# Audit Log Webhook Payload Schema Reference

This reference describes each of the properties of the webhook payload schema.

The payload schema defines the structure of the data that you can pass in the webhook payload. Apono uses the [Handlebars](https://handlebarsjs.com/guide/) templating language to format expressions for certain data fields.

```json
{
    "event_type": "string",
    "event_time": "{seconds}.{nanos}",
    "data": {
        "timestamp": "{seconds}.{nanos}",
        "action": "string",
        "actor_id": "string",
        "actor_name": "string",
        "actor_type": "string",
        "source": "string",
        "target_id": "string",
        "target_type": "string",
        "target_name": "string",
        "metadata": "object",
        "current_target_object": "object",
        "previous_target_object": "object"
    }
}
```

<table><thead><tr><th width="294">Property</th><th>Description</th></tr></thead><tbody><tr><td><strong>event_type</strong> string</td><td>Type of audit log event</td></tr><tr><td><strong>event_time</strong> string</td><td>Date the event occurred</td></tr><tr><td><strong>data</strong> object</td><td>Field containing an embedded object with contextual information about the triggering event<br><br>See: <a href="#data-object">data object</a></td></tr></tbody></table>

#### data object

<table><thead><tr><th width="291">Property</th><th>Description</th></tr></thead><tbody><tr><td><strong>timestamp</strong> string</td><td>Date and time the event occurred</td></tr><tr><td><strong>action</strong> string</td><td>Event performed, such as creating, editing, or deleting an item</td></tr><tr><td><strong>actor_id</strong> string</td><td>Email address of the user who performed the action</td></tr><tr><td><strong>actor_name</strong> string</td><td>Full name of the user who performed the action</td></tr><tr><td><strong>actor_type</strong> string</td><td>Type of user who performed the action</td></tr><tr><td><strong>source</strong> string</td><td><p>Location where the action originated</p><p><strong>Possible Values:</strong></p><ul><li>API</li><li>integration</li><li>Terraform</li><li>web application</li></ul></td></tr><tr><td><strong>target_id</strong> string</td><td>Unique identifier of the object affected by the action</td></tr><tr><td><strong>target_type</strong> string</td><td><p>Type of object affected by the action<br></p><p><strong>Possible Values:</strong></p><ul><li>access flow</li><li>bundle</li><li>integration</li></ul></td></tr><tr><td><strong>target_name</strong> string</td><td>Friendly name of the object affected by the action</td></tr><tr><td><strong>current_target_object</strong> object</td><td><p>Updated details of the object affected by the action<br></p><p><em><strong>IMPORTANT</strong>: The webhook will return all data within this object. Specific values within a target object cannot be targeted. The following details of each target are provided for information purposes only.</em></p><p><br><strong>Target Objects</strong>:</p><ul><li><a href="#access-flows">Access Flows</a></li><li><a href="#account-settings">Account Settings</a></li><li><a href="#activity-reports">Activity Reports</a></li><li><a href="#bundles">Bundles</a></li><li><a href="#integrations">Integrations</a></li><li><a href="#users">Users</a></li><li><a href="#webhooks">Webhooks</a></li></ul></td></tr><tr><td><strong>previous_target_object</strong> object</td><td><p>Previous details of the object affected by the action<br></p><p><em><strong>IMPORTANT</strong>: The webhook will return all data within this object. Specific values within a target object cannot be targeted. The following details of each target are provided for information purposes only.</em></p><p><strong>Target Objects</strong>:</p><ul><li><a href="#access-flows">Access Flows</a></li><li><a href="#account-settings">Account Settings</a></li><li><a href="#activity-reports">Activity Reports</a></li><li><a href="#bundles">Bundles</a></li><li><a href="#integrations">Integrations</a></li><li><a href="#users">Users</a></li><li><a href="#webhooks">Webhooks</a></li></ul></td></tr></tbody></table>

