> ## Documentation Index
> Fetch the complete documentation index at: https://docs.serval.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List Audit Logs

> List audit logs for your organization. You can optionally filter by time range.



## OpenAPI

````yaml /sections/api-reference/openapi-spec-v2.yaml get /v2/audit-logs
openapi: 3.1.0
info:
  title: Serval Public API
  description: Serval Public API
  contact:
    name: Serval
    url: https://serval.com
    email: support@serval.com
  license:
    name: Serval License
    url: https://serval.com/license
  version: 2.0.0
servers:
  - url: https://public.api.serval.com
security:
  - BearerAuth: []
tags:
  - name: Access Policy API
  - name: Access Policy Approval Procedure API
  - name: Access Profile API
  - name: Access Relationship API
  - name: Access Request API
  - name: Agent API
  - name: App Instance API
  - name: App Resource API
  - name: App Resource Role API
  - name: Approval Delegation API
  - name: Approval Request API
  - name: Audit Log API
  - name: Change Blackout API
  - name: Change Model API
  - name: Custom Field API
  - name: Custom Service API
  - name: Entity API
  - name: Entity Field Mapping API
  - name: Entity Ingestion Config API
  - name: Entity Type API
  - name: Folder API
  - name: Group API
  - name: Guidance API
  - name: Help Agent API
  - name: Journey API
  - name: Knowledge API
  - name: Knowledge Base API
  - name: Report API
  - name: SLA API
  - name: Schedule API
  - name: Tag API
  - name: Team API
  - name: Team User API
  - name: Ticket API
  - name: Topic API
  - name: User API
  - name: User Relationship API
  - name: Workflow API
  - name: Workflow Approval Procedure API
  - name: Workflow Run API
paths:
  /v2/audit-logs:
    get:
      tags:
        - Audit Log API
      summary: List Audit Logs
      description: >-
        List audit logs for your organization. You can optionally filter by time
        range.
      operationId: svrelay.publicv2.PublicAPIServiceV2.ListAuditLogs
      parameters:
        - name: pageToken
          in: query
          schema:
            type: string
            title: page_token
        - name: pageSize
          in: query
          schema:
            type: integer
            title: page_size
            format: int32
        - name: startTime.seconds
          in: query
          description: Unix timestamp in seconds.
          schema:
            type:
              - integer
              - string
            title: seconds
            format: int64
            description: Unix timestamp in seconds.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/svlog.publicapi.ListAuditLogsResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/connect.error'
      security:
        - BearerAuth: []
components:
  schemas:
    svlog.publicapi.ListAuditLogsResponse:
      type: object
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/svlog.events.AuditLogEvent'
          title: data
          x-stainless-terraform-configurability: optional
        nextPageToken:
          type: string
          title: next_page_token
          nullable: true
          x-stainless-terraform-configurability: optional
      title: ListAuditLogsResponse
      additionalProperties: false
    connect.error:
      type: object
      properties:
        code:
          type: string
          examples:
            - not_found
          enum:
            - canceled
            - unknown
            - invalid_argument
            - deadline_exceeded
            - not_found
            - already_exists
            - permission_denied
            - resource_exhausted
            - failed_precondition
            - aborted
            - out_of_range
            - unimplemented
            - internal
            - unavailable
            - data_loss
            - unauthenticated
          description: >-
            The status code, which should be an enum value of
            [google.rpc.Code][google.rpc.Code].
          x-stainless-terraform-configurability: optional
        message:
          type: string
          description: >-
            A developer-facing error message, which should be in English. Any
            user-facing error message should be localized and sent in the
            [google.rpc.Status.details][google.rpc.Status.details] field, or
            localized by the client.
          x-stainless-terraform-configurability: optional
        detail:
          $ref: '#/components/schemas/google.protobuf.Any'
          x-stainless-terraform-configurability: optional
      title: Connect Error
      additionalProperties: true
      description: >-
        Error type returned by Connect:
        https://connectrpc.com/docs/go/errors/#http-representation
    svlog.events.AuditLogEvent:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
        teamId:
          type: string
          title: team_id
          description: Not all events are team-specific (though most are)
          nullable: true
          x-stainless-terraform-configurability: optional
        timestamp:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          title: timestamp
          x-stainless-terraform-configurability: optional
        actor:
          $ref: '#/components/schemas/svauth.models.Actor'
          title: actor
          x-stainless-terraform-configurability: optional
        context:
          $ref: '#/components/schemas/svlog.events.Context'
          title: context
          x-stainless-terraform-configurability: optional
        eventType:
          $ref: '#/components/schemas/svlog.events.EventType'
          title: event_type
          x-stainless-terraform-configurability: optional
        outcome:
          $ref: '#/components/schemas/svlog.events.Outcome'
          title: outcome
          description: |-
            Result of the attempted action (the fifth core audit dimension).
             Required going forward: svlog rejects an unset / STATUS_UNSPECIFIED
             status at ingest rather than silently recording it as success.
          x-stainless-terraform-configurability: optional
        justification:
          type: string
          title: justification
          description: |-
            Business reason the actor supplied at action time (the "why"),
             distinct from outcome.reason_detail (the "what happened"). Populated
             for privileged / sensitive actions (access grants, impersonation,
             deletions, config changes); empty otherwise.
          nullable: true
          x-stainless-terraform-configurability: optional
        severity:
          $ref: '#/components/schemas/svlog.events.Severity'
          title: severity
          description: >-
            Leveled telemetry dimension: lets operational / non-user-driven
            events
             (e.g. workflow_run_* fired per execution) be recorded at a low level and
             filtered out of the user-facing audit feed, while genuine user actions
             stay at SEVERITY_INFO. Producers default to SEVERITY_INFO via
             producer.NewAuditLogEvent, so existing call sites are unchanged; svlog
             lifts this into an indexed column so "hide everything below INFO" is a
             cheap keyset query.
          x-stainless-terraform-configurability: optional
      title: AuditLogEvent
      additionalProperties: false
      description: >-
        AuditLogEvent is the schema for events received in the audit log event
        queue from
         other services
         These are the events that will be processed by svlog

         This proto is the SINGLE source of truth for WorkOS audit log export:
           - The WorkOS action string for each variant is the oneof field name
             itself (e.g. "workflow_created").
           - (serval.options.audit_target) on each entity submessage field declares
             that field as a WorkOS target. Target type is derived from the
             snake_case of the message type (Workflow -> "workflow",
             WorkflowVersion -> "workflow_version"); id/display_name come from
             fields named `id` and `display_name` on the submessage.
