data.eventType.accessDeprovisioned

access_deprovisioned · object

Option: access_deprovisioned

Show child attributes

data.eventType.accessDeprovisioned.accessRequest

access_request · object

Show child attributes

data.eventType.accessDeprovisioned.accessRequest.id

string

data.eventType.accessDeprovisioned.entitlement

entitlement · object

Show child attributes

data.eventType.accessDeprovisioned.entitlement.id

string

data.eventType.accessDeprovisioned.entitlement.displayName

string

data.eventType.accessDeprovisioned.resource

resource · object

Show child attributes

data.eventType.accessDeprovisioned.resource.id

string

data.eventType.accessDeprovisioned.resource.displayName

string

data.eventType.accessDeprovisioned.user

user · object

The user whose access was removed

Show child attributes

data.eventType.accessDeprovisioned.user.id

string

data.eventType.accessDeprovisioned.user.displayName

string

data.eventType.accessDeprovisioned.user.email

string

Email serves as display name for users

data.eventType.accessDeprovisioned.user.name

string

Full name if available

data.eventType.accessDeprovisioned.reason

string

Optional free-form reason (e.g., "expired", "revoked")

data.eventType.accessDeprovisioned.ticket

ticket · object

Show child attributes

data.eventType.accessDeprovisioned.ticket.id

string

data.eventType.accessPolicyCreated

access_policy_created · object

Option: access_policy_created

Show child attributes

data.eventType.accessPolicyCreated.accessPolicy

access_policy · object

Show child attributes

data.eventType.accessPolicyCreated.accessPolicy.id

string

data.eventType.accessPolicyCreated.accessPolicy.displayName

string

data.eventType.accessPolicyDeleted

access_policy_deleted · object

Option: access_policy_deleted

Show child attributes

data.eventType.accessPolicyDeleted.accessPolicy

access_policy · object

Show child attributes

data.eventType.accessPolicyDeleted.accessPolicy.id

string

data.eventType.accessPolicyDeleted.accessPolicy.displayName

string

data.eventType.accessPolicyUpdated

access_policy_updated · object

Option: access_policy_updated

Show child attributes

data.eventType.accessPolicyUpdated.accessPolicy

access_policy · object

Show child attributes

data.eventType.accessPolicyUpdated.accessPolicy.id

string

data.eventType.accessPolicyUpdated.accessPolicy.displayName

string

data.eventType.accessPolicyUpdated.changes

FieldChange · object[]

What actually changed

Show child attributes

data.eventType.accessPolicyUpdated.changes.boolChange

bool_change · object

Option: bool_change

Show child attributes

data.eventType.accessPolicyUpdated.changes.boolChange.oldValue

boolean

data.eventType.accessPolicyUpdated.changes.boolChange.newValue

boolean

data.eventType.accessPolicyUpdated.changes.jsonChange

json_change · object

Option: json_change

Show child attributes

data.eventType.accessPolicyUpdated.changes.jsonChange.oldValue

string

JSON string

data.eventType.accessPolicyUpdated.changes.jsonChange.newValue

string

JSON string

data.eventType.accessPolicyUpdated.changes.numberChange

number_change · object

Option: number_change

Show child attributes

data.eventType.accessPolicyUpdated.changes.numberChange.oldValue

number<double>

Can represent int or float

data.eventType.accessPolicyUpdated.changes.numberChange.newValue

number<double>

data.eventType.accessPolicyUpdated.changes.stringChange

string_change · object

Option: string_change

Show child attributes

data.eventType.accessPolicyUpdated.changes.stringChange.oldValue

string

data.eventType.accessPolicyUpdated.changes.stringChange.newValue

string

data.eventType.accessPolicyUpdated.changes.timestampChange

timestamp_change · object

Option: timestamp_change

Show child attributes

data.eventType.accessPolicyUpdated.changes.timestampChange.oldValue

string<date-time>

A Timestamp represents a point in time independent of any time zone or local calendar, encoded as a count of seconds and fractions of seconds at nanosecond resolution. The count is relative to an epoch at UTC midnight on January 1, 1970, in the proleptic Gregorian calendar which extends the Gregorian calendar backwards to year one.

All minutes are 60 seconds long. Leap seconds are "smeared" so that no leap second table is needed for interpretation, using a 24-hour linear smear.

The range is from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z. By restricting to that range, we ensure that we can convert to and from RFC 3339 date strings.

Examples

Example 1: Compute Timestamp from POSIX time().

Timestamp timestamp;
 timestamp.set_seconds(time(NULL));
 timestamp.set_nanos(0);

Example 2: Compute Timestamp from POSIX gettimeofday().

struct timeval tv;
 gettimeofday(&tv, NULL);

 Timestamp timestamp;
 timestamp.set_seconds(tv.tv_sec);
 timestamp.set_nanos(tv.tv_usec * 1000);

Example 3: Compute Timestamp from Win32 GetSystemTimeAsFileTime().

