Universal audit model (UAM) is Immuta's consistent structure for all Immuta system and user query audit logs. This reference guide provides example schemas of all the UAM events available in Immuta.
There are some parameter details throughout to help better understand the UAM schemas. But there are two important parameters to each event:
targetType
: Informs the Immuta object that's the target of the action being audited. This will specify if it was a user, project, policy, etc. being affected by the action.
action
: Informs the base action being performed on the target. This will specify if something was created, deleted, updated, etc.
To learn more about Immuta's audit, see the UAM reference page or view the examples below.
Events and descriptions
Immuta object
Events
Descriptions
Audit events for managing API keys.
Audit events for managing attributes.
An audit event for Immuta configuration changes.
Audit events for actions on data sources and their policies.
Audit events for managing domains, domain policies, and domain permissions.
Audit events for managing global policies.
Audit events for managing Immuta groups and group members.
Audit events for managing Immuta licenses.
Audit events for managing local policies.
Audit events for managing user permissions.
Audit events for managing policy adjustments in a project.
Audit events for managing projects and their purposes.
Audit events for managing purposes.
Audit events for user queries within data platforms.
Sensitive data discovery (SDD)
Audit events for managing and running SDD.
Audit events for managing tags and their application.
Audit events for user actions, managing users, and managing the objects users are subscribed to in Immuta.
Audit events for managing webhooks.
ApiKeyCreated event
Description : An audit event for when an API key is created on the Immuta app settings page or from an Immuta user's profile page.
Copy {
"relatedResources" : [] ,
"auditPayload" : {
"type" : "ApiKeyCreatedAuditPayload" ,
"apiKeyId" : "1112158" ,
"name" : "T1" ,
"version" : 1
} ,
"action" : "CREATE" ,
"tenantId" : "your-immuta-tenant.com" ,
"actionStatus" : "SUCCESS" ,
"eventTimestamp" : "2024-01-25T18:04:58.368Z" ,
"actor" : {
"id" : "taylor@immuta.com" ,
"identityProvider" : "bim" ,
"profileId" : "1" ,
"type" : "USER_ACTOR" ,
"name" : "Taylor Smith"
} ,
"targetType" : "APIKEY" ,
"id" : "d9dc3cee-98d0-47d6-ba81-e0b38f9f4014" ,
"receivedTimestamp" : "2024-01-25T18:04:58.505Z" ,
"actorIp" : "xxx.xx.xx.xx" ,
"targets" : [] ,
"requestId" : "60c68659-ac83-5299-bf3e-14856178a0de" ,
"sessionId" : "9c553d7ace0aa3ee735fd3c14f737bc6"
}
ApiKeyDeleted event
Description : An audit event for when an API key is deleted on the Immuta app settings page or from an Immuta user's profile page.
Copy {
"id" : "fe47ddd1-fd22-4dcf-9648-83950a10ef34" ,
"targetType" : "APIKEY" ,
"receivedTimestamp" : "2024-01-25T18:08:28.891Z" ,
"actor" : {
"type" : "USER_ACTOR" ,
"identityProvider" : "bim" ,
"id" : "taylor@immuta.com" ,
"profileId" : "1" ,
"name" : "Taylor Smith"
} ,
"requestId" : "220c7faa-7f56-5d8c-aa31-8ac2212b7707" ,
"sessionId" : "9c553d7ace0aa3ee735fd3c14f737bc6" ,
"targets" : [] ,
"actorIp" : "xxx.xx.xx.xx" ,
"relatedResources" : [] ,
"auditPayload" : {
"type" : "ApiKeyDeletedAuditPayload" ,
"apiKeyId" : "1112158" ,
"version" : 1
} ,
"eventTimestamp" : "2024-01-25T18:08:21.319Z" ,
"action" : "DELETE" ,
"actionStatus" : "SUCCESS" ,
"tenantId" : "your-immuta-tenant.com"
}
AttributeApplied event
Legacy events : accessUser
and accessGroup
Description : An audit event for an attribute applied to a group or user.
Additional parameter details : targetType
will specify whether the attribute was added to a USER
or GROUP
.
