Audit events

auth.signup

An end user signed up for dispute.markets.

tenant.create

A workspace was created; the person who created it is its first owner. source: signup (the sandbox a new sign-up gets), bootstrap (an account that had none) or create (POST /v1/workspaces); copied_settings_from names the workspace whose default currency and time zone it started with.

tenant.copy_settings

An owner created a new workspace (target_workspace_id) starting from this workspace's default currency and time zone (fields). Written in this, the source, workspace; nothing here changed.

auth.switch_workspace

A person switched their session into this workspace (from_workspace_id: the workspace the session was in, absent when it had none). Written in the workspace switched to. outcome: failed (workspace_not_found, workspace_switch_not_allowed) is written in the workspace the session was in.

auth.signin

Password sign-in. success when the password was right (mfa_required when a challenge follows); failed (invalid_credentials) only for an identifier that is a tenant member, written just after the response and coalesced per identifier per minute. Only success rows carry the caller's correlation id; a failed attempt cannot be found by it.

auth.bootstrap

A signed-in end user bootstrapped or re-entered their tenant. denied (already_a_member) when a team member (synthetic account) tried to create a workspace; written in the workspace it belongs to.

auth.session_expire

A synthetic account's access token was refused because it is older than the session.max_age flow variant allows (outcome=failed, error_code=session_expired; the request answered 401). Written exactly once per token (the first refused request, on whichever server). max_age_s is the limit that applied.

auth.refresh

Token refresh; recorded only when it fails and the refresh token was issued for a known workspace.

mfa.send_code

An MFA code was e-mailed: for a sign-in challenge (the challenge must come from a sign-in this API attributed to the tenant), or to a signed-in user for a step-up.

mfa.verify

The MFA challenge of a sign-in was answered. failed rows (wrong code) are written just after the response and coalesced per challenge per minute.

mfa.recover

A recovery code was used to finish a sign-in. failed rows as for mfa.verify.

mfa.step_up

A signed-in user re-proved MFA (step-up). A wrong code (401) is failed with error_code invalid_code (step_up_rejected for any other 401 from Auth), coalesced per user per minute.

mfa_factor.create

An MFA factor was enrolled (pending verification).

mfa_factor.verify

A pending MFA factor was verified and activated.

mfa_factor.delete

An MFA factor was removed.

recovery_codes.regenerate

MFA recovery codes were regenerated (the codes are never recorded).

email_verification.resend

The e-mail verification message was sent again (sent: false when the account has no e-mail).

email_verification.confirm

An e-mail address was verified with its code.

password.forgot

A password reset was requested for a tenant member's e-mail. Written just after the response, coalesced per address per minute; the caller proved nothing, so the correlation id is only metadata.unverified_correlation_id.

password.reset

A password was reset with a reset code. Not recorded yet: a reset code does not say which account or workspace it belongs to, so the event cannot be placed in a workspace's trail.

user_email.create

An e-mail address was added to the signed-in user, or its code re-sent (existing); sent: false when it was already verified. The address itself is never recorded.

user_email.verify

A secondary e-mail address was verified.

user_email.delete

A secondary e-mail address was removed.

synthetic_account.create

A synthetic account was provisioned (credentials are never recorded).

synthetic_account.update

A synthetic account's label, role, notes or flow profile changed (flow_profile as {from, to} refs, only when it changed). denied with required_permission: flow.write when flow_profile was sent without that permission.

synthetic_account.flow_profile_releasedasync

A synthetic account's flow profile assignment was cleared because the profile was archived more than 24 hours ago (system; changes.flow_profile {from, to: null}, reason: profile_archived). Written by the release job scheduled at archive time, or by the hourly flow retention for leftovers.

synthetic_account.rotate_password

A synthetic account's password was rotated (also written by rotate-credentials when the password rotated but the MFA rotation then failed). On an email-mode account this switches it back to a generated password (changes.credential_mode) and revokes any unused setup link (setup_link_revoked).

synthetic_account.rotate_mfa

A synthetic account's TOTP secret was rotated.

synthetic_account.rotate_credentials

A synthetic account's password and TOTP secret were rotated together. On an email-mode account this switches it back to a generated password (changes.credential_mode) and revokes any unused setup link (setup_link_revoked).

