44:51.067Z"
}

TagRemoved event

Event: TagRemoved
Legacy event: tagRemoved
Description: An audit event for removing a tag from an object in Immuta.

{
    "id": "5a090fe2-382e-4e80-8b95-a9ed243da8f4",
    "sessionId": "0fcaaf9c074330b4b875746c2e52739c",
    "requestId": "509c475c-d00c-5895-af79-87563ed090ce",
    "action": "TAG_REMOVE",
    "actionStatus": "SUCCESS",
    "actor": {
        "name": "Taylor Smith",
        "id": "taylor@immuta.com",
        "identityProvider": "bim",
        "profileId": "1",
        "type": "USER_ACTOR"
    },
    "actorIp": "xxx.xx.xx.xx",
    "tenantId": "your-immuta-tenant.com",
    "targetType": "DATASOURCE",
    "targets": [
        {
            "type": "DATASOURCE",
            "id": "27",
            "name": "Public case",
            "technology": "POSTGRESQL"
        }
    ],
    "relatedResources": [
        {
            "type": "TAG",
            "name": "Discovered",
            "id": "1",
            "source": "curated"
        }
    ],
    "auditPayload": {
        "type": "TagRemovedAuditPayload",
        "version": 1,
        "removedTags": [
            {
                "targetName": "Public case",
                "targetType": "DATASOURCE",
                "tags": [
                    {
                        "type": "TAG",
                        "name": "Discovered",
                        "id": "1",
                        "source": "curated"
                    }
                ]
            }
        ]
    },
    "eventTimestamp": "2024-02-22T14:44:29.943Z",
    "receivedTimestamp": "2024-02-22T14:44:30.077Z"
}

TagUpdated event

Event: TagUpdated
Legacy event: tagUpdated
Description: An audit event for updating a tag in Immuta.

{
    "id": "cdc9d4f5-f960-487c-a5cf-22059492a806",
    "sessionId": "0fcaaf9c074330b4b875746c2e52739c",
    "requestId": "0a8e084f-354f-51b0-998d-e5aa0455b223",
    "action": "UPDATE",
    "actionStatus": "SUCCESS",
    "actor": {
        "name": "Taylor Smith",
        "id": "taylor@immuta.com",
        "identityProvider": "bim",
        "profileId": "1",
        "type": "USER_ACTOR"
    },
    "actorIp": "xxx.xx.xx.xx",
    "tenantId": "your-immuta-tenant.com",
    "targetType": "TAG",
    "targets": [
        {
            "type": "TAG",
            "name": "TestTagUpdate",
            "id": "452",
            "source": "curated"
        }
    ],
    "relatedResources": [],
    "auditPayload": {
        "type": "TagUpdatedAuditPayload",
        "version": 1,
        "rootTag": "First_name",
        "deleteHierarchy": false,
        "tags": [
            {
                "id": "452",
                "name": "First name",
                "source": "curated",
                "type": "TAG"
            }
        ]
    },
    "eventTimestamp": "2024-02-22T14:40:08.449Z",
    "receivedTimestamp": "2024-02-22T14:40:08.563Z"
}

UserAuthenticated event

Event: UserAuthenticated
Legacy event: authenticate
Description: An audit event for a user authenticating in Immuta.
Additional parameter details: authenticationMethod possible values include
- OAuth: The user authenticated using the 3rd party authentication OAuth.
- OpenId: The user authenticated using the 3rd party authentication OpenId.
- SAML: The user authenticated using the 3rd party authentication SAML.
- apiKey: The user authenticated or impersonated using an API key.
- password: The user authenticated with username and password.

{
    "requestId": "0aaf4825-f245-582a-935d-312b15adbf3e",
    "auditPayload": {
        "type": "UserAuthenticatedAuditPayload",
        "authenticationMethod": "apiKey"
    },
    "action": "AUTHENTICATE",
    "actor": {
        "id": "postgres_system",
        "name": "Immuta System Account",
        "type": "SYSTEM_ACCOUNT"
    },
    "targetType": "USER",
    "relatedResources": [],
    "eventTimestamp": "2023-03-03T01:47:36.225Z",
    "actionStatus": "SUCCESS",
    "receivedTimestamp": "2023-03-03T01:47:36.319Z",
    "tenantId": "your-immuta-tenant.com",
    "targets": [],
    "actorIp": "xxx.xx.xx.xx",
    "id": "5683bb3d-226a-4140-b3d9-2c3db22cf1fb",
    "sessionId": "73396d16b9330d28a68dbf171948ace3"
}

UserCloned event

Event: UserCloned
Legacy event: accessUser
Description: An audit event for creating a new user in Immuta by cloning an existing user.