FILETIME ft;
 GetSystemTimeAsFileTime(&ft);
 UINT64 ticks = (((UINT64)ft.dwHighDateTime) << 32) | ft.dwLowDateTime;

 // A Windows tick is 100 nanoseconds. Windows epoch 1601-01-01T00:00:00Z
 // is 11644473600 seconds before Unix epoch 1970-01-01T00:00:00Z.
 Timestamp timestamp;
 timestamp.set_seconds((INT64) ((ticks / 10000000) - 11644473600LL));
 timestamp.set_nanos((INT32) ((ticks % 10000000) * 100));

Example 4: Compute Timestamp from Java System.currentTimeMillis().

long millis = System.currentTimeMillis();

 Timestamp timestamp = Timestamp.newBuilder().setSeconds(millis / 1000)
     .setNanos((int) ((millis % 1000) * 1000000)).build();

Example 5: Compute Timestamp from Java Instant.now().

Instant now = Instant.now();

 Timestamp timestamp =
     Timestamp.newBuilder().setSeconds(now.getEpochSecond())
         .setNanos(now.getNano()).build();

Example 6: Compute Timestamp from current time in Python.

timestamp = Timestamp()
 timestamp.GetCurrentTime()

JSON Mapping

In JSON format, the Timestamp type is encoded as a string in the RFC 3339 format. That is, the format is "{year}-{month}-{day}T{hour}:{min}:{sec}[.{frac_sec}]Z" where {year} is always expressed using four digits while {month}, {day}, {hour}, {min}, and {sec} are zero-padded to two digits each. The fractional seconds, which can go up to 9 digits (i.e. up to 1 nanosecond resolution), are optional. The "Z" suffix indicates the timezone ("UTC"); the timezone is required. A proto3 JSON serializer should always use UTC (as indicated by "Z") when printing the Timestamp type and a proto3 JSON parser should be able to accept both UTC and other timezones (as indicated by an offset).

For example, "2017-01-15T01:30:15.01Z" encodes 15.01 seconds past 01:30 UTC on January 15, 2017.

In JavaScript, one can convert a Date object to this format using the standard toISOString() method. In Python, a standard datetime.datetime object can be converted to this format using strftime with the time format spec '%Y-%m-%dT%H:%M:%S.%fZ'. Likewise, in Java, one can use the Joda Time's ISODateTimeFormat.dateTime() to obtain a formatter capable of generating timestamps in this format.

data.eventType.accessPolicyUpdated.changes.timestampChange.newValue

string<date-time>

A Timestamp represents a point in time independent of any time zone or local calendar, encoded as a count of seconds and fractions of seconds at nanosecond resolution. The count is relative to an epoch at UTC midnight on January 1, 1970, in the proleptic Gregorian calendar which extends the Gregorian calendar backwards to year one.

All minutes are 60 seconds long. Leap seconds are "smeared" so that no leap second table is needed for interpretation, using a 24-hour linear smear.

The range is from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z. By restricting to that range, we ensure that we can convert to and from RFC 3339 date strings.

Examples

Example 1: Compute Timestamp from POSIX time().

Timestamp timestamp;
 timestamp.set_seconds(time(NULL));
 timestamp.set_nanos(0);

Example 2: Compute Timestamp from POSIX gettimeofday().

struct timeval tv;
 gettimeofday(&tv, NULL);

 Timestamp timestamp;
 timestamp.set_seconds(tv.tv_sec);
 timestamp.set_nanos(tv.tv_usec * 1000);

Example 3: Compute Timestamp from Win32 GetSystemTimeAsFileTime().

FILETIME ft;
 GetSystemTimeAsFileTime(&ft);
 UINT64 ticks = (((UINT64)ft.dwHighDateTime) << 32) | ft.dwLowDateTime;

 // A Windows tick is 100 nanoseconds. Windows epoch 1601-01-01T00:00:00Z
 // is 11644473600 seconds before Unix epoch 1970-01-01T00:00:00Z.
 Timestamp timestamp;
 timestamp.set_seconds((INT64) ((ticks / 10000000) - 11644473600LL));
 timestamp.set_nanos((INT32) ((ticks % 10000000) * 100));

Example 4: Compute Timestamp from Java System.currentTimeMillis().

long millis = System.currentTimeMillis();

 Timestamp timestamp = Timestamp.newBuilder().setSeconds(millis / 1000)
     .setNanos((int) ((millis % 1000) * 1000000)).build();

Example 5: Compute Timestamp from Java Instant.now().

Instant now = Instant.now();

 Timestamp timestamp =
     Timestamp.newBuilder().setSeconds(now.getEpochSecond())
         .setNanos(now.getNano()).build();

Example 6: Compute Timestamp from current time in Python.

timestamp = Timestamp()
 timestamp.GetCurrentTime()

JSON Mapping

In JSON format, the Timestamp type is encoded as a string in the RFC 3339 format. That is, the format is "{year}-{month}-{day}T{hour}:{min}:{sec}[.{frac_sec}]Z" where {year} is always expressed using four digits while {month}, {day}, {hour}, {min}, and {sec} are zero-padded to two digits each. The fractional seconds, which can go up to 9 digits (i.e. up to 1 nanosecond resolution), are optional. The "Z" suffix indicates the timezone ("UTC"); the timezone is required. A proto3 JSON serializer should always use UTC (as indicated by "Z") when printing the Timestamp type and a proto3 JSON parser should be able to accept both UTC and other timezones (as indicated by an offset).