         Adding a new event variant: add a oneof case and mark any entity
         submessage fields with audit_target. No Go code changes needed —
         pkg/workosaudit reads everything reflectively at runtime.
    google.protobuf.Any:
      type: object
      properties:
        type:
          type: string
          x-stainless-terraform-configurability: optional
        value:
          type: string
          format: binary
          x-stainless-terraform-configurability: optional
        debug:
          type: object
          additionalProperties: true
          x-stainless-terraform-configurability: optional
      additionalProperties: true
      description: >-
        Contains an arbitrary serialized message along with a @type that
        describes the type of the serialized message.
    google.protobuf.Timestamp:
      type: string
      format: date-time
      description: A timestamp in RFC 3339 format (e.g., "2025-01-15T01:30:15Z").
    svauth.models.Actor:
      type: object
      oneOf:
        - $ref: '#/components/schemas/svauth.models.Actor.ApiKey'
        - $ref: '#/components/schemas/svauth.models.Actor.ImpersonatedUser'
        - $ref: '#/components/schemas/svauth.models.Actor.System'
        - $ref: '#/components/schemas/svauth.models.Actor.User'
        - $ref: '#/components/schemas/svauth.models.Actor.Worker'
      title: Actor
    svlog.events.Context:
      type: object
      properties:
        ipAddress:
          type: string
          title: ip_address
          x-stainless-terraform-configurability: optional
        userAgent:
          type: string
          title: user_agent
          x-stainless-terraform-configurability: optional
      title: Context
      additionalProperties: false
    svlog.events.EventType:
      type: object
      oneOf:
        - $ref: '#/components/schemas/svlog.events.EventType.AccessDeprovisioned'
        - $ref: >-
            #/components/schemas/svlog.events.EventType.AccessPolicyApprovalProcedureCreated
        - $ref: >-
            #/components/schemas/svlog.events.EventType.AccessPolicyApprovalProcedureDeleted
        - $ref: >-
            #/components/schemas/svlog.events.EventType.AccessPolicyApprovalProcedureUpdated
        - $ref: '#/components/schemas/svlog.events.EventType.AccessPolicyCreated'
        - $ref: '#/components/schemas/svlog.events.EventType.AccessPolicyDeleted'
        - $ref: '#/components/schemas/svlog.events.EventType.AccessPolicyUpdated'
        - $ref: '#/components/schemas/svlog.events.EventType.AccessProvisioned'
        - $ref: >-
            #/components/schemas/svlog.events.EventType.AccessReviewPolicyCreated
        - $ref: >-
            #/components/schemas/svlog.events.EventType.AccessReviewPolicyDeleted
        - $ref: >-
            #/components/schemas/svlog.events.EventType.AccessReviewPolicySetTeamDefault
        - $ref: >-
            #/components/schemas/svlog.events.EventType.AccessReviewPolicyUpdated
        - $ref: '#/components/schemas/svlog.events.EventType.AgentConfigCreated'
        - $ref: '#/components/schemas/svlog.events.EventType.AgentConfigDeleted'
        - $ref: '#/components/schemas/svlog.events.EventType.AgentConfigUpdated'
        - $ref: '#/components/schemas/svlog.events.EventType.AgentInstalled'
        - $ref: '#/components/schemas/svlog.events.EventType.AgentSessionTriggered'
        - $ref: '#/components/schemas/svlog.events.EventType.ApiKeyCreated'
        - $ref: '#/components/schemas/svlog.events.EventType.ApiKeyRevoked'
        - $ref: '#/components/schemas/svlog.events.EventType.AppInstanceAuthRefreshed'
        - $ref: '#/components/schemas/svlog.events.EventType.AppInstanceCreated'
        - $ref: '#/components/schemas/svlog.events.EventType.AppInstanceDeleted'
        - $ref: '#/components/schemas/svlog.events.EventType.AppInstanceReconnected'
        - $ref: '#/components/schemas/svlog.events.EventType.AppInstanceShared'
        - $ref: '#/components/schemas/svlog.events.EventType.AppInstanceUnshared'
        - $ref: '#/components/schemas/svlog.events.EventType.CatalystAgentInstalled'
        - $ref: >-
            #/components/schemas/svlog.events.EventType.CatalystChangeSetReviewed
        - $ref: '#/components/schemas/svlog.events.EventType.CatalystChangesApplied'
        - $ref: >-
            #/components/schemas/svlog.events.EventType.CatalystScheduledSessionCreated
        - $ref: >-
            #/components/schemas/svlog.events.EventType.CatalystScheduledSessionTriggered
        - $ref: >-
            #/components/schemas/svlog.events.EventType.CatalystSessionSharingChanged
        - $ref: '#/components/schemas/svlog.events.EventType.CatalystSkillDeployed'
        - $ref: '#/components/schemas/svlog.events.EventType.CategoryCreated'
        - $ref: '#/components/schemas/svlog.events.EventType.CategoryDeleted'
        - $ref: '#/components/schemas/svlog.events.EventType.CategoryUpdated'
        - $ref: '#/components/schemas/svlog.events.EventType.CustomRoleCreated'
        - $ref: '#/components/schemas/svlog.events.EventType.CustomRoleDeleted'
        - $ref: '#/components/schemas/svlog.events.EventType.CustomRoleGrantsSet'
        - $ref: '#/components/schemas/svlog.events.EventType.CustomRoleMemberAssigned'
        - $ref: >-
            #/components/schemas/svlog.events.EventType.CustomRoleMemberUnassigned
        - $ref: '#/components/schemas/svlog.events.EventType.CustomRoleTeamBound'
        - $ref: '#/components/schemas/svlog.events.EventType.CustomRoleTeamUnbound'
        - $ref: '#/components/schemas/svlog.events.EventType.CustomRoleUpdated'
        - $ref: '#/components/schemas/svlog.events.EventType.DashboardCreated'
        - $ref: '#/components/schemas/svlog.events.EventType.DashboardDeleted'
        - $ref: '#/components/schemas/svlog.events.EventType.DashboardUpdated'
        - $ref: '#/components/schemas/svlog.events.EventType.EmailIntakeConfigCreated'
        - $ref: '#/components/schemas/svlog.events.EventType.EmailIntakeConfigDeleted'
        - $ref: '#/components/schemas/svlog.events.EventType.EmailIntakeConfigUpdated'
        - $ref: '#/components/schemas/svlog.events.EventType.EntitlementCreated'
        - $ref: '#/components/schemas/svlog.events.EventType.EntitlementDeleted'
        - $ref: >-
            #/components/schemas/svlog.events.EventType.EntitlementRequestabilityChanged
        - $ref: '#/components/schemas/svlog.events.EventType.EntitlementUpdated'
        - $ref: '#/components/schemas/svlog.events.EventType.EntityCreated'
        - $ref: '#/components/schemas/svlog.events.EventType.EntityDeleted'
        - $ref: '#/components/schemas/svlog.events.EventType.EntityTypeCreated'
        - $ref: '#/components/schemas/svlog.events.EventType.EntityTypeDeleted'
        - $ref: '#/components/schemas/svlog.events.EventType.EntityTypeFieldCreated'
        - $ref: '#/components/schemas/svlog.events.EventType.EntityTypeFieldDeleted'
        - $ref: '#/components/schemas/svlog.events.EventType.EntityTypeUpdated'
        - $ref: '#/components/schemas/svlog.events.EventType.EntityUpdated'
        - $ref: '#/components/schemas/svlog.events.EventType.FolderCreated'
        - $ref: '#/components/schemas/svlog.events.EventType.FolderDeleted'
        - $ref: >-
            #/components/schemas/svlog.events.EventType.FolderResourceLocationSet
        - $ref: '#/components/schemas/svlog.events.EventType.FolderUpdated'
        - $ref: '#/components/schemas/svlog.events.EventType.GroupCreated'
        - $ref: '#/components/schemas/svlog.events.EventType.GroupDeleted'
        - $ref: '#/components/schemas/svlog.events.EventType.GroupUpdated'
        - $ref: '#/components/schemas/svlog.events.EventType.GuidanceCreated'
        - $ref: '#/components/schemas/svlog.events.EventType.GuidanceDeleted'
        - $ref: '#/components/schemas/svlog.events.EventType.GuidanceDeployed'
        - $ref: '#/components/schemas/svlog.events.EventType.GuidanceDisabled'
