Event reference

Every audit action Gigadrive records today, the operation type it carries, and the resource each one points at.

An action is <category>.<verb>. The category names the kind of thing that changed and the verb names what happened to it, so env_var.update and storage_bucket.delete read the same way whether the change came from the console, the CLI, or the API.

Most verbs are create, update, delete, and read, and each maps to the matching operationType. A few categories add a verb of their own where the generic four would lose the meaning, such as storage_object.trash against storage_object.purge.

Applications and deployments

Action	Operation	Target	Recorded when
`application.create`	`CREATE`	`application`	An application is created
`application.update`	`UPDATE`	`application`	Application settings change, including connecting a Git source
`environment.create`	`CREATE`	`application_environment`	An environment is added
`environment.update`	`UPDATE`	`application_environment`	An environment is renamed or reconfigured
`environment.delete`	`DELETE`	`application_environment`	An environment is removed
`deployment.create`	`CREATE`	`deployment`	A deployment is started
`deployment.update`	`UPDATE`	`deployment`	A deployment changes state, for example when its archive upload completes
`env_var.create`	`CREATE`	`application_env_var`, `organization_env_var`	A variable is added. The payload carries the key and whether it is sensitive, never the value
`env_var.update`	`UPDATE`	`application_env_var`, `organization_env_var`	A variable is changed
`env_var.delete`	`DELETE`	`application_env_var`, `organization_env_var`	A variable is removed
`hostname.update`	`UPDATE`	`application`	The application's hostname label changes. `before` and `after` carry the old and new label
`github_installation.update`	`UPDATE`	`github_installation`	A GitHub App installation is reconciled
`gitlab_connection.update`	`UPDATE`	`gitlab_connection`	The organization's GitLab connection is made or reauthorized
`gitlab_connection.delete`	`DELETE`	`gitlab_connection`	The organization's GitLab connection is removed
`build_cache.update`	`UPDATE`	`build_cache`	The build cache is cleared. The payload counts the entries and bytes removed
`sticky_session.create`	`CREATE`	`deployment_function`	A sticky session is issued for a function

File storage

Action	Operation	Target	Recorded when
`storage_bucket.create`	`CREATE`	`storage_bucket`	A bucket is created
`storage_bucket.delete`	`DELETE`	`storage_bucket`	A bucket is deleted
`storage_object.create`	`CREATE`	`storage_object`	An object is written
`storage_object.update`	`UPDATE`	`storage_object`	An object's metadata changes
`storage_object.read`	`READ`	`storage_object`	An access URL is issued for an object
`storage_object.trash`	`DELETE`	`storage_object`	An object is moved to the trash and is still recoverable
`storage_object.restore`	`UPDATE`	`storage_object`	A trashed object is restored
`storage_object.purge`	`DELETE`	`storage_object`, `storage_bucket`	An object is destroyed for good, or a whole bucket's trash is emptied
`storage_upload.create`	`CREATE`	`storage_upload_session`	An upload session is opened
`storage_upload.update`	`UPDATE`	`storage_upload_session`	An upload session advances or completes
`storage_s3_credential.create`	`CREATE`	`storage_s3_credential`	An S3 credential pair is minted
`storage_s3_credential.delete`	`DELETE`	`storage_s3_credential`	An S3 credential pair is revoked
`storage_bucket_backup.create`	`CREATE`	`storage_bucket_backup`	A backup is taken
`storage_bucket_backup.restore`	`UPDATE`	`storage_bucket_backup`	A backup is restored into a bucket
`storage_bucket_backup.delete`	`DELETE`	`storage_bucket_backup`	A backup is deleted
`storage_bucket_backup_schedule.create`	`CREATE`	`storage_bucket_backup_schedule`	A backup schedule is set on a bucket
`storage_bucket_backup_schedule.update`	`UPDATE`	`storage_bucket_backup_schedule`	An existing schedule is changed
`storage_bucket_backup_schedule.delete`	`DELETE`	`storage_bucket_backup_schedule`	A schedule is removed

Organization, access, and billing

Action	Operation	Target	Recorded when
`organization.create`	`CREATE`	`organization`	An organization is created
`organization.update`	`UPDATE`	`organization`	Organization-level state changes, for example a GitHub installation being connected
`api_key.create`	`CREATE`	`api_key`	A key is minted. The secret is never in the payload
`api_key.delete`	`DELETE`	`api_key`	A key is revoked
`product_subscription.update`	`UPDATE`	`product_subscription`	A plan is activated or changed. The payload carries the product, plan, status, and seat count
`product_seat.create`	`CREATE`	`product_seat`	A seat is assigned to a member
`product_seat.delete`	`DELETE`	`product_seat`	A seat is unassigned
`billing.update`	`UPDATE`	`billing_customer`	Billing details or the saved payment method change
`billing_budget.update`	`UPDATE`	`billing_budget`	A spend budget is set, raised, or cleared
`billing_credit.grant`	`CREATE`	`billing_credit_grant`	A billing credit grant is added to the organization
`billing_credit.apply`	`ACTION`	`invoice`	Eligible credits are applied to an issued invoice
`billing_credit.revoke`	`ACTION`	`billing_credit_grant`	A credit grant is withdrawn
`billing_credit.reverse`	`ACTION`	`invoice`	Credits previously applied to an invoice are released
`ai_gateway_budget.update`	`UPDATE`	`ai_gateway_budget`	An AI Gateway budget is changed
`ai_gateway_policy.update`	`UPDATE`	`ai_gateway_policy`	An AI Gateway policy is changed

What is not in this list

Further categories exist for work Gigadrive does to keep the platform running. Those entries are written against your organization but describe nothing anyone in your team changed, so they are deliberately left out here.

Feature-gated capabilities record their own categories in the same shape. If a capability is enabled for your organization, its events are logged like the listed categories.

Failures are modelled: an entry carries success, errorMessage, and errorCode. No service writes a failure entry today, so every entry you will find has success: true.