Universal audit model (UAM) is Immuta's consistent structure for all Immuta system and user query audit logs. This reference guide maps the legacy audit events to the new UAM events and provides example schemas of all the UAM events available in Immuta.
To learn more about Immuta's audit, see the UAM reference page .
Events and descriptions
ApiKeyCreated event
Description : An audit event for when an API key is created on the Immuta app settings page or from an Immuta user's profile page.
Copy {
"relatedResources" : [] ,
"auditPayload" : {
"type" : "ApiKeyCreatedAuditPayload" ,
"apiKeyId" : "1112158" ,
"name" : "T1" ,
"version" : 1
} ,
"action" : "CREATE" ,
"tenantId" : "your-immuta-tenant.com" ,
"actionStatus" : "SUCCESS" ,
"eventTimestamp" : "2024-01-25T18:04:58.368Z" ,
"actor" : {
"id" : "taylor@immuta.com" ,
"identityProvider" : "bim" ,
"profileId" : "1" ,
"type" : "USER_ACTOR" ,
"name" : "Taylor Smith"
} ,
"targetType" : "APIKEY" ,
"id" : "d9dc3cee-98d0-47d6-ba81-e0b38f9f4014" ,
"receivedTimestamp" : "2024-01-25T18:04:58.505Z" ,
"actorIp" : "xxx.xx.xx.xx" ,
"targets" : [] ,
"requestId" : "60c68659-ac83-5299-bf3e-14856178a0de" ,
"sessionId" : "9c553d7ace0aa3ee735fd3c14f737bc6"
}
ApiKeyDeleted event
Description : An audit event for when an API key is deleted on the Immuta app settings page or from an Immuta user's profile page.
Copy {
"id" : "fe47ddd1-fd22-4dcf-9648-83950a10ef34" ,
"targetType" : "APIKEY" ,
"receivedTimestamp" : "2024-01-25T18:08:28.891Z" ,
"actor" : {
"type" : "USER_ACTOR" ,
"identityProvider" : "bim" ,
"id" : "taylor@immuta.com" ,
"profileId" : "1" ,
"name" : "Taylor Smith"
} ,
"requestId" : "220c7faa-7f56-5d8c-aa31-8ac2212b7707" ,
"sessionId" : "9c553d7ace0aa3ee735fd3c14f737bc6" ,
"targets" : [] ,
"actorIp" : "xxx.xx.xx.xx" ,
"relatedResources" : [] ,
"auditPayload" : {
"type" : "ApiKeyDeletedAuditPayload" ,
"apiKeyId" : "1112158" ,
"version" : 1
} ,
"eventTimestamp" : "2024-01-25T18:08:21.319Z" ,
"action" : "DELETE" ,
"actionStatus" : "SUCCESS" ,
"tenantId" : "your-immuta-tenant.com"
}
AttributeApplied event
Legacy events : accessUser
and accessGroup
Description : An audit event for an attribute applied to a group or user.
Additional parameter details : targetType
will specify whether the attribute was added to a USER
or GROUP
.
Copy {
"actorIp" : "xxx.xx.xx.xx" ,
"targets" : [
{
"name" : "Deepu Murty" ,
"id" : "deepu@immuta.com" ,
"identityProvider" : "bim" ,
"profileId" : "20" ,
"type" : "USER"
}
] ,
"requestId" : "e45652cd-4d00-5def-8e8c-aca696822fc2" ,
"sessionId" : "cdbffff8804103418350947c6586712c" ,
"actor" : {
"type" : "USER_ACTOR" ,
"profileId" : "1" ,
"id" : "taylor@immuta.com" ,
"identityProvider" : "bim" ,
"name" : "Taylor Smith"
} ,
"id" : "63f111a7-0835-4696-8fdb-188130c44fac" ,
"targetType" : "USER" ,
"receivedTimestamp" : "2023-09-13T14:36:02.926Z" ,
"action" : "ATTRIBUTE_APPLY" ,
"tenantId" : "your-immuta-tenant.com" ,
"actionStatus" : "SUCCESS" ,
"eventTimestamp" : "2023-09-13T14:36:02.688Z" ,
"relatedResources" : [
{
"values" : [ "Product" ] ,
"name" : "Department" ,
"id" : "department" ,
"type" : "ATTRIBUTE"
}
] ,
"auditPayload" : {
"entityType" : "USER" ,
"type" : "AttributeAppliedAuditPayload" ,
"version" : 1 ,
"attributes" : [
{
"values" : [ "Product" ] ,
"attribute" : "Department"
}
] ,
"entityIdProvider" : "bim" ,
"entityId" : "deepu@immuta.com"
}
}
AttributeRemoved event
Legacy events : accessUser
and accessGroup
Description : An audit event for an attribute removed from a group or user.
