Audit event reference

This reference is for security teams parsing Dew’s audit log in a SIEM or script. Event names and fields don’t change once published; new events and new detail keys can be added.

Record format

Every path (viewer API, NDJSON export, SIEM feed, audit.log stream) emits the same fields with the same values per event; only the key order inside metadata may differ between the stream and the database paths.

Field	Meaning
id	Increasing integer, assigned in commit order. The feed cursor. Gaps are normal (a retried write uses up numbers); they never mean a deleted event.
event_id	UUID, stable across every delivery path. Deduplicate on it.
timestamp	When the action happened: UTC, always six fraction digits (2026-09-25T14:03:11.120000Z), whatever the server’s time zone. Times inside metadata (expires_at, due_at …) use the same format.
event_type	<object>.<action>, from the event list.
category	The <object> part, for grouping.
outcome	success, or failure for an attempt that was refused.
reason	Why an attempt failed, or why the system acted: a snake_case code (wrong_password, expired).
severity	info or warn. Fixed per event type; a failure is at least warn.
description	The event’s label from the catalog (the failure label for failures).
actor.type	user, integration (a service account, through one of its API tokens), idp (SCIM provisioning by an SSO connection), external (someone outside the app: a link recipient, an uploader, a caller presenting a token) or system (a background job, or a recovery command run on the server: metadata.method cli). A person’s own (personal) API token is the user it belongs to.
actor.id	User ID (user), service account ID (integration) or SSO connection ID (idp).
actor.email	The user’s email; for external, the address a recipient proved or an uploader gave. On a failed sign-in it is the address that was typed or the IdP asserted: a claim, not a verified identity.
actor.name	Service account name, SSO connection name, or an uploader’s name.
target.type / .id / .name	What was acted on. name is captured at the time and survives the target’s deletion.
domain	The web address of the domain a file.* or file_request.* event happened on, such as files.example.com. Absent on other events, and on events stored before October 2026.
client_ip	The client address, resolved through trusted proxies only.
user_agent	The client’s User-Agent header (at most 512 bytes).
request_id	Correlates with system logs and the access log (REF- + first 8 characters).
metadata	Event details, keys per event in the catalog. A key keeps one JSON type across all events. metadata.changes holds updates as {"field": {"old": …, "new": …}}; secret values appear as [redacted]. Any action taken through an API token adds token_name; when a service account acts as a person (Dew-Act-As), on_behalf_of holds that person’s email. owner_email names the owner of a file or request: a person’s email, or a service account’s name.

Text fields hold valid UTF-8 without NUL characters: invalid bytes in client-supplied values (a typed email, a User-Agent) are replaced with U+FFFD and NULs are removed. Every text value, in the columns and inside metadata, is at most 1 KB. Lists that summarize events recorded one per item (the emails of a license or SSO connection event, which also has a count key and one event per user) hold at most the first 100 entries. Lists that are the only record (the recipients a file was sent to) are complete, so a line can exceed 10,000 bytes: see Send audit logs to a SIEM.

Link IDs (the target.id of file.* events) work like passwords: anyone with one can open the link. Treat your SIEM index as holding link credentials.

Event names

Names are <object>.<action> in snake_case, the action in the past tense, and never change once published.

• An edit of an object’s fields is <object>.updated. <object>.<aspect>_changed marks a change with its own security meaning, even when it spans several fields: a password, an email, the primary domain, who can open a link (file.sharing_changed).
• deleted: the object stopped existing. removed: something was taken out of another object (file_request.person_removed). revoked: access was taken away (api_token.revoked, user.admin_revoked, invite.revoked).
• A session starts and ends as signed_in and signed_out, on the web (auth.*) and in the desktop app (device.*).
• Anything with a lifecycle of its own (a certificate, a SCIM token, a group) is its own object, so one category holds all its events.
• A refused attempt is the same event with outcome failure and a reason, never a separate _failed event.

Map to SIEM schemas

Events don’t include the server’s name. Set it in your ingest pipeline (observer.name in ECS, dest in Splunk, Dvc in Sentinel). One server can serve several hostnames; file.* and file_request.* events carry the hostname in the top-level domain field.

Every mapping below derives the type of change from the action part of event_type (after the dot):

Action	Kind
created, uploaded, shared_from_request, received, issued, imported, invited	creation
deleted, revoked, purged, person_removed	deletion
downloaded, exported, password_viewed, tested, access_denied	access
signed_in, token_rejected	sign-in
signed_out	sign-out
started, stopped	server start and stop (system.started, system.stopped)
everything else (updated, *_changed, activated, assigned, admin_granted …)	change

Elastic ECS

event.kind is event, event.module is dew, event.dataset is dew.audit, observer.vendor and observer.product are Dew.