        - $ref: '#/components/schemas/svlog.events.EventType.GuidanceEnabled'
        - $ref: '#/components/schemas/svlog.events.EventType.GuidanceUpdated'
        - $ref: '#/components/schemas/svlog.events.EventType.HelpAgentSimulationReply'
        - $ref: >-
            #/components/schemas/svlog.events.EventType.HelpAgentSimulationStarted
        - $ref: >-
            #/components/schemas/svlog.events.EventType.ImpersonationSessionStarted
        - $ref: >-
            #/components/schemas/svlog.events.EventType.ImpersonationSessionTerminated
        - $ref: '#/components/schemas/svlog.events.EventType.KnowledgeBaseArchived'
        - $ref: '#/components/schemas/svlog.events.EventType.KnowledgeBaseCreated'
        - $ref: '#/components/schemas/svlog.events.EventType.KnowledgeBaseDeleted'
        - $ref: '#/components/schemas/svlog.events.EventType.KnowledgeBaseUpdated'
        - $ref: >-
            #/components/schemas/svlog.events.EventType.KnowledgeDocumentAudienceUpdated
        - $ref: '#/components/schemas/svlog.events.EventType.KnowledgeDocumentCreated'
        - $ref: >-
            #/components/schemas/svlog.events.EventType.KnowledgeDocumentPublished
        - $ref: '#/components/schemas/svlog.events.EventType.LabelCreated'
        - $ref: '#/components/schemas/svlog.events.EventType.LabelDeleted'
        - $ref: '#/components/schemas/svlog.events.EventType.LabelUpdated'
        - $ref: '#/components/schemas/svlog.events.EventType.McpOauthAuthorized'
        - $ref: '#/components/schemas/svlog.events.EventType.McpOauthDenied'
        - $ref: '#/components/schemas/svlog.events.EventType.McpOauthTokenRevoked'
        - $ref: '#/components/schemas/svlog.events.EventType.OrgAuthzTeardown'
        - $ref: '#/components/schemas/svlog.events.EventType.OrgLifecycleStateChanged'
        - $ref: '#/components/schemas/svlog.events.EventType.OrgProviderTrustRevoked'
        - $ref: '#/components/schemas/svlog.events.EventType.OrgProvisioned'
        - $ref: >-
            #/components/schemas/svlog.events.EventType.OrgProvisionedViaAccessCode
        - $ref: >-
            #/components/schemas/svlog.events.EventType.OrgRedactionPatternsChanged
        - $ref: '#/components/schemas/svlog.events.EventType.OrgSettingsChanged'
        - $ref: '#/components/schemas/svlog.events.EventType.OrgSetupLinkResent'
        - $ref: '#/components/schemas/svlog.events.EventType.OrgSsoTeardown'
        - $ref: '#/components/schemas/svlog.events.EventType.PermissionDenied'
        - $ref: '#/components/schemas/svlog.events.EventType.QueueCreated'
        - $ref: '#/components/schemas/svlog.events.EventType.QueueDeleted'
        - $ref: '#/components/schemas/svlog.events.EventType.QueueUpdated'
        - $ref: '#/components/schemas/svlog.events.EventType.RoutingRuleCreated'
        - $ref: '#/components/schemas/svlog.events.EventType.RoutingRuleDeleted'
        - $ref: '#/components/schemas/svlog.events.EventType.RoutingRuleUpdated'
        - $ref: '#/components/schemas/svlog.events.EventType.SimulationConfigCreated'
        - $ref: '#/components/schemas/svlog.events.EventType.SimulationConfigDeleted'
        - $ref: '#/components/schemas/svlog.events.EventType.SimulationConfigUpdated'
        - $ref: '#/components/schemas/svlog.events.EventType.SlaDefinitionCreated'
        - $ref: '#/components/schemas/svlog.events.EventType.SlaDefinitionDeleted'
        - $ref: '#/components/schemas/svlog.events.EventType.SlaDefinitionUpdated'
        - $ref: '#/components/schemas/svlog.events.EventType.SsoConfigChanged'
        - $ref: >-
            #/components/schemas/svlog.events.EventType.TeamCatalystSettingsChanged
        - $ref: '#/components/schemas/svlog.events.EventType.TeamCreated'
        - $ref: >-
            #/components/schemas/svlog.events.EventType.TeamDefaultAssigneesChanged
        - $ref: '#/components/schemas/svlog.events.EventType.TeamDeleted'
        - $ref: >-
            #/components/schemas/svlog.events.EventType.TeamOverrideApproverDecision
        - $ref: '#/components/schemas/svlog.events.EventType.TeamUpdated'
        - $ref: '#/components/schemas/svlog.events.EventType.TicketAssigned'
        - $ref: '#/components/schemas/svlog.events.EventType.TicketDeleted'
        - $ref: '#/components/schemas/svlog.events.EventType.TicketEscalated'
        - $ref: '#/components/schemas/svlog.events.EventType.TicketLabelAdded'
        - $ref: '#/components/schemas/svlog.events.EventType.TicketLabelRemoved'
        - $ref: '#/components/schemas/svlog.events.EventType.TicketModelCreated'
        - $ref: '#/components/schemas/svlog.events.EventType.TicketModelDeleted'
        - $ref: '#/components/schemas/svlog.events.EventType.TicketModelUpdated'
        - $ref: '#/components/schemas/svlog.events.EventType.TicketOwningGroupChanged'
        - $ref: '#/components/schemas/svlog.events.EventType.TicketPermanentlyDeleted'
        - $ref: '#/components/schemas/svlog.events.EventType.TicketPriorityChanged'
        - $ref: '#/components/schemas/svlog.events.EventType.TicketStatusChanged'
        - $ref: '#/components/schemas/svlog.events.EventType.TicketTeamChanged'
        - $ref: '#/components/schemas/svlog.events.EventType.TicketTrashed'
        - $ref: '#/components/schemas/svlog.events.EventType.TicketTypeChanged'
        - $ref: '#/components/schemas/svlog.events.EventType.TicketUntrashed'
        - $ref: '#/components/schemas/svlog.events.EventType.TicketViewed'
        - $ref: '#/components/schemas/svlog.events.EventType.UserAddedToTeam'
        - $ref: '#/components/schemas/svlog.events.EventType.UserAuthMethodUpdated'
        - $ref: '#/components/schemas/svlog.events.EventType.UserCreated'
        - $ref: '#/components/schemas/svlog.events.EventType.UserDeactivated'
        - $ref: '#/components/schemas/svlog.events.EventType.UserInvited'
        - $ref: '#/components/schemas/svlog.events.EventType.UserLogin'
        - $ref: '#/components/schemas/svlog.events.EventType.UserLoginFailed'
        - $ref: '#/components/schemas/svlog.events.EventType.UserLogout'
        - $ref: '#/components/schemas/svlog.events.EventType.UserMfaEnrolled'
        - $ref: >-
            #/components/schemas/svlog.events.EventType.UserOrganizationRoleChanged
        - $ref: '#/components/schemas/svlog.events.EventType.UserPasswordChanged'
        - $ref: '#/components/schemas/svlog.events.EventType.UserRemovedFromTeam'
        - $ref: '#/components/schemas/svlog.events.EventType.UserSessionRevoked'
        - $ref: '#/components/schemas/svlog.events.EventType.UserTeamRoleChanged'
        - $ref: '#/components/schemas/svlog.events.EventType.WidgetCreated'
        - $ref: '#/components/schemas/svlog.events.EventType.WidgetDeleted'
        - $ref: '#/components/schemas/svlog.events.EventType.WidgetUpdated'
        - $ref: '#/components/schemas/svlog.events.EventType.WorkflowCreated'
        - $ref: '#/components/schemas/svlog.events.EventType.WorkflowDeleted'
        - $ref: '#/components/schemas/svlog.events.EventType.WorkflowDisabled'
        - $ref: '#/components/schemas/svlog.events.EventType.WorkflowEnabled'
        - $ref: '#/components/schemas/svlog.events.EventType.WorkflowPublished'
        - $ref: '#/components/schemas/svlog.events.EventType.WorkflowRunRequested'
        - $ref: '#/components/schemas/svlog.events.EventType.WorkflowRunStarted'
        - $ref: '#/components/schemas/svlog.events.EventType.WorkflowUpdated'
      title: EventType
    svlog.events.Outcome:
      type: object
      properties:
        status:
          $ref: '#/components/schemas/svlog.events.Outcome.Status'
          title: status
          x-stainless-terraform-configurability: optional
        reasonCode:
          type: string
          title: reason_code
          description: |-
            Machine-stable code SIEM rules key on (e.g. "permission_denied",
             "transition_not_allowed", "precondition_not_met").
