Built-in audit event actions

Torii-generated events use the stable action identifiers below. Store and alert on the identifier, not dashboard display text. New identifiers may be added, but an existing identifier does not change meaning.

Most completed operations have result: success. Authentication refusals use failure; authorization refusals use denied. An unresolved sign-in attempt has actor.type: user with actor.id: null, so the event records the refusal without inventing a user or revealing whether the account exists. Password and email-code refusals target the environment when no user is resolved. OAuth provider refusals retain a user target with a null ID.

The timestamp used for polling and bounded search is recordedAt. occurredAt describes when the source says the action happened and may be earlier for customer-ingested events.

Users, authentication, and sessions

Action	Recorded when
user.signed_up	A user completes sign-up.
user.signed_in	A password, email-code, OAuth, ticket, or continuation sign-in completes.
user.sign_in_failed	A password, email-code, or OAuth sign-in is refused. Unknown accounts keep a null actor ID.
user.signed_out	A user signs out.
user.profile_updated	A user profile is changed.
user.deleted	A user account is deleted.
user.deletion_requested	Account deletion is requested.
user.data_requested	A user requests a copy of their data.
user.data_exported	A data export is produced.
user.password_changed	A password is changed or reset.
user.impersonated	An operator starts an impersonated user session.
user_fields.config_changed	Reserved for user-field configuration changes; not currently emitted.
user.created	A backend creates a user.
user.email_verified	An email address is verified.
user.email_added	An email address is added.
user.primary_email_changed	The primary email address changes.
user.email_removed	An email address is removed.
session.revoked	One session is revoked.
session.revoked_all	All sessions for a user are revoked.
session.switched	A browser switches its active session.
identity.linked	An external identity is linked.
identity.unlinked	An external identity is unlinked.

Legal, security, and environment configuration

Action	Recorded when
legal_document.published	Reserved for publishing a legal document; not currently emitted.
legal_document.accepted	Reserved for accepting a legal document; not currently emitted.
legal_document.deleted	Reserved for deleting a legal document; not currently emitted.
legal.consent_accepted	A user accepts required legal consent.
legal.settings_updated	Legal settings are changed.
auth.settings_updated	Authentication settings are changed.
session.settings_updated	Session settings are changed.
audit.pii_deletion_policy_updated	Audit PII handling after user deletion is changed.
locale.settings_updated	Locale settings are changed.
signing_key.generated	A signing key is generated.
signing_key.rotated	Reserved for an atomic signing-key rotation; rotations currently emit their component key events.
signing_key.deactivated	A signing key is deactivated.
signing_key.deleted	A signing key is deleted.
api_key.generated	A publishable API key is generated.
api_key.revoked	A publishable API key is revoked.
secret_key.generated	A secret key is generated.
secret_key.revoked	A secret key is revoked.
secret_key.rotated	Reserved for an atomic secret-key rotation; rotations currently emit their component key events.
security.alert_raised	Reserved for security-alert auditing; not currently emitted.
email.sent	Reserved for per-message delivery auditing; not currently emitted.
email.failed	Reserved for per-message delivery failure auditing; not currently emitted.

Billing, projects, and environments

Action	Recorded when
subscription.created	A subscription is created.
subscription.plan_changed	A subscription changes plan.
subscription.canceled	A subscription is canceled.
subscription.reactivated	A canceled subscription is reactivated.
charge.failed	Reserved for a failed charge event; not currently emitted.
project.plan_changed	Reserved for the legacy project-plan event; subscription plan changes use subscription.plan_changed.
project.created	A project is created.
project.updated	Project settings are changed.
environment.created	An environment is created.
environment.custom_domain_set	A custom domain is configured.
environment.custom_domain_removed	A custom domain is removed.
environment.allowed_origins_changed	Allowed web origins are changed.
environment.allowed_native_redirects_changed	Allowed native redirect URLs are changed.
environment.allowed_email_domains_changed	Allowed email domains are changed.
environment.impersonation_setting_changed	User impersonation is enabled or disabled.
environment.session_sharing_changed	Session sharing between subdomains is changed.
environment.satellite_domain_added	A satellite domain is added.
environment.satellite_domain_removed	A satellite domain is removed.
environment.allowed_subdomains_changed	Allowed session-sharing subdomains are changed.
sending_domain.added	A sending domain is added.
sending_domain.removed	A sending domain is removed.
sending_domain.verified	A sending domain is verified.
environment.sending_domain_selected	The environment selects a sending domain.
email_template.branding_updated	Shared email branding is changed.
email_template.settings_updated	Email-template settings are changed.
email_template.override_saved	An email-template override is saved.
email_template.override_deleted	An email-template override is deleted.
email.delivery_quality_flagged	Torii flags degraded email delivery quality.
email.quota_lifted	An operator lifts an email quota.
auth_provider.created	An authentication provider is created.
auth_provider.updated	An authentication provider is changed.
auth_provider.deleted	An authentication provider is deleted.
jwt_template.created	A JWT template is created.
jwt_template.updated	A JWT template is changed.
jwt_template.deleted	A JWT template is deleted.
jwt_template.default_set	A JWT template becomes the default.
jwt_template.default_cleared	The default JWT template is cleared.
security.alert_resolved	A security alert is resolved.
user.banned	A user is banned.
user.unbanned	A user is unbanned.
user.mfa_enrolled	A user enrolls a multi-factor method.
user.mfa_disabled	Multi-factor authentication is disabled for a user.
user.mfa_challenge_succeeded	An MFA challenge succeeds.
user.mfa_challenge_failed	An MFA challenge fails.
user.mfa_recovery_code_used	A recovery code is used.
user.mfa_recovery_codes_regenerated	Recovery codes are regenerated.
authorization.denied	A resolvable request is refused by origin or permission checks. Repeated denials are rate limited.
environment.mfa_setting_changed	The environment MFA requirement changes.
environment.portal_config_changed	Hosted portal configuration changes.
environment.new_sign_in_notification_setting_changed	New-sign-in notification settings change.
environment.redirect_urls_changed	Authentication redirect URLs change.
environment.impersonation_redirect_url_changed	The post-impersonation redirect URL changes.

Invitations, roles, and organizations

Action	Recorded when
environment_invitation.created	An environment invitation is created, including a replacement created by resend.
environment_invitation.revoked	An environment invitation is explicitly revoked.
environment_invitation.accepted	An environment invitation is accepted.
environment_invitation.updated	Pending invitation metadata is changed.
role.created	A custom organization role is created.
role.updated	A custom organization role is changed.
role.deleted	A custom organization role is deleted.
role_set.created	A role set is created.
role_set.updated	A role set is changed.
role_set.deleted	A role set is deleted.
role_set_role.added	A role is added to a role set.
role_set_role.removed	A role is removed from a role set.
organization.settings_updated	Organization settings are changed.
organization.role_set_changed	An organization changes role set.
organization.created	An organization is created.
organization.metadata_updated	Organization metadata is changed.
organization.member_metadata_updated	Organization-member metadata is changed.
organization_invitation.created	An organization invitation is created or resent.
organization_invitation.revoked	An organization invitation is revoked.
organization_invitation.accepted	An organization invitation is accepted.
organization.member_role_changed	An organization member changes role.
organization.member_removed	A member is removed from an organization.
feature.created	An organization authorization feature is created.
feature.updated	An organization authorization feature is changed.
feature.deleted	An organization authorization feature is deleted.
custom_permission.created	A custom permission is created.
custom_permission.deleted	A custom permission is deleted.

Application-owned events use the separate customer.<namespace>.<event> namespace described in Audit events and SIEM export.