Audited Events

This page describes the types of audit events emitted by Posit Connect.

Audit events are atomic logged entries that record actions performed by users or system processes in Connect. Each audit event is logged with a timestamp and includes details about the audit action, the actor who performed it, and any other relevant data.

Audit actions are an enumerated list of values which identify what occurred in a logged audit event. Each audit event is associated with a specific action, such as add_user, edit_user, or remove_group. The action is recorded in the action field of the audit event.

There are many types of auditable events in Connect. For example, a user creating a group will generate the following event log:

time="2022-10-18T20:07:39.813Z" level=info msg="Added group Publishers" action=add_group actor_description="admin n (admin)" actor_guid=8c1c6df6-16bf-4901-b52c-50de0b1da233 actor_id=1 actor_role=administrator entry_id=73 group_guid=1b2c1790-c95f-4df3-9363-6563475070d0 group_id=2 group_name=Publishers type=audit

Notice that the data associated with the event is provided as key=value pairs. Every audit event will always include the following fields: time (UTC), level=info, type=audit, action, actor_id, actor_description, actor_guid, actor_role. The audit event message will be recorded as msg.

Some audit events will track additional fields. In the example above, group creation also records group_guid, group_id, and group_name.

Audit actors

Audited actions can be triggered by a user or by an automated system process. Each audited event specifies the type of actor which triggered the event.

Event records triggered by a user will have actor_id, actor_guid, actor_role and actor_description:

actor_id=4 actor_guid=8c1c6df6-16bf-4901-b52c-50de0b1da233 actor_role=publisher actor_description="Frank Castell (fcastell)"

Events triggered by the system will have the fixed fields actor_id=0 and actor_role=system. They will not have an actor_guid:

actor_id=0 actor_role=system actor_description="Scheduled email checker"

The actor_description provides more details about the system process which triggered the event.

Field data types

Data fields included in audit entries are of type string, regardless of the configured format (TEXT or JSON), except for *_id fields which are of type int. Example *_id fields include entry_id, content_id, user_id, and group_id.

Note

The time in every log entry is logged in UTC. E.g: time=2022-01-01T20:00:00.000Z

User events

`add_user`

Create a new user.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type, user_guid, user_id, user_role

`edit_user`

Modify an existing user.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, new_email, new_first_name, new_last_name, new_user_role, new_username, previous_email, previous_first_name, previous_last_name, previous_user_role, previous_username, time, type, user_guid, user_id, user_role

`remove_user`

Remove an existing user. This action can only be performed via the usermanager CLI tool.

Event logging fields: action, actor_description, actor_id, actor_role, entry_id, level, msg, time, type, user_guid, user_id, user_role

`update_lock_user`

Modify the lock on an existing user.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type, user_guid, user_id, user_role

`set_password`

Set the password for a user.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type, user_guid, user_id, user_role

`user_login`

A user starts a dashboard session.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type, user_guid, user_id, user_role

`user_login_failure`

A login attempt is unsuccessful.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type, user_guid, user_id, user_role

`web_sudo`

A user needs to reauthenticate for a privileged action after a WebSudo timeout.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type, user_guid, user_id, user_role

`activate_token`

Activate a token. Tokens are used by the rsconnect R package to authenticate a user.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type

`add_api_key`

Create an API key.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type

`edit_api_key`

Modify an existing API key. This action can only be performed via the usermanager CLI.

Event logging fields: action, actor_description, actor_id, actor_role, entry_id, level, msg, new_user_id, new_user_role, previous_user_id, previous_user_role, time, type

`remove_api_key`

Remove an existing API key.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type

`create_oauth_integration`

Create a new OAuth integration.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type, user_guid, user_id, user_role

`remove_oauth_integration`

Remove an OAuth integration.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type, user_guid, user_id, user_role

`update_oauth_integration`

Modify an OAuth integration.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type, user_guid, user_id, user_role

`create_oauth_associations`

Create an association between a content item and an OAuth integration.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type, user_guid, user_id, user_role

`remove_oauth_association`

Remove an association between a content item and an OAuth integration.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type, user_guid, user_id, user_role

`remove_oauth_session`

Remove an OAuth session.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type, user_guid, user_id, user_role

`oauth_integration_login`

Initiate a login flow against an OAuth integration.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type, user_guid, user_id, user_role

`oauth_integration_logout`

Logout of an OAuth integration.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type, user_guid, user_id, user_role

`oauth_integration_callback`

Complete a login flow against an OAuth integration.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type, user_guid, user_id, user_role

`set_custom_documentation`

Set custom documentation for the Connect server.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type

`delete_custom_documentation`

Remove custom documentation for the Connect server.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type

Group events

`add_group`

Create a new group.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, group_guid, group_id, group_name, level, msg, time, type

`edit_group`

Modify an existing group.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, group_guid, group_id, group_name, level, msg, new_name, new_owner_id, previous_name, previous_owner_id, time, type

`remove_group`

Remove an existing group.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, group_guid, group_id, group_name, level, msg, time, type

`add_group_member`

Add a user to an existing group.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, group_guid, group_id, group_name, level, msg, time, type, user_guid, user_id, user_role

`remove_group_member`

Remove a user from a group.

