Audit events¶

The shared audit service records administrative changes, outgoing email, and automatic timer activity. You read them in Audit log → Explorer, filtering by event name. The email-specific view is documented in Emails.

User and role changes¶

Event	Recorded when
`admin.user.create`	A user is created
`admin.user.update`	A user is edited
`admin.user.disable`	A user is deactivated
`admin.user.enable`	A user is reactivated
`admin.user.delete`	A user is deleted
`admin.role.create`	A role is created
`admin.role.update`	A role is edited
`admin.role.delete`	A role is deleted
`admin.role.user.assign` / `.remove`	A user is added to or removed from a role
`admin.role.permission.assign` / `.remove`	A permission is granted to or removed from a role

Each event records who did it, on which user or role, the result, and the date and time.

No secrets in the log

No event contains a password, a token, or a secret. A user event refers to the user; a role event refers to the role code.

Email events¶

Every send produces a queued event and then a result.

Event	Recorded when
`email.send.queued`	The message is accepted for delivery
`email.send.success`	The message was delivered
`email.send.failure`	Delivery failed; the event carries a short error

The event includes the subject and whether it was the first attempt or a retry.
Sender and recipient addresses are masked, for example j***e@acme.com.
The body of the message and any credentials never appear in the log.

The same messages are listed with filters and detail in Emails.

Timer events¶

Cases that are created or advanced by a timer are recorded with no author, because the system did it.

Event	Result field	Recorded information
`case.bpmn.timer.create`	`created`	Case number and title, process, task, timer name
`case.bpmn.timer.continue`	`continued`	The case that was advanced
Failure of either	`failure`	The reason the timer could not run

Reading the events¶

Open Audit log → Explorer.
Filter by event name, for example admin.user or email.send.
Open a row to see the details.

See Explorer for the filters and Permissions for who can read the audit log.

Emails — the email registry with filters and detail.
Audit log — the shared audit surface.
Roles — the changes that generate these events.