***

### Target Objects

#### Access Flows

```json
{
    "id": "flow123",
    "name": "example_access_flow",
    "active": true,
    "revoke_after_in_sec": 3600,
    "trigger": {
        "type": "time_based",
        "timeframe": {
            "days_in_week": ["Monday", "Tuesday"],
            "time_zone": "UTC"
        }
    },
    "grantees": {
        "logical_operator": "AND",
        "attribute_filters": [
            {
                "operator": "EQUALS",
                "attribute_type": "role",
                "attribute_value": "admin",
                "integration_id": "integration123"
            }
        ]
    },
    "access_targets": [
        {
            "integration": {
                "resource_integration_id": "integration123",
                "resource_type": "database",
                "resource_tag_restrictors": [
                    {
                        "name": "env",
                        "value": "production"
                    }
                ],
                "resource_tag_restrictors": [],
                "permissions": ["read", "write"]
            }
        }
    ],
    "approver_policy": {
        "groups_operator": "OR",
        "condition_groups": [
            {
                "logical_operator": "AND",
                "conditions": [
                    {
                        "attribute_condition": {
                            "operator": "EQUALS",
                            "attribute_type": "department",
                            "attribute_value": "IT",
                            "integration_id": "integration123"
                        }
                    }
                ]
            }
        ]
    },
    "settings": {
        "require_approver_justification": true,
        "require_justification": false,
        "approver_cannot_approve_himself": true,
        "require_mfa": true
    },
    "labels": [
        {
            "key": "priority",
            "value": "high"
        }
    ],
    "created_date": "2023-10-01T12:34:56Z",
    "updated_date": "2023-10-02T12:34:56Z"
}
```

<table><thead><tr><th width="291">Property</th><th>Description</th></tr></thead><tbody><tr><td><strong>id</strong> string</td><td>Unique identifier of the access flow</td></tr><tr><td><strong>name</strong> string</td><td>Friendly name of the access flow</td></tr><tr><td><strong>active</strong> boolean</td><td><p>Status of the access flow<br><br><strong>Possible Values:</strong></p><ul><li>true</li><li>false</li></ul></td></tr><tr><td><strong>revoke_after_in_sec</strong> integer</td><td>Access duration (in seconds) granted for the resources within the access flow</td></tr><tr><td><strong>trigger</strong> string | object</td><td>Event associated with the access flow</td></tr><tr><td><strong>grantees</strong> object</td><td>Identities for whom access is requested<br><br>See: <a href="#grantees-object">grantees object</a></td></tr><tr><td><strong>access_targets</strong> object</td><td>Integrations, bundles, or access scopes to which access will be given<br><br>See: <a href="#access_targets-object">access_targets object</a></td></tr><tr><td><strong>approver_policy</strong> object</td><td>Identities authorized to approve the access flow request</td></tr><tr><td><strong>settings</strong> object</td><td>Access flow settings (<a href="../../../access-flows/creating-access-flows-in-apono/self-serve-access-flows#enable-settings">self serve</a>, <a href="../../../access-flows/creating-access-flows-in-apono/automatic-access-flows#add-a-label">automatic</a>) applied to the access flow</td></tr><tr><td><strong>labels</strong> object</td><td>Identifies access flows for streamlined organization and use<br><br>See: <a href="../../../access-flows/creating-access-flows-in-apono/self-serve-access-flows#enable-settings">Self Serve Access Flows</a> or <a href="../../../access-flows/creating-access-flows-in-apono/automatic-access-flows#add-a-label">Automatic Access Flows</a></td></tr><tr><td><strong>created_date</strong> string</td><td>Creation date of the access flow</td></tr><tr><td><strong>updated_date</strong> string</td><td>Most recent modified date of the access flow</td></tr></tbody></table>

#### grantees object

<table><thead><tr><th width="291">Property</th><th>Description</th></tr></thead><tbody><tr><td><strong>logical_operator</strong> string</td><td>Logical operator applied to the <code>attribute_filters</code> objects</td></tr><tr><td><strong>attribute_filters</strong> object</td><td>List of grantees<br><br>See: <a href="#grantees.attribute_filters-object">grantees.attribute_filters object</a></td></tr></tbody></table>

#### grantees.attribute\_filters object

<table><thead><tr><th width="291">Property</th><th>Description</th></tr></thead><tbody><tr><td><strong>operator</strong> string</td><td>Comparative operator relating the <code>attribute_type_id</code> and <code>attribute_value</code></td></tr><tr><td><strong>attribute_type_id</strong> string</td><td><p>Type of grantee<br></p><p><strong>Possible Values:</strong></p><ul><li>group</li><li>user</li></ul></td></tr><tr><td><strong>attribute_value</strong> [string]</td><td>Unique identifier of the grantee</td></tr></tbody></table>

#### access\_targets object

<table><thead><tr><th width="291">Property</th><th>Description</th></tr></thead><tbody><tr><td><strong>integration</strong> object</td><td>Integration definition<br><br>See: <a href="#access_targets.integration-object">access_targets.integration object</a></td></tr><tr><td><strong>bundle</strong> object</td><td><p>Unique identifier of the <a href="../../access-flows/create-bundles">bundle</a>, contained within the <code>bundle_id</code> property<br></p><p>The <code>bundle_id</code> is the sole property of this object.</p></td></tr><tr><td><strong>saved_query</strong> object</td><td>Unique identifier of the <a href="../../inventory/access-scopes">access scope</a>, contained within the <code>saved_query_id</code> property<br><br>The <code>saved_query_id</code> is the sole property of this object.</td></tr></tbody></table>

