Audited Events

This page enumerates Posit Connect’s auditable events.

There are many types of auditable events in Connect. For example, a user creating a group will generate the following event log:

time="2022-10-18T20:07:39.813Z" level=info msg="Added group Publishers" action=add_group actor_description="admin n (admin)" actor_guid=8c1c6df6-16bf-4901-b52c-50de0b1da233 actor_id=1 actor_role=administrator entry_id=73 group_guid=1b2c1790-c95f-4df3-9363-6563475070d0 group_id=2 group_name=Publishers type=audit

Notice that the data associated with the event is provided as key=value pairs. Every audit event will always include the following fields: time (UTC), level=info, type=audit, action, actor_id, actor_description, actor_guid, actor_role. The audit event message will be recorded as msg.

Some audit events will track additional fields. In the example above, group creation also records group_guid, group_id, and group_name.

Audit actors

Audited actions can be triggered by a user or by an automated system process. Each audited event specifies the type of actor which triggered the event.

Event records triggered by a user will have actor_id, actor_guid, actor_role and actor_description:

actor_id=4 actor_guid=8c1c6df6-16bf-4901-b52c-50de0b1da233 actor_role=publisher actor_description="Frank Castell (fcastell)"

Events triggered by the system will have the fixed fields actor_id=0 and actor_role=system. They will not have an actor_guid:

actor_id=0 actor_role=system actor_description="Scheduled email checker"

The actor_description provides more details about the system process which triggered the event.

Field data types

Data fields included in audit entries are of type string, regardless of the configured format (TEXT or JSON), except for *_id fields which are of type int. Example *_id fields include entry_id, content_id, user_id, and group_id.

Note

The time in every log entry is logged in UTC. E.g: time=2022-01-01T20:00:00.000Z

User events

`add_user`

Create a user.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type, user_guid, user_id, user_role

`edit_user`

Change an existing user.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, new_email, new_first_name, new_last_name, new_user_role, new_username, previous_email, previous_first_name, previous_last_name, previous_user_role, previous_username, time, type, user_guid, user_id, user_role

`remove_user`

Delete a user. This action can only be performed via the usermanager administration command.

Event logging fields: action, actor_description, actor_id, actor_role, entry_id, level, msg, time, type, user_guid, user_id, user_role

`update_lock_user`

Set or remove a lock for an existing user.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type, user_guid, user_id, user_role

`set_password`

Set password for user.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type, user_guid, user_id, user_role

`user_login`

A user has started a dashboard session.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type, user_guid, user_id, user_role

`user_login_failure`

A login attempt was unsuccessful.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type, user_guid, user_id, user_role

`web_sudo`

A user needed to reauthenticate for a privileged action after a WebSudo timeout.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type, user_guid, user_id, user_role

`activate_token`

Activate a token. Tokens are used by the rsconnect R package to authenticate a user.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type

`add_api_key`

Create an API key.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type

`edit_api_key`

Change an existing API key. This action can only be performed via the usermanager administration tool.

Event logging fields: action, actor_description, actor_id, actor_role, entry_id, level, msg, new_user_id, new_user_role, previous_user_id, previous_user_role, time, type

`remove_api_key`

Remove API key.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type

`create_oauth_integration`

Created OAuth integration.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type, user_guid, user_id, user_role

`remove_oauth_integration`

Removed OAuth integration.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type, user_guid, user_id, user_role

`update_oauth_integration`

Updated OAuth integration.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type, user_guid, user_id, user_role

`create_oauth_associations`

Created OAuth association.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type, user_guid, user_id, user_role

`remove_oauth_association`

Removed OAuth association.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type, user_guid, user_id, user_role

`remove_oauth_session`

Removed OAuth session.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type, user_guid, user_id, user_role

`oauth_integration_login`

OAuth integration login.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type, user_guid, user_id, user_role

`oauth_integration_logout`

OAuth integration logout.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type, user_guid, user_id, user_role

`oauth_integration_callback`

OAuth integration callback.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type, user_guid, user_id, user_role

Group events

`add_group`

Create group.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, group_guid, group_id, group_name, level, msg, time, type

`edit_group`

Change an existing group.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, group_guid, group_id, group_name, level, msg, new_name, new_owner_id, previous_name, previous_owner_id, time, type

`remove_group`

Delete a group.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, group_guid, group_id, group_name, level, msg, time, type

`add_group_member`

Add a user to a group.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, group_guid, group_id, group_name, level, msg, time, type, user_guid, user_id, user_role

`remove_group_member`

Remove a user from a group.