          x-stainless-terraform-configurability: optional
        reasonDetail:
          type: string
          title: reason_detail
          description: Human-readable detail. MUST NOT contain PII or secrets.
          x-stainless-terraform-configurability: optional
      title: Outcome
      additionalProperties: false
      description: >-
        Outcome captures the RESULT of an attempted action. event_data carries
        the
         full proto; svlog also lifts outcome.status into an indexed column so
         "every DENIED action by actor X" is a cheap query and SIEM rules can key on
         the status.
    svlog.events.Severity:
      type: string
      title: Severity
      enum:
        - SEVERITY_UNSPECIFIED
        - SEVERITY_TRACE
        - SEVERITY_DEBUG
        - SEVERITY_INFO
        - SEVERITY_WARN
        - SEVERITY_ERROR
      description: >-
        Severity is the leveled-telemetry dimension of an audit event, mirroring
        the
         classic syslog level ordering. event_data carries the full proto; svlog also
         lifts the level name into an indexed column so the user-facing feed can cheaply
         drop sub-INFO operational noise without scanning every row.

         SEVERITY_INFO is the default for user-driven actions (everything emitted today).
         SEVERITY_DEBUG / SEVERITY_TRACE are for high-volume operational telemetry that
         should be retained but kept out of the default feed. SEVERITY_WARN /
         SEVERITY_ERROR escalate notable / faulty events for alerting.
    svauth.models.Actor.ApiKey:
      type: object
      title: Api Key
      properties:
        apiKey:
          $ref: '#/components/schemas/svauth.models.ApiKeyActor'
          title: api_key
          x-stainless-terraform-configurability: optional
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
      required:
        - apiKey
      additionalProperties: false
    svauth.models.Actor.ImpersonatedUser:
      type: object
      title: Impersonated User
      properties:
        impersonatedUser:
          $ref: '#/components/schemas/svauth.models.ImpersonatedUserActor'
          title: impersonated_user
          x-stainless-terraform-configurability: optional
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
      required:
        - impersonatedUser
      additionalProperties: false
    svauth.models.Actor.System:
      type: object
      title: System
      properties:
        system:
          $ref: '#/components/schemas/svauth.models.SystemActor'
          title: system
          x-stainless-terraform-configurability: optional
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
      required:
        - system
      additionalProperties: false
    svauth.models.Actor.User:
      type: object
      title: User
      properties:
        user:
          $ref: '#/components/schemas/svauth.models.UserActor'
          title: user
          x-stainless-terraform-configurability: optional
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
      required:
        - user
      additionalProperties: false
    svauth.models.Actor.Worker:
      type: object
      title: Worker
      properties:
        worker:
          $ref: '#/components/schemas/svauth.models.WorkerActor'
          title: worker
          x-stainless-terraform-configurability: optional
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
      required:
        - worker
      additionalProperties: false
    svlog.events.EventType.AccessDeprovisioned:
      type: object
      title: Access Deprovisioned
      properties:
        accessDeprovisioned:
          $ref: '#/components/schemas/svlog.events.AccessDeprovisionedEvent'
          title: access_deprovisioned
          x-stainless-terraform-configurability: optional
      required:
        - accessDeprovisioned
      additionalProperties: false
    svlog.events.EventType.AccessPolicyApprovalProcedureCreated:
      type: object
      title: Access Policy Approval Procedure Created
      properties:
        accessPolicyApprovalProcedureCreated:
          $ref: >-
            #/components/schemas/svlog.events.AccessPolicyApprovalProcedureCreatedEvent
          title: access_policy_approval_procedure_created
          description: |-
            svflow access-policy approval procedures — the approval gate on an
             access policy. Policy create/update/delete were already audited;
             the procedure lifecycle (who approves access requests) was not.
             Emitted from the handler seams that mutate a policy-linked
             procedure (public Create/Update/DeleteAccessPolicyApprovalProcedure
             and the user-API Set/UnsetApprovalProcedure policy branch), after
             the mutation commits. Renumbered from 145-147 to 158-160:
             145-148 were claimed by access_review_policy_* on main while this
             branch was in flight — see the reservation note above.
          x-stainless-terraform-configurability: optional
      required:
        - accessPolicyApprovalProcedureCreated
      additionalProperties: false
      description: |-
        svflow access-policy approval procedures — the approval gate on an
         access policy. Policy create/update/delete were already audited;
         the procedure lifecycle (who approves access requests) was not.
         Emitted from the handler seams that mutate a policy-linked
         procedure (public Create/Update/DeleteAccessPolicyApprovalProcedure
         and the user-API Set/UnsetApprovalProcedure policy branch), after
         the mutation commits. Renumbered from 145-147 to 158-160:
         145-148 were claimed by access_review_policy_* on main while this
         branch was in flight — see the reservation note above.