Copy {
"actorIp" : "xxx.xx.xx.xx" ,
"targets" : [
{
"name" : "Deepu Murty" ,
"id" : "deepu@immuta.com" ,
"identityProvider" : "bim" ,
"profileId" : "20" ,
"type" : "USER"
}
] ,
"requestId" : "e45652cd-4d00-5def-8e8c-aca696822fc2" ,
"sessionId" : "cdbffff8804103418350947c6586712c" ,
"actor" : {
"type" : "USER_ACTOR" ,
"profileId" : "1" ,
"id" : "taylor@immuta.com" ,
"identityProvider" : "bim" ,
"name" : "Taylor Smith"
} ,
"id" : "63f111a7-0835-4696-8fdb-188130c44fac" ,
"targetType" : "USER" ,
"receivedTimestamp" : "2023-09-13T14:36:02.926Z" ,
"action" : "ATTRIBUTE_APPLY" ,
"tenantId" : "your-immuta-tenant.com" ,
"actionStatus" : "SUCCESS" ,
"eventTimestamp" : "2023-09-13T14:36:02.688Z" ,
"relatedResources" : [
{
"values" : [ "Product" ] ,
"name" : "Department" ,
"id" : "department" ,
"type" : "ATTRIBUTE"
}
] ,
"auditPayload" : {
"entityType" : "USER" ,
"type" : "AttributeAppliedAuditPayload" ,
"version" : 1 ,
"attributes" : [
{
"values" : [ "Product" ] ,
"attribute" : "Department"
}
] ,
"entityIdProvider" : "bim" ,
"entityId" : "deepu@immuta.com"
}
}
AttributeRemoved event
Legacy events : accessUser
and accessGroup
Description : An audit event for an attribute removed from a group or user.
Additional parameter details : targetType
will specify whether the attribute was removed from a USER
or GROUP
.
Copy {
"relatedResources" : [
{
"values" : [ "UNCLASSIFIED" ] ,
"name" : "classification" ,
"id" : "classification" ,
"type" : "ATTRIBUTE"
}
] ,
"auditPayload" : {
"type" : "AttributeRemovedAuditPayload" ,
"entityType" : "USER" ,
"version" : 1 ,
"attributes" : [
{
"values" : [ "UNCLASSIFIED" ] ,
"attribute" : "classification"
}
] ,
"entityIdProvider" : "bim" ,
"entityId" : "deepu@immuta.com"
} ,
"action" : "ATTRIBUTE_REMOVE" ,
"actionStatus" : "SUCCESS" ,
"tenantId" : "your-immuta-tenant.com" ,
"eventTimestamp" : "2024-02-20T19:46:50.259Z" ,
"actor" : {
"profileId" : "1" ,
"id" : "taylor@immuta.com" ,
"identityProvider" : "bim" ,
"type" : "USER_ACTOR" ,
"name" : "Taylor Smith"
} ,
"id" : "0fd77c61-f08a-488c-9d10-c356ffea0d11" ,
"targetType" : "USER" ,
"receivedTimestamp" : "2024-02-20T19:46:50.426Z" ,
"targets" : [
{
"name" : "Deepu Murty" ,
"type" : "USER" ,
"id" : "deepu@immuta.com" ,
"identityProvider" : "bim" ,
"profileId" : "20"
}
] ,
"actorIp" : "xxx.xx.xx.xx" ,
"requestId" : "146ec771-ec2e-5f40-8551-1dbc38e64078" ,
"sessionId" : "893db38b8f1977fda75f60d168c4e74e"
}
ConfigurationUpdated event
Event : ConfigurationUpdated
Legacy event : configurationUpdate
Description : An audit event for updates to the configuration on the Immuta app settings page.
Copy {
"eventTimestamp" : "2023-12-04T18:38:25.801Z" ,
"tenantId" : "your-immuta-tenant.com" ,
"actionStatus" : "SUCCESS" ,
"action" : "CONFIGURATION_UPDATED" ,
"auditPayload" : {
"version" : 1 ,
"type" : "ConfigurationUpdatedAuditPayload" ,
"changeSet" : {
"plugins" : {
"policy" : {
"approveToPromote" : {
"requiredApprovalCount" : [
{
"newValue" : 1 ,
"oldValue" : 2
}
]
}
}
}
} ,
"configurationId" : "20"
} ,
"relatedResources" : [] ,
"sessionId" : "aed83ab8b46affcb1169532dada92b72" ,
"requestId" : "c80f510f-3f55-5450-8dea-d5e243708686" ,
"targets" : [
{
"name" : "20" ,
"type" : "CONFIGURATION" ,
"id" : "20"
}
] ,
"actorIp" : "xxx.xx.xx.xx" ,
"receivedTimestamp" : "2023-12-04T18:38:26.039Z" ,
"id" : "3989e233-c791-43e9-813f-7738f4c8e26b" ,
"targetType" : "CONFIGURATION" ,
"actor" : {
"identityProvider" : "bim" ,
"id" : "taylor@immuta.com" ,
"profileId" : "1" ,
"type" : "USER_ACTOR" ,
"name" : "Taylor Smith"
}
}
DatasourceAppliedToProject event
Event : DatasourceAppliedToProject
Legacy event : addToProject
Description : An audit event for adding a data source to an Immuta project.