Record field	ECS field
event_id	event.id
timestamp	@timestamp
event_type	event.action
category	event.category, by the table below
kind (table above)	event.type, by the table below
outcome	event.outcome (same values)
reason	event.reason
severity	log.level
description	message
actor with type user or external	user.id, user.email, user.name
actor with type integration, idp or system	dew.actor.* (a service account or an SSO connection is not a user)
target with type user	user.target.id, user.target.email (from target.name)
target with type file	file.name (from target.name), dew.target.id
any other target	dew.target.*
domain	dew.domain
client_ip	source.ip, related.ip
actor.email, and target.name of a user target	related.user
user_agent	user_agent.original
request_id	http.request.id
metadata	dew.metadata, mapped as flattened (keys vary per event)

category	event.category	event.type by kind
auth, device	authentication	sign-in: start; sign-out: end
auth.access_denied (the event, not the category)	web	access. An authorization refusal of a signed-in caller, not a failed sign-in: kept out of authentication, it doesn’t feed failed-login and brute-force rules
user, invite, api_token, service_account, scim_token, group	iam	creation, deletion: creation, deletion; everything else: change. Add user for user.*, group for group.*, admin for user.admin_granted, user.admin_revoked and user.break_glass_assigned
domain.access_granted, domain.access_revoked (the events)	iam	change. Who can use a domain, kept with the other access changes rather than in configuration
system.started, system.stopped (the events)	process	start, end
file, file_request	file	creation, deletion, access or change
every other category	configuration	creation, deletion, access or change

A refused attempt keeps its kind and has event.outcome failure: auth.token_rejected is authentication start, file.access_denied is file access.

Splunk CIM

auth.signed_in, auth.token_rejected and device.signed_in map to the Authentication data model; every other event maps to Change. app is dew, vendor_product is Dew. For Change, CIM’s user is the account that was changed when the object is an account, and src_user who changed it; for any other object user is who made the change.

Record field	Authentication	Change
outcome	action (success, failure)	status
kind (table above)		action: creation created, deletion deleted, access read, system.stopped stopped, everything else modified
event_type	signature	command
target.name	user (the account signing in: an email, the address typed for an unknown account, or a token’s name), except device.signed_in, whose target is the device	object; also user when target.type is user
target.id / .type		object_id, object_category
actor.email, else actor.name	src_user; user for device.signed_in	src_user when target.type is user, else user
metadata.method	authentication_method
client_ip	src	src
reason	reason	result
event_id	event_id	event_id
severity	severity: info informational, warn medium	severity, the same

Set change_type to AAA for the iam categories of the ECS table.

Microsoft Sentinel (ASIM)

Map auth.signed_in, auth.token_rejected and device.signed_in to the Authentication schema, everything else to AuditEvent. EventVendor and EventProduct are Dew.

Record field	Authentication	AuditEvent
timestamp	TimeGenerated	TimeGenerated
event_id	EventOriginalUid	EventOriginalUid
event_type	EventOriginalType	Operation
kind (table above)	EventType Logon	EventType: creation Create, deletion Delete, access Read, activated Enable, deactivated Disable, server start and stop Other, everything else Set
outcome	EventResult (Success, Failure)	EventResult
reason	EventResultDetails by the table below; the code itself in EventOriginalResultDetails	EventOriginalResultDetails
severity	EventSeverity (info Informational, warn Medium)	EventSeverity
target.name	TargetUsername, except device.signed_in: actor.email	Object
target.type		ObjectType: Configuration Atom for settings, domain and the *_config, storage_provider, sso_connection targets, Policy Rule for ip_allowlist, else Other; the type itself in AdditionalFields
actor.email, else actor.name	ActorUsername	ActorUsername
metadata.method	LogonMethod by the table below; the method itself in LogonProtocol
client_ip	SrcIpAddr	SrcIpAddr
user_agent	HttpUserAgent	HttpUserAgent

ASIM restricts EventResultDetails and LogonMethod to fixed values:

Record value	ASIM value
reason user_not_found	No such user
reason wrong_password	Incorrect password
reason wrong_secret	Incorrect key
reason account_deactivated	User disabled
reason session_expired, sign_in_timed_out, password_changed	Session expired
reason sso_enforced, no_domain_access, 2fa_setup_required, email_domain_not_allowed	Logon violates policy
any other reason	Other
method password	Username & Password
method totp, backup_code, trusted_device	Multi factor authentication
any other method (saml, oidc, setup, invite, handoff)	empty

Event list

Each event has a label shown in Activity → Audit logs (description in the record), and a separate label for refused attempts. The details column lists the keys in metadata and the possible reason values.

