> ## Documentation Index
> Fetch the complete documentation index at: https://docs.omni.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit log event types

> Reference for all audit log event types and their payload fields.

This page describes the fields included in each audit log event type. Payloads can contain Omni metadata, which can be safely ignored.

## Query context events

Occurs when a user loads a document (workbook or dashboard). Event type: `QUERY_CONTEXT`

<ParamField body="documentIdentifier" type="string">
  The unique ID of the workbook or dashboard within Omni, found within the URL for the document.
</ParamField>

<ParamField body="embedEntity" type="string">
  If applicable, the value will be the value of the entity field in an embed URL generated for a user.
</ParamField>

<ParamField body="event" type="string">
  The type of the event. This will be `QUERY_CONTEXT`.
</ParamField>

<ParamField body="message" type="string">
  Additional detail passed from the log.
</ParamField>

<ParamField body="organizationID" type="string">
  The unique identifier for the Omni organization.
</ParamField>

<ParamField body="organizationUserID" type="string">
  The unique identifier for the Omni user associated with the event.
</ParamField>

<ParamField body="queryCount" type="number">
  The maximum number of query execution events that a query context event can trigger. Can be used to calculate cache hit rate as the denominator.
</ParamField>

<ParamField body="referrer" type="string">
  The URL of the page where the event was issued.
</ParamField>

<ParamField body="query_source" type="string">
  The source of the query context event. Possible values:

  * `DASHBOARD`
  * `WORKBOOK`
  * `QUERY_DOWNLOAD`
  * `SUGGESTIONS`
  * `SUMMARY_VALUES`
  * `AI_FETCH_FIELD_VALUES`
</ParamField>

<ParamField body="source" type="string">
  <Warning>
    **Deprecated**. Use `query_source` instead.
  </Warning>

  The first 6 characters of this field are overwritten with `stdout` in delivered audit logs (e.g., `DASHBOARD` becomes `stdoutARD`). The `query_source` field contains the correct uncorrupted value. This field is retained for backwards compatibility only.
</ParamField>

<ParamField body="timestamp" type="string">
  The time the event occurred.
</ParamField>

<ParamField body="traceID" type="string">
  A uuid that can be used to trace the event across other log entries. For example, from a query context or dashboard download event to the query execution events that were subsequently run.
</ParamField>

<ParamField body="url" type="string">
  The URL of the page where the event occurred.
</ParamField>

## Query execution events

Occurs when a user runs a query, which may be sent back to the warehouse. Event type: `QUERY_EXECUTE`

<ParamField body="@timestamp" type="string">
  The time the event occurred.
</ParamField>

<ParamField body="duration" type="number">
  The total length of query execution within the warehouse.
</ParamField>

<ParamField body="event" type="string">
  The type of the event. This will be `QUERY_EXECUTE`.
</ParamField>

<ParamField body="jobId" type="string">
  The ID of the corresponding job in the warehouse where the query was executed.
</ParamField>

<ParamField body="message" type="string">
  Detail passed from the infrastructure back to the user, if applicable.
</ParamField>

<ParamField body="omniQueryID" type="string">
  A uuid for the query being executed within Omni. Used for query killing purposes.
</ParamField>

<ParamField body="organizationID" type="string">
  The unique identifier for the Omni organization.
</ParamField>

<ParamField body="query" type="string">
  The query that was executed.
</ParamField>

<ParamField body="traceID" type="string">
  A uuid that can be used to trace the event across other log entries. For example, from a query context or dashboard download event to the query execution events that were subsequently run.
</ParamField>

<ParamField body="success" type="boolean">
  Indicates if the query executed successfully. **Note**: This doesn't indicate the success of the job, only the individual query.
</ParamField>

## Dashboard download events

Occurs when a user downloads a full dashboard. Event type: `DASHBOARD_DOWNLOAD`

<ParamField body="documentIdentifier" type="string">
  The unique ID of the workbook or dashboard within Omni, found within the URL for the document.
</ParamField>

<ParamField body="embedEntity" type="string">
  If applicable, the value will be the value of the entity field in an embed URL generated for a user.
</ParamField>

<ParamField body="event" type="string">
  The type of the event. This will be `DASHBOARD_DOWNLOAD`.
</ParamField>

<ParamField body="message" type="string">
  Additional detail passed from the log.
</ParamField>