For example, "2017-01-15T01:30:15.01Z" encodes 15.01 seconds past 01:30 UTC on January 15, 2017.

In JavaScript, one can convert a Date object to this format using the standard toISOString() method. In Python, a standard datetime.datetime object can be converted to this format using strftime with the time format spec '%Y-%m-%dT%H:%M:%S.%fZ'. Likewise, in Java, one can use the Joda Time's ISODateTimeFormat.dateTime() to obtain a formatter capable of generating timestamps in this format.

data.eventType.accessProvisioned

access_provisioned · object

Option: access_provisioned — Access lifecycle events

Show child attributes

data.eventType.accessProvisioned.accessRequest

access_request · object

Show child attributes

data.eventType.accessProvisioned.accessRequest.id

string

data.eventType.accessProvisioned.entitlement

entitlement · object

Show child attributes

data.eventType.accessProvisioned.entitlement.id

string

data.eventType.accessProvisioned.entitlement.displayName

string

data.eventType.accessProvisioned.resource

resource · object

Show child attributes

data.eventType.accessProvisioned.resource.id

string

data.eventType.accessProvisioned.resource.displayName

string

data.eventType.accessProvisioned.user

user · object

The user who now has access

Show child attributes

data.eventType.accessProvisioned.user.id

string

data.eventType.accessProvisioned.user.displayName

string

data.eventType.accessProvisioned.user.email

string

Email serves as display name for users

data.eventType.accessProvisioned.user.name

string

Full name if available

data.eventType.accessProvisioned.ticket

ticket · object

Show child attributes

data.eventType.accessProvisioned.ticket.id

string

data.eventType.guidanceCreated

guidance_created · object

Option: guidance_created

Show child attributes

data.eventType.guidanceCreated.guidance

guidance · object

Show child attributes

data.eventType.guidanceCreated.guidance.id

string

data.eventType.guidanceCreated.guidance.displayName

string

Should generally include a name where possible as makes it easier to identify the object on export to SIEM without complex hydration

data.eventType.guidanceDeleted

guidance_deleted · object

Option: guidance_deleted

Show child attributes

data.eventType.guidanceDeleted.guidance

guidance · object

Show child attributes

data.eventType.guidanceDeleted.guidance.id

string

data.eventType.guidanceDeleted.guidance.displayName

string

Should generally include a name where possible as makes it easier to identify the object on export to SIEM without complex hydration

data.eventType.guidanceDeployed

guidance_deployed · object

Option: guidance_deployed

Show child attributes

data.eventType.guidanceDeployed.guidance

guidance · object

Show child attributes

data.eventType.guidanceDeployed.guidance.id

string

data.eventType.guidanceDeployed.guidance.displayName

string

Should generally include a name where possible as makes it easier to identify the object on export to SIEM without complex hydration

data.eventType.guidanceDeployed.previousVersion

previous_version · object

null if first deployed

Show child attributes

data.eventType.guidanceDeployed.previousVersion.id

string

This is the version ID, not the guidance ID

data.eventType.guidanceDeployed.previousVersion.displayName

string

data.eventType.guidanceDeployed.previousVersion.guidanceId

string

data.eventType.guidanceDeployed.previousVersion.versionNumber

integer<int32>

data.eventType.guidanceDeployed.deployedVersion

deployed_version · object

Show child attributes

data.eventType.guidanceDeployed.deployedVersion.id

string

This is the version ID, not the guidance ID

data.eventType.guidanceDeployed.deployedVersion.displayName

string

data.eventType.guidanceDeployed.deployedVersion.guidanceId

string

data.eventType.guidanceDeployed.deployedVersion.versionNumber

integer<int32>

data.eventType.guidanceUpdated

guidance_updated · object

Option: guidance_updated

Show child attributes

data.eventType.guidanceUpdated.guidance

guidance · object

Show child attributes

data.eventType.guidanceUpdated.guidance.id

string

data.eventType.guidanceUpdated.guidance.displayName

string

Should generally include a name where possible as makes it easier to identify the object on export to SIEM without complex hydration

data.eventType.guidanceUpdated.version

version · object

Show child attributes

data.eventType.guidanceUpdated.version.id

string

This is the version ID, not the guidance ID

data.eventType.guidanceUpdated.version.displayName

string

data.eventType.guidanceUpdated.version.guidanceId

string

data.eventType.guidanceUpdated.version.versionNumber

integer<int32>

data.eventType.guidanceUpdated.changes

FieldChange · object[]