{
    "id": "8f64a4e9-cfae-4166-94a0-3899d6d6fbf5",
    "sessionId": "efb381c4e05844332a87ae265c3225dc",
    "requestId": "243bf98c-bb2e-58b7-8842-1d997137cccb",
    "action": "CLONE",
    "actionStatus": "SUCCESS",
    "actor": {
        "name": "Taylor Smith",
        "id": "taylor@immuta.com",
        "identityProvider": "bim",
        "profileId": "1",
        "type": "USER_ACTOR"
    },
    "actorIp": "xxx.xx.xx.xx",
    "tenantId": "your-immuta-tenant.com",
    "targetType": "USER",
    "targets": [
        {
            "name": "Clone of taylor@immuta.com (awaiting first login)",
            "id": "clonetaylor@immuta.com",
            "identityProvider": "bim",
            "profileId": "999111236",
            "type": "USER"
        },
        {
            "name": "Clone of taylor@immuta.com (awaiting first login)",
            "id": "clone2taylor@immuta.com",
            "identityProvider": "bim",
            "profileId": "999111237",
            "type": "USER"
        }
    ],
    "relatedResources": [
        {
            "name": "Taylor Smith",
            "id": "taylor@immuta.com",
            "identityProvider": "bim",
            "profileId": "999111228",
            "type": "USER"
        }
    ],
    "auditPayload": {
        "type": "UserClonedAuditPayload",
        "version": 1,
        "failedUserIds": [],
        "newUserIds": ["clonetaylor@immuta.com", "clone2taylor@immuta.com"],
        "clonedUserId": "testuser1@localhost.fake",
        "clonedUserIamProvider": "bim"
    },
    "eventTimestamp": "2024-01-05T19:07:29.141Z",
    "receivedTimestamp": "2024-01-05T19:07:29.364Z"
}

UserCreated event

Event: UserCreated
Legacy event: accessUser
Description: An audit event for creating a new user in Immuta.

{
    "id": "f6d2443e-1a08-4e38-8a4b-ec938334e217",
    "action": "CREATE",
    "actionStatus": "SUCCESS",
    "actor": {
        "name": "Immuta System Account",
        "id": "immuta_system_account",
        "type": "SYSTEM_ACCOUNT"
    },
    "tenantId": "your-immuta-tenant.com",
    "targetType": "USER",
    "targets": [
        {
            "name": "Deepu Murty",
            "id": "deepu@immuta.com",
            "identityProvider": "okta",
            "profileId": "999111251",
            "type": "USER"
        }
    ],
    "relatedResources": [],
    "auditPayload": {
        "type": "UserCreatedAuditPayload",
        "version": 1,
        "name": "Deepu Murty",
        "email": "deepu@immuta.com"
    },
    "eventTimestamp": "2024-02-01T13:16:26.541Z",
    "receivedTimestamp": "2024-02-01T13:16:26.564Z"
}

UserDeleted event

Event: UserDeleted
Legacy event: accessUser
Description: An audit event for deleting a user in Immuta.

{
    "id": "5e359dbf-414e-4bc2-90fe-66534d728a02",
    "sessionId": "fc63e473565c823682f2b1a517c71355",
    "requestId": "610ff95c-dfc1-5ac0-a1a7-07a065c13c48",
    "action": "DELETE",
    "actionStatus": "SUCCESS",
    "actor": {
        "name": "Taylor Smith",
        "id": "taylor@immuta.com",
        "identityProvider": "bim",
        "profileId": "1",
        "type": "USER_ACTOR"
    },
    "actorIp": "xxx.xx.xx.xx",
    "tenantId": "your-immuta-tenant.com",
    "targetType": "USER",
    "targets": [],
    "relatedResources": [],
    "auditPayload": {
        "type": "UserDeletedAuditPayload",
        "version": 1,
        "userId": "deepu@immuta.com",
        "userIdProvider": "okta"
    },
    "eventTimestamp": "2024-01-31T15:41:25.000Z",
    "receivedTimestamp": "2024-01-31T15:41:27.150Z"
}

UserLogout event

Event: UserLogout
Legacy events: None
Description: An audit event for a user logging out of Immuta.
Additional parameter details:
- authenticationMethod possible values include
  - OAuth: The user authenticated using the 3rd party authentication OAuth.
  - OpenId: The user authenticated using the 3rd party authentication OpenId.
  - SAML: The user authenticated using the 3rd party authentication SAML.
  - apiKey: The user authenticated or impersonated using an API key.
  - password: The user authenticated with username and password.
- logoutReason possible values include
  - EXPIRATION: The user was logged out because the token expired.
  - IDP_INITIATED: The IdP initiated the logout.
  - USER_LOGOUT_TRIGGERED: The user manually logged out.

