Universal audit model (UAM) is Immuta's consistent structure for all Immuta system and user query audit logs. This reference guide maps the legacy audit events to the new UAM events and provides example schemas of all the UAM events available in Immuta.
To learn more about Immuta's audit, see the UAM reference page .
Events and descriptions
Legacy event UAM event Description
ApiKeyCreated event
Description : An audit event for when an API key is created on the Immuta app settings page or from an Immuta user's profile page.
Copy {
"relatedResources" : [] ,
"auditPayload" : {
"type" : "ApiKeyCreatedAuditPayload" ,
"apiKeyId" : "1112158" ,
"name" : "T1" ,
"version" : 1
} ,
"action" : "CREATE" ,
"tenantId" : "your-immuta-tenant.com" ,
"actionStatus" : "SUCCESS" ,
"eventTimestamp" : "2024-01-25T18:04:58.368Z" ,
"actor" : {
"id" : "taylor@immuta.com" ,
"identityProvider" : "bim" ,
"profileId" : "1" ,
"type" : "USER_ACTOR" ,
"name" : "Taylor Smith"
} ,
"targetType" : "APIKEY" ,
"id" : "d9dc3cee-98d0-47d6-ba81-e0b38f9f4014" ,
"receivedTimestamp" : "2024-01-25T18:04:58.505Z" ,
"actorIp" : "xxx.xx.xx.xx" ,
"targets" : [] ,
"requestId" : "60c68659-ac83-5299-bf3e-14856178a0de" ,
"sessionId" : "9c553d7ace0aa3ee735fd3c14f737bc6"
} ApiKeyDeleted event
Description : An audit event for when an API key is deleted on the Immuta app settings page or from an Immuta user's profile page.
Copy {
"id" : "fe47ddd1-fd22-4dcf-9648-83950a10ef34" ,
"targetType" : "APIKEY" ,
"receivedTimestamp" : "2024-01-25T18:08:28.891Z" ,
"actor" : {
"type" : "USER_ACTOR" ,
"identityProvider" : "bim" ,
"id" : "taylor@immuta.com" ,
"profileId" : "1" ,
"name" : "Taylor Smith"
} ,
"requestId" : "220c7faa-7f56-5d8c-aa31-8ac2212b7707" ,
"sessionId" : "9c553d7ace0aa3ee735fd3c14f737bc6" ,
"targets" : [] ,
"actorIp" : "xxx.xx.xx.xx" ,
"relatedResources" : [] ,
"auditPayload" : {
"type" : "ApiKeyDeletedAuditPayload" ,
"apiKeyId" : "1112158" ,
"version" : 1
} ,
"eventTimestamp" : "2024-01-25T18:08:21.319Z" ,
"action" : "DELETE" ,
"actionStatus" : "SUCCESS" ,
"tenantId" : "your-immuta-tenant.com"
} AttributeApplied event
Legacy events : accessUser and accessGroup
Description : An audit event for an attribute applied to a group or user.
Additional parameter details : targetType will specify whether the attribute was added to a USER or GROUP.
Copy {
"actorIp" : "xxx.xx.xx.xx" ,
"targets" : [
{
"name" : "Deepu Murty" ,
"id" : "deepu@immuta.com" ,
"identityProvider" : "bim" ,
"profileId" : "20" ,
"type" : "USER"
}
] ,
"requestId" : "e45652cd-4d00-5def-8e8c-aca696822fc2" ,
"sessionId" : "cdbffff8804103418350947c6586712c" ,
"actor" : {
"type" : "USER_ACTOR" ,
"profileId" : "1" ,
"id" : "taylor@immuta.com" ,
"identityProvider" : "bim" ,
"name" : "Taylor Smith"
} ,
"id" : "63f111a7-0835-4696-8fdb-188130c44fac" ,
"targetType" : "USER" ,
"receivedTimestamp" : "2023-09-13T14:36:02.926Z" ,
"action" : "ATTRIBUTE_APPLY" ,
"tenantId" : "your-immuta-tenant.com" ,
"actionStatus" : "SUCCESS" ,
"eventTimestamp" : "2023-09-13T14:36:02.688Z" ,
"relatedResources" : [
{
"values" : [ "Product" ] ,
"name" : "Department" ,
"id" : "department" ,
"type" : "ATTRIBUTE"
}
] ,
"auditPayload" : {
"entityType" : "USER" ,
"type" : "AttributeAppliedAuditPayload" ,
"version" : 1 ,
"attributes" : [
{
"values" : [ "Product" ] ,
"attribute" : "Department"
}
] ,
"entityIdProvider" : "bim" ,
"entityId" : "deepu@immuta.com"
}
} AttributeRemoved event
Legacy events : accessUser and accessGroup
Description : An audit event for an attribute removed from a group or user.
Additional parameter details : targetType will specify whether the attribute was removed from a USER or GROUP.