Event	Severity	Label	Failure label	Details
auth.signed_in	info	Signed in	Sign-in failed	method (password, totp, backup_code, trusted_device, setup: the first admin at setup, invite: a new user right after accepting an invitation, handoff: an admin’s browser sign-in carried to a new hostname when the domain wizard finished, with host); backup_codes_remaining (backup_code); trusted_device_issued (2FA sign-ins: a “remember this device” token was issued); connection_id, connection_name (sso_enforced); auth_provider (no_password). Reasons: user_not_found (actor external, the typed address as target name; a database error is a server error, not recorded), wrong_password, account_deactivated, no_password, sso_enforced, no_domain_access, wrong_2fa_code, password_changed and sign_in_timed_out (the 2FA step was voided). Throttled attempts are not recorded. Single sign-on (method saml, or oidc for retained OIDC connections): connection_id, connection_name, provider (entra, okta, google, generic); cross_host_origin when the sign-in finished on another Dew hostname (recorded at finalize, never when the handoff is minted). The actor is the IdP-asserted address, external until an account is known. SSO reasons: session_expired, invalid_relay_state (includes an unsupported sign-in from the IdP’s app tile), origin_host_not_allowed, connection_not_found, connection_inactive, validate_failed, idp_error (the IdP answered with a non-success status), inresponseto_mismatch, replay_detected, missing_email, missing_user_id (the connection’s user ID attribute was not in the assertion), email_mismatch, token_exchange_failed (OIDC), email_domain_not_allowed, email_in_use, identity_mismatch (the address matched an account linked to a different IdP identity; an admin unlinks it on the Users page), break_glass_link_refused, email_unverified, invite_email_unverified (the address has a pending invitation, which an unverified address may not accept), user_creation_disabled, license_user_limit, no_access_for_new_account (no active domain is open to Everyone or to an email rule matching the address, and no pending invitation for the address grants an active domain, a Local group on an active domain’s access list or the admin role, so no account was created), provisioning_failed (internal error), account_deactivated, no_domain_access. Before the assertion is validated only method and a well-formed connection_id are recorded.
auth.signed_out	info	Signed out		Recorded only when the session named a user.
auth.token_rejected	warn		Token rejected	A request presented a token found in the database, and it was refused. Actor external (the caller is unknown). token_type: api (a service account token, target api_token), personal (target api_token, owner_email), desktop (target desktop_token, owner_email; device.signed_in names the same token in token_id) or scim (target sso_connection). Reasons: revoked, expired (api and personal), personal_tokens_disabled (an admin turned personal tokens off), wrong_secret (scim only: the connection exists but the secret is wrong). API, personal and desktop tokens are found by their hash, so only their holder can be refused for one of these reasons; an unknown or malformed token, and a SCIM token for a missing connection, a connection with SCIM off or no token set, are not recorded. Expect one revoked event when a signed-out desktop app next calls. At most 10 events per source and token per 10 minutes.
auth.access_denied	warn		Access denied	A signed-in user or an API token was refused by authorization. No target. http_method, path (no query string). Reasons: ip_not_allowed (admin IP allowlist), admin_required, desktop_app_not_allowed (a desktop app token on an admin route, or on an account-security action: password, email address, 2FA), integration_token_not_allowed (an API token on a route only people can use: account pages, API token and service account management), personal_token_not_allowed (a personal token on an admin route), act_as_not_allowed (a service account named someone it may not act as, act_as masked; or sent Dew-Act-As to an admin route), admin_target_not_allowed (an API token tried to create, invite or manage an admin), scope_missing (required_scopes). At most 10 events per actor and reason per 10 minutes.
user.created	info	User created		source scim (actor idp: the SSO connection; status active or inactive, email_domain_covered false when the address is outside the connection’s email domains) or sso_jit (actor idp: first SSO sign-in created the account). A JIT or active SCIM account that completed a pending invitation adds is_admin, domains and groups, after an invite.accepted and before a user.admin_granted, actor idp. Access through Everyone or an email rule is not recorded per user; SCIM group membership is group.member_added. Admin-created: source admin, is_admin, domains (hostnames the user was added to directly), groups (names of the Local groups the user was added to). From an invite: source invite, is_admin, domains, groups, actor the new user. The first admin at setup: source setup, is_admin, domains (empty). An account created with admin access also gets user.admin_granted.