    svlog.events.EventType.AccessPolicyApprovalProcedureDeleted:
      type: object
      title: Access Policy Approval Procedure Deleted
      properties:
        accessPolicyApprovalProcedureDeleted:
          $ref: >-
            #/components/schemas/svlog.events.AccessPolicyApprovalProcedureDeletedEvent
          title: access_policy_approval_procedure_deleted
          x-stainless-terraform-configurability: optional
      required:
        - accessPolicyApprovalProcedureDeleted
      additionalProperties: false
    svlog.events.EventType.AccessPolicyApprovalProcedureUpdated:
      type: object
      title: Access Policy Approval Procedure Updated
      properties:
        accessPolicyApprovalProcedureUpdated:
          $ref: >-
            #/components/schemas/svlog.events.AccessPolicyApprovalProcedureUpdatedEvent
          title: access_policy_approval_procedure_updated
          x-stainless-terraform-configurability: optional
      required:
        - accessPolicyApprovalProcedureUpdated
      additionalProperties: false
    svlog.events.EventType.AccessPolicyCreated:
      type: object
      title: Access Policy Created
      properties:
        accessPolicyCreated:
          $ref: '#/components/schemas/svlog.events.AccessPolicyCreatedEvent'
          title: access_policy_created
          x-stainless-terraform-configurability: optional
      required:
        - accessPolicyCreated
      additionalProperties: false
    svlog.events.EventType.AccessPolicyDeleted:
      type: object
      title: Access Policy Deleted
      properties:
        accessPolicyDeleted:
          $ref: '#/components/schemas/svlog.events.AccessPolicyDeletedEvent'
          title: access_policy_deleted
          x-stainless-terraform-configurability: optional
      required:
        - accessPolicyDeleted
      additionalProperties: false
    svlog.events.EventType.AccessPolicyUpdated:
      type: object
      title: Access Policy Updated
      properties:
        accessPolicyUpdated:
          $ref: '#/components/schemas/svlog.events.AccessPolicyUpdatedEvent'
          title: access_policy_updated
          x-stainless-terraform-configurability: optional
      required:
        - accessPolicyUpdated
      additionalProperties: false
    svlog.events.EventType.AccessProvisioned:
      type: object
      title: Access Provisioned
      properties:
        accessProvisioned:
          $ref: '#/components/schemas/svlog.events.AccessProvisionedEvent'
          title: access_provisioned
          description: Access lifecycle events
          x-stainless-terraform-configurability: optional
      required:
        - accessProvisioned
      additionalProperties: false
      description: Access lifecycle events
    svlog.events.EventType.AccessReviewPolicyCreated:
      type: object
      title: Access Review Policy Created
      properties:
        accessReviewPolicyCreated:
          $ref: '#/components/schemas/svlog.events.AccessReviewPolicyCreatedEvent'
          title: access_review_policy_created
          x-stainless-terraform-configurability: optional
      required:
        - accessReviewPolicyCreated
      additionalProperties: false
    svlog.events.EventType.AccessReviewPolicyDeleted:
      type: object
      title: Access Review Policy Deleted
      properties:
        accessReviewPolicyDeleted:
          $ref: '#/components/schemas/svlog.events.AccessReviewPolicyDeletedEvent'
          title: access_review_policy_deleted
          x-stainless-terraform-configurability: optional
      required:
        - accessReviewPolicyDeleted
      additionalProperties: false
    svlog.events.EventType.AccessReviewPolicySetTeamDefault:
      type: object
      title: Access Review Policy Set Team Default
      properties:
        accessReviewPolicySetTeamDefault:
          $ref: >-
            #/components/schemas/svlog.events.AccessReviewPolicySetTeamDefaultEvent
          title: access_review_policy_set_team_default
          x-stainless-terraform-configurability: optional
      required:
        - accessReviewPolicySetTeamDefault
      additionalProperties: false
    svlog.events.EventType.AccessReviewPolicyUpdated:
      type: object
      title: Access Review Policy Updated
      properties:
        accessReviewPolicyUpdated:
          $ref: '#/components/schemas/svlog.events.AccessReviewPolicyUpdatedEvent'
          title: access_review_policy_updated
          x-stainless-terraform-configurability: optional
      required:
        - accessReviewPolicyUpdated
      additionalProperties: false
    svlog.events.EventType.AgentConfigCreated:
      type: object
      title: Agent Config Created
      properties:
        agentConfigCreated:
          $ref: '#/components/schemas/svlog.events.AgentConfigCreatedEvent'
          title: agent_config_created
          description: |-
            svmeta Catalyst agent configs (scheduled sessions managed via the
             public API).
          x-stainless-terraform-configurability: optional
      required:
        - agentConfigCreated
      additionalProperties: false
      description: |-
        svmeta Catalyst agent configs (scheduled sessions managed via the
         public API).
    svlog.events.EventType.AgentConfigDeleted:
      type: object
      title: Agent Config Deleted
      properties:
        agentConfigDeleted:
          $ref: '#/components/schemas/svlog.events.AgentConfigDeletedEvent'
          title: agent_config_deleted
          x-stainless-terraform-configurability: optional
      required:
        - agentConfigDeleted
      additionalProperties: false
    svlog.events.EventType.AgentConfigUpdated:
      type: object
      title: Agent Config Updated
      properties:
        agentConfigUpdated:
          $ref: '#/components/schemas/svlog.events.AgentConfigUpdatedEvent'
          title: agent_config_updated
          x-stainless-terraform-configurability: optional
      required:
        - agentConfigUpdated
      additionalProperties: false
    svlog.events.EventType.AgentInstalled:
      type: object
      title: Agent Installed
      properties:
        agentInstalled:
          $ref: '#/components/schemas/svlog.events.AgentInstalledEvent'
          title: agent_installed
          x-stainless-terraform-configurability: optional
      required:
        - agentInstalled
      additionalProperties: false
    svlog.events.EventType.AgentSessionTriggered:
      type: object
      title: Agent Session Triggered
      properties:
        agentSessionTriggered:
          $ref: '#/components/schemas/svlog.events.AgentSessionTriggeredEvent'
          title: agent_session_triggered
          description: |-
            svmeta agent run/install actions (not config CRUD): triggering a
             manual run creates an agent session; installing pulls an agent from
             the marketplace. Supersede the legacy catalyst_scheduled_session_*
             and catalyst_agent_installed events (fields 85-87, now unemitted).
          x-stainless-terraform-configurability: optional
      required:
        - agentSessionTriggered
      additionalProperties: false
      description: |-
        svmeta agent run/install actions (not config CRUD): triggering a
         manual run creates an agent session; installing pulls an agent from
         the marketplace. Supersede the legacy catalyst_scheduled_session_*
         and catalyst_agent_installed events (fields 85-87, now unemitted).
    svlog.events.EventType.ApiKeyCreated:
      type: object
      title: Api Key Created
      properties:
        apiKeyCreated:
          $ref: '#/components/schemas/svlog.events.ApiKeyCreatedEvent'
          title: api_key_created
          x-stainless-terraform-configurability: optional
      required:
        - apiKeyCreated
      additionalProperties: false
    svlog.events.EventType.ApiKeyRevoked:
      type: object
      title: Api Key Revoked
      properties:
        apiKeyRevoked:
          $ref: '#/components/schemas/svlog.events.ApiKeyRevokedEvent'
          title: api_key_revoked
          x-stainless-terraform-configurability: optional
      required:
        - apiKeyRevoked
      additionalProperties: false
    svlog.events.EventType.AppInstanceAuthRefreshed:
      type: object
      title: App Instance Auth Refreshed
      properties:
        appInstanceAuthRefreshed:
          $ref: '#/components/schemas/svlog.events.AppInstanceAuthRefreshedEvent'
          title: app_instance_auth_refreshed
          description: |-
            Automated credential refresh/rotation on an existing connection
             (silent OAuth token refresh, Jira Forge scheduled system-token
             rotation). Deliberate, user-initiated credential replacement emits
             app_instance_reconnected instead. Baseline severity is DEBUG (see
             producer.debugEventNames): per-credential rotation cadence can be
             minutes, so this is retained for forensics but kept out of the
             default INFO feed.
          x-stainless-terraform-configurability: optional
      required:
        - appInstanceAuthRefreshed
      additionalProperties: false
      description: |-
        Automated credential refresh/rotation on an existing connection
         (silent OAuth token refresh, Jira Forge scheduled system-token
         rotation). Deliberate, user-initiated credential replacement emits
         app_instance_reconnected instead. Baseline severity is DEBUG (see
         producer.debugEventNames): per-credential rotation cadence can be
         minutes, so this is retained for forensics but kept out of the
         default INFO feed.
    svlog.events.EventType.AppInstanceCreated:
      type: object
      title: App Instance Created
      properties:
        appInstanceCreated:
          $ref: '#/components/schemas/svlog.events.AppInstanceCreatedEvent'
          title: app_instance_created
          x-stainless-terraform-configurability: optional
      required:
        - appInstanceCreated
      additionalProperties: false
    svlog.events.EventType.AppInstanceDeleted:
      type: object
      title: App Instance Deleted
      properties:
        appInstanceDeleted:
          $ref: '#/components/schemas/svlog.events.AppInstanceDeletedEvent'
          title: app_instance_deleted
          x-stainless-terraform-configurability: optional
      required:
        - appInstanceDeleted
      additionalProperties: false
    svlog.events.EventType.AppInstanceReconnected:
      type: object
      title: App Instance Reconnected
      properties:
        appInstanceReconnected:
          $ref: '#/components/schemas/svlog.events.AppInstanceReconnectedEvent'
          title: app_instance_reconnected
          x-stainless-terraform-configurability: optional
      required:
        - appInstanceReconnected
      additionalProperties: false
    svlog.events.EventType.AppInstanceShared:
      type: object
      title: App Instance Shared
      properties:
        appInstanceShared:
          $ref: '#/components/schemas/svlog.events.AppInstanceSharedEvent'
          title: app_instance_shared
          description: |-
            App-instance cross-team sharing (grant/revoke of credential-backed
             access to another team in the same org).