What actually changed

Show child attributes

data.eventType.guidanceUpdated.changes.boolChange

bool_change · object

Option: bool_change

Show child attributes

data.eventType.guidanceUpdated.changes.boolChange.oldValue

boolean

data.eventType.guidanceUpdated.changes.boolChange.newValue

boolean

data.eventType.guidanceUpdated.changes.jsonChange

json_change · object

Option: json_change

Show child attributes

data.eventType.guidanceUpdated.changes.jsonChange.oldValue

string

JSON string

data.eventType.guidanceUpdated.changes.jsonChange.newValue

string

JSON string

data.eventType.guidanceUpdated.changes.numberChange

number_change · object

Option: number_change

Show child attributes

data.eventType.guidanceUpdated.changes.numberChange.oldValue

number<double>

Can represent int or float

data.eventType.guidanceUpdated.changes.numberChange.newValue

number<double>

data.eventType.guidanceUpdated.changes.stringChange

string_change · object

Option: string_change

Show child attributes

data.eventType.guidanceUpdated.changes.stringChange.oldValue

string

data.eventType.guidanceUpdated.changes.stringChange.newValue

string

data.eventType.guidanceUpdated.changes.timestampChange

timestamp_change · object

Option: timestamp_change

Show child attributes

data.eventType.guidanceUpdated.changes.timestampChange.oldValue

string<date-time>

A Timestamp represents a point in time independent of any time zone or local calendar, encoded as a count of seconds and fractions of seconds at nanosecond resolution. The count is relative to an epoch at UTC midnight on January 1, 1970, in the proleptic Gregorian calendar which extends the Gregorian calendar backwards to year one.

All minutes are 60 seconds long. Leap seconds are "smeared" so that no leap second table is needed for interpretation, using a 24-hour linear smear.

The range is from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z. By restricting to that range, we ensure that we can convert to and from RFC 3339 date strings.

Examples

Example 1: Compute Timestamp from POSIX time().

Timestamp timestamp;
 timestamp.set_seconds(time(NULL));
 timestamp.set_nanos(0);

Example 2: Compute Timestamp from POSIX gettimeofday().

struct timeval tv;
 gettimeofday(&tv, NULL);

 Timestamp timestamp;
 timestamp.set_seconds(tv.tv_sec);
 timestamp.set_nanos(tv.tv_usec * 1000);

Example 3: Compute Timestamp from Win32 GetSystemTimeAsFileTime().

FILETIME ft;
 GetSystemTimeAsFileTime(&ft);
 UINT64 ticks = (((UINT64)ft.dwHighDateTime) << 32) | ft.dwLowDateTime;

 // A Windows tick is 100 nanoseconds. Windows epoch 1601-01-01T00:00:00Z
 // is 11644473600 seconds before Unix epoch 1970-01-01T00:00:00Z.
 Timestamp timestamp;
 timestamp.set_seconds((INT64) ((ticks / 10000000) - 11644473600LL));
 timestamp.set_nanos((INT32) ((ticks % 10000000) * 100));

Example 4: Compute Timestamp from Java System.currentTimeMillis().

long millis = System.currentTimeMillis();

 Timestamp timestamp = Timestamp.newBuilder().setSeconds(millis / 1000)
     .setNanos((int) ((millis % 1000) * 1000000)).build();

Example 5: Compute Timestamp from Java Instant.now().

Instant now = Instant.now();

 Timestamp timestamp =
     Timestamp.newBuilder().setSeconds(now.getEpochSecond())
         .setNanos(now.getNano()).build();

Example 6: Compute Timestamp from current time in Python.

timestamp = Timestamp()
 timestamp.GetCurrentTime()

JSON Mapping

In JSON format, the Timestamp type is encoded as a string in the RFC 3339 format. That is, the format is "{year}-{month}-{day}T{hour}:{min}:{sec}[.{frac_sec}]Z" where {year} is always expressed using four digits while {month}, {day}, {hour}, {min}, and {sec} are zero-padded to two digits each. The fractional seconds, which can go up to 9 digits (i.e. up to 1 nanosecond resolution), are optional. The "Z" suffix indicates the timezone ("UTC"); the timezone is required. A proto3 JSON serializer should always use UTC (as indicated by "Z") when printing the Timestamp type and a proto3 JSON parser should be able to accept both UTC and other timezones (as indicated by an offset).

For example, "2017-01-15T01:30:15.01Z" encodes 15.01 seconds past 01:30 UTC on January 15, 2017.

In JavaScript, one can convert a Date object to this format using the standard toISOString() method. In Python, a standard datetime.datetime object can be converted to this format using strftime with the time format spec '%Y-%m-%dT%H:%M:%S.%fZ'. Likewise, in Java, one can use the Joda Time's ISODateTimeFormat.dateTime() to obtain a formatter capable of generating timestamps in this format.

data.eventType.guidanceUpdated.changes.timestampChange.newValue

string<date-time>

A Timestamp represents a point in time independent of any time zone or local calendar, encoded as a count of seconds and fractions of seconds at nanosecond resolution. The count is relative to an epoch at UTC midnight on January 1, 1970, in the proleptic Gregorian calendar which extends the Gregorian calendar backwards to year one.