#### access\_targets.integration object

<table><thead><tr><th width="291">Property</th><th>Description</th></tr></thead><tbody><tr><td><strong>resource_integration_id</strong> string</td><td>Unique identifier of the resource</td></tr><tr><td><strong>resource_type</strong> string</td><td>Type of resource</td></tr><tr><td><strong>resource_tag_restrictors</strong> object</td><td>Resources excluded from the integration</td></tr><tr><td><strong>permissions</strong> object</td><td>Permissions granted to the resource</td></tr></tbody></table>

#### approver\_policy object

<table><thead><tr><th width="291">Property</th><th>Description</th></tr></thead><tbody><tr><td><strong>groups_operator</strong> string</td><td>Logical operator applied to the <code>condition_groups</code> objects</td></tr><tr><td><strong>condition_groups</strong> object</td><td>Grouped list of approvers<br><br>See: <a href="#approver_policy.condition_groups-object">approver_policy.condition_groups object</a></td></tr></tbody></table>

#### approver\_policy.condition\_groups object

<table><thead><tr><th width="291">Property</th><th>Description</th></tr></thead><tbody><tr><td><strong>logical_operator</strong> string</td><td>Logical operator applied to the <code>conditions</code> objects</td></tr><tr><td><strong>conditions</strong> object</td><td>List of individual approver criteria<br><br>See: <a href="#approver_policy.condition_groups.conditions-object">approver_policy.condition_groups.conditions object</a></td></tr></tbody></table>

#### approver\_policy.condition\_groups.conditions object

<table><thead><tr><th width="291">Property</th><th>Description</th></tr></thead><tbody><tr><td><strong>attribute_condition</strong> object</td><td>Attributes of a specific approver<br><br>See: <a href="#approver_policy.condition_groups.conditions.attribute_condition-object">approver_policy.condition_groups.conditions.attribute_condition object</a></td></tr><tr><td><strong>request_context_based_attribution_filter</strong> object</td><td>Attributes of a specific approver based on context<br><br>See: <a href="#approver_policy.condition_groups.conditions.request_context_based_attribution_filter-object">approver_policy.condition_groups.conditions.request_context_based_attribution_filter object</a></td></tr></tbody></table>

#### approver\_policy.condition\_groups.conditions.attribute\_condition object

<table><thead><tr><th width="291">Property</th><th>Description</th></tr></thead><tbody><tr><td><strong>operator</strong> string</td><td>Comparative operator relating the <code>attribute_type_id</code> and <code>attribute_value</code></td></tr><tr><td><strong>attribute_type_id</strong> string</td><td>Type of approver</td></tr><tr><td><strong>attribute_value</strong> [string]</td><td>Unique identifier of the approver</td></tr></tbody></table>

#### approver\_policy.condition\_groups.conditions.request\_context\_based\_attribution\_filter object

<table><thead><tr><th width="291">Property</th><th>Description</th></tr></thead><tbody><tr><td><strong>attribute_type_id</strong> string</td><td>Type of approver</td></tr><tr><td><strong>integration_id</strong> string</td><td>Identifying value of the associated integration</td></tr></tbody></table>

#### settings object

<table><thead><tr><th width="291">Property</th><th>Description</th></tr></thead><tbody><tr><td><strong>require_approver_justification</strong> boolean</td><td>Indicates if approvers are required to enter a justification for approving or rejecting a request<br><br>See: <a href="../../../access-flows/creating-access-flows-in-apono/self-serve-access-flows#enable-settings">Self Serve Access Flows</a></td></tr><tr><td><strong>require_justification</strong> boolean</td><td>Indicates if grantees are required to enter a justification for their requests<br><br>See: <a href="../../../access-flows/creating-access-flows-in-apono/self-serve-access-flows#enable-settings">Self Serve Access Flows</a></td></tr><tr><td><strong>approver_cannot_approve_himself</strong> boolean</td><td>Indicates if users can approve their own access<br><br>See: <a href="../../../access-flows/creating-access-flows-in-apono/self-serve-access-flows#enable-settings">Self Serve Access Flows</a></td></tr><tr><td><strong>require_mfa</strong> boolean</td><td>Indicates if users will be required to pass <a href="../../../access-flows/creating-access-flows-in-apono/self-serve-access-flows#enable-settings">multi-factor authentication</a> when requesting access</td></tr></tbody></table>

