Every audit event type Dome emits, with its class, webhook delivery, and what it records
Dome writes one audit trail for configuration and runtime activity. This page is the complete list of event types on that trail, what each one records, and which are also delivered to webhook subscriptions.
Use it to pick the types you want to query, subscribe to, or alert on. For the envelope fields, enum forms, and filter syntax those types share, refer to Event contracts .
Every type is entity.verb in present tense: the entity the event is about, then the operation. agent.register, bundle.deploy, connection.create, workspace.config.update. Nested entities keep their path, as in agent.key.rotate and verification.provider.update.
Event types name a single entity: agent.register, bundle.deploy, quota.update. Permissions name a collection: agents.register, rules.deploy, gateways.manage. The singular form is always the event; the plural form is always the permission.
Every type belongs to exactly one class.
Class Description governingAuthorization and runtime decisions state_changeConfiguration mutations securityAuthentication front door audit_accessReads of the trail itself
Class is the coarse filter. Query security to review the authentication front door, audit_access to see who read the trail, state_change for configuration history, governing for runtime decisions.
A type's name never changes to describe its outcome. The same event carries the verdict.
Field Meaning stageattempted or completed. Types with a two-phase profile emit both.resultallowed or denied on types that have a verdict.denialPresent exactly when result is denied, with the reason and deciding rule. errorHandling or dispatch failure, independent of result.
There is no separate denial event type and no access.denied. A refused operation is its own event with stage=completed, result=denied, and the denial block. To find refusals, filter any type on result=denied. Guard blocks leave the verdict on the enclosing call with denial.reason=guard_blocked.
These five carry the most contract detail:
Type Contract tool.callOne tool operation. Emits stage=attempted and stage=completed; the completed row carries result=allowed or result=denied, plus an independent error when handling or dispatch failed. model.callOne model operation with the same phase and verdict contract. Completed rows carry token, byte, latency, provider, connection, pool, and model fields when available. authorization.evaluateCompleted Cedar evaluation with result=allowed or result=denied. guard.filter.evaluateCompleted Filter evaluation. The verdict is on the enclosing tool.call or model.call; this event has no result. Payload includes direction, actions, acting Filter IDs, connection facts, and tool/model facts. guard.validator.evaluateCompleted Validator evaluation. The verdict is on the enclosing tool.call; this event has no result. Payload includes direction, failed Validator IDs, and failure reasons.
Webhook event types are the same strings as audit event types, byte for byte, so one fact carries one name on both. The delivered catalog is a subset: the Webhook column below marks which types reach subscriptions. eventing.test is webhook-only, a synthetic ping with no audit twin.
The body differs even when the name matches. A webhook carries a slim public data projection with no PII, credentials, or raw tool payloads. Refer to Event contracts for that envelope and the bundle presets.
This page stops at the event type. Each type also has a typed payload whose fields are defined per type, and only catalog-marked fields are filterable.
CLI MCP Dashboard
dome audit catalog list dome audit catalog show tool.call Tools: dome_audit_catalog_list, dome_audit_catalog_show
Open Settings → Eventing → Event Catalog to browse payload fields, sample bodies, and JSON schemas.
212 event types, grouped by Connect, Govern, Operate, and Manage. The Webhook column marks the 46 types also delivered to webhook subscriptions.
Event type Class Webhook Description agent.activatestate_change✅ An agent became active and may send traffic. agent.deletestate_change✅ An agent identity was deleted. agent.enrollstate_change✅ A device-bound agent completed enrollment. agent.enrollmenttoken.createstate_change— An enrollment token was issued for device binding. agent.enrollmenttoken.readgoverning— Enrollment token metadata was read. agent.enrollmenttoken.revokestate_change— An enrollment token was revoked. agent.key.createstate_change✅ An API key was issued for an agent. agent.key.readgoverning— Agent key metadata was read. The key itself is never returned. agent.key.revokestate_change✅ An agent API key was revoked. agent.key.rotatestate_change✅ An agent API key was rotated. agent.listgoverning— Agents were listed. agent.reactivatestate_change✅ A suspended agent was returned to active. agent.readgoverning— An agent record was read. agent.registerstate_change✅ An agent identity was registered. agent.revokestate_change✅ An agent was revoked and can no longer authenticate. agent.suspendstate_change✅ An agent was suspended and its traffic blocked. agent.token.issuesecurity— An agent exchanged its API key for a short-lived access token. agent.updatestate_change✅ An agent record, access, or Act-As settings changed.