All minutes are 60 seconds long. Leap seconds are "smeared" so that no leap second table is needed for interpretation, using a 24-hour linear smear.

The range is from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z. By restricting to that range, we ensure that we can convert to and from RFC 3339 date strings.

Examples

Example 1: Compute Timestamp from POSIX time().

Timestamp timestamp;
 timestamp.set_seconds(time(NULL));
 timestamp.set_nanos(0);

Example 2: Compute Timestamp from POSIX gettimeofday().

struct timeval tv;
 gettimeofday(&tv, NULL);

 Timestamp timestamp;
 timestamp.set_seconds(tv.tv_sec);
 timestamp.set_nanos(tv.tv_usec * 1000);

Example 3: Compute Timestamp from Win32 GetSystemTimeAsFileTime().

FILETIME ft;
 GetSystemTimeAsFileTime(&ft);
 UINT64 ticks = (((UINT64)ft.dwHighDateTime) << 32) | ft.dwLowDateTime;

 // A Windows tick is 100 nanoseconds. Windows epoch 1601-01-01T00:00:00Z
 // is 11644473600 seconds before Unix epoch 1970-01-01T00:00:00Z.
 Timestamp timestamp;
 timestamp.set_seconds((INT64) ((ticks / 10000000) - 11644473600LL));
 timestamp.set_nanos((INT32) ((ticks % 10000000) * 100));

Example 4: Compute Timestamp from Java System.currentTimeMillis().

long millis = System.currentTimeMillis();

 Timestamp timestamp = Timestamp.newBuilder().setSeconds(millis / 1000)
     .setNanos((int) ((millis % 1000) * 1000000)).build();

Example 5: Compute Timestamp from Java Instant.now().

Instant now = Instant.now();

 Timestamp timestamp =
     Timestamp.newBuilder().setSeconds(now.getEpochSecond())
         .setNanos(now.getNano()).build();

Example 6: Compute Timestamp from current time in Python.

timestamp = Timestamp()
 timestamp.GetCurrentTime()

JSON Mapping

In JSON format, the Timestamp type is encoded as a string in the RFC 3339 format. That is, the format is "{year}-{month}-{day}T{hour}:{min}:{sec}[.{frac_sec}]Z" where {year} is always expressed using four digits while {month}, {day}, {hour}, {min}, and {sec} are zero-padded to two digits each. The fractional seconds, which can go up to 9 digits (i.e. up to 1 nanosecond resolution), are optional. The "Z" suffix indicates the timezone ("UTC"); the timezone is required. A proto3 JSON serializer should always use UTC (as indicated by "Z") when printing the Timestamp type and a proto3 JSON parser should be able to accept both UTC and other timezones (as indicated by an offset).

For example, "2017-01-15T01:30:15.01Z" encodes 15.01 seconds past 01:30 UTC on January 15, 2017.

In JavaScript, one can convert a Date object to this format using the standard toISOString() method. In Python, a standard datetime.datetime object can be converted to this format using strftime with the time format spec '%Y-%m-%dT%H:%M:%S.%fZ'. Likewise, in Java, one can use the Joda Time's ISODateTimeFormat.dateTime() to obtain a formatter capable of generating timestamps in this format.