Content events

`add_application`

Add new content.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, content_guid, content_id, entry_id, level, msg, time, type

`remove_application`

Delete content.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, content_guid, content_id, entry_id, level, msg, time, type

`edit_application`

Change content settings.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, content_guid, content_id, entry_id, level, msg, new_access_type, new_connection_timeout, new_description, new_idle_timeout, new_init_timeout, new_load_factor, new_max_conns_per_process, new_max_processes, new_min_processes, new_name, new_read_timeout, new_title, previous_access_type, previous_connection_timeout, previous_description, previous_idle_timeout, previous_init_timeout, previous_load_factor, previous_max_conns_per_process, previous_max_processes, previous_min_processes, previous_name, previous_read_timeout, previous_title, time, type

`create_variant`

Create content variant.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, content_guid, content_id, entry_id, level, msg, time, type, variant_id, variant_key, variant_name

`edit_variant`

Change variant settings.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, content_guid, content_id, entry_id, level, msg, new_owner_id, previous_owner_id, time, type, variant_id, variant_key, variant_name

`promote_variant`

Promote variant.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, content_guid, content_id, entry_id, level, msg, new_rendering_id, previous_rendering_id, time, type, variant_id, variant_key, variant_name

`duplicate_variant`

Duplicate variant.

`remove_variant`

Remove variant.

`create_variant_manual_overrides`

Create manual overrides for variant.

`promote_variant_manual_overrides`

Promoted manual overrides for variant.

`variant_sender`

Request to email variant.

`variant_render`

Request to render variant.

`deploy_application`

Deploy content to the server. Content may need to be published after deployment.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, bundle_id, content_guid, content_id, entry_id, level, msg, time, type

`upload_bundle`

Upload a bundle for a content item.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, bundle_id, content_guid, content_id, entry_id, level, msg, time, type

`remove_bundle`

Remove a bundle.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, bundle_id, content_guid, content_id, entry_id, level, msg, time, type

`download_bundle`

Download a bundle.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, bundle_id, content_guid, content_id, entry_id, level, msg, time, type

`add_vanity`

Add vanity URL.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, content_guid, content_guid, content_id, content_id, entry_id, level, msg, time, type, vanity_id, vanity_prefix

`update_vanity`

Update vanity URL.

`remove_vanity`

Remove vanity URL.

`subscribe_app_variant`

Subscribe user to content variant.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type, user_guid, user_id, user_role, variant_id, variant_key, variant_name

`unsubscribe_app_variant`

Unsubscribe user from content variant.

`remove_rendering`

Removed rendering for a given content.

Event logging fields: action, actor_description, actor_id, actor_role, entry_id, level, msg, time, type

`updated_environment_variables`

Update environment variables.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, content_guid, content_id, entry_id, level, msg, time, type

`transfer_content`

Content ownership transfer.

`clear_variant_email_all`

Disable emailing scheduled reports to everyone on the server.

Event logging fields: action, actor_description, actor_id, actor_role, entry_id, level, msg, time, type, variant_id, variant_key, variant_name

`build_application`

Built bundle for content.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, bundle_id, content_guid, content_id, entry_id, level, msg, time, type

`add_thumbnail_to_content`

Add a preview image to a content item.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, content_guid, content_id, entry_id, level, msg, time, type

`delete_thumbnail_from_content`

Delete a preview image from a content item.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, content_guid, content_id, entry_id, level, msg, time, type

`register_kill_job_order`

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, content_guid, content_id, entry_id, job_host, job_id, job_key, job_pid, level, msg, time, type

`create_share_link`

Created share link.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, content_guid, content_id, entry_id, level, msg, time, type

`remove_share_link`

Removed share link.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, content_guid, content_id, entry_id, level, msg, time, type

Content permission events

`assign_user_app_role`

Give a user view or edit access to content.

