Function: auditHeaderOf()

auditHeaderOf(record): Omit<AuditRecorded, "payload">

Defined in: packages/contracts/src/schemas/audit.ts:339

The header of an audit record: the record without its payload. This is what the link formula hashes (with payloadHash inside it), so a payload can be erased without breaking the chain. Canonicalizing and hashing it is not done here.

Parameters

record

{ action: "subject.create"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { kind: "organization" | "person"; path: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "authentication-identity.link"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { subjectId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "bootstrap.apply"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { anchorCreated: boolean; identitiesCreated: number; organizationsCreated: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "access.deny"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "denied"; payload: { messageId: string; reason: "tenant_mismatch" | "schema_mismatch" | "unlisted_edge" | "actor_unverified" | "platform_grant_missing" | "scope_denied" | "principal_unknown" | "issuer_not_accepted"; schema: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "grant.create"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { bundle: string; granteeId: string; organizationId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "grant.revoke"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { cause?: "grantee-erased" | "bundle-replaced" | "grantor-revoked" | "holder-replaced"; causeGrantId?: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "person.invite"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { providerUserLinked: boolean; realm: "staff" | "holders"; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "person.reinvite"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { previous: "failed" | "none" | "sent"; realm: "staff" | "holders"; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "subject-key.destroy"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: object; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "identity-provider.converge"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { changed: ("smtp" | "realm" | "access-token-lifespan" | "id-token-lifespan" | "authorization-code-lifespan" | "refresh-token-lifespan" | "sso-session-lifespan" | "password-policy" | "brute-force" | "internationalisation" | "required-actions" | "client" | "client-scope" | "audience-mapper" | "direct-access-grants" | "root-account" | "client-disabled" | "invitation-mail")[]; realm: "staff" | "holders"; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "audit.record-refused"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "denied"; payload: { reason: "tenant_mismatch" | "schema_mismatch" | "subject_unreadable" | "envelope_invalid" | "body_not_json" | "record_invalid" | "payload_hash_mismatch" | "producer_mismatch" | "not_a_producer" | "database_refused" | "not_canonical"; refusedProducer?: string; refusedRecordId?: string; streamSequence: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "accreditation.apply"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { accreditationId: string; frameworkVersion: number; organizationId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "accreditation.admit"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success" | "denied"; payload: { accreditationId: string; fourEyes?: boolean; frameworkVersion: number; nameConfusable?: string[]; organizationId: string; reason?: "four-eyes" | "name-collision" | "name-script"; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "accreditation.publish"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { accreditationId: string; frameworkVersion: number; organizationId: string; statementIds: string[]; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "framework.publish"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { digest: string; version: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "anchor.converge"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { changed: ("statement" | "key" | "framework" | "accreditation" | "four-eyes")[]; fourEyes?: boolean; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "entity-statement.prepare"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { accreditationId: string; exp: string; keyId: string; kind: "entity-configuration" | "subordinate-statement"; statementId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "entity-statement.publish"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success" | "denied"; payload: { accreditationId: string; exp: string; keyId: string; kind: "entity-configuration" | "subordinate-statement"; recordedBy?: "approval" | "interrupted-settle" | "renewal-sweep"; statementId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "entity-statement.renew"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { accreditationId: string; exp: string; keyId: string; kind: "entity-configuration" | "subordinate-statement"; statementId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "signing-key.generate"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { keyId: string; purpose: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "configuration.apply"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { contentHash: string; driftCount: number; previousId?: string; supersedes?: string; versionId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "access.deny"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "denied"; payload: { messageId: string; reason: "tenant_mismatch" | "schema_mismatch" | "unlisted_edge" | "actor_unverified" | "platform_grant_missing" | "scope_denied" | "principal_unknown" | "issuer_not_accepted" | "actor_token_invalid"; schema: string; version: 2; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "identifier.create"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { host: string; identifierId: string; instanceId?: string; organizationId: string; version: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "identifier.prepare"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success" | "denied"; payload: { host: string; identifierId: string; instanceId?: string; organizationId: string; reason?: "agent-refused"; version: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "identifier.update"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success" | "denied"; payload: { host: string; identifierId: string; instanceId?: string; organizationId: string; reason?: "document-mismatch" | "agent-refused" | "host-unverified"; version: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "identifier.publish"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success" | "denied"; payload: { did: string; identifierId: string; keyIds: string[]; version: number; versionId?: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "identifier.converge"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { changed: ("identifier" | "probe" | "methods")[]; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "registry.probe"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { changed: ("identifier" | "probe" | "methods")[]; registry: "centralized"; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "placement.create"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { instanceId: string; state: "active" | "draining" | "retired"; subjectId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "agent.converge"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success" | "denied"; payload: { changed: ("registries" | "instance" | "scheme-refused" | "tenancy-refused" | "custody-refused")[]; instanceId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "audit.checkpoint"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { fromSeq: number; keyId: string; toSeq: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "subject-key.rewrap"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { count: number; fromKekId: string; toKekId: string; unwrapFailed?: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "bootstrap.plan"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { driftCount: number; runId: string; wouldChange: boolean; wouldRefuse?: boolean; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "bootstrap.setup-code-issued"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { installerRunId: string; principal: "setup:installer"; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "bootstrap.setup-code-reissued"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { installerRunId: string; principal: "setup:installer"; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "bootstrap.setup-redeemed"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { forwardedAddress?: string; installerRunId: string; principal: "setup:root"; socketAddress?: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "bootstrap.setup-code-burned"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "denied"; payload: { attempts: number; forwardedAddress?: string; installerRunId: string; principal: "setup:root"; socketAddress?: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "bootstrap.setup-reopened"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { fromEngineVersion: number; installerRunId: string; principal: "setup:installer"; reopenedAtStep: "anchor" | "identifiers" | "organizations" | "identity-provider" | "accounts" | "key-store" | "configuration"; toEngineVersion: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "bootstrap.setup-step-applied"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { changed: boolean; environment?: string; governingAccount?: "created" | "present" | "skipped"; identifierMethod?: "webvh" | "web"; invitationSent?: boolean; principal: "setup:root"; runId: string; step: "anchor" | "identifiers" | "organizations" | "identity-provider" | "accounts" | "key-store" | "configuration"; versionId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "bootstrap.setup-completed"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { engineVersion: number; principal: "setup:root"; versionId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "signing-key.register"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { keyId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "placement.quota-held"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "denied"; payload: { perWindow: number; placed: number; windowSeconds: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "identifier.publish"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success" | "denied"; payload: { assertionKeyIds: string[]; commitsTo?: string; did?: string; identifierId: string; method: "webvh" | "web"; reason?: "document-mismatch" | "agent-refused" | "host-unverified" | "host-taken"; signedBy?: string; version: number; versionId?: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "identifier.key-discard"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { identifierId: string; keyIds: string[]; reason: "spent" | "unpublished"; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; } | { action: "bootstrap.root-invite"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { principal: "setup:installer"; runId: string; versionId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