data.eventType.userAddedToTeam

user_added_to_team · object

Option: user_added_to_team

Show child attributes

data.eventType.userAddedToTeam.user

user · object

Show child attributes

data.eventType.userAddedToTeam.user.id

string

data.eventType.userAddedToTeam.user.displayName

string

data.eventType.userAddedToTeam.user.email

string

Email serves as display name for users

data.eventType.userAddedToTeam.user.name

string

Full name if available

data.eventType.userAddedToTeam.team

team · object

Show child attributes

data.eventType.userAddedToTeam.team.id

string

data.eventType.userAddedToTeam.team.displayName

string

data.eventType.userAddedToTeam.role

string

data.eventType.userInvited

user_invited · object

Option: user_invited

Show child attributes

data.eventType.userInvited.invitedUser

invited_user · object

Show child attributes

data.eventType.userInvited.invitedUser.id

string

data.eventType.userInvited.invitedUser.displayName

string

data.eventType.userInvited.invitedUser.email

string

Email serves as display name for users

data.eventType.userInvited.invitedUser.name

string

Full name if available

data.eventType.userInvited.invitation

invitation · object

Show child attributes

data.eventType.userInvited.invitation.id

string

data.eventType.userOrganizationRoleChanged

user_organization_role_changed · object

Option: user_organization_role_changed

Show child attributes

data.eventType.userOrganizationRoleChanged.user

user · object

Show child attributes

data.eventType.userOrganizationRoleChanged.user.id

string

data.eventType.userOrganizationRoleChanged.user.displayName

string

data.eventType.userOrganizationRoleChanged.user.email

string

Email serves as display name for users

data.eventType.userOrganizationRoleChanged.user.name

string

Full name if available

data.eventType.userOrganizationRoleChanged.organizationId

string

data.eventType.userOrganizationRoleChanged.oldRole

string

data.eventType.userOrganizationRoleChanged.newRole

string

data.eventType.userRemovedFromTeam

user_removed_from_team · object

Option: user_removed_from_team

Show child attributes

data.eventType.userRemovedFromTeam.user

user · object

Show child attributes

data.eventType.userRemovedFromTeam.user.id

string

data.eventType.userRemovedFromTeam.user.displayName

string

data.eventType.userRemovedFromTeam.user.email

string

Email serves as display name for users

data.eventType.userRemovedFromTeam.user.name

string

Full name if available

data.eventType.userRemovedFromTeam.team

team · object

Show child attributes

data.eventType.userRemovedFromTeam.team.id

string

data.eventType.userRemovedFromTeam.team.displayName

string

data.eventType.userRemovedFromTeam.role

string

The role they had before removal

data.eventType.userTeamRoleChanged

user_team_role_changed · object

Option: user_team_role_changed

Show child attributes

data.eventType.userTeamRoleChanged.user

user · object

Show child attributes

data.eventType.userTeamRoleChanged.user.id

string

data.eventType.userTeamRoleChanged.user.displayName

string

data.eventType.userTeamRoleChanged.user.email

string

Email serves as display name for users

data.eventType.userTeamRoleChanged.user.name

string

Full name if available

data.eventType.userTeamRoleChanged.team

team · object

Show child attributes

data.eventType.userTeamRoleChanged.team.id

string

data.eventType.userTeamRoleChanged.team.displayName

string

data.eventType.userTeamRoleChanged.oldRole

string

data.eventType.userTeamRoleChanged.newRole

string

data.eventType.workflowCreated

workflow_created · object

Option: workflow_created

Show child attributes

data.eventType.workflowCreated.workflow

workflow · object

Show child attributes

data.eventType.workflowCreated.workflow.id

string

data.eventType.workflowCreated.workflow.displayName

string

Should generally include a name where possible as makes it easier to identify the object on export to SIEM without complex hydration

data.eventType.workflowDeleted

workflow_deleted · object

Option: workflow_deleted

Show child attributes

data.eventType.workflowDeleted.workflow

workflow · object

Show child attributes

data.eventType.workflowDeleted.workflow.id

string

data.eventType.workflowDeleted.workflow.displayName

string

Should generally include a name where possible as makes it easier to identify the object on export to SIEM without complex hydration

data.eventType.workflowPublished

workflow_published · object

Option: workflow_published

Show child attributes

data.eventType.workflowPublished.workflow

workflow · object

Show child attributes

data.eventType.workflowPublished.workflow.id

string

data.eventType.workflowPublished.workflow.displayName

string

Should generally include a name where possible as makes it easier to identify the object on export to SIEM without complex hydration

data.eventType.workflowPublished.previousVersion

previous_version · object

null if first published

Show child attributes

data.eventType.workflowPublished.previousVersion.id

string

This is the version ID, not the workflow ID

data.eventType.workflowPublished.previousVersion.displayName

string

data.eventType.workflowPublished.previousVersion.workflowId

string

data.eventType.workflowPublished.previousVersion.versionNumber

integer<int32>

data.eventType.workflowPublished.publishedVersion

published_version · object

Show child attributes

data.eventType.workflowPublished.publishedVersion.id

string

This is the version ID, not the workflow ID

data.eventType.workflowPublished.publishedVersion.displayName

string

data.eventType.workflowPublished.publishedVersion.workflowId

string

data.eventType.workflowPublished.publishedVersion.versionNumber

integer<int32>

data.eventType.workflowRunRequested

workflow_run_requested · object

Option: workflow_run_requested

Show child attributes

data.eventType.workflowRunRequested.workflow

workflow · object

Show child attributes

data.eventType.workflowRunRequested.workflow.id

string

data.eventType.workflowRunRequested.workflow.displayName

string

Should generally include a name where possible as makes it easier to identify the object on export to SIEM without complex hydration

data.eventType.workflowRunRequested.version

version · object

Show child attributes

data.eventType.workflowRunRequested.version.id

string

This is the version ID, not the workflow ID

data.eventType.workflowRunRequested.version.displayName

string

data.eventType.workflowRunRequested.version.workflowId

string

data.eventType.workflowRunRequested.version.versionNumber

integer<int32>

data.eventType.workflowRunRequested.workflowRun

workflow_run · object

Show child attributes

data.eventType.workflowRunRequested.workflowRun.id

string

No obvious display name for workflow runs, so we skip that field

data.eventType.workflowRunRequested.workflowRun.workflowId

string

data.eventType.workflowRunStarted

workflow_run_started · object

Option: workflow_run_started

Show child attributes

data.eventType.workflowRunStarted.workflow

workflow · object

Show child attributes

data.eventType.workflowRunStarted.workflow.id

string

data.eventType.workflowRunStarted.workflow.displayName

string

Should generally include a name where possible as makes it easier to identify the object on export to SIEM without complex hydration