Copy {
"auditPayload" : {
"type" : "DatasourceAppliedToProjectAuditPayload" ,
"errors" : [] ,
"projectId" : "2" ,
"version" : 1 ,
"datasources" : [
{
"id" : "2" ,
"name" : "Public Case"
}
]
} ,
"sessionId" : "6b928653b1411078647a2764a72beca6" ,
"targets" : [
{
"projectKey" : "HumanResources" ,
"id" : "2" ,
"type" : "PROJECT" ,
"name" : "Human Resources"
}
] ,
"action" : "DATASOURCE_APPLY" ,
"id" : "8106b44f-cf56-4ca2-a111-641d0e80e6ff" ,
"targetType" : "PROJECT" ,
"actionStatus" : "SUCCESS" ,
"relatedResources" : [
{
"id" : "2" ,
"technology" : "SNOWFLAKE" ,
"type" : "DATASOURCE" ,
"name" : "Public Case"
}
] ,
"actor" : {
"id" : "taylor@immuta.com" ,
"profileId" : "1" ,
"name" : "Taylor Smith" ,
"identityProvider" : "bim" ,
"type" : "USER_ACTOR"
} ,
"eventTimestamp" : "2023-10-13T14:08:20.427Z" ,
"actorIp" : "xxx.xx.xx.xx" ,
"requestId" : "8823f3f0-4e46-590c-bbb2-209cce750ff9" ,
"tenantId" : "your-immuta-tenant.com" ,
"receivedTimestamp" : "2023-10-13T14:08:20.660Z"
}
DatasourceCatalogSynced event
Event : DatasourceCatalogSynced
Legacy event : catalogUpdate
Description : An audit event for syncing an external catalog to tag Immuta data sources.
Copy {
"tenantId" : "your-immuta-tenant.com" ,
"action" : "CATALOG_SYNC" ,
"actor" : {
"type" : "USER_ACTOR" ,
"identityProvider" : "bim" ,
"name" : "Taylor Smith" ,
"profileId" : "1" ,
"id" : "taylor@immuta.com"
} ,
"targetType" : "DATASOURCE" ,
"actionStatus" : "SUCCESS" ,
"eventTimestamp" : "2023-04-14T16:48:21.159Z" ,
"id" : "159d4299-fca5-47cb-aa6b-81d93bafa526" ,
"targets" : [
{
"id" : "9" ,
"name" : "Public case" ,
"technology" : "SNOWFLAKE" ,
"type" : "DATASOURCE"
}
] ,
"relatedResources" : [] ,
"receivedTimestamp" : "2023-04-14T16:48:21.209Z" ,
"auditPayload" : {
"datasourceId" : "9" ,
"changes" : {
"before" : {
"catalogId" : null ,
"documentation" : null ,
"dictionary" : [
{
"tags" : [] ,
"columnName" : "country"
} ,
{
"columnName" : "date" ,
"tags" : []
} ,
{
"tags" : [] ,
"columnName" : "fastest_qualifying"
} ,
{
"columnName" : "location" ,
"tags" : []
} ,
{
"columnName" : "round" ,
"tags" : []
} ,
{
"columnName" : "winning_aircraft" ,
"tags" : []
} ,
{
"tags" : [] ,
"columnName" : "winning_pilot"
}
] ,
"tableTags" : null ,
"description" : null
} ,
"after" : {
"description" : "" ,
"tableTags" : null ,
"dictionary" : [
{
"columnName" : "country" ,
"description" : "" ,
"tags" : []
} ,
{
"tags" : [] ,
"description" : "" ,
"columnName" : "date"
} ,
{
"tags" : [] ,
"columnName" : "fastest_qualifying" ,
"description" : ""
} ,
{
"tags" : [] ,
"columnName" : "location" ,
"description" : ""
} ,
{
"columnName" : "round" ,
"description" : "" ,
"tags" : []
} ,
{
"tags" : [] ,
"description" : "" ,
"columnName" : "winning_aircraft"
} ,
{
"columnName" : "winning_pilot" ,
"description" : "" ,
"tags" : []
}
] ,
"catalogId" : "immuta-product_engineering"
}
} ,
"type" : "DatasourceCatalogSyncedAuditPayload"
}
}
DatasourceCreated event
Legacy event : dataSourceCreate
Description : An audit event for registering a table as an Immuta data source.