Type Literal

An audit record.

action

"subject.create" = ...

actor

{ kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } = Actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ kind: "organization" | "person"; path: string; }

payload.kind

"organization" | "person" = ...

payload.path

string = TenantScopePath

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "authentication-identity.link"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { subjectId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"authentication-identity.link" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ subjectId: string; }

payload.subjectId

string = Uuid

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "bootstrap.apply"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { anchorCreated: boolean; identitiesCreated: number; organizationsCreated: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"bootstrap.apply" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ anchorCreated: boolean; identitiesCreated: number; organizationsCreated: number; }

payload.anchorCreated

boolean = ...

payload.identitiesCreated

number = ...

payload.organizationsCreated

number = ...

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "access.deny"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "denied"; payload: { messageId: string; reason: "tenant_mismatch" | "schema_mismatch" | "unlisted_edge" | "actor_unverified" | "platform_grant_missing" | "scope_denied" | "principal_unknown" | "issuer_not_accepted"; schema: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"access.deny" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"denied" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ messageId: string; reason: "tenant_mismatch" | "schema_mismatch" | "unlisted_edge" | "actor_unverified" | "platform_grant_missing" | "scope_denied" | "principal_unknown" | "issuer_not_accepted"; schema: string; }

payload.messageId

string = Uuid

The refused message's id, for joining to the caller's logs.

payload.reason

payload.schema

string = DeniedSchemaKey

The registry key of the refused request.