Additional parameter details : targetType
will specify whether the attribute was removed from a USER
or GROUP
.
Copy {
"relatedResources" : [
{
"values" : [ "UNCLASSIFIED" ] ,
"name" : "classification" ,
"id" : "classification" ,
"type" : "ATTRIBUTE"
}
] ,
"auditPayload" : {
"type" : "AttributeRemovedAuditPayload" ,
"entityType" : "USER" ,
"version" : 1 ,
"attributes" : [
{
"values" : [ "UNCLASSIFIED" ] ,
"attribute" : "classification"
}
] ,
"entityIdProvider" : "bim" ,
"entityId" : "deepu@immuta.com"
} ,
"action" : "ATTRIBUTE_REMOVE" ,
"actionStatus" : "SUCCESS" ,
"tenantId" : "your-immuta-tenant.com" ,
"eventTimestamp" : "2024-02-20T19:46:50.259Z" ,
"actor" : {
"profileId" : "1" ,
"id" : "taylor@immuta.com" ,
"identityProvider" : "bim" ,
"type" : "USER_ACTOR" ,
"name" : "Taylor Smith"
} ,
"id" : "0fd77c61-f08a-488c-9d10-c356ffea0d11" ,
"targetType" : "USER" ,
"receivedTimestamp" : "2024-02-20T19:46:50.426Z" ,
"targets" : [
{
"name" : "Deepu Murty" ,
"type" : "USER" ,
"id" : "deepu@immuta.com" ,
"identityProvider" : "bim" ,
"profileId" : "20"
}
] ,
"actorIp" : "xxx.xx.xx.xx" ,
"requestId" : "146ec771-ec2e-5f40-8551-1dbc38e64078" ,
"sessionId" : "893db38b8f1977fda75f60d168c4e74e"
}
ConfigurationUpdated event
Event : ConfigurationUpdated
Legacy event : configurationUpdate
Description : An audit event for updates to the configuration on the Immuta app settings page.
Copy {
"eventTimestamp" : "2023-12-04T18:38:25.801Z" ,
"tenantId" : "your-immuta-tenant.com" ,
"actionStatus" : "SUCCESS" ,
"action" : "CONFIGURATION_UPDATED" ,
"auditPayload" : {
"version" : 1 ,
"type" : "ConfigurationUpdatedAuditPayload" ,
"changeSet" : {
"plugins" : {
"policy" : {
"approveToPromote" : {
"requiredApprovalCount" : [
{
"newValue" : 1 ,
"oldValue" : 2
}
]
}
}
}
} ,
"configurationId" : "20"
} ,
"relatedResources" : [] ,
"sessionId" : "aed83ab8b46affcb1169532dada92b72" ,
"requestId" : "c80f510f-3f55-5450-8dea-d5e243708686" ,
"targets" : [
{
"name" : "20" ,
"type" : "CONFIGURATION" ,
"id" : "20"
}
] ,
"actorIp" : "xxx.xx.xx.xx" ,
"receivedTimestamp" : "2023-12-04T18:38:26.039Z" ,
"id" : "3989e233-c791-43e9-813f-7738f4c8e26b" ,
"targetType" : "CONFIGURATION" ,
"actor" : {
"identityProvider" : "bim" ,
"id" : "taylor@immuta.com" ,
"profileId" : "1" ,
"type" : "USER_ACTOR" ,
"name" : "Taylor Smith"
}
}
DatasourceAppliedToProject event
Event : DatasourceAppliedToProject
Legacy event : addToProject
Description : An audit event for adding a data source to an Immuta project.