synthetic_account.disable_mfa

MFA was turned off for a synthetic account.

synthetic_account.revoke_sessions

Every session of a synthetic account was revoked (owner only; a security action): its next request with an access token issued before this answers 401 session_revoked, and its refresh tokens stop working at the auth service too (auth_sessions_revoked; false when that call failed and only the access-token cut-off applies). A new sign-in works.

synthetic_account.expire_sessions

A synthetic account's sessions were expired on purpose (flow.write; a simulation for testing the client's expiry handling): its next request with a token issued before this answers 401 session_expired. A new sign-in works.

synthetic_account.delete

A synthetic account was archived and its sign-in account removed; setup_link_revoked when an unused setup link stopped working with it. reason: mail_owner_departed when it was archived as a disposition of removing or demoting the person its mail went to (docs/15 §5.5).

synthetic_account.send_setup_email

A setup link was emailed to an email-mode synthetic account (docs/14): at creation (reason: create), on a resend (resend), a restart that signed the account out first (restart), an address change (email_change) or a switch from a generated password (mode_change, with changes.credential_mode). credentials_revoked says whether the password, sessions and MFA factors were revoked first; delivery is queued or send_failed (Envoi refused or was unreachable; the link was not delivered). outcome: failed with setup_email_rate_limited, setup_pending_limit, setup_email_suppressed or setup_email_unavailable when nothing was sent. Neither the link, the base address nor the derived address is recorded; email_changed says whether the address changed.

synthetic_account.complete_setup

A setup link was used to set an email-mode synthetic account's password (changes.credential_status {from: pending, to: set}; mfa_method names the factor provisioned with it, or null). The actor is the synthetic account. outcome: failed with error_code (setup_link_used, setup_link_expired, setup_link_revoked, password_rejected, mfa_setup_failed, credential_change_in_progress) when the link maps to an account; an unknown link is not attributable and writes no row.

synthetic_account.setup_email_bouncedasync

A setup mail could not be delivered: the address it was sent to is on the dispute.markets mail suppression list (a hard bounce or a complaint was recorded), found by the synthetic_account.setup_delivery_check job 5 or 30 minutes after the send (system; source: suppression_list, checked_at the time of the lookup). The link is revoked and the account's setup.status reads bounced until a link is sent to a different address; a resend to the same address answers 409 setup_email_suppressed without a send. The address is not recorded.

workspace_invite.create

An owner invited someone to the workspace by e-mail (role, the invited email, shown to owners only; expires_at; delivery is sent or send_failed; replaces_expired_invite_id when the address had an expired invite, which this one replaces). The link is never recorded. outcome: failed with error_code when nothing was sent: invite_rate_limited, invite_pending_limit, member_limit_reached, invite_undeliverable, invite_paused, invite_unavailable, invite_pending, already_a_member, synthetic_address, step_up_required, email_not_verified.

tenant.delete

An owner deleted the workspace (DELETE /v1/workspaces/:id). From this row on every member's next request here answers 401 account_revoked, its API keys answer 401 invalid_api_key, its webhooks are disabled (webhooks_disabled), its scheduled jobs and background tasks are canceled (jobs_canceled, tasks_canceled), its pending invites are cancelled (invites_revoked) and every member was removed (members_removed, removal_reason: workspace_deleted). The counts are what the confirm dialog showed (transactions, disputes, reports, webhooks, people, synthetic_accounts, api_key_count; api_key_count absent when Auth could not be asked). step_up says whether a second factor from the last 5 minutes was required (an empty workspace whose only member is the caller needs none). The data is purged after purge_after (30 days; tenant.purge follows). outcome: failed with confirm_name_mismatch, step_up_required.

tenant.purgeasync

A deleted workspace's data was purged, 30 days after tenant.delete (system, on_behalf_of: workspace_purge): every row of every table except this audit trail (rows_deleted, files_deleted evidence and report files), the Auth accounts of its synthetic accounts (synthetic_accounts_deleted) and the Auth tenant (auth_tenant: deleted, or absent when it was already gone). The last row ever written for the workspace.