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "grant.create"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { bundle: string; granteeId: string; organizationId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"grant.create" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ bundle: string; granteeId: string; organizationId: string; }

payload.bundle

string = BundleCode

payload.granteeId

string = Uuid

payload.organizationId

string = Uuid

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "grant.revoke"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { cause?: "grantee-erased" | "bundle-replaced" | "grantor-revoked" | "holder-replaced"; causeGrantId?: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"grant.revoke" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ cause?: "grantee-erased" | "bundle-replaced" | "grantor-revoked" | "holder-replaced"; causeGrantId?: string; }

payload.cause?

"grantee-erased" | "bundle-replaced" | "grantor-revoked" | "holder-replaced" = ...

payload.causeGrantId?

string = ...

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "person.invite"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { providerUserLinked: boolean; realm: "staff" | "holders"; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"person.invite" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ providerUserLinked: boolean; realm: "staff" | "holders"; }

payload.providerUserLinked

boolean = ...

payload.realm

"staff" | "holders" = IdentityProviderRealmSchema

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "person.reinvite"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { previous: "failed" | "none" | "sent"; realm: "staff" | "holders"; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"person.reinvite" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ previous: "failed" | "none" | "sent"; realm: "staff" | "holders"; }

payload.previous

"failed" | "none" | "sent" = ...

payload.realm

"staff" | "holders" = IdentityProviderRealmSchema

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "subject-key.destroy"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: object; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"subject-key.destroy" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" = ...

Exactly the outcomes the action's registry entry lists.

payload

object

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "identity-provider.converge"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { changed: ("smtp" | "realm" | "access-token-lifespan" | "id-token-lifespan" | "authorization-code-lifespan" | "refresh-token-lifespan" | "sso-session-lifespan" | "password-policy" | "brute-force" | "internationalisation" | "required-actions" | "client" | "client-scope" | "audience-mapper" | "direct-access-grants" | "root-account" | "client-disabled" | "invitation-mail")[]; realm: "staff" | "holders"; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"identity-provider.converge" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ changed: ("smtp" | "realm" | "access-token-lifespan" | "id-token-lifespan" | "authorization-code-lifespan" | "refresh-token-lifespan" | "sso-session-lifespan" | "password-policy" | "brute-force" | "internationalisation" | "required-actions" | "client" | "client-scope" | "audience-mapper" | "direct-access-grants" | "root-account" | "client-disabled" | "invitation-mail")[]; realm: "staff" | "holders"; }

payload.changed

payload.realm

"staff" | "holders" = IdentityProviderRealmSchema

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "audit.record-refused"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "denied"; payload: { reason: "tenant_mismatch" | "schema_mismatch" | "subject_unreadable" | "envelope_invalid" | "body_not_json" | "record_invalid" | "payload_hash_mismatch" | "producer_mismatch" | "not_a_producer" | "database_refused" | "not_canonical"; refusedProducer?: string; refusedRecordId?: string; streamSequence: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"audit.record-refused" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"denied" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ reason: "tenant_mismatch" | "schema_mismatch" | "subject_unreadable" | "envelope_invalid" | "body_not_json" | "record_invalid" | "payload_hash_mismatch" | "producer_mismatch" | "not_a_producer" | "database_refused" | "not_canonical"; refusedProducer?: string; refusedRecordId?: string; streamSequence: number; }

payload.reason

payload.refusedProducer?

string = ...

The module token of the subject the message arrived on, when well-formed.

payload.refusedRecordId?

string = ...

The refused record's id, when the body held a well-formed one.

payload.streamSequence

number = ...

The stream sequence of the refused message.