#### Account Settings

```json
{
    "account_id": "account123",
    "account_name": "example_account",
    "enable_flow_failure_notifications": true,
    "credentials_rotation_period_in_days": 90,
    "inactive_user_retention_in_days": 180,
    "integrations_updates_notifications": true,
    "require_duration_for_access_request": false
}
```

<table><thead><tr><th width="291">Property</th><th>Description</th></tr></thead><tbody><tr><td><strong>account_id</strong> string</td><td>Unique identifier of the account</td></tr><tr><td><strong>account_name</strong> string</td><td>Friendly name of the account</td></tr><tr><td><strong>enable_flow_failure_notifications</strong> boolean</td><td>Notifications sent to admins about access flow failures</td></tr><tr><td><strong>credential_rotation_period_in_days</strong> integer</td><td><p>Number of days after which the credentials must be rotated</p><p>See: <a href="../../architecture-and-security/credentials-rotation-policy">Credentials Rotation Policy</a></p></td></tr><tr><td><strong>inactive_user_retention_in_days</strong> integer</td><td>Number of days after which to delete a user Apono created if no grant is active<br><br>See: <a href="../../architecture-and-security/periodic-user-cleanup-and-deletion">Periodic User Cleanup &#x26; Deletion</a></td></tr><tr><td><strong>integrations_updates_notifications</strong> boolean</td><td>Email notifications sent to admins about integration status updates</td></tr><tr><td><strong>require_duration_for_access_request</strong> boolean</td><td>Requires the requester to specify duration of access</td></tr></tbody></table>

#### Activity Reports

```json
{
    "id": "report123",
    "name": "example_activity_report",
    "active": true,
    "filters": {
        "filter_key1": "filter_value1",
        "filter_key2": "filter_value2"
    },
    "start_date": "2023-10-01T12:34:56Z",
    "end_date": "2023-10-02T12:34:56Z",
    "period": {
        "unit": "day",
        "value": 1,
        "rounded": true
    },
    "time_zone": "UTC",
    "fields": ["field1", "field2"],
    "schedule": {
        "cron": "0 0 * * *",
        "format": "json",
        "recipients": ["user@example.com"]
    },
    "created_date": "2023-10-01T12:34:56Z",
    "updated_date": "2023-10-02T12:34:56Z"
}
```

<table><thead><tr><th width="291">Property</th><th>Description</th></tr></thead><tbody><tr><td><strong>id</strong> string</td><td>Unique identifier of the activity report</td></tr><tr><td><strong>name</strong> string</td><td>Friendly name of the activity report</td></tr><tr><td><strong>active</strong> boolean</td><td>Status of the activity report</td></tr><tr><td><strong>filters</strong> object</td><td>Selected report filters</td></tr><tr><td><strong>start_date</strong> string</td><td>Absolute start date of the report window</td></tr><tr><td><strong>end_date</strong> string</td><td>Absolute end date of the report window</td></tr><tr><td><strong>period</strong> object</td><td>Relative time of the report window</td></tr><tr><td><strong>time_zone</strong> string</td><td>Time zone of the report</td></tr><tr><td><strong>fields</strong> [string]</td><td>Data fields included in the report</td></tr><tr><td><strong>schedule</strong> object</td><td>Generation frequency, format, and recipients of the report</td></tr><tr><td><strong>created_date</strong> string</td><td>Creation date of the report</td></tr><tr><td><strong>updated_date</strong> string</td><td>Most recent modified date of the report</td></tr></tbody></table>

#### Bundles

<pre class="language-json"><code class="lang-json"><strong>{
</strong>    "id": "12345",
    "name": "example_access_bundle",
    "created_date": "2023-10-01T12:34:56Z",
    "access_targets": [
        {
            "id": "target1",
            "name": "target_1",
            "type": "example_type"
        },
        {
            "id": "target2",
            "name": "target_2",
            "type": "example_type"
        }
    ]
}
</code></pre>

<table><thead><tr><th width="291">Property</th><th>Description</th></tr></thead><tbody><tr><td><strong>id</strong> string</td><td>Unique identifier of the bundle</td></tr><tr><td><strong>name</strong> string</td><td>Friendly name of the bundle</td></tr><tr><td><strong>create_date</strong> string</td><td>Creation date of the bundle</td></tr><tr><td><strong>access_targets</strong> object</td><td>Resources within the bundle<br><br>See: <a href="#bundles-access_targets-object">(bundles) access_targets</a></td></tr></tbody></table>