user.deleted	warn	User deleted		Everything the user owned goes with them: shared_links, file_requests, received_files (counts). Deleting an admin also records user.admin_revoked.
user.updated	info	Profile updated		changes.display_name, or avatar (uploaded, removed) for the profile picture (an admin removing someone’s picture is the actor). source scim (actor idp; changes email, display_name, external_id; linking an existing account adds linked true and changes auth_provider, external_id) or sso (actor idp; profile sync at sign-in: changes email, display_name; linking by email, including an account moving to a new sign-in identity: linked true, changes auth_provider, sso_subject). A SCIM re-send that changes nothing is not recorded.
user.activated	info	User enabled		source scim (actor idp): the IdP set active=true on an inactive account. Reasons: license_restored (a license covers the user again; actor system, or the admin who activated or refreshed the license).
user.deactivated	warn	User disabled		source scim (actor idp): active=false, or reason deleted_in_idp for a SCIM DELETE (the account is deactivated, never deleted) (events from 2026.10.1363 and earlier may also carry email_domain_not_covered: SCIM linked an account outside the connection’s email domains, then disabled it). sessions_terminated: every sign-in the user held was ended (all deactivations except license_limit, where the license restores the account as it was). Reasons: license_limit (over the license user limit; actor system, or the admin who removed the license), email_domain_removed (an admin removed the user’s email domain from their SSO connection: connection_id, connection_name; the connection’s sso_connection.updated lists them too).
user.admin_granted	warn	Admin access granted		Every way to admin access records it: a promotion (sessions_terminated when it put the user into 2FA setup; not recorded when the user already was an admin), and an account created as admin by an admin, from an admin invite (actor the new user) or at setup, each with new_account true next to its user.created.
user.admin_revoked	warn	Admin access removed		Not recorded when the user was not an admin. account_deleted true when the admin was deleted, next to its user.deleted.
user.break_glass_assigned	warn	Break-glass account assigned		previous_holder_email (the actor: only the holder can hand it on).
user.converted_to_local	warn	User converted to a local account		connection_id, connection_name: the SSO connection the user was detached from. reactivated, sessions_terminated, reset_email_sent (an admin converting one user). Also recorded when a step after the conversion failed, with those flags false. When an SSO connection is deleted, one event per user it converted.
user.sso_unlinked	warn	SSO identity unlinked		An admin cleared the user’s sign-in identity, so their next SSO sign-in with the account’s email links whichever identity it names; the user was signed out. changes.sso_subject (old identity → empty); connection_id, connection_name. An account with no identity linked is left unchanged: no event, no sign-out.
user.password_changed	info	Password changed	Password change failed	method (self, reset_link, admin_set, cli: the --reset-user recovery command, actor system); sessions_terminated. Reasons: wrong_password (self).
user.password_reset_requested	info	Password reset requested		Self-service reset: actor external, target the account the link was sent to. Requests that send nothing are not recorded, so the trail does not reveal which addresses have accounts.
user.password_reset_sent	info	Password reset link sent		An admin sent the target a reset link.
user.2fa_enabled	info	2FA enabled	2FA setup failed	Reasons: wrong_2fa_code.
user.2fa_reenrolled	info	2FA authenticator replaced	2FA authenticator replacement failed	Reasons: wrong_password, wrong_2fa_code.
user.2fa_disabled	warn	2FA disabled	Disabling 2FA failed	Reasons: wrong_password (turned off by the user). method (self, admin, cli: the --reset-user recovery command, actor system); sessions_terminated (admin, cli).
user.email_change_requested	info	Email change requested	Email change request failed	new_email; connection_id, connection_name (sso_enforced). Reasons: wrong_password, sso_enforced, email_in_use.
user.email_change_canceled	info	Email change canceled		new_email: the address the canceled change would have set.
user.email_changed	warn	Email address changed		changes.email; notice_delivered (the notice with the revert link reached the previous address); sessions_terminated.
user.email_change_reverted	warn	Email change undone		Undone from the link sent to the previous address. changes.email, changes.password (cleared); sessions_terminated; sso_enforced with connection_id, connection_name (password sign-in is unavailable on the restored address).