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "accreditation.apply"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { accreditationId: string; frameworkVersion: number; organizationId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"accreditation.apply" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ accreditationId: string; frameworkVersion: number; organizationId: string; }

payload.accreditationId

string = Uuid

payload.frameworkVersion

number = ...

payload.organizationId

string = Uuid

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "accreditation.admit"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success" | "denied"; payload: { accreditationId: string; fourEyes?: boolean; frameworkVersion: number; nameConfusable?: string[]; organizationId: string; reason?: "four-eyes" | "name-collision" | "name-script"; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"accreditation.admit" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" | "denied" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ accreditationId: string; fourEyes?: boolean; frameworkVersion: number; nameConfusable?: string[]; organizationId: string; reason?: "four-eyes" | "name-collision" | "name-script"; }

payload.accreditationId

string = Uuid

payload.fourEyes?

boolean = ...

Whether the four-eyes rule was in force for this decision, as read in the admission's own transaction. true on a record four eyes refused. Absent on records written before the field existed.

payload.frameworkVersion

number = ...

payload.nameConfusable?

string[] = ...

The entities whose display name folds to the same string as this organisation's. On a denied record with reason name-collision they are the ones that refused it. On success they are a warning: entities the refusal does not cover, which today means siblings that have applied and are not yet admitted, so two admissions racing each other each name the other. Absent when there are none, and on records written before the field existed.

payload.organizationId

string = Uuid

payload.reason?

"four-eyes" | "name-collision" | "name-script" = ...

Which rule refused, on a denied record. Absent on success, and on a denied record written before the field existed, when four eyes was the only rule that produced one.

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "accreditation.publish"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { accreditationId: string; frameworkVersion: number; organizationId: string; statementIds: string[]; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"accreditation.publish" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ accreditationId: string; frameworkVersion: number; organizationId: string; statementIds: string[]; }

payload.accreditationId

string = Uuid

payload.frameworkVersion

number = ...

payload.organizationId

string = Uuid

payload.statementIds

string[] = ...

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "framework.publish"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { digest: string; version: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"framework.publish" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ digest: string; version: number; }

payload.digest

string = Sha256Hex

payload.version

number = ...

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "anchor.converge"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { changed: ("statement" | "key" | "framework" | "accreditation" | "four-eyes")[]; fourEyes?: boolean; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"anchor.converge" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ changed: ("statement" | "key" | "framework" | "accreditation" | "four-eyes")[]; fourEyes?: boolean; }

payload.changed

("statement" | "key" | "framework" | "accreditation" | "four-eyes")[] = AnchorConvergeChanges

payload.fourEyes?

boolean = ...

The four-eyes rule as it stands after this run, whether or not the run changed it (changed holds four-eyes when it did). Absent on records written before the field existed.

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "entity-statement.prepare"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { accreditationId: string; exp: string; keyId: string; kind: "entity-configuration" | "subordinate-statement"; statementId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"entity-statement.prepare" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ accreditationId: string; exp: string; keyId: string; kind: "entity-configuration" | "subordinate-statement"; statementId: string; }

payload.accreditationId

string = Uuid

payload.exp

string = Timestamp

The statement's exp.

payload.keyId

string = KeyId

The published thumbprint of the signing key; never the custodian's handle.

payload.kind

"entity-configuration" | "subordinate-statement" = EntityStatementKindSchema

payload.statementId

string = Uuid

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "entity-statement.publish"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success" | "denied"; payload: { accreditationId: string; exp: string; keyId: string; kind: "entity-configuration" | "subordinate-statement"; recordedBy?: "approval" | "interrupted-settle" | "renewal-sweep"; statementId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"entity-statement.publish" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" | "denied" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ accreditationId: string; exp: string; keyId: string; kind: "entity-configuration" | "subordinate-statement"; recordedBy?: "approval" | "interrupted-settle" | "renewal-sweep"; statementId: string; }

payload.accreditationId

string = Uuid

payload.exp

string = Timestamp

The statement's exp.

payload.keyId

string = KeyId

The published thumbprint of the signing key; never the custodian's handle.

payload.kind

"entity-configuration" | "subordinate-statement" = EntityStatementKindSchema

payload.recordedBy?