          x-stainless-terraform-configurability: optional
      required:
        - appInstanceShared
      additionalProperties: false
      description: |-
        App-instance cross-team sharing (grant/revoke of credential-backed
         access to another team in the same org).
    svlog.events.EventType.AppInstanceUnshared:
      type: object
      title: App Instance Unshared
      properties:
        appInstanceUnshared:
          $ref: '#/components/schemas/svlog.events.AppInstanceUnsharedEvent'
          title: app_instance_unshared
          x-stainless-terraform-configurability: optional
      required:
        - appInstanceUnshared
      additionalProperties: false
    svlog.events.EventType.CatalystAgentInstalled:
      type: object
      title: Catalyst Agent Installed
      properties:
        catalystAgentInstalled:
          $ref: '#/components/schemas/svlog.events.CatalystAgentInstalledEvent'
          title: catalyst_agent_installed
          x-stainless-terraform-configurability: optional
      required:
        - catalystAgentInstalled
      additionalProperties: false
    svlog.events.EventType.CatalystChangeSetReviewed:
      type: object
      title: Catalyst Change Set Reviewed
      properties:
        catalystChangeSetReviewed:
          $ref: '#/components/schemas/svlog.events.CatalystChangeSetReviewedEvent'
          title: catalyst_change_set_reviewed
          x-stainless-terraform-configurability: optional
      required:
        - catalystChangeSetReviewed
      additionalProperties: false
    svlog.events.EventType.CatalystChangesApplied:
      type: object
      title: Catalyst Changes Applied
      properties:
        catalystChangesApplied:
          $ref: '#/components/schemas/svlog.events.CatalystChangesAppliedEvent'
          title: catalyst_changes_applied
          description: |-
            svmeta Catalyst (agent-session) — first audit coverage wave. These
             actions previously emitted no org-level audit event. Each carries its
             Outcome on the envelope (catalyst_change_set_reviewed records DENIED on
             a rejected change set).
          x-stainless-terraform-configurability: optional
      required:
        - catalystChangesApplied
      additionalProperties: false
      description: |-
        svmeta Catalyst (agent-session) — first audit coverage wave. These
         actions previously emitted no org-level audit event. Each carries its
         Outcome on the envelope (catalyst_change_set_reviewed records DENIED on
         a rejected change set).
    svlog.events.EventType.CatalystScheduledSessionCreated:
      type: object
      title: Catalyst Scheduled Session Created
      properties:
        catalystScheduledSessionCreated:
          $ref: >-
            #/components/schemas/svlog.events.CatalystScheduledSessionCreatedEvent
          title: catalyst_scheduled_session_created
          x-stainless-terraform-configurability: optional
      required:
        - catalystScheduledSessionCreated
      additionalProperties: false
    svlog.events.EventType.CatalystScheduledSessionTriggered:
      type: object
      title: Catalyst Scheduled Session Triggered
      properties:
        catalystScheduledSessionTriggered:
          $ref: >-
            #/components/schemas/svlog.events.CatalystScheduledSessionTriggeredEvent
          title: catalyst_scheduled_session_triggered
          x-stainless-terraform-configurability: optional
      required:
        - catalystScheduledSessionTriggered
      additionalProperties: false
    svlog.events.EventType.CatalystSessionSharingChanged:
      type: object
      title: Catalyst Session Sharing Changed
      properties:
        catalystSessionSharingChanged:
          $ref: '#/components/schemas/svlog.events.CatalystSessionSharingChangedEvent'
          title: catalyst_session_sharing_changed
          x-stainless-terraform-configurability: optional
      required:
        - catalystSessionSharingChanged
      additionalProperties: false
    svlog.events.EventType.CatalystSkillDeployed:
      type: object
      title: Catalyst Skill Deployed
      properties:
        catalystSkillDeployed:
          $ref: '#/components/schemas/svlog.events.CatalystSkillDeployedEvent'
          title: catalyst_skill_deployed
          x-stainless-terraform-configurability: optional
      required:
        - catalystSkillDeployed
      additionalProperties: false
    svlog.events.EventType.CategoryCreated:
      type: object
      title: Category Created
      properties:
        categoryCreated:
          $ref: '#/components/schemas/svlog.events.CategoryCreatedEvent'
          title: category_created
          x-stainless-terraform-configurability: optional
      required:
        - categoryCreated
      additionalProperties: false
    svlog.events.EventType.CategoryDeleted:
      type: object
      title: Category Deleted
      properties:
        categoryDeleted:
          $ref: '#/components/schemas/svlog.events.CategoryDeletedEvent'
          title: category_deleted
          x-stainless-terraform-configurability: optional
      required:
        - categoryDeleted
      additionalProperties: false
    svlog.events.EventType.CategoryUpdated:
      type: object
      title: Category Updated
      properties:
        categoryUpdated:
          $ref: '#/components/schemas/svlog.events.CategoryUpdatedEvent'
          title: category_updated
          x-stainless-terraform-configurability: optional
      required:
        - categoryUpdated
      additionalProperties: false
    svlog.events.EventType.CustomRoleCreated:
      type: object
      title: Custom Role Created
      properties:
        customRoleCreated:
          $ref: '#/components/schemas/svlog.events.CustomRoleCreatedEvent'
          title: custom_role_created
          description: Custom-role lifecycle (svauth, org-admin surface)
          x-stainless-terraform-configurability: optional
      required:
        - customRoleCreated
      additionalProperties: false
      description: Custom-role lifecycle (svauth, org-admin surface)
    svlog.events.EventType.CustomRoleDeleted:
      type: object
      title: Custom Role Deleted
      properties:
        customRoleDeleted:
          $ref: '#/components/schemas/svlog.events.CustomRoleDeletedEvent'
          title: custom_role_deleted
          x-stainless-terraform-configurability: optional
      required:
        - customRoleDeleted
      additionalProperties: false
    svlog.events.EventType.CustomRoleGrantsSet:
      type: object
      title: Custom Role Grants Set
      properties:
        customRoleGrantsSet:
          $ref: '#/components/schemas/svlog.events.CustomRoleGrantsSetEvent'
          title: custom_role_grants_set
          x-stainless-terraform-configurability: optional
      required:
        - customRoleGrantsSet
      additionalProperties: false
    svlog.events.EventType.CustomRoleMemberAssigned:
      type: object
      title: Custom Role Member Assigned
      properties:
        customRoleMemberAssigned:
          $ref: '#/components/schemas/svlog.events.CustomRoleMemberAssignedEvent'
          title: custom_role_member_assigned
          x-stainless-terraform-configurability: optional
      required:
        - customRoleMemberAssigned
      additionalProperties: false
    svlog.events.EventType.CustomRoleMemberUnassigned:
      type: object
      title: Custom Role Member Unassigned
      properties:
        customRoleMemberUnassigned:
          $ref: '#/components/schemas/svlog.events.CustomRoleMemberUnassignedEvent'
          title: custom_role_member_unassigned
          x-stainless-terraform-configurability: optional
      required:
        - customRoleMemberUnassigned
      additionalProperties: false
    svlog.events.EventType.CustomRoleTeamBound:
      type: object
      title: Custom Role Team Bound
      properties:
        customRoleTeamBound:
          $ref: '#/components/schemas/svlog.events.CustomRoleTeamBoundEvent'
          title: custom_role_team_bound
          x-stainless-terraform-configurability: optional
      required:
        - customRoleTeamBound
      additionalProperties: false
    svlog.events.EventType.CustomRoleTeamUnbound:
      type: object
      title: Custom Role Team Unbound
      properties:
        customRoleTeamUnbound:
          $ref: '#/components/schemas/svlog.events.CustomRoleTeamUnboundEvent'
          title: custom_role_team_unbound
          x-stainless-terraform-configurability: optional
      required:
        - customRoleTeamUnbound
      additionalProperties: false
    svlog.events.EventType.CustomRoleUpdated:
      type: object
      title: Custom Role Updated
      properties:
        customRoleUpdated:
          $ref: '#/components/schemas/svlog.events.CustomRoleUpdatedEvent'
          title: custom_role_updated
          x-stainless-terraform-configurability: optional
      required:
        - customRoleUpdated
      additionalProperties: false
    svlog.events.EventType.DashboardCreated:
      type: object
      title: Dashboard Created
      properties:
        dashboardCreated:
          $ref: '#/components/schemas/svlog.events.DashboardCreatedEvent'
          title: dashboard_created
          description: >-
            svanalytics dashboard + widget lifecycle — first audit coverage
            wave.