user.ownership_transferred	warn	Files and requests transferred		Target: the user who gave them up. to_email (who has them now), shared_links, file_requests, received_files (counts moved), uploads_canceled (the user’s own unfinished uploads).
device.signed_in	info	Desktop app signed in	Desktop app sign-in failed	platform, app_version; token_id, token_name (success). Reasons: no_domain_access, 2fa_setup_required, cross_origin, csrf_check_failed (the last two only when the request carried a signed-in session).
device.signed_out	info	Desktop app signed out		owner_email; method (self, desktop_sign_out, admin).
invite.created	info	Invite sent		is_admin, domains (hostnames), groups (Local group names), expires_at.
invite.resent	info	Invite resent		changes.expires_at. The link is re-minted, so the previous one stops working.
invite.revoked	info	Invite revoked		Reasons: replaced (a new invite to the same address closed it).
invite.accepted	info	Invite accepted		Actor: the new user (not signed in yet). Paired with user.created (source invite), which carries the access the invite granted. Also when single sign-on or SCIM creates the invited address’s account (actor idp, the connection; user.created source sso_jit or scim).
file.uploaded	info	File uploaded		One event per finished upload. size_bytes, file_count, link_type (public, protected, private, onetime), protection (none, password, sms, email), expires_at (null: never), domain, emails (invitations sent, email protection)
file.shared_from_request	info	Link created from received files		A link made from files a request received. file_request_id, size_bytes and the file.uploaded link keys
file.downloaded	info	File downloaded		Once per download (no event for HEAD or later Range requests). via (link, owner, admin, api), size_bytes, zip_entry (one entry of a shared archive), automated (true for preview bots, scanners and prefetch, which receive the bytes), owner_email and admin_action when not the owner. Link downloads: actor external, with the email only when the recipient proved it; owner_email always
file.access_denied	warn		Link access denied	Actor external. owner_email. Reasons: wrong_password, wrong_code, one_time_used, ip_not_allowed, expired. The last three are not recorded for preview bots, scanners and prefetch; rate-limited attempts are not recorded; at most 10 events per source and link per 10 minutes
file.sharing_changed	info	Link sharing changed		changes: link_type, protection, password and phone_number (redacted), allowlist (name). emails_added, emails_removed, owner_email, admin_action
file.updated	info	Link settings updated		changes: expires_at or download_receipt. owner_email, admin_action, beyond_domain_limit (an expiry past the domain’s maximum link lifetime, which only admins may set)
file.resent	info	Link resent		emails, owner_email, admin_action
file.password_viewed	warn	Link password viewed		owner_email, admin_action when not the owner
file.deleted	info	File deleted		Reasons: user, admin, expired, retention. admin_note (the reason an admin typed), owner_email and admin_action when not the owner, file_request_id for received files. Expired and retention deletions: actor system, one event per file
file_request.created	info	Request created		emails (invited), domain, link_enabled, due_at
file_request.updated	info	Request updated		changes: title, instructions, due_at, notify_mode, link_enabled, closed
file_request.deleted	info	Request deleted		Reasons: user, retention (actor system, with owner_email). file_count; each received file also gets file.deleted
file_request.invited	info	People invited		emails; changes.email when an invitee’s address was corrected (the old address’s upload link stopped working)
file_request.reminded	info	Reminder sent		emails
file_request.person_removed	info	Person removed		email
file_request.received	info	Files received		Actor external: the sender’s email and name. email_verified, file_count, size_bytes, file_id, file_name (the upload: a file, or the archive of several)
file_request.downloaded	info	Received files downloaded		file_count, size_bytes, file_name and zip_entry for one upload or one entry of it
file_request.access_denied	warn		Request access denied	Actor external, with the email (and name) the uploader gave. Reasons: wrong_code (shared-link email code), closed (an invitee’s upload link used after the request closed)
domain.created	info	Domain added		is_primary, is_active
domain.deleted	warn	Domain deleted		What went with it: user_count (accounts that could use it, by any route, admins reached through Everyone or a rule included), access (its access list: groups by name, people by email), ip_allowlists (names). Force delete: force true, link_count, file_request_count, upload_count (uploads in progress), deleted with their files.
domain.activated	info	Domain activated		Reasons: license_restored (actor system, or the admin who activated or refreshed the license).
domain.deactivated	warn	Domain deactivated		Reasons: license_limit (the license covers only the primary domain).