"approval" | "interrupted-settle" | "renewal-sweep" = ...

payload.statementId

string = Uuid

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "entity-statement.renew"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { accreditationId: string; exp: string; keyId: string; kind: "entity-configuration" | "subordinate-statement"; statementId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"entity-statement.renew" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ accreditationId: string; exp: string; keyId: string; kind: "entity-configuration" | "subordinate-statement"; statementId: string; }

payload.accreditationId

string = Uuid

payload.exp

string = Timestamp

The statement's exp.

payload.keyId

string = KeyId

The published thumbprint of the signing key; never the custodian's handle.

payload.kind

"entity-configuration" | "subordinate-statement" = EntityStatementKindSchema

payload.statementId

string = Uuid

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "signing-key.generate"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { keyId: string; purpose: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"signing-key.generate" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ keyId: string; purpose: string; }

payload.keyId

string = KeyId

payload.purpose

string = ...

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "configuration.apply"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { contentHash: string; driftCount: number; previousId?: string; supersedes?: string; versionId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"configuration.apply" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ contentHash: string; driftCount: number; previousId?: string; supersedes?: string; versionId: string; }

payload.contentHash

string = Sha256Hex

payload.driftCount

number = ...

payload.previousId?

string = ...

payload.supersedes?

string = ...

The wizard's version this file was explicitly imported over, with --supersede (setup-wizard.md, DW19). Absent on every ordinary apply.

payload.versionId

string = Uuid

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "access.deny"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "denied"; payload: { messageId: string; reason: "tenant_mismatch" | "schema_mismatch" | "unlisted_edge" | "actor_unverified" | "platform_grant_missing" | "scope_denied" | "principal_unknown" | "issuer_not_accepted" | "actor_token_invalid"; schema: string; version: 2; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"access.deny" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"denied" = ...

Exactly the outcomes the action's registry entry lists.

payload

payload.messageId

string = Uuid

The refused message's id, for joining to the caller's logs.

payload.reason

payload.schema

string = DeniedSchemaKey

The registry key of the refused request.

payload.version

2 = ...

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "identifier.create"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { host: string; identifierId: string; instanceId?: string; organizationId: string; version: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"identifier.create" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ host: string; identifierId: string; instanceId?: string; organizationId: string; version: number; }

payload.host

string = Hostname

payload.identifierId

string = Uuid

payload.instanceId?

string = ...

payload.organizationId

string = Uuid

payload.version

number = ...

The version published when the record was written: 0 before the first.

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "identifier.prepare"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success" | "denied"; payload: { host: string; identifierId: string; instanceId?: string; organizationId: string; reason?: "agent-refused"; version: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"identifier.prepare" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" | "denied" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ host: string; identifierId: string; instanceId?: string; organizationId: string; reason?: "agent-refused"; version: number; }

payload.host

string = Hostname

payload.identifierId

string = Uuid

payload.instanceId?

string = ...

payload.organizationId

string = Uuid

payload.reason?

"agent-refused" = ...

payload.version

number = ...

The version published when the record was written: 0 before the first.

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "identifier.update"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success" | "denied"; payload: { host: string; identifierId: string; instanceId?: string; organizationId: string; reason?: "document-mismatch" | "agent-refused" | "host-unverified"; version: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"identifier.update" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" | "denied" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ host: string; identifierId: string; instanceId?: string; organizationId: string; reason?: "document-mismatch" | "agent-refused" | "host-unverified"; version: number; }

payload.host

string = Hostname

payload.identifierId

string = Uuid

payload.instanceId?

string = ...

payload.organizationId

string = Uuid

payload.reason?

"document-mismatch" | "agent-refused" | "host-unverified" = ...

payload.version

number = ...

The version published when the record was written: 0 before the first.

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "identifier.publish"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success" | "denied"; payload: { did: string; identifierId: string; keyIds: string[]; version: number; versionId?: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"identifier.publish" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" | "denied" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ did: string; identifierId: string; keyIds: string[]; version: number; versionId?: string; }

payload.did

string = Did

payload.identifierId

string = Uuid

payload.keyIds

string[] = ...

payload.version

number = ...

payload.versionId?

string = ...