workspace_member.reconcileasync

The hourly reconcile (system, on_behalf_of: membership_reconcile) compared the workspace's people and synthetic accounts with the authentication service, which only ever narrows access. correction: auth_removed (an Auth membership without a live member here was removed), auth_narrowed (an Auth role broader than the role here was set to it, auth_role → role) or account_deleted (the person's Auth account was deleted: their row here was removed and they no longer count as an owner). drift (alert only, nothing changed): auth_membership_missing (a live member here has no Auth membership; an operator may have removed it on purpose) or auth_role_narrower (the Auth role grants less than the role here). The target is the member (wm_… / sa_…) when one exists here.

workspace_invite.resend

An owner sent an invite again: a new link (this row's target, send_count the sends to that address so far) replaces the previous one (previous_invite_id), which stops working. delivery as on create.

workspace_invite.revoke

A pending invite was cancelled: by an owner (reason: revoked), because the owner who sent it stopped being an owner (inviter_lost_owner, written by the removal or role change, or by the hourly reconcile when their Auth account was deleted), because its mail bounced (bounced, system, found by the delivery check 5 or 30 minutes after the send), or because the workspace was deleted (workspace_deleted).

workspace_invite.pausedasync

A recipient marked an invite as spam (an SES complaint, found by the delivery check): the owner who sent it cannot invite anyone, in any workspace, until paused_until (24 hours). System row in the workspace of the invite.

workspace_invite.accept

Someone joined the workspace with an invite (role; created_account when they signed up for it). The actor is the person who joined. outcome: failed with error_code (invite_email_mismatch, synthetic_account_not_allowed, already_a_member, membership_limit_reached, member_limit_reached, invite_expired, invite_used, invite_revoked, auth_unavailable) when the invite was found but the join refused; coalesced per person per minute.

workspace_member.update

An owner changed a person's role (changes.role). Demoting an owner also cancels the invites they sent (invites_revoked) and carries the dispositions of the synthetic accounts mailed to them or whose credentials they knew (synthetic_dispositions, sa_…:move_to_me|rotate|archive). outcome: failed with last_owner when it would leave the workspace without an owner, or step_up_required, disposition_required.

workspace_member.remove

An owner removed a person from the workspace: their next request here answers 401 account_revoked, their API keys stop working (api_keys_revoked), the invites they sent are cancelled (invites_revoked) and their running background tasks here are cancelled (tasks_canceled). What they left behind follows the dispositions: synthetic accounts mailed to them or whose credentials they knew (synthetic_dispositions, sa_…:move_to_me|rotate|archive), and the webhooks, webhook sinks and playbooks they created (webhooks_disabled/webhooks_kept, sinks_disabled/sinks_kept, playbooks_disabled/playbooks_kept); each item also gets its own row. outcome: failed with last_owner, step_up_required or disposition_required.

workspace_member.leave

A person left the workspace. Their next request here answers 401 account_revoked (their sign-in and their other workspaces are untouched), their API keys here stop working, the invites they sent are cancelled (invites_revoked) and their running background tasks here are cancelled (tasks_canceled). Synthetic accounts mailed to them were archived, and those whose credentials they knew were archived or had their credentials reset (synthetic_dispositions, sa_…:rotate|archive); the webhooks, webhook sinks and playbooks they created are disabled (webhooks_disabled, sinks_disabled, playbooks_disabled), each with its own row. outcome: failed with last_owner (the last owner cannot leave) or synthetic_mail_owner (synthetic accounts are still mailed to them).

synthetic_account.reset_credentials

A synthetic account's credentials were reset to ones nobody knows because a person who saw or set its password, or whose mailbox received its mail, was removed, left or stopped being an owner (docs/15 §5.6). Its password was replaced (nobody is shown the new one), its sessions were ended at the authentication service (auth_sessions_revoked) and its access tokens answer 401 session_revoked; any unused setup link stopped working (setup_link_revoked). The account keeps its role and history: an owner rotates its credentials (generated mode) or sends a new setup link (email mode) to use it again. reason: creator_departed (someone who knew the credentials left) or mail_owner_departed (its mail moved to the acting owner).

synthetic_account.move_mail

An owner moved a synthetic account's mail to themselves: its sign-in address is re-derived on one of their verified e-mails (email_changed; an address on the agents.dispute.markets sink keeps its address and only changes hands), any unused setup link stops working (setup_link_revoked), and setup, reset and sign-in codes go to their mailbox from now on. reason: mail_owner_departed when it was a disposition of a removal or demotion, requested from the row action.