Copy {
"auditPayload" : {
"type" : "DatasourceAppliedToProjectAuditPayload" ,
"errors" : [] ,
"projectId" : "2" ,
"version" : 1 ,
"datasources" : [
{
"id" : "2" ,
"name" : "Public Case"
}
]
} ,
"sessionId" : "6b928653b1411078647a2764a72beca6" ,
"targets" : [
{
"projectKey" : "HumanResources" ,
"id" : "2" ,
"type" : "PROJECT" ,
"name" : "Human Resources"
}
] ,
"action" : "DATASOURCE_APPLY" ,
"id" : "8106b44f-cf56-4ca2-a111-641d0e80e6ff" ,
"targetType" : "PROJECT" ,
"actionStatus" : "SUCCESS" ,
"relatedResources" : [
{
"id" : "2" ,
"technology" : "SNOWFLAKE" ,
"type" : "DATASOURCE" ,
"name" : "Public Case"
}
] ,
"actor" : {
"id" : "taylor@immuta.com" ,
"profileId" : "1" ,
"name" : "Taylor Smith" ,
"identityProvider" : "bim" ,
"type" : "USER_ACTOR"
} ,
"eventTimestamp" : "2023-10-13T14:08:20.427Z" ,
"actorIp" : "xxx.xx.xx.xx" ,
"requestId" : "8823f3f0-4e46-590c-bbb2-209cce750ff9" ,
"tenantId" : "your-immuta-tenant.com" ,
"receivedTimestamp" : "2023-10-13T14:08:20.660Z"
}
DatasourceCatalogSynced event
Event : DatasourceCatalogSynced
Legacy event : catalogUpdate
Description : An audit event for syncing an external catalog to tag Immuta data sources.
Copy {
"tenantId" : "your-immuta-tenant.com" ,
"action" : "CATALOG_SYNC" ,
"actor" : {
"type" : "USER_ACTOR" ,
"identityProvider" : "bim" ,
"name" : "Taylor Smith" ,
"profileId" : "1" ,
"id" : "taylor@immuta.com"
} ,
"targetType" : "DATASOURCE" ,
"actionStatus" : "SUCCESS" ,
"eventTimestamp" : "2023-04-14T16:48:21.159Z" ,
"id" : "159d4299-fca5-47cb-aa6b-81d93bafa526" ,
"targets" : [
{
"id" : "9" ,
"name" : "Public case" ,
"technology" : "SNOWFLAKE" ,
"type" : "DATASOURCE"
}
] ,
"relatedResources" : [] ,
"receivedTimestamp" : "2023-04-14T16:48:21.209Z" ,
"auditPayload" : {
"datasourceId" : "9" ,
"changes" : {
"before" : {
"catalogId" : null ,
"documentation" : null ,
"dictionary" : [
{
"tags" : [] ,
"columnName" : "country"
} ,
{
"columnName" : "date" ,
"tags" : []
} ,
{
"tags" : [] ,
"columnName" : "fastest_qualifying"
} ,
{
"columnName" : "location" ,
"tags" : []
} ,
{
"columnName" : "round" ,
"tags" : []
} ,
{
"columnName" : "winning_aircraft" ,
"tags" : []
} ,
{
"tags" : [] ,
"columnName" : "winning_pilot"
}
] ,
"tableTags" : null ,
"description" : null
} ,
"after" : {
"description" : "" ,
"tableTags" : null ,
"dictionary" : [
{
"columnName" : "country" ,
"description" : "" ,
"tags" : []
} ,
{
"tags" : [] ,
"description" : "" ,
"columnName" : "date"
} ,
{
"tags" : [] ,
"columnName" : "fastest_qualifying" ,
"description" : ""
} ,
{
"tags" : [] ,
"columnName" : "location" ,
"description" : ""
} ,
{
"columnName" : "round" ,
"description" : "" ,
"tags" : []
} ,
{
"tags" : [] ,
"description" : "" ,
"columnName" : "winning_aircraft"
} ,
{
"columnName" : "winning_pilot" ,
"description" : "" ,
"tags" : []
}
] ,
"catalogId" : "immuta-product_engineering"
}
} ,
"type" : "DatasourceCatalogSyncedAuditPayload"
}
}
DatasourceCreated event
Legacy event : dataSourceCreate
Description : An audit event for registering a table as an Immuta data source.