{
    "sessionId": "0d8de090f542620a09cc0bf2cd103371",
    "id": "bd7713b7-a40a-4905-a5cf-68df2ed10c58",
    "actionStatusReason": null,
    "actorIp": "xxx.xx.xx.xx",
    "targets": [
        {
            "name": "Taylor Smith",
            "id": "taylor@immuta.com",
            "profileId": "1",
            "type": "USER",
            "identityProvider": "bim"
        }
    ],
    "tenantId": "your-immuta-tenant.com",
    "receivedTimestamp": "2024-02-08T15:51:54.660Z",
    "actionStatus": "SUCCESS",
    "relatedResources": [],
    "eventTimestamp": "2022-07-28T03:52:03.790Z",
    "targetType": "USER",
    "actor": {
        "type": "USER_ACTOR",
        "identityProvider": "bim",
        "name": "Taylor Smith",
        "id": "taylor@immuta.com",
        "profileId": "1"
    },
    "action": "LOGOUT",
    "auditPayload": {
        "logoutReason": "EXPIRATION",
        "authenticationMethod": "password",
        "impersonatedId": "taylor@immuta.com",
        "impersonatedIdProvider": "bim",
        "type": "UserLogoutAuditPayload",
        "version": 1
    },
    "requestId": "myRequestId"
}

UserOneTimeTokenCreated event

Event: UserOneTimeTokenCreated
Legacy event: accessUser
Description: An audit event for creating a single use login token for a user.

{
    "id": "8ddf5e1e-637f-444b-9575-7ef0cd135136",
    "sessionId": "aadf12cfbd5af292da1075f83b97716d",
    "requestId": "76b6cc50-532f-5bfc-8d71-f19befd0e93e",
    "action": "NEW_TOKEN",
    "actionStatus": "SUCCESS",
    "actor": {
        "name": "Taylor Smith",
        "id": "taylor@immuta.com",
        "identityProvider": "bim",
        "profileId": "1",
        "type": "USER_ACTOR"
    },
    "actorIp": "xxx.xx.xx.xx",
    "tenantId": "your-immuta-tenant.com",
    "targetType": "USER",
    "targets": [
        {
            "name": "Deepu Murty",
            "id": "deepu@immuta.com",
            "identityProvider": "bim",
            "profileId": "999111235",
            "type": "USER"
        }
    ],
    "relatedResources": [],
    "auditPayload": {
        "type": "UserOneTimeTokenCreatedAuditPayload",
        "version": 1
    },
    "eventTimestamp": "2024-01-22T19:57:56.319Z",
    "receivedTimestamp": "2024-01-22T19:57:56.394Z"
}

UserPasswordUpdated event

Event: UserPasswordUpdated
Legacy event: accessUser
Description: An audit event for updating a user's Immuta password.

{
    "actor": {
        "type": "USER_ACTOR",
        "id": "taylor@immuta.com",
        "name": "Taylor Smith",
        "identityProvider": "bim",
        "profileId": "1"
    },
    "sessionId": "8aa5dfb94afa9bde135f6208f5290ca1",
    "requestId": "77e80707-f5c8-5238-bf70-bd71c81200e8",
    "actionStatus": "SUCCESS",
    "actorIp": "xxx.xx.xx.xx",
    "eventTimestamp": "2023-12-22T21:27:51.255Z",
    "id": "bd6b42e9-61c1-4ea0-a19a-ec38163a85a2",
    "tenantId": "your-immuta-tenant.com",
    "targets": [
        {
            "type": "USER",
            "id": "deepu@immuta.com",
            "name": "Deepu Murty",
            "identityProvider": "bim",
            "profileId": "999111226"
        }
    ],
    "action": "PASSWORD_UPDATE",
    "auditPayload": {
        "type": "UserPasswordUpdatedAuditPayload",
        "version": 1
    },
    "targetType": "USER",
    "relatedResources": [],
    "receivedTimestamp": "2023-12-22T21:27:51.394Z"
}

UserUpdated event

Event: UserUpdated
Legacy event: externalUserIdChanged
Description: An audit event for updating user details in Immuta.