webhook.revouch

A webhook created by a person who left the workspace was kept: an owner vouched for it (reason: creator_departed); it keeps sending.

playbook.revouch

A playbook created by a person who left the workspace was kept: an owner vouched for it (reason: creator_departed); it keeps running.

webhook_sink.revouch

A webhook sink created by a person who left the workspace was kept: an owner vouched for it (reason: creator_departed).

dispute.accept

The merchant accepted the dispute (no challenge).

dispute.challenge

The merchant challenged the dispute with evidence.

dispute.respond_rfi

The merchant answered a request for information.

dispute.arbitrate

The merchant escalated the dispute to arbitration.

dispute.add_note

A note was added to the dispute (the text is not recorded).

dispute.add_to_decline_list

The dispute's card or customer was added to the decline list.

dispute.request_support

A support case was opened for the dispute.

dispute.bulk_decide

One decision applied to many disputes; parent of one child row per dispute.

dispute.apply_playbook

A playbook was applied to disputes; parent of one child row per dispute.

evidence.create_upload_url

A presigned upload URL was issued for dispute evidence (the URL is not recorded).

evidence.create

An uploaded evidence file was attached to the dispute. status is available, or processing under the evidence.processing flow variant (dispute-api/037; processing_until and job_id name its evidence.process job). failed with evidence_too_large (over the 25 MB platform cap or evidence.limits.max_bytes), evidence_type_not_allowed or evidence_limit_reached (evidence.limits) when the upload was refused and the stored file deleted.

evidence.processasync

An evidence file uploaded under the evidence.processing flow variant (dispute-api/037) finished processing: changes.status from processing to available, or to rejected with rejection_reason (virus_detected, unsupported_type, unreadable; the stored file was deleted). processing_canceled / processing_failed when its evidence.process job was canceled or failed for good. Actor system, on_behalf_of the uploader, with the upload's correlation id. webhook_enabled: the dispute has lifecycle.webhooks enabled, so an evidence.processed webhook went to its simulation subscribers.

report.create

A report was created. Under report.limits (dispute-api/060) it carries limit and live_count (the run's live reports including this one; on a refused create, failed + report_limit_reached, the count that refused it). Synchronous (the default): built during the request (failed + report_too_large above 100,000 rows, report_build_failed when the build throws, or simulated_<code> for the code a report.outcome flow variant chose). Async (report.delivery {mode: "async"}, delivery: async): queued, rows null; its report.build row follows.

report.delete

A report was deleted (a tombstone; reads answer 410 report_deleted). status_at_delete is the status it had; canceled_job_id the queued report.build job the delete canceled (null when none). A repeat delete answers 200 and writes this row again with already_deleted: true and no changes. A report.purge row follows once the file is gone. flow carries the request's report.limits when one applied.

report.purgeasync

A deleted report's file was removed from storage (system actor, on_behalf_of the deleter, with the delete's correlation id). object_existed is false when there was no file (a queued, failed or expired report).

report.buildasync

An async report finished building (system actor, on_behalf_of its creator, with the creator's correlation id): success (done), or failed with the report's error_code (simulated_report_timeout / simulated_report_too_large / simulated_internal when report.outcome simulated the failure, report_too_large, report_build_failed, canceled, job_lease_expired). flow carries the stamped variants.

report.retry

A failed report was run again (changes.attempt). delivery: sync: built during the request, the row's outcome is the build's; delivery: async: queued again, a report.build row follows.

playbook.create

A playbook was created.

playbook.update

A playbook changed.

playbook.delete

A playbook was deleted.

playbook.dry_run

A playbook was evaluated without applying it.

playbook.disableasync

A playbook was disabled: one created by an API key because the key expired or was revoked (system, api_key_id), or one created by a person who was removed from the workspace (reason: creator_departed, the remover's disposition).

webhook.create

A webhook endpoint was registered (the signing secret is never recorded).

webhook.update

A webhook endpoint changed.

webhook.delete

A webhook endpoint was deleted.