             These CRUD actions previously emitted no org-level audit event.
             Emitted from svanalytics' user-API handlers (Create/Update/Delete
             Dashboard/Widget ForTeam), where the acting user is resolved from the
             request and the team scope is the *ForTeam team_id. Each carries
             SUCCESS on the envelope (these handler seams only emit after the
             mutation commits). Pure layout reflows (UpdateDashboardLayout) and the
             default-dashboard toggle (SetDefaultDashboard) are intentionally NOT
             audited — high-frequency UX state, not security-relevant mutations.
          x-stainless-terraform-configurability: optional
      required:
        - dashboardCreated
      additionalProperties: false
      description: |-
        svanalytics dashboard + widget lifecycle — first audit coverage wave.
         These CRUD actions previously emitted no org-level audit event.
         Emitted from svanalytics' user-API handlers (Create/Update/Delete
         Dashboard/Widget ForTeam), where the acting user is resolved from the
         request and the team scope is the *ForTeam team_id. Each carries
         SUCCESS on the envelope (these handler seams only emit after the
         mutation commits). Pure layout reflows (UpdateDashboardLayout) and the
         default-dashboard toggle (SetDefaultDashboard) are intentionally NOT
         audited — high-frequency UX state, not security-relevant mutations.
    svlog.events.EventType.DashboardDeleted:
      type: object
      title: Dashboard Deleted
      properties:
        dashboardDeleted:
          $ref: '#/components/schemas/svlog.events.DashboardDeletedEvent'
          title: dashboard_deleted
          x-stainless-terraform-configurability: optional
      required:
        - dashboardDeleted
      additionalProperties: false
    svlog.events.EventType.DashboardUpdated:
      type: object
      title: Dashboard Updated
      properties:
        dashboardUpdated:
          $ref: '#/components/schemas/svlog.events.DashboardUpdatedEvent'
          title: dashboard_updated
          x-stainless-terraform-configurability: optional
      required:
        - dashboardUpdated
      additionalProperties: false
    svlog.events.EventType.EmailIntakeConfigCreated:
      type: object
      title: Email Intake Config Created
      properties:
        emailIntakeConfigCreated:
          $ref: '#/components/schemas/svlog.events.EmailIntakeConfigCreatedEvent'
          title: email_intake_config_created
          x-stainless-terraform-configurability: optional
      required:
        - emailIntakeConfigCreated
      additionalProperties: false
    svlog.events.EventType.EmailIntakeConfigDeleted:
      type: object
      title: Email Intake Config Deleted
      properties:
        emailIntakeConfigDeleted:
          $ref: '#/components/schemas/svlog.events.EmailIntakeConfigDeletedEvent'
          title: email_intake_config_deleted
          x-stainless-terraform-configurability: optional
      required:
        - emailIntakeConfigDeleted
      additionalProperties: false
    svlog.events.EventType.EmailIntakeConfigUpdated:
      type: object
      title: Email Intake Config Updated
      properties:
        emailIntakeConfigUpdated:
          $ref: '#/components/schemas/svlog.events.EmailIntakeConfigUpdatedEvent'
          title: email_intake_config_updated
          x-stainless-terraform-configurability: optional
      required:
        - emailIntakeConfigUpdated
      additionalProperties: false
    svlog.events.EventType.EntitlementCreated:
      type: object
      title: Entitlement Created
      properties:
        entitlementCreated:
          $ref: '#/components/schemas/svlog.events.EntitlementCreatedEvent'
          title: entitlement_created
          description: |-
            svflow entitlement lifecycle (the access-grant config on an app
             resource). Access policy create/update/delete and the access
             provision/deprovision lifecycle were already audited; the
             entitlement CRUD that sits between them was the gap. Emitted from
             svflow's public-API handlers (Create/Update/DeleteAppResourceEntitlement),
             where the acting principal (user or API key) is resolved from the
             request. Each carries SUCCESS on the envelope (these handler seams
             only emit after the mutation commits).
          x-stainless-terraform-configurability: optional
      required:
        - entitlementCreated
      additionalProperties: false
      description: |-
        svflow entitlement lifecycle (the access-grant config on an app
         resource). Access policy create/update/delete and the access
         provision/deprovision lifecycle were already audited; the
         entitlement CRUD that sits between them was the gap. Emitted from
         svflow's public-API handlers (Create/Update/DeleteAppResourceEntitlement),
         where the acting principal (user or API key) is resolved from the
         request. Each carries SUCCESS on the envelope (these handler seams
         only emit after the mutation commits).
    svlog.events.EventType.EntitlementDeleted:
      type: object
      title: Entitlement Deleted
      properties:
        entitlementDeleted:
          $ref: '#/components/schemas/svlog.events.EntitlementDeletedEvent'
          title: entitlement_deleted
          x-stainless-terraform-configurability: optional
      required:
        - entitlementDeleted
      additionalProperties: false
    svlog.events.EventType.EntitlementRequestabilityChanged:
      type: object
      title: Entitlement Requestability Changed
      properties:
        entitlementRequestabilityChanged:
          $ref: >-
            #/components/schemas/svlog.events.EntitlementRequestabilityChangedEvent
          title: entitlement_requestability_changed
          description: |-
            svflow entitlement requestability toggle: whether end users can
             request this role/entitlement through Serval (requests_enabled).
             Flipping it changes who can ask for access, so it is audited as its
             own action rather than folded into the generic entitlement_updated
             (which the public update handlers still emit for any config change).
             Emitted from the access state manager so every mutation surface is
             covered by one seam: the settings user API (Set/BulkSet
             EntitlementsRequestable), the public-API entitlement/role update
             endpoints (single + batch), and the private API. Fires only when the
             stored value actually changed, post-commit, SUCCESS on the envelope.
          x-stainless-terraform-configurability: optional
      required:
        - entitlementRequestabilityChanged
      additionalProperties: false
      description: |-
        svflow entitlement requestability toggle: whether end users can
         request this role/entitlement through Serval (requests_enabled).
         Flipping it changes who can ask for access, so it is audited as its
         own action rather than folded into the generic entitlement_updated
         (which the public update handlers still emit for any config change).