domain.primary_changed	warn	Primary domain changed		Target: the new primary. previous_primary (hostname), previous_primary_deactivated (Free swap). Each active SAML connection also gets sso_connection.updated (reason primary_domain_changed)
domain.verified	info	Domain verified		Strict TLS probe passed
domain.access_granted	info	Domain access granted		A person or group was put on the domain’s access list. Target type domain_access, ID the domain, name <group name or email> → <hostname>. domain_id, and group_id or user_id. Not recorded when the person or group was already on the list.
domain.access_revoked	info	Domain access removed		A person or group was taken off the domain’s access list. Target and metadata as domain.access_granted. Entries that go with a deleted group, person or domain are not recorded separately: see group.deleted, user.deleted, domain.deleted.
domain.unverified	warn	Domain no longer verified		reasons: the strict probe’s TLS error class (hostname_mismatch, untrusted_root, expired, name_not_allowed, incompatible_usage, name_constraints, certificate_invalid, tls_error, request_build) or probe_failed
domain_settings.updated	info	Domain settings updated		changes: every per-domain override the save changed, by field name; changes.hsts (bool) when HSTS is turned on or off on the domain’s certificate details. Reasons: license_limit (changes.storage_provider provider name → null: cloud storage not licensed), license_restored (null → provider name).
domain_settings.reset	info	Domain settings reset		changes: the overrides removed (new value null); branding assets are removed too
certificate.issued	info	Certificate issued	Certificate renewal failed	Target: the domain. method (manual: the Let’s Encrypt wizard; renewal: the background job, actor system), expires_at on renewal; reasons (renewal only): certificate_unavailable, renewal_stalled
certificate.imported	warn	Certificate imported		Target: certificate (the cert name). method (paste, upload), dns_names, expires_at. No key material
certificate.assigned	warn	Certificate changed		Target: the domain. changes: cert_name, cert_mode
certificate.reloaded	info	Certificates reloaded		https_listener_restarted when the HTTPS listener was restarted
system.started	info	Server started		Actor system, no target. version.
system.stopped	info	Server stopped		Actor system, no target. Recorded at a graceful shutdown, after in-flight requests and the work they started finished or the shutdown deadline passed, and with reason start_failed when the server could not start (its domains or certificates could not be loaded, or the port could not be opened).
system.setup_completed	info	Setup completed	Setup refused	Actor and target: the first admin account. A refused attempt (a wrong setup code) has reason wrong_setup_code, actor external and no target.
support_bundle.downloaded	warn	Support bundle downloaded		The diagnostic report holds system info, recent warn and error logs, the last 5,000 lines the server logged since it started and today’s access log, redacted.
system.debug_logging_enabled	warn	Debug logging turned on		No target. until: when it turns itself off (24 hours later).
system.debug_logging_disabled	info	Debug logging turned off		No target. Reason expired, actor system, when the 24 hours ran out.
log.exported	info	Logs exported		log (system, access). system: filters (the export’s query parameters). access: file; recorded when a whole file is read (tail=0), not for the tailed view the System page polls.
audit.exported	warn	Audit log exported		filters (the export’s query parameters).
audit.purged	info	Expired audit events deleted		Actor system, reason retention. count, last_deleted_id (the highest ID deleted: a feed cursor below it may have missed events), retention_days, cutoff.
settings.updated	warn	Global settings updated		Target: settings global. Not recorded when the save changed nothing. changes: every global setting the save changed, by field name (audit_log_retention_days, require_2fa, password_, session_lifetime_hours, idle_timeout_, admin_dashboard_allowed_ips, trusted_proxy_networks (Trust this proxy and Remove on System), alert_*, storage_provider, max_upload_size_gb, link_expiry_days, max_link_lifetime_days, link_format_template, received_file_retention_days, display_name, …). Lowering audit_log_retention_days also alerts every admin. sessions_terminated, affected_user_count when tightening 2FA signed users out. Reasons: license_limit (changes.storage_provider, provider names: cloud storage not licensed), license_restored (changes.storage_provider, provider names: the license covers cloud storage again). method cli: the --disable-admin-allowlist recovery command (actor system; changes.enable_admin_ip_allowlist, changes.admin_dashboard_allowed_ips).
branding.updated	info	Branding updated		Target: settings global or the domain. scope (global, domain), asset (logo, favicon, background), action (uploaded, removed). Reasons: license_limit (suppressed true: the license no longer covers custom branding, which shows defaults but is kept; recorded on each enforcement pass), license_restored (suppressed false).