Copy {
"id" : "dc0b7313-ecc9-42f1-ba33-df0a1a753c08" ,
"action" : "CREATE" ,
"actionStatus" : "SUCCESS" ,
"actor" : {
"name" : "Taylor Smith" ,
"id" : "taylor@immuta.com" ,
"identityProvider" : "bim" ,
"profileId" : "1" ,
"type" : "USER_ACTOR"
} ,
"tenantId" : "your-immuta-tenant.com" ,
"targetType" : "DATASOURCE" ,
"targets" : [
{
"type" : "DATASOURCE" ,
"id" : "102" ,
"name" : "Pgboss Job" ,
"technology" : "POSTGRESQL"
}
] ,
"relatedResources" : [
{
"type" : "CONNECTION" ,
"id" : "4" ,
"name" : "data-source-connection-name" ,
"connectionKey" : "data-source-connection-key"
}
] ,
"auditPayload" : {
"type" : "DatasourceCreatedAuditPayload" ,
"version" : 1 ,
"description" : null ,
"documentation" : null ,
"expiration" : null ,
"columnDetectionEnabled" : true ,
"disabled" : false ,
"technology" : "POSTGRESQL" ,
"connectionId" : "4" ,
"table" : "job" ,
"schema" : "pgboss" ,
"sensitiveDataDiscoveryEnabled" : true
} ,
"eventTimestamp" : "2024-02-22T13:59:04.681Z" ,
"receivedTimestamp" : "2024-02-22T13:59:04.715Z"
}
DatasourceDeleted event
Legacy event : dataSourceDelete
Description : An audit event for deleting a data source in Immuta.
Copy {
"id" : "1403b675-70f6-4833-ab4c-a7486c63f494" ,
"action" : "DELETE" ,
"actionStatus" : "SUCCESS" ,
"actor" : {
"name" : "Taylor Smith" ,
"id" : "taylor@immuta.com" ,
"identityProvider" : "bim" ,
"profileId" : "1" ,
"type" : "USER_ACTOR"
} ,
"tenantId" : "your-immuta-tenant.com" ,
"targetType" : "DATASOURCE" ,
"targets" : [
{
"type" : "DATASOURCE" ,
"id" : "93" ,
"name" : "Audit" ,
"technology" : "POSTGRESQL"
}
] ,
"relatedResources" : [] ,
"auditPayload" : {
"type" : "DatasourceDeletedAuditPayload" ,
"version" : 1 ,
"datasourceId" : "93" ,
"name" : "Audit" ,
"technology" : "POSTGRESQL"
} ,
"eventTimestamp" : "2024-02-22T14:20:42.379Z" ,
"receivedTimestamp" : "2024-02-22T14:20:42.392Z"
}
DatasourceDisabled event
Event : DatasourceDisabled
Description : An audit event for disabling a data source in Immuta.
Copy {
"id" : "a09b9bc3-3775-4496-87ec-b808cf649794" ,
"sessionId" : "0fcaaf9c074330b4b875746c2e52739c" ,
"requestId" : "153fe145-32a0-5c33-930d-c571c1d7748d" ,
"action" : "DISABLE" ,
"actionStatus" : "SUCCESS" ,
"actor" : {
"name" : "Taylor Smith" ,
"id" : "taylor@immuta.com" ,
"identityProvider" : "bim" ,
"profileId" : "1" ,
"type" : "USER_ACTOR"
} ,
"actorIp" : "xxx.xx.xx.xx" ,
"tenantId" : "your-immuta-tenant.com" ,
"targetType" : "DATASOURCE" ,
"targets" : [
{
"type" : "DATASOURCE" ,