{
    "id": "94179969-7dae-4b1c-a14f-de80573f841a",
    "sessionId": "b2b2ab5eabaac606e171fdcc3a042c32",
    "requestId": "d3b7e572-8c5f-535d-be51-3715fa181160",
    "action": "UPDATE",
    "actionStatus": "SUCCESS",
    "actor": {
        "name": "Taylor Smith",
        "id": "taylor@immuta.com",
        "identityProvider": "bim",
        "profileId": "1",
        "type": "USER_ACTOR"
    },
    "actorIp": "xxx.xx.xx.xx",
    "tenantId": "your-immuta-tenant.com",
    "targetType": "USER",
    "targets": [
        {
            "name": "Deepu Murty",
            "id": "deepu@immuta.com",
            "identityProvider": "bim",
            "profileId": "6",
            "type": "USER"
        }
    ],
    "relatedResources": [],
    "auditPayload": {
        "type": "UserUpdatedAuditPayload",
        "version": 1,
        "userId": "deepu@immuta.com",
        "userIdProvider": "bim",
        "externalUserIds": [],
        "disabled": false
    },
    "eventTimestamp": "2024-02-08T15:46:25.949Z",
    "receivedTimestamp": "2024-02-08T15:46:26.167Z"
}

WebhookCreated event

Event: WebhookCreated
Legacy event: webhookCreate
Description: An audit event for creating an Immuta webhook.

{
    "targets": [
        {
            "name": "ProjectCreateMonitorHook",
            "type": "WEBHOOK",
            "id": "12"
        }
    ],
    "actionStatus": "SUCCESS",
    "receivedTimestamp": "2023-10-19T14:15:38.160Z",
    "actorIp": "xxx.xx.xx.xx",
    "id": "5faed0d0-ff64-4c86-87eb-193c04d6e5f2",
    "auditPayload": {
        "type": "WebhookCreatedAuditPayload",
        "version": 1,
        "webhooks": [
            {
                "id": "12",
                "name": "ProjectCreateMonitorHook",
                "actionType": "TRIGGERED",
                "global": false,
                "url": "https://hooks.slack.com/triggers/your-id",
                "notificationType": [
                    "projectUpdated"
                ]
            }
        ]
    },
    "requestId": "6cfccb1c-e828-5b4b-a971-e7a02bb0aea7",
    "relatedResources": [],
    "action": "CREATE",
    "tenantId": "your-immuta-tenant.com",
    "targetType": "WEBHOOK",
    "actor": {
        "identityProvider": "bim",
        "name": "Taylor Smith",
        "type": "USER_ACTOR",
        "profileId": "1",
        "id": "taylor@immuta.com"
    },
    "eventTimestamp": "2023-10-19T14:15:38.074Z",
    "sessionId": "f29b217886b7c5fd0efee59d5f53b866"
}

WebhookDeleted event

Event: WebhookDeleted
Legacy event: webhookDelete
Description: An audit event for deleting an Immuta webhook.

{
    "id": "0f89c84c-ce64-49e7-a08e-8cac34b5b820",
    "actorIp": "xxx.xx.xx.xx",
    "auditPayload": {
        "name": "ProjectCreateMonitorHook",
        "webhookId": "12",
        "type": "WebhookDeletedAuditPayload",
        "version": 1
    },
    "targets": [
        {
            "id": "12",
            "name": "ProjectCreateMonitorHook",
            "type": "WEBHOOK"
        }
    ],
    "actionStatus": "SUCCESS",
    "receivedTimestamp": "2023-10-19T14:20:50.152Z",
    "tenantId": "your-immuta-tenant.com",
    "targetType": "WEBHOOK",
    "actor": {
        "id": "taylor@immuta.com",
        "profileId": "1",
        "type": "USER_ACTOR",
        "name": "Taylor Smith",
        "identityProvider": "bim"
    },
    "sessionId": "302c4af6b147b6bfe8bed550030f6594",
    "eventTimestamp": "2023-10-19T14:20:50.077Z",
    "requestId": "ffe61b45-cb8b-5a96-83cb-5d366c735558",
    "action": "DELETE",
    "relatedResources": []
}

Deprecated events

blobDelete
blobFetch
blobIndex
blobUpdateFeatures
blobUpdateTags
blobVisibility
checkPendingRequest
dataSourceExpired
dataSourceTestQuery
dictionaryCreate
dictionaryDelete
dictionaryUpdate
driverUpload
featureList
governanceUpdate
policyExemption
policyExport
policyImport
queryDebugRequest
sqlAccess
sqlCreateUser
sqlDeleteUser
sqlResetPassword
sqlQuery