Copy {
"id" : "dc0b7313-ecc9-42f1-ba33-df0a1a753c08" ,
"action" : "CREATE" ,
"actionStatus" : "SUCCESS" ,
"actor" : {
"name" : "Taylor Smith" ,
"id" : "taylor@immuta.com" ,
"identityProvider" : "bim" ,
"profileId" : "1" ,
"type" : "USER_ACTOR"
} ,
"tenantId" : "your-immuta-tenant.com" ,
"targetType" : "DATASOURCE" ,
"targets" : [
{
"type" : "DATASOURCE" ,
"id" : "102" ,
"name" : "Pgboss Job" ,
"technology" : "POSTGRESQL"
}
] ,
"relatedResources" : [
{
"type" : "CONNECTION" ,
"id" : "4" ,
"name" : "data-source-connection-name" ,
"connectionKey" : "data-source-connection-key"
}
] ,
"auditPayload" : {
"type" : "DatasourceCreatedAuditPayload" ,
"version" : 1 ,
"description" : null ,
"documentation" : null ,
"expiration" : null ,
"columnDetectionEnabled" : true ,
"disabled" : false ,
"technology" : "POSTGRESQL" ,
"connectionId" : "4" ,
"table" : "job" ,
"schema" : "pgboss" ,
"sensitiveDataDiscoveryEnabled" : true
} ,
"eventTimestamp" : "2024-02-22T13:59:04.681Z" ,
"receivedTimestamp" : "2024-02-22T13:59:04.715Z"
}
DatasourceDeleted event
Legacy event : dataSourceDelete
Description : An audit event for deleting a data source in Immuta.
Copy {
"id" : "1403b675-70f6-4833-ab4c-a7486c63f494" ,
"action" : "DELETE" ,
"actionStatus" : "SUCCESS" ,
"actor" : {
"name" : "Taylor Smith" ,
"id" : "taylor@immuta.com" ,
"identityProvider" : "bim" ,
"profileId" : "1" ,
"type" : "USER_ACTOR"
} ,
"tenantId" : "your-immuta-tenant.com" ,
"targetType" : "DATASOURCE" ,
"targets" : [
{
"type" : "DATASOURCE" ,
"id" : "93" ,
"name" : "Audit" ,
"technology" : "POSTGRESQL"
}
] ,
"relatedResources" : [] ,
"auditPayload" : {
"type" : "DatasourceDeletedAuditPayload" ,
"version" : 1 ,
"datasourceId" : "93" ,
"name" : "Audit" ,
"technology" : "POSTGRESQL"
} ,
"eventTimestamp" : "2024-02-22T14:20:42.379Z" ,
"receivedTimestamp" : "2024-02-22T14:20:42.392Z"
}
DatasourceDisabled event
Event : DatasourceDisabled
Description : An audit event for disabling a data source in Immuta.
Copy {
"id" : "a09b9bc3-3775-4496-87ec-b808cf649794" ,
"sessionId" : "0fcaaf9c074330b4b875746c2e52739c" ,
"requestId" : "153fe145-32a0-5c33-930d-c571c1d7748d" ,
"action" : "DISABLE" ,
"actionStatus" : "SUCCESS" ,
"actor" : {
"name" : "Taylor Smith" ,
"id" : "taylor@immuta.com" ,
"identityProvider" : "bim" ,
"profileId" : "1" ,
"type" : "USER_ACTOR"
} ,
"actorIp" : "xxx.xx.xx.xx" ,
"tenantId" : "your-immuta-tenant.com" ,
"targetType" : "DATASOURCE" ,
"targets" : [
{
"type" : "DATASOURCE" ,
"id" : "57" ,
"name" : "Activity" ,
"technology" : "POSTGRESQL"
}
] ,
"relatedResources" : [] ,
"auditPayload" : {
"type" : "DatasourceDisabledAuditPayload" ,
"version" : 1 ,
"datasourceId" : "57" ,
"name" : "Activity" ,
"technology" : "POSTGRESQL"
} ,
"eventTimestamp" : "2024-02-22T14:22:20.039Z" ,
"receivedTimestamp" : "2024-02-22T14:22:20.183Z"
}
DatasourceGlobalPolicyApplied event
Event : DatasourceGlobalPolicyApplied
Legacy event : globalPolicyApplied
Description : An audit event for applying a global policy to a data source.