Copy {
"relatedResources" : [
{
"values" : [ "UNCLASSIFIED" ] ,
"name" : "classification" ,
"id" : "classification" ,
"type" : "ATTRIBUTE"
}
] ,
"auditPayload" : {
"type" : "AttributeRemovedAuditPayload" ,
"entityType" : "USER" ,
"version" : 1 ,
"attributes" : [
{
"values" : [ "UNCLASSIFIED" ] ,
"attribute" : "classification"
}
] ,
"entityIdProvider" : "bim" ,
"entityId" : "deepu@immuta.com"
} ,
"action" : "ATTRIBUTE_REMOVE" ,
"actionStatus" : "SUCCESS" ,
"tenantId" : "your-immuta-tenant.com" ,
"eventTimestamp" : "2024-02-20T19:46:50.259Z" ,
"actor" : {
"profileId" : "1" ,
"id" : "taylor@immuta.com" ,
"identityProvider" : "bim" ,
"type" : "USER_ACTOR" ,
"name" : "Taylor Smith"
} ,
"id" : "0fd77c61-f08a-488c-9d10-c356ffea0d11" ,
"targetType" : "USER" ,
"receivedTimestamp" : "2024-02-20T19:46:50.426Z" ,
"targets" : [
{
"name" : "Deepu Murty" ,
"type" : "USER" ,
"id" : "deepu@immuta.com" ,
"identityProvider" : "bim" ,
"profileId" : "20"
}
] ,
"actorIp" : "xxx.xx.xx.xx" ,
"requestId" : "146ec771-ec2e-5f40-8551-1dbc38e64078" ,
"sessionId" : "893db38b8f1977fda75f60d168c4e74e"
} ConfigurationUpdated event
Event : ConfigurationUpdated
Legacy event : configurationUpdate
Description : An audit event for updates to the configuration on the Immuta app settings page.
Copy {
"eventTimestamp" : "2023-12-04T18:38:25.801Z" ,
"tenantId" : "your-immuta-tenant.com" ,
"actionStatus" : "SUCCESS" ,
"action" : "CONFIGURATION_UPDATED" ,
"auditPayload" : {
"version" : 1 ,
"type" : "ConfigurationUpdatedAuditPayload" ,
"changeSet" : {
"plugins" : {
"policy" : {
"approveToPromote" : {
"requiredApprovalCount" : [
{
"newValue" : 1 ,
"oldValue" : 2
}
]
}
}
}
} ,
"configurationId" : "20"
} ,
"relatedResources" : [] ,
"sessionId" : "aed83ab8b46affcb1169532dada92b72" ,
"requestId" : "c80f510f-3f55-5450-8dea-d5e243708686" ,
"targets" : [
{
"name" : "20" ,
"type" : "CONFIGURATION" ,
"id" : "20"
}
] ,
"actorIp" : "xxx.xx.xx.xx" ,
"receivedTimestamp" : "2023-12-04T18:38:26.039Z" ,
"id" : "3989e233-c791-43e9-813f-7738f4c8e26b" ,
"targetType" : "CONFIGURATION" ,
"actor" : {
"identityProvider" : "bim" ,
"id" : "taylor@immuta.com" ,
"profileId" : "1" ,
"type" : "USER_ACTOR" ,
"name" : "Taylor Smith"
}
} DatasourceAppliedToProject event
Event : DatasourceAppliedToProject
Legacy event : addToProject
Description : An audit event for adding a data source to an Immuta project.
Copy {
"auditPayload" : {
"type" : "DatasourceAppliedToProjectAuditPayload" ,
"errors" : [] ,
"projectId" : "2" ,
"version" : 1 ,
"datasources" : [
{
"id" : "2" ,
"name" : "Public Case"
}
]
} ,
"sessionId" : "6b928653b1411078647a2764a72beca6" ,
"targets" : [
{
"projectKey" : "HumanResources" ,
"id" : "2" ,
"type" : "PROJECT" ,
"name" : "Human Resources"
}
] ,
"action" : "DATASOURCE_APPLY" ,
"id" : "8106b44f-cf56-4ca2-a111-641d0e80e6ff" ,
"targetType" : "PROJECT" ,
"actionStatus" : "SUCCESS" ,
"relatedResources" : [
{
"id" : "2" ,
"technology" : "SNOWFLAKE" ,
"type" : "DATASOURCE" ,
"name" : "Public Case"
}
] ,
"actor" : {
"id" : "taylor@immuta.com" ,
"profileId" : "1" ,
"name" : "Taylor Smith" ,
"identityProvider" : "bim" ,
"type" : "USER_ACTOR"
} ,
"eventTimestamp" : "2023-10-13T14:08:20.427Z" ,
"actorIp" : "xxx.xx.xx.xx" ,
"requestId" : "8823f3f0-4e46-590c-bbb2-209cce750ff9" ,
"tenantId" : "your-immuta-tenant.com" ,
"receivedTimestamp" : "2023-10-13T14:08:20.660Z"
} DatasourceCatalogSynced event
Event : DatasourceCatalogSynced
Legacy event : catalogUpdate
Description : An audit event for syncing an external catalog to tag Immuta data sources.
Copy {
"tenantId" : "your-immuta-tenant.com" ,
"action" : "CATALOG_SYNC" ,
"actor" : {
"type" : "USER_ACTOR" ,
"identityProvider" : "bim" ,
"name" : "Taylor Smith" ,
"profileId" : "1" ,
"id" : "taylor@immuta.com"
} ,
"targetType" : "DATASOURCE" ,
"actionStatus" : "SUCCESS" ,
"eventTimestamp" : "2023-04-14T16:48:21.159Z" ,
"id" : "159d4299-fca5-47cb-aa6b-81d93bafa526" ,
"targets" : [
{
"id" : "9" ,
"name" : "Public case" ,
"technology" : "SNOWFLAKE" ,
"type" : "DATASOURCE"
}
] ,
"relatedResources" : [] ,
"receivedTimestamp" : "2023-04-14T16:48:21.209Z" ,
"auditPayload" : {
"datasourceId" : "9" ,
"changes" : {
"before" : {
"catalogId" : null ,
"documentation" : null ,
"dictionary" : [
{
"tags" : [] ,
"columnName" : "country"
} ,