Content events

`add_application`

Create new content on the Connect server.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, content_guid, content_id, entry_id, level, msg, time, type

`remove_application`

Remove a published content item.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, content_guid, content_id, entry_id, level, msg, time, type

`edit_application`

Modify the settings of a content item.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, content_guid, content_id, entry_id, level, msg, new_access_type, new_connection_timeout, new_description, new_idle_timeout, new_init_timeout, new_load_factor, new_max_conns_per_process, new_max_processes, new_min_processes, new_name, new_read_timeout, new_title, previous_access_type, previous_connection_timeout, previous_description, previous_idle_timeout, previous_init_timeout, previous_load_factor, previous_max_conns_per_process, previous_max_processes, previous_min_processes, previous_name, previous_read_timeout, previous_title, time, type

`create_variant`

Create a new variant for a content item.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, content_guid, content_id, entry_id, level, msg, time, type, variant_id, variant_key, variant_name

`edit_variant`

Modify the settings for a content item variant.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, content_guid, content_id, entry_id, level, msg, new_owner_id, previous_owner_id, time, type, variant_id, variant_key, variant_name

`promote_variant`

Promote a variant for a content item.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, content_guid, content_id, entry_id, level, msg, new_rendering_id, previous_rendering_id, time, type, variant_id, variant_key, variant_name

`duplicate_variant`

Create a new variant for a content item which duplicates an existing variant.

`remove_variant`

Remove a variant from a content item.

`create_variant_manual_overrides`

Create new manual overrides for a variant of a content item.

`promote_variant_manual_overrides`

Promote the manual overrides for a variant of a content item.

`variant_sender`

Request an email for a variant of a content item.

`variant_render`

Request a render for a variant of a content item.

`deploy_application`

Deploy content to the Connect server. Content may need to be published after deployment.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, bundle_id, content_guid, content_id, entry_id, level, msg, time, type

`upload_bundle`

Upload a bundle for a content item.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, bundle_id, content_guid, content_id, entry_id, level, msg, time, type

`remove_bundle`

Remove a bundle from a content item.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, bundle_id, content_guid, content_id, entry_id, level, msg, time, type

`activate_bundle`

Activate a given bundle as the default source to run for a content item.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, bundle_id, content_guid, content_id, entry_id, level, msg, time, type

`launch_bundle`

Run a bundle for a content item.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, bundle_id, content_guid, content_id, entry_id, level, msg, time, type

`download_bundle`

Download a bundle for a content item.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, bundle_id, content_guid, content_id, entry_id, level, msg, time, type

`add_vanity`

Create a new vanity URL for a content item.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, content_guid, content_guid, content_id, content_id, entry_id, level, msg, time, type, vanity_id, vanity_prefix

`update_vanity`

Modify a vanity URL for a content item.

`remove_vanity`

Remove a vanity URL from a content item.

`subscribe_app_variant`

Subscribe a user to a variant of a content item.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type, user_guid, user_id, user_role, variant_id, variant_key, variant_name

`unsubscribe_app_variant`

Unsubscribe a user from a variant of a content item.

`remove_rendering`

Remove a rendering for a variant of a content item.

Event logging fields: action, actor_description, actor_id, actor_role, entry_id, level, msg, time, type

`updated_environment_variables`

Modify environment variables for a content item.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, content_guid, content_id, entry_id, level, msg, time, type

`transfer_content`

Transfer content item ownership between users.

`clear_variant_email_all`

Disable global scheduled report emails.