Event type Class Webhook Description apikey.createstate_change✅ A platform API key was created. apikey.readgoverning— Platform API key metadata was read. apikey.revokestate_change✅ A platform API key was revoked. caller.identity.deletestate_change— A projected caller record was erased. Audit evidence is untouched. caller.identity.readgoverning— The Callers registry was read. caller.identity.setsecurity— A verified Act-As identity was observed and projected into the Callers registry. impersonation.startsecurity— A support impersonation session started. impersonation.terminatesecurity— An impersonation session ended. interactivegrant.createsecurity— An interactive OAuth grant was issued so a person could ride an agent. interactivegrant.readgoverning— Interactive grants were read. interactivegrant.revokesecurity— An interactive grant was revoked. mcpclient.registerstate_change— An MCP client registered itself for interactive OAuth. session.loginsecurity— A person signed in to the platform. session.rotatesecurity— A platform session token was refreshed. session.switchsecurity— A session switched organization, tenant, or workspace context. session.terminatesecurity— A platform session ended. user.createsecurity— A platform user record was created. user.readgoverning— Platform user records were read.
Event type Class Webhook Description verification.provider.createstate_change✅ A verification provider was created. verification.provider.deletestate_change✅ A verification provider was deleted. verification.provider.secret.issuesecurity— An HMAC secret was issued for a verification provider. verification.provider.syncstate_change— A verification provider was synced from an SSO connection. verification.provider.updatestate_change✅ A verification provider was updated.
Event type Class Webhook Description tool.callgoverning✅ One tool operation through the Tool Gateway, from attempt to outcome. tool.catalog.readgoverning— A tool catalog was read. tool.catalog.syncstate_change✅ A tool catalog was refreshed from its upstream MCP server. tool.listgoverning— An agent discovered the tools available to it. tool.status.setstate_change✅ A tool was enabled or disabled. tool.validator.readgoverning— Validator assignments on a tool were read. tool.validator.setstate_change— A Validator was assigned to a tool. tool.validator.unsetstate_change— A Validator was removed from a tool.
Event type Class Webhook Description model.callgoverning— One model operation through the Model Broker, from attempt to outcome. model.listgoverning— An agent listed the models available to it. model.upstream.proxygoverning— A request was proxied to an upstream model provider.
Event type Class Webhook Description pool.createstate_change— A model pool was created. pool.default.setstate_change— A pool was made the workspace default. pool.deletestate_change— A model pool was deleted. pool.member.createstate_change— A model connection was added to a pool. pool.member.deletestate_change— A model connection was removed from a pool. pool.member.updatestate_change— A pool member's routing settings changed. pool.movestate_change— A pool was moved to another scope. pool.readgoverning— Model pools were read. pool.updatestate_change— A pool's routing or failover settings changed.
Event type Class Webhook Description connection.consent.grantstate_change— Consent was granted for an upstream connection. connection.createstate_change✅ A connection to an upstream tool or model provider was created. connection.credential.disconnectstate_change— Stored upstream credentials were disconnected. connection.credential.readsecurity— Upstream credential metadata was read. connection.credential.refreshstate_change— An upstream OAuth credential was refreshed. connection.credential.rotatestate_change— Upstream credentials were rotated. connection.credentiallink.consumestate_change— A credential link was redeemed to attach upstream credentials. connection.credentiallink.issuestate_change— A credential link was issued for out-of-band credential entry. connection.deletestate_change✅ A connection was deleted. connection.oauth.client.registerstate_change— An OAuth client was registered for a connection. connection.oauth.connectsecurity— An OAuth authorization flow ran for a connection. connection.readgoverning— Connections were read. connection.updatestate_change✅ A connection's configuration or egress settings changed.
Event type Class Webhook Description gateway.allagentsgrant.setstate_change— A workspace-wide agent grant on a Gateway was set or cleared. gateway.createstate_change✅ A Gateway was created. gateway.default.setstate_change— A Gateway was made the workspace default. gateway.deletestate_change✅ A Gateway was deleted and its endpoint stopped accepting traffic. gateway.member.createstate_change✅ A resource was attached to a Gateway. gateway.member.deletestate_change✅ A resource was detached from a Gateway. gateway.readgoverning— Gateways were read. gateway.state.setstate_change— A Gateway was enabled or disabled. gateway.updatestate_change✅ A Gateway's configuration changed.