webhook.test

A test event was sent to one webhook endpoint (only that webhook: webhooks_scheduled is always 1). failed with webhook_delivery_failed when the endpoint did not answer 2xx, or webhook_not_found (404) for an unknown id.

webhook.disableasync

A webhook was disabled: one created by an API key because the key expired or was revoked (system, api_key_id), one created by a person who was removed from the workspace (reason: creator_departed, the remover's disposition), or every enabled webhook of a workspace being deleted (reason: workspace_deleted).

generate_job.create

A synthetic-data generate job was started. trickle_batches: with generate.trickle, how many batches (a minute apart) the job will run (dispute-api/038).

generate_job.runasync

A generate job finished: success when its last chunk committed, failed with generate_failed (a chunk kept failing), job_lease_expired (a chunk was interrupted too often) or canceled. Never the exception text. With lifecycle.webhooks enabled, webhooks_fired / webhooks_skipped count the dispute.created webhooks (at most 200 per job); lifecycle_fallback_auto counts disputes left auto because the workspace scheduled 20,000 lifecycle transitions today (dispute-api/033); trickle_batches counts the batches of a generate.trickle job (dispute-api/038).

generate_job.cleanupasync

Exactly one generate job's data was deleted. Written with the response for a synchronous cleanup (at most 2,000 transactions), else by the last chunk of the generate.cleanup background task (202), with the totals and chunks; failed with the stable code if that task failed or was canceled.

generate_job.cancel

A generate job was canceled: its remaining chunks stopped and it ended canceled, keeping the transactions already committed (rows_done). canceled: false when it had already finished (no change).

scheduled_job.fast_forward

Scheduled jobs were moved earlier (time travel). One row per call: moved of matched jobs, the first 50 ids in job_ids.

scheduled_job.cancel

Scheduled jobs were canceled (by the API, a report cancel, or a generate job cancel or cleanup). One row per call: canceled of matched jobs, the first 50 ids in job_ids.

scheduled_job.expireasync

A scheduled job failed for good because its runner kept losing its lease (failed, job_lease_expired); its target moves to its failed state in the same transaction.

flow_profile.create

A flow profile was created (version 1). Creating the same name with the same body again returns the existing profile and writes no row.

flow_profile.update

A flow profile got a new immutable version (changes.variants = the per-key {from, to} diff, changes.version the version move).

flow_profile.delete

A flow profile was archived: by its owner (DELETE, with the synthetic accounts still assigned to it), or by the hourly flow retention after 30 days unused (system, reason: unused). Archived profiles resolve for 24 hours, then stop.

tenant_flow_default.update

The workspace default flow profile changed (changes.default_profile {from, to} as fp_…@N refs, fp_platform for none). Applies to requests without a profile and to resources created afterwards only.

workspace_settings.update

The owner changed the workspace (changes = {from, to} for each field that changed: the name, company, default currency, default time zone, environment label or colour). Tenant-shared: every member sees the new values.

user_preferences.update

A signed-in user changed their own preferences (changes = {from, to} for each field that changed). Never an API key.

tenant_data.resetasync

Every synthetic transaction and dispute of the tenant was deleted (the audit trail survives). Written once, by the dev.reset background task when its last batch committed, with the totals; failed with the stable code if the task failed or was canceled.

lifecycle.run

A lifecycle pass ran (hourly cron or advance-lifecycle); parent of one row per dispute it moved.

dispute.expire_rfiasync

A request for information passed its deadline unanswered: the hourly pass, or (a scheduled dispute, dispute-api/033) its dispute.deadline job.

dispute.expireasync

A dispute passed its response deadline and expired: the hourly pass, or (a scheduled dispute, dispute-api/033) its dispute.deadline job.

dispute.ruleasync

The issuer ruled on a dispute under review (won or lost): the hourly pass, or (a scheduled dispute, dispute-api/033) its dispute.rule job. With transition: arbitration_ruling (dispute-api/034, lifecycle.escalation) it is the scheme ruling on a dispute in arbitration (arbitration_won / arbitration_lost), from the sub-key's own mode. ruling_mode is the stamped lifecycle.ruling mode (random for an unstamped dispute) and p the win probability a random/probability draw used, when set; an issuer_decision of won/lost overrides the mode.