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "identifier.converge"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { changed: ("identifier" | "probe" | "methods")[]; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"identifier.converge" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ changed: ("identifier" | "probe" | "methods")[]; }

payload.changed

("identifier" | "probe" | "methods")[] = IssuanceConvergeChanges

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "registry.probe"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { changed: ("identifier" | "probe" | "methods")[]; registry: "centralized"; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"registry.probe" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ changed: ("identifier" | "probe" | "methods")[]; registry: "centralized"; }

payload.changed

("identifier" | "probe" | "methods")[] = IssuanceConvergeChanges

payload.registry

"centralized" = IdentifierRegistrySchema

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "placement.create"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { instanceId: string; state: "active" | "draining" | "retired"; subjectId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"placement.create" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ instanceId: string; state: "active" | "draining" | "retired"; subjectId: string; }

payload.instanceId

string = AgentInstanceId

payload.state

"active" | "draining" | "retired" = PlacementStateSchema

payload.subjectId

string = Uuid

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "agent.converge"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success" | "denied"; payload: { changed: ("registries" | "instance" | "scheme-refused" | "tenancy-refused" | "custody-refused")[]; instanceId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"agent.converge" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" | "denied" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ changed: ("registries" | "instance" | "scheme-refused" | "tenancy-refused" | "custody-refused")[]; instanceId: string; }

payload.changed

("registries" | "instance" | "scheme-refused" | "tenancy-refused" | "custody-refused")[] = AgentConvergeChanges

payload.instanceId

string = AgentInstanceId

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "audit.checkpoint"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { fromSeq: number; keyId: string; toSeq: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"audit.checkpoint" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ fromSeq: number; keyId: string; toSeq: number; }

payload.fromSeq

number = Sequence

payload.keyId

string = KeyId

payload.toSeq

number = Sequence

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "subject-key.rewrap"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { count: number; fromKekId: string; toKekId: string; unwrapFailed?: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"subject-key.rewrap" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ count: number; fromKekId: string; toKekId: string; unwrapFailed?: number; }

payload.count

number = ...

payload.fromKekId

string = ...

payload.toKekId

string = ...

payload.unwrapFailed?

number = ...

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "bootstrap.plan"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { driftCount: number; runId: string; wouldChange: boolean; wouldRefuse?: boolean; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"bootstrap.plan" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ driftCount: number; runId: string; wouldChange: boolean; wouldRefuse?: boolean; }

payload.driftCount

number = ...

payload.runId

string = Uuid

payload.wouldChange

boolean = ...

payload.wouldRefuse?

boolean = ...

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "bootstrap.setup-code-issued"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { installerRunId: string; principal: "setup:installer"; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"bootstrap.setup-code-issued" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ installerRunId: string; principal: "setup:installer"; }

payload.installerRunId

string = InstallerRunId

payload.principal

"setup:installer" = ...

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "bootstrap.setup-code-reissued"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { installerRunId: string; principal: "setup:installer"; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"bootstrap.setup-code-reissued" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ installerRunId: string; principal: "setup:installer"; }

payload.installerRunId

string = InstallerRunId

payload.principal

"setup:installer" = ...

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "bootstrap.setup-redeemed"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { forwardedAddress?: string; installerRunId: string; principal: "setup:root"; socketAddress?: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"bootstrap.setup-redeemed" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ forwardedAddress?: string; installerRunId: string; principal: "setup:root"; socketAddress?: string; }

payload.forwardedAddress?

string = ...

The client address the edge forwarded, when it forwarded one that is an address.

payload.installerRunId

string = InstallerRunId

payload.principal

"setup:root" = ...

payload.socketAddress?

string = ...

The peer address of the connection. Behind the edge this is the edge's. Absent when the service could not read one: an absence says "unknown", which a placeholder address would have said falsely.

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "bootstrap.setup-code-burned"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "denied"; payload: { attempts: number; forwardedAddress?: string; installerRunId: string; principal: "setup:root"; socketAddress?: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"bootstrap.setup-code-burned" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"denied" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ attempts: number; forwardedAddress?: string; installerRunId: string; principal: "setup:root"; socketAddress?: string; }

payload.attempts

number = ...

payload.forwardedAddress?

string = ...