`remove_user_app_role`

Remove a user from view or edit access list.

`assign_group_app_role`

Give a group view or edit access to content.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, content_guid, content_id, entry_id, group_guid, group_id, group_name, level, msg, time, type

`remove_group_app_role`

Remove a group from view or edit access list.

`clear_app_viewer_acl`

Change from a specific list of viewers to “just me”.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, content_guid, content_id, entry_id, level, msg, time, type

`permission_request`

Permission request to access content.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, content_access_request_id, content_access_request_role, content_access_request_status, content_guid, content_id, entry_id, level, msg, time, type

Git events

`set_git_repo`

Assign Git repository as source for content.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, content_guid, content_id, entry_id, git_branch, git_path, git_url, level, msg, time, type

`fetch_git_repo`

Fetch Git repository.

Event logging fields: action, actor_description, actor_id, actor_role, entry_id, git_branch, git_path, git_url, level, msg, time, type

`update_git_repo`

Update Git repository.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, git_branch, git_path, git_url, level, msg, new_branch, new_content_path, new_enabled, new_repository_url, previous_branch, previous_content_path, previous_enabled, previous_repository_url, time, type

`remove_git_repo`

Remove Git repository.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, content_guid, content_id, entry_id, level, msg, time, type

`bundle_git_repo`

Created bundle fom Git location.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, bundle_id, content_guid, content_id, entry_id, level, msg, time, type

Scheduled content events

`update_schedule`

Update content’s schedule.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, new_next_run, new_schedule, new_start_time, new_time_zone, previous_next_run, previous_schedule, previous_start_time, previous_time_zone, schedule_id, schedule_next_run, schedule_timezone, schedule_type, time, type

`add_schedule`

Schedule content run.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, schedule_id, schedule_next_run, schedule_timezone, schedule_type, time, type, variant_id, variant_key, variant_name

`remove_schedule`

Remove content’s schedule.

Tag/category events

`add_tag`

Create a tag/category.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, tag_id, tag_name, tag_version, time, type

`add_tag_with_parent`

Create tag as a child of some parent tag/category.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, tag_id, tag_name, tag_version, time, type

`remove_tag`

Delete a tag/category.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, tag_id, tag_name, tag_version, time, type

`update_tag`

Update a tag/category.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, new_name, new_parent_id, new_version, previous_name, previous_parent_id, previous_version, tag_id, tag_name, tag_version, time, type

`add_app_tag`

Associate a tag with content.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, content_guid, content_id, entry_id, level, msg, tag_id, tag_name, tag_version, time, type

`remove_app_tag`

Disassociate a tag with content.

`remove_tag_descendant`

Delete a child tag.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, tag_id, tag_name, tag_version, time, type

Python environment events

`remove_python_environment`

Remove unused python environment.

Event logging fields: action, actor_description, actor_id, actor_role, entry_id, level, msg, time, type

Execution environment events

`add_execution_environment`

Add new execution environment.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, environment_guid, environment_id, level, msg, time, type

`remove_execution_environment`

Remove execution environment.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, environment_guid, environment_id, level, msg, time, type

`update_execution_environment`

Update execution environment.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, environment_guid, environment_id, level, msg, new_cluster_name, new_description, new_environment_type, new_matching, new_name, new_supervisor, new_title, previous_cluster_name, previous_description, previous_environment_type, previous_matching, previous_name, previous_supervisor, previous_title, time, type

Runtime cache deletion events

`delete_runtime_cache`

Deleted runtime cache.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type

Execution environment permission events

`create_execution_environment_permission`

Create permission to grant a user or group access to an execution environment.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, environment_permission_guid, environment_permission_id, level, msg, time, type

`delete_execution_environment_permission`

Delete permission to revoke a user or group access to an execution environment.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, environment_permission_guid, environment_permission_id, level, msg, time, type