Event logging fields: action, actor_description, actor_id, actor_role, entry_id, level, msg, time, type, variant_id, variant_key, variant_name

`build_application`

Build a bundle for a content item.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, bundle_id, content_guid, content_id, entry_id, level, msg, time, type

`add_thumbnail_to_content`

Create a preview image for a content item.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, content_guid, content_id, entry_id, level, msg, time, type

`delete_thumbnail_from_content`

Remove a preview image from a content item.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, content_guid, content_id, entry_id, level, msg, time, type

`register_kill_job_order`

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, content_guid, content_id, entry_id, job_host, job_id, job_key, job_pid, level, msg, time, type

`create_share_link`

Create a new share link for a content item.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, content_guid, content_id, entry_id, level, msg, time, type

`remove_share_link`

Remove a share link from a content item.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, content_guid, content_id, entry_id, level, msg, time, type

Content permission events

`assign_user_app_role`

Give a user view or edit access to a content item.

`remove_user_app_role`

Remove a user from view or edit access list for a content item.

`assign_group_app_role`

Give a group view or edit access to a content item.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, content_guid, content_id, entry_id, group_guid, group_id, group_name, level, msg, time, type

`remove_group_app_role`

Remove a group from view or edit access list for a content item.

`clear_app_viewer_acl`

NoDoc

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, content_guid, content_id, entry_id, level, msg, time, type

`permission_request`

Request permission for a user to access a content item.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, content_access_request_id, content_access_request_role, content_access_request_status, content_guid, content_id, entry_id, level, msg, time, type

Git events

`set_git_repo`

Assign a Git repository as the source for a content item.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, content_guid, content_id, entry_id, git_branch, git_path, git_url, level, msg, time, type

`fetch_git_repo`

Fetch a Git repository.

Event logging fields: action, actor_description, actor_id, actor_role, entry_id, git_branch, git_path, git_url, level, msg, time, type

`update_git_repo`

Modify a Git repository as the source for a content item.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, git_branch, git_path, git_url, level, msg, new_branch, new_content_path, new_enabled, new_repository_url, previous_branch, previous_content_path, previous_enabled, previous_repository_url, time, type

`remove_git_repo`

Remove a Git repository as the source for a content item.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, content_guid, content_id, entry_id, level, msg, time, type

`bundle_git_repo`

Create a new content item bundle from a Git location.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, bundle_id, content_guid, content_id, entry_id, level, msg, time, type

Scheduled content events

`update_schedule`

Modify the schedule for a variant of a content item.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, new_next_run, new_schedule, new_start_time, new_time_zone, previous_next_run, previous_schedule, previous_start_time, previous_time_zone, schedule_id, schedule_next_run, schedule_timezone, schedule_type, time, type

`add_schedule`

Create a schedule for a variant of a content item.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, schedule_id, schedule_next_run, schedule_timezone, schedule_type, time, type, variant_id, variant_key, variant_name

`remove_schedule`

Remove a schedule from a variant of a content item.

Tag/category events

`add_tag`

Create a tag/category.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, tag_id, tag_name, time, type

`add_tag_with_parent`

Create a tag as a child of a parent tag/category.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, tag_id, tag_name, time, type

`remove_tag`

Remove a tag/category.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, tag_id, tag_name, time, type

`update_tag`

Modify a tag/category.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, new_name, new_parent_id, previous_name, previous_parent_id, tag_id, tag_name, time, type

`add_app_tag`

Associate a tag with a content item.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, content_guid, content_id, entry_id, level, msg, tag_id, tag_name, time, type

`remove_app_tag`

Remove a tag from a content item.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, content_guid, content_id, entry_id, level, msg, tag_id, tag_name, time, type

`remove_tag_descendant`

Remove a child tag.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, tag_id, tag_name, time, type

Python environment events

`remove_python_environment`

Remove an unused Python environment.

Event logging fields: action, actor_description, actor_id, actor_role, entry_id, level, msg, time, type

Execution environment events

`add_execution_environment`

Add a new execution environment.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, environment_guid, environment_id, level, msg, time, type

`remove_execution_environment`

Remove an execution environment.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, environment_guid, environment_id, level, msg, time, type

`update_execution_environment`

Modify an execution environment.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, environment_guid, environment_id, level, msg, new_cluster_name, new_description, new_environment_type, new_matching, new_name, new_supervisor, new_title, previous_cluster_name, previous_description, previous_environment_type, previous_matching, previous_name, previous_supervisor, previous_title, time, type

Runtime cache deletion events

`delete_runtime_cache`

Remove a runtime cache.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, level, msg, time, type

Execution environment permission events

`create_execution_environment_permission`

Create user/group permissions to access an execution environment.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, environment_permission_guid, environment_permission_id, level, msg, time, type

`delete_execution_environment_permission`

Remove user/group permissions to access an execution environment.

Event logging fields: action, actor_description, actor_guid, actor_id, actor_role, entry_id, environment_permission_guid, environment_permission_id, level, msg, time, type