The client address the edge forwarded, when it forwarded one that is an address.

payload.installerRunId

string = InstallerRunId

payload.principal

"setup:root" = ...

payload.socketAddress?

string = ...

The peer address of the connection. Behind the edge this is the edge's. Absent when the service could not read one: an absence says "unknown", which a placeholder address would have said falsely.

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "bootstrap.setup-reopened"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { fromEngineVersion: number; installerRunId: string; principal: "setup:installer"; reopenedAtStep: "anchor" | "identifiers" | "organizations" | "identity-provider" | "accounts" | "key-store" | "configuration"; toEngineVersion: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"bootstrap.setup-reopened" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ fromEngineVersion: number; installerRunId: string; principal: "setup:installer"; reopenedAtStep: "anchor" | "identifiers" | "organizations" | "identity-provider" | "accounts" | "key-store" | "configuration"; toEngineVersion: number; }

payload.fromEngineVersion

number = EngineVersion

The engine version setup was completed with.

payload.installerRunId

string = InstallerRunId

payload.principal

"setup:installer" = ...

payload.reopenedAtStep

The first step the completing version lacked.

payload.toEngineVersion

number = EngineVersion

The engine version of the image that reopened it. Always higher.

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "bootstrap.setup-step-applied"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { changed: boolean; environment?: string; governingAccount?: "created" | "present" | "skipped"; identifierMethod?: "webvh" | "web"; invitationSent?: boolean; principal: "setup:root"; runId: string; step: "anchor" | "identifiers" | "organizations" | "identity-provider" | "accounts" | "key-store" | "configuration"; versionId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"bootstrap.setup-step-applied" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ changed: boolean; environment?: string; governingAccount?: "created" | "present" | "skipped"; identifierMethod?: "webvh" | "web"; invitationSent?: boolean; principal: "setup:root"; runId: string; step: "anchor" | "identifiers" | "organizations" | "identity-provider" | "accounts" | "key-store" | "configuration"; versionId: string; }

payload.changed

boolean = ...

payload.environment?

string = ...

With governingAccount: the environment class the step ran in.

payload.governingAccount?

"created" | "present" | "skipped" = ...

On the accounts step only (DW15, rule 7): whether this apply created the governing account, found it already there, or skipped it because the root account also governs. A skip is recorded so that it is a dated fact and not an absence.

payload.identifierMethod?

"webvh" | "web" = ...

On the identifiers step only (W6), when the answers asked for the anchor's own identifier: the method it was asked with. Absent when no anchor identifier was asked for, so an absence is not read as a default.

payload.invitationSent?

boolean = ...

With governingAccount: created: whether the invitation was handed to the mail relay.

payload.principal

"setup:root" = ...

payload.runId

string = Uuid

The run, as in the setup service's log.

payload.step

payload.versionId

string = Uuid

The configuration version the step was applied for.

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "bootstrap.setup-completed"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { engineVersion: number; principal: "setup:root"; versionId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"bootstrap.setup-completed" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ engineVersion: number; principal: "setup:root"; versionId: string; }

payload.engineVersion

number = EngineVersion

payload.principal

"setup:root" = ...

payload.versionId

string = Uuid

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "signing-key.register"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { keyId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"signing-key.register" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ keyId: string; }

payload.keyId

string = KeyId

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "placement.quota-held"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "denied"; payload: { perWindow: number; placed: number; windowSeconds: number; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"placement.quota-held" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"denied" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ perWindow: number; placed: number; windowSeconds: number; }

payload.perWindow

number = ...

payload.placed

number = ...

payload.windowSeconds

number = ...

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "identifier.publish"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success" | "denied"; payload: { assertionKeyIds: string[]; commitsTo?: string; did?: string; identifierId: string; method: "webvh" | "web"; reason?: "document-mismatch" | "agent-refused" | "host-unverified" | "host-taken"; signedBy?: string; version: number; versionId?: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"identifier.publish" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" | "denied" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ assertionKeyIds: string[]; commitsTo?: string; did?: string; identifierId: string; method: "webvh" | "web"; reason?: "document-mismatch" | "agent-refused" | "host-unverified" | "host-taken"; signedBy?: string; version: number; versionId?: string; }

payload.assertionKeyIds

string[] = ...

payload.commitsTo?

string = ...

payload.did?

string = ...

payload.identifierId

string = Uuid

payload.method

"webvh" | "web" = IdentifierMethodSchema

payload.reason?