data.eventType.workflowRunStarted.version

version · object

Show child attributes

data.eventType.workflowRunStarted.version.id

string

This is the version ID, not the workflow ID

data.eventType.workflowRunStarted.version.displayName

string

data.eventType.workflowRunStarted.version.workflowId

string

data.eventType.workflowRunStarted.version.versionNumber

integer<int32>

data.eventType.workflowRunStarted.workflowRun

workflow_run · object

Show child attributes

data.eventType.workflowRunStarted.workflowRun.id

string

No obvious display name for workflow runs, so we skip that field

data.eventType.workflowRunStarted.workflowRun.workflowId

string

data.eventType.workflowUpdated

workflow_updated · object

Option: workflow_updated

Show child attributes

data.eventType.workflowUpdated.workflow

workflow · object

Show child attributes

data.eventType.workflowUpdated.workflow.id

string

data.eventType.workflowUpdated.workflow.displayName

string

Should generally include a name where possible as makes it easier to identify the object on export to SIEM without complex hydration

data.eventType.workflowUpdated.version

version · object

Show child attributes

data.eventType.workflowUpdated.version.id

string

This is the version ID, not the workflow ID

data.eventType.workflowUpdated.version.displayName

string

data.eventType.workflowUpdated.version.workflowId

string

data.eventType.workflowUpdated.version.versionNumber

integer<int32>

data.eventType.workflowUpdated.changes

FieldChange · object[]

What actually changed

Show child attributes

data.eventType.workflowUpdated.changes.boolChange

bool_change · object

Option: bool_change

Show child attributes

data.eventType.workflowUpdated.changes.boolChange.oldValue

boolean

data.eventType.workflowUpdated.changes.boolChange.newValue

boolean

data.eventType.workflowUpdated.changes.jsonChange

json_change · object

Option: json_change

Show child attributes

data.eventType.workflowUpdated.changes.jsonChange.oldValue

string

JSON string

data.eventType.workflowUpdated.changes.jsonChange.newValue

string

JSON string

data.eventType.workflowUpdated.changes.numberChange

number_change · object

Option: number_change

Show child attributes

data.eventType.workflowUpdated.changes.numberChange.oldValue

number<double>

Can represent int or float

data.eventType.workflowUpdated.changes.numberChange.newValue

number<double>

data.eventType.workflowUpdated.changes.stringChange

string_change · object

Option: string_change

Show child attributes

data.eventType.workflowUpdated.changes.stringChange.oldValue

string

data.eventType.workflowUpdated.changes.stringChange.newValue

string

data.eventType.workflowUpdated.changes.timestampChange

timestamp_change · object

Option: timestamp_change

Show child attributes

data.eventType.workflowUpdated.changes.timestampChange.oldValue

string<date-time>

A Timestamp represents a point in time independent of any time zone or local calendar, encoded as a count of seconds and fractions of seconds at nanosecond resolution. The count is relative to an epoch at UTC midnight on January 1, 1970, in the proleptic Gregorian calendar which extends the Gregorian calendar backwards to year one.

All minutes are 60 seconds long. Leap seconds are "smeared" so that no leap second table is needed for interpretation, using a 24-hour linear smear.

The range is from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z. By restricting to that range, we ensure that we can convert to and from RFC 3339 date strings.

Examples

Example 1: Compute Timestamp from POSIX time().

Timestamp timestamp;
 timestamp.set_seconds(time(NULL));
 timestamp.set_nanos(0);

Example 2: Compute Timestamp from POSIX gettimeofday().

struct timeval tv;
 gettimeofday(&tv, NULL);

 Timestamp timestamp;
 timestamp.set_seconds(tv.tv_sec);
 timestamp.set_nanos(tv.tv_usec * 1000);

Example 3: Compute Timestamp from Win32 GetSystemTimeAsFileTime().

FILETIME ft;
 GetSystemTimeAsFileTime(&ft);
 UINT64 ticks = (((UINT64)ft.dwHighDateTime) << 32) | ft.dwLowDateTime;

 // A Windows tick is 100 nanoseconds. Windows epoch 1601-01-01T00:00:00Z
 // is 11644473600 seconds before Unix epoch 1970-01-01T00:00:00Z.
 Timestamp timestamp;
 timestamp.set_seconds((INT64) ((ticks / 10000000) - 11644473600LL));
 timestamp.set_nanos((INT32) ((ticks % 10000000) * 100));

Example 4: Compute Timestamp from Java System.currentTimeMillis().

long millis = System.currentTimeMillis();

 Timestamp timestamp = Timestamp.newBuilder().setSeconds(millis / 1000)
     .setNanos((int) ((millis % 1000) * 1000000)).build();

Example 5: Compute Timestamp from Java Instant.now().

