Appendix: Audit Events Examples

Audit messages, when logging to sysout (the default), uses formatted JSON string instead of formatted string.

The following provides some examples of audit events; i.e., the content is not an exhaustive catalog of the audit events.

Audit messages are async.

Examples: Service Startup/Shutdown Events

service-started

{
   "@context" : [
      "https://www.w3.org/ns/activitystreams",
      "https://schema.inrupt.com/audit/v1.jsonld"
   ],
   "id" : "urn:uuid:f762e7da-4716-4ed1-9fef-6674c0d5b314",
   "type" : [
      "Activity"
   ],
   "name" : "service-started",
   "summary" : "Service inrupt-provision-postgres-s3 has started up",
   "generator" : {
      "qualifiedAssociation" : "1",
      "type" : [
         "SoftwareApplication"
      ],
      "wasAssociatedWith" : "ess-pod-provision-b984d649b-2q8xr",
      "id" : "https://provision.example.com/",
      "name" : "inrupt-provision-postgres-s3"
   },
   "actor" : [ ],
   "object" : [
      {
         "name" : "quarkus",
         "qualifiedAssociation" : "2.2.0"
      }
   ],
   "instrument" : [ ],
   "result" : [ ],
   "identifier" : "ee61bf8ac01c41f7811debe09d84b0e0",
   "published" : "2023-12-06T01:44:47.218214562Z"
}

service-shutdown

Examples: Authorization Code Flow Events

openid-authorization-initialized

openid-backend-idp-login

openid-token-requested

uma-token-created

Examples: WebID/Pod Provision Events

webid-created

pod-provisioned

provisioned-pod-access-control

Note

During Pod creation, both provisioned-pod-access-control and acr-created events are issued (along with other events). Once a Pod is created, if an ACR is created for a new resource, only the acr-created event is issued.

Examples: Access Control Resource (ACR) Events

acr-created

Note

During Pod creation, both provisioned-pod-access-control and acr-created events are issued (along with other events). Once a Pod is created, if an ACR is created for a new resource, only the acr-created event is issued.

acr-updated

acr-deleted

Examples: Resource Lifecycle Events

resource-created

resource-read

Note

Starting in 2.2, Pod resource lifecycle events no longer include a StorageCreator object. See the instrument.hasDataSubject field instead.

resource-updated

resource-deleted

Examples: Access Requests/Grants Lifecycle Events

The following displays some of the events related to access requests & access grants lifecycle.

Note

Authenticated access requests/grants/denials events are preceded by a corresponding request-authorized event that contain additional information, such as the access grant service endpoint, the WebID, the client id, etc. However, other than the service endpoint, the same information may be found in the access-* event messages themselves.

For each access requests/grants/denials lifecycle event that are authenticated, the associated request-authorized events are also provided below. You can find the corresponding request-authorized event using the instrument field.

access-request-created

And the associated (i.e., "identifier" : "a56ec16479774029bc3ee10d4bb2f347") request-authorized event:

access-grant-created

And the associated (i.e., "identifier" : "3e6fd53802cb4f939ace03aec16ac031") request-authorized event:

access-request-read

And the associated (i.e., "identifier" : "3df615dea1c8425f92765f79b40ff149") request-authorized event:

access-grant-read

Tip

The object field, not the result field, contains the Access Grant.

And the associated (i.e., "identifier" : "bfe04951202643e788eeb569205c060b") request-authorized event:

access-request-verified

Passed Verification Event

Tip

The result field contains information about whether the verification has passed or failed.

And the associated (i.e., "identifier" : "33e2f68ce12a4ea2b5815997c95aca39") request-authorized event:

Failed Verification Event

Tip

The result field contains information about whether the verification has passed or failed.

And the associated (i.e., "identifier" : "f2dd6fa40d9c4b74a30bd1cab02b5abc") request-authorized event:

access-grant-verified

Tip

The result field contains information about whether the verification has passed or failed.

And the associated (i.e., "identifier" : "1f62aae1aa0745b89a2e19cadade449c") request-authorized event:

access-grant-queried

And the associated (i.e., "identifier" : "e14d7c7f65bd461c8063401df3f2b3c3") request-authorized event:

access-grant-revoked

And the associated (i.e., "identifier" : "48348a98ee3f4a50add60836625c77c2") request-authorized event:

revocation-status-read

Note

As part of the access grant to UMA access token exchange (which is an unauthenticated event), revocation-status-read events occur. These revocation-status-read events, which are also unauthenticated, do not have an associated request-authorized event.

Examples: Query

Last updated