"document-mismatch" | "agent-refused" | "host-unverified" | "host-taken" = ...

payload.signedBy?

string = ...

payload.version

number = ...

payload.versionId?

string = ...

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "identifier.key-discard"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { identifierId: string; keyIds: string[]; reason: "spent" | "unpublished"; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"identifier.key-discard" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ identifierId: string; keyIds: string[]; reason: "spent" | "unpublished"; }

payload.identifierId

string = Uuid

payload.keyIds

string[] = ...

payload.reason

"spent" | "unpublished" = ...

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Type Literal

{ action: "bootstrap.root-invite"; actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; }; correlationId: string; occurredAt: string; onBehalfOf?: string; outcome: "success"; payload: { principal: "setup:installer"; runId: string; versionId: string; }; payloadHash: string; producerModule: string; recordId: string; target?: { id: string; type: string; }; tenant: string; }

An audit record.

action

"bootstrap.root-invite" = ...

actor

correlationId

string = ...

occurredAt

string = Timestamp

onBehalfOf?

string = ...

outcome

"success" = ...

Exactly the outcomes the action's registry entry lists.

payload

{ principal: "setup:installer"; runId: string; versionId: string; }

payload.principal

"setup:installer" = ...

payload.runId

string = Uuid

This resend, as in the command's output.

payload.versionId

string = Uuid

The configuration version the realm and the address were read from.

payloadHash

string = ...

producerModule

string = ...

recordId

string = Uuid

target?

{ id: string; type: string; } = ...

target.id

string = Uuid

target.type

string = ...

tenant

string = Tenant

Returns

Omit<AuditRecorded, "payload">

A copy of the record with no payload key.

Parameters​

record​

Type Literal​

action​

actor​

correlationId​

occurredAt​

onBehalfOf?​

outcome​

payload​

payload.kind​

payload.path​

payloadHash​

producerModule​

recordId​

target?​

target.id​

target.type​

tenant​

Type Literal​

action​

actor​

correlationId​

occurredAt​

onBehalfOf?​

outcome​

payload​

payload.subjectId​

payloadHash​

producerModule​

recordId​

target?​

target.id​

target.type​

tenant​

Type Literal​

action​

actor​

correlationId​

occurredAt​

onBehalfOf?​

outcome​

payload​

payload.anchorCreated​

payload.identitiesCreated​

payload.organizationsCreated​

payloadHash​

producerModule​

recordId​

target?​

target.id​

target.type​

tenant​

Type Literal​

action​

actor​

correlationId​

occurredAt​

onBehalfOf?​

outcome​

payload​

payload.messageId​

payload.reason​

payload.schema​

payloadHash​

producerModule​

recordId​

target?​

target.id​

target.type​

tenant​

Type Literal​

action​

actor​

correlationId​

occurredAt​

onBehalfOf?​

outcome​

payload​

payload.bundle​

Parameters

record

Type Literal

action

actor

correlationId

occurredAt

onBehalfOf?

outcome

payload

payload.kind

payload.path

payloadHash

producerModule

recordId

target?

target.id

target.type

tenant

Type Literal

action

actor

correlationId

occurredAt

onBehalfOf?

outcome

payload

payload.subjectId

payloadHash

producerModule

recordId

target?

target.id

target.type

tenant

Type Literal

action

actor

correlationId

occurredAt

onBehalfOf?

outcome

payload

payload.anchorCreated

payload.identitiesCreated

payload.organizationsCreated

payloadHash

producerModule

recordId

target?

target.id

target.type

tenant

Type Literal

action

actor

correlationId

occurredAt

onBehalfOf?

outcome

payload

payload.messageId

payload.reason

payload.schema

payloadHash

producerModule

recordId

target?

target.id

target.type

tenant

Type Literal

action

actor

correlationId

occurredAt

onBehalfOf?

outcome

payload

payload.bundle