Copy {
"receivedTimestamp" : "2023-10-24T18:06:27.645Z" ,
"auditPayload" : {
"conflict" : null ,
"version" : 1 ,
"policy" : {
"actions" : [
{
"dataPolicyType" : "MASKING" ,
"rules" : [
{
"exceptions" : null ,
"type" : "MASKING_HASH" ,
"fields" : [ "AWARD_ID" ] ,
"ruleAppliedForUser" : false
}
] ,
"type" : "DATA" ,
"global" : false ,
"rationale" : null
}
] ,
"type" : "DATA"
} ,
"type" : "DatasourceGlobalPolicyAppliedAuditPayload"
} ,
"relatedResources" : [
{
"policyKey" : "Mask PII" ,
"name" : "Mask PII" ,
"type" : "GLOBAL_POLICY" ,
"id" : "7"
}
] ,
"id" : "7f57d63a-5db8-412a-ad93-c6baa61384b3" ,
"targetType" : "DATASOURCE" ,
"actor" : {
"profileId" : "1" ,
"identityProvider" : "bim" ,
"id" : "taylor@immuta.com" ,
"type" : "USER_ACTOR" ,
"name" : "Taylor Smith"
} ,
"eventTimestamp" : "2023-10-24T18:06:27.617Z" ,
"tenantId" : "your-immuta-tenant.com" ,
"actionStatus" : "SUCCESS" ,
"targets" : [
{
"id" : "47" ,
"type" : "DATASOURCE" ,
"technology" : "SNOWFLAKE" ,
"name" : "Public case"
}
] ,
"action" : "POLICY_APPLIED"
}
DatasourceGlobalPolicyConflictResolved event
Event : DatasourceGlobalPolicyConflictResolved
Legacy event : globalPolicyConflictResolved
Description : An audit event for a global policy conflict being resolved on a data source.
Copy {
"actor" : {
"name" : "Taylor Smith" ,
"profileId" : "1" ,
"identityProvider" : "bim" ,
"id" : "taylor@immuta.com" ,
"type" : "USER_ACTOR"
} ,
"id" : "ac9c699a-aad0-4899-964c-279cd7eba125" ,
"targetType" : "DATASOURCE" ,
"relatedResources" : [] ,
"auditPayload" : {
"type" : "DatasourceGlobalPolicyConflictResolvedAuditPayload" ,
"version" : 1
} ,
"receivedTimestamp" : "2023-10-24T18:34:04.330Z" ,
"action" : "POLICY_CONFLICT_RESOLVED" ,
"targets" : [
{
"name" : "Public case" ,
"technology" : "SNOWFLAKE" ,
"id" : "47" ,
"type" : "DATASOURCE"
}
] ,
"actionStatus" : "SUCCESS" ,
"tenantId" : "your-immuta-tenant.com" ,
"eventTimestamp" : "2023-10-24T18:34:04.301Z"
}
DatasourceGlobalPolicyDisabled event
Event : DatasourceGlobalPolicyDisabled
Legacy event : globalPolicyDisabled
Description : An audit event for a data owner disabling a global policy from their data source.
Copy {
"relatedResources" : [
{
"id" : "7" ,
"type" : "GLOBAL_POLICY" ,
"name" : "Mask PII" ,
"policyKey" : "mask pii"
}
] ,
"targetType" : "DATASOURCE" ,
"id" : "4853154c-8825-4138-800d-913cbab56af6" ,
"receivedTimestamp" : "2023-10-24T18:13:25.004Z" ,
"auditPayload" : {
"version" : 1 ,
"type" : "DatasourceGlobalPolicyDisabledAuditPayload"
} ,
"actor" : {
"id" : "taylor@immuta.com" ,
"identityProvider" : "bim" ,
"profileId" : "1" ,
"type" : "USER_ACTOR" ,
"name" : "Taylor Smith"
} ,
"eventTimestamp" : "2023-10-24T18:13:24.975Z" ,
"action" : "POLICY_DISABLED" ,
"targets" : [
{
"id" : "47" ,
"type" : "DATASOURCE" ,
"name" : "Public case" ,
"technology" : "SNOWFLAKE"
}