<ParamField body="organizationID" type="string">
  The unique identifier for the Omni organization.
</ParamField>

<ParamField body="organizationUserID" type="string">
  The unique identifier for the Omni user associated with the event.
</ParamField>

<ParamField body="timestamp" type="string">
  The time the event occurred.
</ParamField>

<ParamField body="traceID" type="string">
  A uuid that can be used to trace the event across other log entries. For example, from a query context or dashboard download event to the query execution events that were subsequently run.
</ParamField>

<ParamField body="url" type="string">
  The URL of the page where the event occurred.
</ParamField>

## Connection base role events

Occurs when the base role for a connection changes. Event type: `UPDATE_CONNECTION_BASE_ROLE`

<ParamField body="actor" type="object">
  Details about the Omni user associated with the event.
</ParamField>

<ParamField body="connectionID" type="string">
  The ID of the connection associated with the role change.
</ParamField>

<ParamField body="event" type="string">
  The type of the event. This will be `UPDATE_CONNECTION_BASE_ROLE`.
</ParamField>

<ParamField body="message" type="string">
  Additional detail passed from the log.
</ParamField>

<ParamField body="roleDefinitionName" type="string">
  The name of the updated base connection role.
</ParamField>

<ParamField body="timestamp" type="string">
  The time the event occurred.
</ParamField>

<ParamField body="traceID" type="string">
  A uuid that can be used to trace the event across other log entries.
</ParamField>

## User connection role events

Occurs when a user's connection role changes. Event type: `UPDATE_USER_CONNECTION_ROLE`

<ParamField body="connectionId" type="string">
  The ID of the connection associated with the role change.
</ParamField>

<ParamField body="event" type="string">
  The type of the event. This will be `UPDATE_USER_CONNECTION_ROLE`.
</ParamField>

<ParamField body="message" type="string">
  Additional detail passed from the log.
</ParamField>

<ParamField body="organizationID" type="string">
  The unique identifier for the Omni organization.
</ParamField>

<ParamField body="organizationUserID" type="string">
  The unique identifier for the Omni user associated with the event.
</ParamField>

<ParamField body="timestamp" type="string">
  The time the event occurred.
</ParamField>

<ParamField body="traceID" type="string">
  A uuid that can be used to trace the event across other log entries.
</ParamField>

## User group connection role events

Occurs when the connection role for a user group changes. Event type: `UPDATE_GROUP_CONNECTION_ROLE`

<ParamField body="actor" type="object">
  Details about the Omni user associated with the event.
</ParamField>

<ParamField body="connectionId" type="string">
  The ID of the connection associated with the role change.
</ParamField>

<ParamField body="event" type="string">
  The type of the event. This will be `UPDATE_GROUP_CONNECTION_ROLE`.
</ParamField>

<ParamField body="message" type="string">
  Additional detail passed from the log.
</ParamField>

<ParamField body="organizationID" type="string">
  The unique identifier for the Omni organization.
</ParamField>

<ParamField body="roleDefinitionName" type="string">
  The name of the updated connection role.
</ParamField>

<ParamField body="targetMembershipID" type="string">
  The membership of the user group associated with the event.
</ParamField>

<ParamField body="timestamp" type="string">
  The time the event occurred.
</ParamField>

<ParamField body="traceID" type="string">
  A uuid that can be used to trace the event across other log entries.
</ParamField>

<ParamField body="userGroupId" type="string">
  The ID of the Omni user group associated with the event.
</ParamField>

## User invite events

Occurs when a new user is invited to the organization. Event type: `USER_INVITE`

<ParamField body="event" type="string">
  The type of the event. This will be `USER_INVITE`.
</ParamField>

<ParamField body="invitedOrganizationUserId" type="string">
  The ID of the invited user.
</ParamField>

<ParamField body="message" type="string">
  Additional detail passed from the log.
</ParamField>

<ParamField body="organizationID" type="string">
  The unique identifier for the Omni organization.
</ParamField>

<ParamField body="organizationUserID" type="string">
  The unique identifier for the Omni user associated with the event.
</ParamField>

<ParamField body="timestamp" type="string">
  The time the event occurred.
</ParamField>

<ParamField body="traceID" type="string">
  A uuid that can be used to trace the event across other log entries.
</ParamField>