smtp_config.created	info	SMTP server added		provider, host, port, from_email, is_default, is_active
smtp_config.updated	warn	SMTP server updated		changes: name, description, is_active, host, port, encryption, username, from_email, from_name, reply_to, ms_tenant_id, ms_client_id, ms_secret_expires_at; password, ms_client_secret redacted
smtp_config.deleted	info	SMTP server deleted
smtp_config.default_changed	warn	Default SMTP server changed		changes.default: the previous default’s name (null: none) → this one’s.
smtp_config.tested	info	Test email sent	Test email failed	to (the recipient the admin entered). Reasons: send_failed.
sms_config.created	info	SMS provider added		provider_type, is_default, is_active
sms_config.updated	warn	SMS provider updated		changes: name, description, is_active, provider_type, account_sid, username; api_key redacted
sms_config.deleted	info	SMS provider deleted
sms_config.default_changed	warn	Default SMS provider changed		changes.default: the previous default’s name (null: none) → this one’s.
sms_config.tested	info	Test SMS sent	Test SMS failed	to (the phone number the admin entered). Reasons: send_failed.
storage_provider.created	info	Storage provider added		provider_type, base_path (local) or bucket, endpoint, region, prefix (S3), direct_upload
storage_provider.updated	info	Storage provider updated		changes: name, path_style, direct_upload (re-check); access_key_id, secret_key redacted
storage_provider.deleted	warn	Storage provider deleted		force, file_count (files deleted with it, 0 without force), deleted_storage and left_on_storage (queued objects on it removed from storage and left there). Written when the storage cleanup that follows the delete ends, after the response
storage_provider.activated	info	Storage provider activated		Reasons: license_restored.
storage_provider.deactivated	warn	Storage provider deactivated		Reasons: license_limit (cloud storage not licensed).
ip_allowlist.created	info	IP allowlist added		cidr_ranges, domain (hostname; null for a global allowlist), is_active
ip_allowlist.updated	info	IP allowlist updated		changes: name, description, cidr_ranges, is_active
ip_allowlist.deleted	info	IP allowlist deleted
license.activated	info	License activated		Target: the license (masked key, tier). max_users, trial, expires_at, moved (activations elsewhere released), restored_users and emails (first 100) (users given their seat back, each also a user.activated).
license.deactivated	warn	License deactivated		Target: the removed license. seat_released; what enforcing Free did: disabled_users, disabled_domains, disabled_sso, disabled_cloud, reassigned_domains, branding_suppressed, enforcement_failed (each change is also its object’s own event, reason license_limit).
license.validated	info	License validated	License validation failed	Target: the license (masked key, tier). changes (tier, max_users, trial, expires_at); restored_users, emails (first 100). By an admin (sync), or actor system from the background revalidation, recorded then only when the terms changed or users got their seat back. Failure (actor system): the license stopped covering this server and dropped to Free, whether or not a grace period follows; changes (tier, max_users), license_error (the verdict, as shown to the admin). Reasons: rejected (expired, suspended, revoked or not valid), moved (another server activated the seat this server held), unreachable (the license server could not be reached for 72 hours).
license.grace_started	warn	License grace period started		Actor system. Target: the license (masked key, current tier; no key on Free). old_tier, old_max_users, tier, max_users, active_users (when counted), grace_expires_at (when enforcement runs: sooner than 14 days, or already past, for a license that lapsed while the server was off); license_error (the verdict, as shown to the admin) when the license itself stopped covering this server. Reasons: downgraded (a validation found lower terms, or the license expired, became invalid or could not be checked for 72 hours, and the configuration has something they do not cover or could not be counted), moved (another server activated the seat this server held), over_provisioned (the configuration exceeds the installed license: more active users than it allows, or domains, SSO connections or cloud storage it does not cover; old_* equal the current terms). Its end is license.grace_ended.
license.grace_ended	info	License grace period ended		Target: the license (masked key, current tier). Reasons: resolved (the license covers everything again; actor the admin whose activation or sync did it, else system), expired (actor system; enforcement brought the server within the license: disabled_users, disabled_domains, disabled_sso, disabled_cloud, reassigned_domains, branding_suppressed, each change also its object’s own event with reason license_limit).
api_token.created	warn	API token created		kind (service or personal); service_account (its name) or owner_email (a personal token’s person); expires_at (null: never expires; personal tokens always expire); scopes (personal tokens; a service account’s are on service_account.*).
