Appendix: Audit Events Examples
Audit messages, when logging to sysout (the default), uses formatted JSON string instead of formatted string.
The following provides some examples of audit events; i.e., the content is not an exhaustive catalog of the audit events.
Examples: Service Startup/Shutdown Events
service-started
service-started{
"@context" : [
"https://www.w3.org/ns/activitystreams",
"https://schema.inrupt.com/audit/v1.jsonld"
],
"id" : "urn:uuid:f762e7da-4716-4ed1-9fef-6674c0d5b314",
"type" : [
"Activity"
],
"name" : "service-started",
"summary" : "Service inrupt-provision-postgres-s3 has started up",
"generator" : {
"qualifiedAssociation" : "1",
"type" : [
"SoftwareApplication"
],
"wasAssociatedWith" : "ess-pod-provision-b984d649b-2q8xr",
"id" : "https://provision.example.com/",
"name" : "inrupt-provision-postgres-s3"
},
"actor" : [ ],
"object" : [
{
"name" : "quarkus",
"qualifiedAssociation" : "2.2.0"
}
],
"instrument" : [ ],
"result" : [ ],
"identifier" : "ee61bf8ac01c41f7811debe09d84b0e0",
"published" : "2023-12-06T01:44:47.218214562Z"
}service-shutdown
service-shutdownExamples: Authorization Code Flow Events
openid-authorization-initialized
openid-authorization-initializedThe actor field is empty because the agent has yet to log in.
openid-backend-idp-login
openid-backend-idp-loginopenid-token-requested
openid-token-requestedTip
The openid-token-requested occurs for both new and refresh token requests. The summary field specifies whether the event is for a new or a refresh token.
uma-token-created
uma-token-createdExamples: WebID/Pod Provision Events
webid-created
webid-createdpod-provisioned
pod-provisionedprovisioned-pod-access-control
provisioned-pod-access-controlExamples: Access Control Resource (ACR) Events
acr-created
acr-createdacr-updated
acr-updatedacr-deleted
acr-deletedExamples: Resource Lifecycle Events
resource-created
resource-createdresource-read
resource-readresource-updated
resource-updatedresource-deleted
resource-deletedExamples: Access Requests/Grants Lifecycle Events
The following displays some of the events related to access requests & access grants lifecycle.
access-request-created
access-request-createdAnd the associated (i.e., "identifier" : "a56ec16479774029bc3ee10d4bb2f347") request-authorized event:
access-grant-created
access-grant-createdAnd the associated (i.e., "identifier" : "3e6fd53802cb4f939ace03aec16ac031") request-authorized event:
access-request-read
access-request-readTip
The object field, not the result field, contains the Access Request.
And the associated (i.e., "identifier" : "3df615dea1c8425f92765f79b40ff149") request-authorized event:
access-grant-read
access-grant-readAnd the associated (i.e., "identifier" : "bfe04951202643e788eeb569205c060b") request-authorized event:
access-request-verified
access-request-verifiedPassed Verification Event
And the associated (i.e., "identifier" : "33e2f68ce12a4ea2b5815997c95aca39") request-authorized event:
Failed Verification Event
And the associated (i.e., "identifier" : "f2dd6fa40d9c4b74a30bd1cab02b5abc") request-authorized event:
access-grant-verified
access-grant-verifiedAnd the associated (i.e., "identifier" : "1f62aae1aa0745b89a2e19cadade449c") request-authorized event:
access-grant-queried
access-grant-queriedAnd the associated (i.e., "identifier" : "e14d7c7f65bd461c8063401df3f2b3c3") request-authorized event:
access-grant-revoked
access-grant-revokedAnd the associated (i.e., "identifier" : "48348a98ee3f4a50add60836625c77c2") request-authorized event:
revocation-status-read
revocation-status-readExamples: Query
Last updated