Instant now = Instant.now();

 Timestamp timestamp =
     Timestamp.newBuilder().setSeconds(now.getEpochSecond())
         .setNanos(now.getNano()).build();

Example 6: Compute Timestamp from current time in Python.

timestamp = Timestamp()
 timestamp.GetCurrentTime()

JSON Mapping

In JSON format, the Timestamp type is encoded as a string in the RFC 3339 format. That is, the format is "{year}-{month}-{day}T{hour}:{min}:{sec}[.{frac_sec}]Z" where {year} is always expressed using four digits while {month}, {day}, {hour}, {min}, and {sec} are zero-padded to two digits each. The fractional seconds, which can go up to 9 digits (i.e. up to 1 nanosecond resolution), are optional. The "Z" suffix indicates the timezone ("UTC"); the timezone is required. A proto3 JSON serializer should always use UTC (as indicated by "Z") when printing the Timestamp type and a proto3 JSON parser should be able to accept both UTC and other timezones (as indicated by an offset).

For example, "2017-01-15T01:30:15.01Z" encodes 15.01 seconds past 01:30 UTC on January 15, 2017.

In JavaScript, one can convert a Date object to this format using the standard toISOString() method. In Python, a standard datetime.datetime object can be converted to this format using strftime with the time format spec '%Y-%m-%dT%H:%M:%S.%fZ'. Likewise, in Java, one can use the Joda Time's ISODateTimeFormat.dateTime() to obtain a formatter capable of generating timestamps in this format.

data.eventType.workflowUpdated.changes.timestampChange.newValue

string<date-time>

A Timestamp represents a point in time independent of any time zone or local calendar, encoded as a count of seconds and fractions of seconds at nanosecond resolution. The count is relative to an epoch at UTC midnight on January 1, 1970, in the proleptic Gregorian calendar which extends the Gregorian calendar backwards to year one.

All minutes are 60 seconds long. Leap seconds are "smeared" so that no leap second table is needed for interpretation, using a 24-hour linear smear.

The range is from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z. By restricting to that range, we ensure that we can convert to and from RFC 3339 date strings.

Examples

Example 1: Compute Timestamp from POSIX time().

Timestamp timestamp;
 timestamp.set_seconds(time(NULL));
 timestamp.set_nanos(0);

Example 2: Compute Timestamp from POSIX gettimeofday().

struct timeval tv;
 gettimeofday(&tv, NULL);

 Timestamp timestamp;
 timestamp.set_seconds(tv.tv_sec);
 timestamp.set_nanos(tv.tv_usec * 1000);

Example 3: Compute Timestamp from Win32 GetSystemTimeAsFileTime().

FILETIME ft;
 GetSystemTimeAsFileTime(&ft);
 UINT64 ticks = (((UINT64)ft.dwHighDateTime) << 32) | ft.dwLowDateTime;

 // A Windows tick is 100 nanoseconds. Windows epoch 1601-01-01T00:00:00Z
 // is 11644473600 seconds before Unix epoch 1970-01-01T00:00:00Z.
 Timestamp timestamp;
 timestamp.set_seconds((INT64) ((ticks / 10000000) - 11644473600LL));
 timestamp.set_nanos((INT32) ((ticks % 10000000) * 100));

Example 4: Compute Timestamp from Java System.currentTimeMillis().

long millis = System.currentTimeMillis();

 Timestamp timestamp = Timestamp.newBuilder().setSeconds(millis / 1000)
     .setNanos((int) ((millis % 1000) * 1000000)).build();

Example 5: Compute Timestamp from Java Instant.now().

Instant now = Instant.now();

 Timestamp timestamp =
     Timestamp.newBuilder().setSeconds(now.getEpochSecond())
         .setNanos(now.getNano()).build();

Example 6: Compute Timestamp from current time in Python.

timestamp = Timestamp()
 timestamp.GetCurrentTime()

JSON Mapping

In JSON format, the Timestamp type is encoded as a string in the RFC 3339 format. That is, the format is "{year}-{month}-{day}T{hour}:{min}:{sec}[.{frac_sec}]Z" where {year} is always expressed using four digits while {month}, {day}, {hour}, {min}, and {sec} are zero-padded to two digits each. The fractional seconds, which can go up to 9 digits (i.e. up to 1 nanosecond resolution), are optional. The "Z" suffix indicates the timezone ("UTC"); the timezone is required. A proto3 JSON serializer should always use UTC (as indicated by "Z") when printing the Timestamp type and a proto3 JSON parser should be able to accept both UTC and other timezones (as indicated by an offset).

For example, "2017-01-15T01:30:15.01Z" encodes 15.01 seconds past 01:30 UTC on January 15, 2017.

In JavaScript, one can convert a Date object to this format using the standard toISOString() method. In Python, a standard datetime.datetime object can be converted to this format using strftime with the time format spec '%Y-%m-%dT%H:%M:%S.%fZ'. Likewise, in Java, one can use the Joda Time's ISODateTimeFormat.dateTime() to obtain a formatter capable of generating timestamps in this format.

Authentication

Endpoints

Development

List Audit Logs

Authorizations

Query Parameters

Response

Examples

JSON Mapping

Examples

JSON Mapping

Examples

JSON Mapping

Examples

JSON Mapping

Examples

JSON Mapping

Examples

JSON Mapping

Examples

JSON Mapping