api_token.regenerated	warn	API token regenerated		Service account tokens only. New secret, in place: changes.secret (redacted) and changes.expires_at (null: never expires). The old secret stops working at once. kind.
api_token.revoked	info	API token revoked		kind; service_account or owner_email. Ending a person’s sign-ins also revokes their personal tokens, recorded on that event (sessions_terminated), not here.
api_token.deleted	info	API token deleted		kind; service_account or owner_email. An admin deletes revoked tokens only; a person deletes their own personal tokens directly.
service_account.created	warn	Service account created		scopes, domains (hostnames), contact_email (null: none).
service_account.updated	warn	Service account updated		changes of name, description, scopes, contact_email, domains.
service_account.deleted	warn	Service account deleted		Its tokens and everything it owned go with it: shared_links, file_requests, received_files (counts).
group.created	info	Group created		kind local (an admin or an API token made it in Dew; email_domains, the email rule, empty for none) or scim (actor idp: the identity provider pushed it; members_added, count, each also a group.member_added).
group.updated	info	Group updated		kind. changes.name; Local groups also changes.email_domains (the email rule). Membership is recorded per person, not here. An edit or IdP re-send that changes nothing is not recorded. A SCIM group that became a Local group: changes.kind (scim → local), changes.name when a suffix was added, reason sso_connection_deleted or scim_turned_off.
group.deleted	warn	Group deleted		kind. Local: member_count (members when deleted), domains (hostnames whose access list named the group). SCIM (actor idp): members_removed (count), domains. Its memberships and access list entries go with it, without events of their own.
group.member_added	info	Added to group		Target: the person (type user, name the email). group_id, group_name. Added by hand to a Local group (also clears an exclusion), or by the identity provider to a SCIM group (actor idp). Matching a group’s email rule records nothing: that membership follows the address.
group.member_removed	info	Removed from group		Target: the person. group_id, group_name. Taken out of a Local group by hand, or out of a SCIM group by the identity provider (actor idp).
group.member_excluded	info	Excluded from group		Target: the person. group_id, group_name. A person a Local group’s email rule matches was excluded from it.
group.member_included	info	Included in group again		Target: the person. group_id, group_name. An exclusion was removed, so the email rule includes the person again.
sso_connection.created	warn	SSO connection added		provider_type (saml, oidc), provider, email_domains, is_active, allow_user_creation; SAML: saml_metadata_url, saml_idp_entity_id, saml_idp_cert_fingerprints (SHA-256); OIDC: oidc_issuer_url. No secrets or certificates.
sso_connection.updated	warn	SSO connection updated		changes: name, description, provider, provider_type, oidc_issuer_url, oidc_client_id, oidc_client_secret (redacted), saml_metadata_url, saml_idp_entity_id, saml_idp_sso_url, saml_idp_cert_fingerprints and saml_additional_cert_fingerprint (SHA-256, certificates are never stored), saml_attr_email, saml_attr_first_name, saml_attr_last_name, saml_attr_user_id, email_domains, allow_user_creation, scim_enabled, enforce_mode. deactivated_count, emails (first 100) when removing email domains deactivated users. sso_subjects_cleared when changing the user ID attribute or the protocol cleared users’ linked sign-in identities (each links again by email at its next sign-in). Reason metadata_refresh (actor system): the hourly IdP metadata refresh changed the certificates, SSO URL or entity ID; prior_cert_count, new_cert_count. Reason certificate_expired (actor system): the certificate kept after Update certificate expired and was removed (changes.saml_additional_cert_fingerprint). Reason primary_domain_changed: the primary domain moved Dew’s SAML endpoints (changes.acs_url, changes.entity_id); update them in the IdP. An edit that changes nothing is not recorded.
sso_connection.deleted	warn	SSO connection deleted		After converting attached users to local accounts: converted_user_count, emails (first 100), sessions_terminated, reset_emails_sent, reset_email_failed_emails (first 100).
sso_connection.activated	info	SSO connection activated		An admin edit set it active; other fields changed in the same edit are in sso_connection.updated. Reasons: license_restored.
sso_connection.deactivated	warn	SSO connection deactivated		An admin edit set it inactive; other fields changed in the same edit are in sso_connection.updated. Reasons: license_limit.
scim_token.created	warn	SCIM token generated		Target: the SSO connection. replaced_token (the previous token stopped working); changes.scim_enabled when this turned SCIM on.