Event type Class Webhook Description assistant.rungoverning— The Rules assistant drafted or refined a policy. authorization.evaluategoverning— Cedar evaluated a governed request and returned allow or deny. authorization.simulategoverning— A decision was simulated without affecting live traffic. bundle.deletestate_change✅ A rule bundle was deleted. bundle.deploystate_change✅ A rule bundle was deployed and became effective policy. bundle.readgoverning— A rule bundle was read. bundle.rollbackstate_change✅ A rule bundle was rolled back to an earlier version. bundle.validategoverning— A rule bundle was validated without deploying. effectivepolicy.readgoverning— The merged effective policy for an agent was read. simulation.readaudit_access— A stored simulation result was read. simulation.runstate_change— A simulation batch was run against historical or supplied requests. snapshot.applystate_change— A policy snapshot was applied.
Event type Class Webhook Description filter.assignment.setstate_change— Filter assignments on a connection changed. filter.createstate_change— A Filter Guard was created. filter.deletestate_change— A Filter Guard was deleted. filter.readgoverning— Filter Guards were read. filter.rollbackstate_change— A Filter Guard was rolled back to an earlier version. filter.updatestate_change— A Filter Guard was updated. guard.filter.evaluategoverning✅ A Filter inspected request or response content. The verdict stays on the enclosing call. guard.validator.evaluategoverning✅ A Validator checked a tool call against its schema. The verdict stays on the enclosing call. validator.createstate_change— A Validator Guard was created. validator.deletestate_change— A Validator Guard was deleted. validator.readgoverning— Validator Guards were read. validator.rollbackstate_change— A Validator Guard was rolled back to an earlier version. validator.updatestate_change— A Validator Guard was updated.
Event type Class Webhook Description constitution.createstate_change— A constitution was created. constitution.deletestate_change— A constitution was deleted. constitution.readgoverning— Constitutions were read. constitution.updatestate_change— A constitution was updated. court.deliberategoverning✅ A judge pool deliberated on a request that deterministic Cedar left unmatched, from attempt to outcome. judge.createstate_change— A judge was created. judge.deletestate_change— A judge was deleted. judge.readgoverning— Judges were read. judge.updatestate_change— A judge was updated. panel.readgoverning— Judge pool seating was read. panel.updatestate_change— Judge pool seating, enabled state, or weights changed. ruling.readgoverning— A persisted deliberation ruling was read. workspacemode.readgoverning— The workspace authorization mode was read. workspacemode.updatestate_change— The workspace authorization mode changed.
Event type Class Webhook Description quota.createstate_change— A Quota was created. quota.deletestate_change— A Quota was removed. quota.readgoverning— Quotas were read. quota.updatestate_change— A Quota's limit or scope changed.
Event type Class Webhook Description audit.event.readgoverning— A single audit event was fetched. audit.export.createaudit_access— An export job was created. audit.export.runaudit_access✅ An export job ran and delivered records downstream. audit.probe.runaudit_access— An audit pipeline health probe ran. audit.querygoverning— The audit trail was queried. audit.stream.createaudit_access— An audit stream was opened. audit.stream.deleteaudit_access— An audit stream was closed. siemstream.cursor.setaudit_access— A SIEM forwarder cursor was moved. siemstream.enabled.setaudit_access— SIEM forwarding was turned on or off. siemstream.status.setaudit_access✅ A SIEM forwarder reported a status change.
Event type Class Webhook Description metric.creategoverning— A metric series was written. metric.readgoverning— Metrics were read.
Event type Class Webhook Description delivery.bulkreplay.createstate_change— A bulk replay of past deliveries was requested. delivery.cancelstate_change— A pending delivery was cancelled. delivery.readgoverning— Delivery history was read. delivery.replaystate_change— One delivery was replayed. destination.createstate_change✅ A webhook destination was created. destination.deletestate_change✅ A webhook destination was deleted. destination.readgoverning— Webhook destinations were read. destination.rotatesecurity— A destination's signing secret was rotated. destination.teststate_change— A test delivery was sent to a destination. destination.updatestate_change✅ A webhook destination was updated. subscription.createstate_change✅ A webhook subscription was created. subscription.deletestate_change✅ A webhook subscription was deleted. subscription.enabled.unsetstate_change✅ A webhook subscription was disabled. subscription.readgoverning— Webhook subscriptions were read. subscription.updatestate_change✅ A webhook subscription's types or filters changed.