#### (bundles) access\_targets object

<table><thead><tr><th width="291">Property</th><th>Description</th></tr></thead><tbody><tr><td><strong>id</strong> string</td><td>Unique identifier of the resource</td></tr><tr><td><strong>name</strong> string</td><td>Friendly name of the resource</td></tr><tr><td><strong>type</strong> string</td><td>Type of resource</td></tr></tbody></table>

#### Integrations

```json
{
    "id": "integration123",
    "name": "example_integration",
    "type": "example_type",
    "status": "active",
    "connector_id": "connector123",
    "parent_integration_id": "parent_integration123",
    "connected_resource_types": ["resource_type1", "resource_type2"],
    "params": {
        "param_key1": "param_value1",
        "param_key2": "param_value2"
    },
    "custom_instructions_access_message": "please follow the instructions.",
    "last_sync_date": "2023-10-01T12:34:56Z",
    "secret_config": {
        "secret_key1": "secret_value1",
        "secret_key2": "secret_value2"
    }
}
```

<table><thead><tr><th width="291">Property</th><th>Description</th></tr></thead><tbody><tr><td><strong>id</strong> string</td><td>Unique identifier of the integration</td></tr><tr><td><strong>name</strong> string</td><td>Friendly name of the integration</td></tr><tr><td><strong>type</strong> string</td><td>Type of integration</td></tr><tr><td><strong>status</strong> string</td><td>Status of the integration</td></tr><tr><td><strong>connector_id</strong> string</td><td>Unique identifier of the connector used for the integration</td></tr><tr><td><strong>parent_integration_id</strong> string</td><td>Unique identifier of the parent integration associated with this integration</td></tr><tr><td><strong>connected_resource_types</strong> [string]</td><td>List of resources associated with the integration</td></tr><tr><td><strong>params</strong> object</td><td>Parameters associated with the integration</td></tr><tr><td><strong>custom_instructions_access_message</strong> string</td><td>Instructions explaining how to access this integration's resources</td></tr><tr><td><strong>last_sync_date</strong> string (date-time)</td><td>Most recent date that Apono synced the integration</td></tr><tr><td><strong>secret_config</strong> object</td><td><a href="../../connectors-and-secrets/apono-integration-secret">Secret</a> for the integration</td></tr></tbody></table>

#### Users

```json
{
    "id": "user123",
    "email": "user@example.com",
    "first_name": "John",
    "last_name": "Doe",
    "active": true,
    "roles": ["admin", "user"]
}
```

<table><thead><tr><th width="291">Property</th><th>Description</th></tr></thead><tbody><tr><td><strong>id</strong> string</td><td>Unique identifier of the user</td></tr><tr><td><strong>email</strong> string</td><td>Email address of the user</td></tr><tr><td><strong>first_name</strong> string</td><td>First name of the user</td></tr><tr><td><strong>last_name</strong> string</td><td>Last name of the user</td></tr><tr><td><strong>active</strong> boolean</td><td>Status of the user</td></tr><tr><td><strong>roles</strong> [string]</td><td>Role-based access assigned to the user</td></tr></tbody></table>

#### Webhooks

```json
{
    "id": "webhook123",
    "name": "example_webhook",
    "active": true,
    "triggers": ["trigger1", "trigger2"],
    "created_date": "2023-10-01T12:34:56Z",
    "updated_date": "2023-10-02T12:34:56Z"
}
```

<table><thead><tr><th width="291">Property</th><th>Description</th></tr></thead><tbody><tr><td><strong>id</strong> string</td><td>Unique identifier of the webhook</td></tr><tr><td><strong>name</strong> string</td><td>Friendly name of the webhook</td></tr><tr><td><strong>active</strong> boolean</td><td>Status of the webhook</td></tr><tr><td><strong>triggers</strong> [string]</td><td><p>Associated webhook triggers<br></p><p><strong>Possible Values:</strong></p><ul><li>AuditEventTriggered</li><li>Manual</li><li>RequestCreated</li><li>RequestApproved</li><li>RequestRejected</li><li>RequestGranted</li><li>RequestExpired</li><li>RequestFailed</li></ul></td></tr><tr><td><strong>created_date</strong> string (date-time)</td><td>Creation date of the webhook<br><br><strong>Example</strong>: 2023-10-01T12:34:56Z</td></tr><tr><td><strong>updated_date</strong> string (date-time)</td><td>Most recent modified date of the webhook<br><br><strong>Example</strong>: 2023-10-03T1:32:57Z</td></tr></tbody></table>