dispute.escalateasync

An opt-in lifecycle.escalation transition (dispute-api/034) moved a dispute out of a status that is a dead end by default. transition names it: rfi_expired_to_chargeback (an expired RFI became a chargeback), rfi_responded (an answered RFI was closed, or escalated to a chargeback; outcome is close or escalate), issuer_cancel (the issuer withdrew an open chargeback) or won_reversal (a win reversed in pre-arbitration, once). p is the probability the dispute's draw was compared with, when one decided it. A reopened chargeback also changes respond_by (the fresh deadline). The hourly pass or advance-lifecycle for an auto dispute, its dispute.escalate job for a scheduled one. The arbitration ruling is dispute.rule with transition: arbitration_ruling.

dispute.lifecycle_stop

A scheduled dispute's lifecycle job was canceled, so its clock stopped: it is manual now (changes.lifecycle_mode), and only an advance-lifecycle that targets it moves it (dispute-api/033). job_id and kind name the canceled job.

dispute.complete_actionasync

An action acknowledged under dispute.action_ack (dispute-api/035) took effect: the dispute moved (changes.status). Actor system, on_behalf_of the requester, parent_id the request's own dispute.challenge / dispute.arbitrate row (with metadata.pending: true). action names the action, job_id its dispute.complete_action job (absent when the hourly repair sweep completed it after its job was lost, source: repair). failed with invalid_dispute_state when the dispute had already moved on (the pending action is cleared).

dispute.cancel_action

A pending action (dispute.action_ack, dispute-api/035) was dropped because its dispute.complete_action job was canceled: pending_action is cleared and the status is unchanged. action and job_id name what was canceled.

webhook_sink.create

A temporary webhook sink was created for a test.

webhook_sink.delete

A temporary webhook sink was retired before it expired (test cleanup), or because the person who created it was removed from the workspace (reason: creator_departed).

webhook_sink.receiveasync

A webhook sink received a delivery.

webhook_delivery.sendasync

A webhook delivery attempt (outcome failed on a non-2xx or network error). Retried attempts are rows of their own with the same delivery_id and attempt 2-5; retry_scheduled says whether another attempt follows. sequence is the body's sequence (first attempt). Under the webhook.delivery flow variant (simulated: true): error_code simulated_failure (an attempt recorded failed without sending), simulated_drop (never sent) or delivery_backlog_full; duplicate copies carry copy (1-3). Every attempt of a variant delivery also records the applied variant: flow_profile_id (the profile that supplied webhook.delivery), flow_source and flow_variants.webhook.delivery, so GET /v1/audit-events?flow_profile_id= finds the deliveries a profile shaped.

api_key.create

An API key was created (the secret is never recorded).

api_key.rotate

An API key was rotated; the old secret stays valid for the grace period.

api_key.revoke

An API key was revoked (already_revoked: true on a repeat, which changed nothing).

api_key.deactivateasync

An active key stopped working (revoked or rotated in the portal or API, revoked by the app owner, expired, or its creator was removed from the workspace); recorded the first time dispute.markets sees it inactive. Actor system; when a revoke or no-grace rotate here caused it, the row carries that request's request id and correlation id.

api_key.authenticate

A request with an API key was refused (outcome denied only; at most once per key per minute per pod).

api_key.useasync

Hourly per-pod summary of one API key's requests.

api.rate_limit_simulated

The api.rate_limit flow variant answered 429 rate_limited on a GET route (outcome=failed, error_code=simulated_rate_limited). Written once per correlation id and route, on the first simulated 429; the later ones of that run are not recorded. route is the route id (GET /v1/disputes), first_n_per_correlation how many calls answer 429, retry_after_s the Retry-After sent.

transaction.export

Transactions were exported as CSV: rows the rows sent, filters the filters given (status, card_brand, search, from, to). failed with export_too_large when more than 100,000 rows match (nothing is sent).

evidence.create_download_url

A presigned download URL was issued for an evidence file (the URL is not recorded): ttl_s its life in seconds, expired: true for a link signed in the past (evidence.download_url {mode: "expired"}).

report.create_download_url

A presigned download URL was issued for a report (the URL is not recorded): ttl_s its life in seconds, expired: true for a link signed in the past (report.download_url {mode: "expired"}).

audit_event.export

Audit events were exported (CSV or NDJSON).