Event type Class Webhook Description workspace.actas.updatestate_change— The workspace Act-As floor or provider selection changed. workspace.config.updatestate_change✅ Workspace configuration changed. workspace.createstate_change— A workspace was created. workspace.deletestate_change— A workspace was deleted. workspace.filterwindow.updatestate_change— The workspace Filter window changed. workspace.freshnesswindow.updatestate_change✅ The workspace policy freshness window changed. workspace.membership.setstate_change✅ A member's workspace role was assigned or changed. workspace.membership.unsetstate_change✅ A member was removed from the workspace. workspace.physicalgateway.credential.movestate_change— Gateway credentials were moved between physical gateways. workspace.physicalgateway.setstate_change— The workspace's physical gateway assignment changed. workspace.readgoverning— Workspace records were read. workspace.sandbox.provisiongoverning— A sandbox workspace was provisioned.
Event type Class Webhook Description tenant.actas.updatestate_change— The tenant Act-As provider selection changed. tenant.createstate_change— A tenant was created. tenant.defaultphysicalgateway.setstate_change— The tenant's default physical gateway changed. tenant.deletestate_change— A tenant was deleted. tenant.membership.setstate_change— A member's tenant role was assigned or changed. tenant.membership.unsetstate_change— A member was removed from the tenant. tenant.readgoverning— Tenant records were read. tenant.sandbox.provisionstate_change— A sandbox tenant was provisioned.
Event type Class Webhook Description organization.actas.updatestate_change— The organization Act-As provider selection changed. organization.billing.contact.updatestate_change— The billing contact changed. organization.billing.credit.grantstate_change— Account credit was granted. organization.billing.readgoverning— Billing records were read. organization.createstate_change— An organization was created. organization.defaultphysicalgateway.setstate_change— The organization's default physical gateway changed. organization.domain.createstate_change— A verified email domain was added. organization.domain.requiresso.setstate_change— SSO enforcement for a domain was turned on or off. organization.membership.readgoverning— Organization memberships were read. organization.membership.setstate_change— A member's organization role was assigned or changed. organization.membership.unsetstate_change— A member was removed from the organization. organization.modelprice.deletestate_change— A model rate was removed from the organization rate era. organization.modelprice.readgoverning— Organization model rates were read. organization.modelprice.setstate_change— A model rate was set, opening or extending a rate era. organization.modelprice.updatestate_change— An organization model rate changed. organization.paymentmethod.default.setstate_change— The default payment method changed. organization.paymentmethod.updatestate_change— A payment method was added or updated. organization.readgoverning— Organization records were read. organization.seats.setstate_change— The purchased seat count changed. organization.sku.setstate_change— The subscription SKU changed. organization.sso.readgoverning— SSO configuration was read. organization.sso.setup.startstate_change— An SSO connection setup flow started. organization.subscription.cancelstate_change— The subscription was cancelled. organization.subscription.reactivatestate_change— A cancelled subscription was reactivated. organization.subscription.updatestate_change— The subscription changed state.
Event type Class Webhook Description integration.catalog.createstate_change— A catalog integration was added. integration.catalog.deletestate_change— A catalog integration was removed. integration.catalog.updatestate_change— A catalog integration was updated. integration.instance.createstate_change— An integration was connected for this workspace. integration.instance.deletestate_change— A connected integration was removed. integration.instance.readgoverning— Connected integrations were read. mcpcatalog.createstate_change— An MCP catalog entry was added. mcpcatalog.deletestate_change— An MCP catalog entry was removed. mcpcatalog.enabled.setstate_change— An MCP catalog entry was enabled or disabled.
Event type Class Webhook Description job.createstate_change— A scheduled job was created. job.deletestate_change— A scheduled job was deleted. job.readgoverning— Scheduled jobs were read. job.runstate_change— A scheduled job ran. job.updatestate_change— A scheduled job was updated.