         Emitted from the access state manager so every mutation surface is
         covered by one seam: the settings user API (Set/BulkSet
         EntitlementsRequestable), the public-API entitlement/role update
         endpoints (single + batch), and the private API. Fires only when the
         stored value actually changed, post-commit, SUCCESS on the envelope.
    svlog.events.EventType.EntitlementUpdated:
      type: object
      title: Entitlement Updated
      properties:
        entitlementUpdated:
          $ref: '#/components/schemas/svlog.events.EntitlementUpdatedEvent'
          title: entitlement_updated
          x-stainless-terraform-configurability: optional
      required:
        - entitlementUpdated
      additionalProperties: false
    svlog.events.EventType.EntityCreated:
      type: object
      title: Entity Created
      properties:
        entityCreated:
          $ref: '#/components/schemas/svlog.events.EntityCreatedEvent'
          title: entity_created
          x-stainless-terraform-configurability: optional
      required:
        - entityCreated
      additionalProperties: false
    svlog.events.EventType.EntityDeleted:
      type: object
      title: Entity Deleted
      properties:
        entityDeleted:
          $ref: '#/components/schemas/svlog.events.EntityDeletedEvent'
          title: entity_deleted
          x-stainless-terraform-configurability: optional
      required:
        - entityDeleted
      additionalProperties: false
    svlog.events.EventType.EntityTypeCreated:
      type: object
      title: Entity Type Created
      properties:
        entityTypeCreated:
          $ref: '#/components/schemas/svlog.events.EntityTypeCreatedEvent'
          title: entity_type_created
          description: svstore entity / entity-type changes (#12583)
          x-stainless-terraform-configurability: optional
      required:
        - entityTypeCreated
      additionalProperties: false
      description: svstore entity / entity-type changes (#12583)
    svlog.events.EventType.EntityTypeDeleted:
      type: object
      title: Entity Type Deleted
      properties:
        entityTypeDeleted:
          $ref: '#/components/schemas/svlog.events.EntityTypeDeletedEvent'
          title: entity_type_deleted
          x-stainless-terraform-configurability: optional
      required:
        - entityTypeDeleted
      additionalProperties: false
    svlog.events.EventType.EntityTypeFieldCreated:
      type: object
      title: Entity Type Field Created
      properties:
        entityTypeFieldCreated:
          $ref: '#/components/schemas/svlog.events.EntityTypeFieldCreatedEvent'
          title: entity_type_field_created
          x-stainless-terraform-configurability: optional
      required:
        - entityTypeFieldCreated
      additionalProperties: false
    svlog.events.EventType.EntityTypeFieldDeleted:
      type: object
      title: Entity Type Field Deleted
      properties:
        entityTypeFieldDeleted:
          $ref: '#/components/schemas/svlog.events.EntityTypeFieldDeletedEvent'
          title: entity_type_field_deleted
          x-stainless-terraform-configurability: optional
      required:
        - entityTypeFieldDeleted
      additionalProperties: false
    svlog.events.EventType.EntityTypeUpdated:
      type: object
      title: Entity Type Updated
      properties:
        entityTypeUpdated:
          $ref: '#/components/schemas/svlog.events.EntityTypeUpdatedEvent'
          title: entity_type_updated
          x-stainless-terraform-configurability: optional
      required:
        - entityTypeUpdated
      additionalProperties: false
    svlog.events.EventType.EntityUpdated:
      type: object
      title: Entity Updated
      properties:
        entityUpdated:
          $ref: '#/components/schemas/svlog.events.EntityUpdatedEvent'
          title: entity_updated
          x-stainless-terraform-configurability: optional
      required:
        - entityUpdated
      additionalProperties: false
    svlog.events.EventType.FolderCreated:
      type: object
      title: Folder Created
      properties:
        folderCreated:
          $ref: '#/components/schemas/svlog.events.FolderCreatedEvent'
          title: folder_created
          description: |-
            svflow folder lifecycle (the per-team, nestable tree that organizes
             workflows and skills/guidance). Emitted from svflow's public-API
             folder handlers (Create/Update/Delete/SetFolderResourceLocation).
             Folder placement governs which workflows/skills are visible where, so
             its mutations are security-relevant and org-audited.
          x-stainless-terraform-configurability: optional
      required:
        - folderCreated
      additionalProperties: false
      description: |-
        svflow folder lifecycle (the per-team, nestable tree that organizes
         workflows and skills/guidance). Emitted from svflow's public-API
         folder handlers (Create/Update/Delete/SetFolderResourceLocation).
         Folder placement governs which workflows/skills are visible where, so
         its mutations are security-relevant and org-audited.
    svlog.events.EventType.FolderDeleted:
      type: object
      title: Folder Deleted
      properties:
        folderDeleted:
          $ref: '#/components/schemas/svlog.events.FolderDeletedEvent'
          title: folder_deleted
          x-stainless-terraform-configurability: optional
      required:
        - folderDeleted
      additionalProperties: false
    svlog.events.EventType.FolderResourceLocationSet:
      type: object
      title: Folder Resource Location Set
      properties:
        folderResourceLocationSet:
          $ref: '#/components/schemas/svlog.events.FolderResourceLocationSetEvent'
          title: folder_resource_location_set
          x-stainless-terraform-configurability: optional
      required:
        - folderResourceLocationSet
      additionalProperties: false
    svlog.events.EventType.FolderUpdated:
      type: object
      title: Folder Updated
      properties:
        folderUpdated:
          $ref: '#/components/schemas/svlog.events.FolderUpdatedEvent'
          title: folder_updated
          x-stainless-terraform-configurability: optional
      required:
        - folderUpdated
      additionalProperties: false
    svlog.events.EventType.GroupCreated:
      type: object
      title: Group Created
      properties:
        groupCreated:
          $ref: '#/components/schemas/svlog.events.GroupCreatedEvent'
          title: group_created
          description: >-
            svauth group lifecycle (org-admin / public-API surface). Groups
            drive
             access through the SpiceDB mirror, so their create/update/delete are
             security-relevant org-level mutations. Emitted from svauth's public-API
             group handlers; org-scoped (no team on the envelope).
          x-stainless-terraform-configurability: optional
      required:
        - groupCreated
      additionalProperties: false
      description: |-
        svauth group lifecycle (org-admin / public-API surface). Groups drive
         access through the SpiceDB mirror, so their create/update/delete are
         security-relevant org-level mutations. Emitted from svauth's public-API
         group handlers; org-scoped (no team on the envelope).
    svlog.events.EventType.GroupDeleted:
      type: object
      title: Group Deleted
      properties:
        groupDeleted:
          $ref: '#/components/schemas/svlog.events.GroupDeletedEvent'
          title: group_deleted
          x-stainless-terraform-configurability: optional
      required:
        - groupDeleted
      additionalProperties: false
    svlog.events.EventType.GroupUpdated:
      type: object
      title: Group Updated
      properties:
        groupUpdated:
          $ref: '#/components/schemas/svlog.events.GroupUpdatedEvent'
          title: group_updated
          x-stainless-terraform-configurability: optional
      required:
        - groupUpdated
      additionalProperties: false
    svlog.events.EventType.GuidanceCreated:
      type: object
      title: Guidance Created
      properties:
        guidanceCreated:
          $ref: '#/components/schemas/svlog.events.GuidanceCreatedEvent'
          title: guidance_created
          x-stainless-terraform-configurability: optional
      required:
        - guidanceCreated
      additionalProperties: false
    svlog.events.EventType.GuidanceDeleted:
      type: object
      title: Guidance Deleted
      properties:
        guidanceDeleted:
          $ref: '#/components/schemas/svlog.events.GuidanceDeletedEvent'
          title: guidance_deleted
          x-stainless-terraform-configurability: optional
      required:
        - guidanceDeleted
      additionalProperties: false
    svlog.events.EventType.GuidanceDeployed:
      type: object
      title: Guidance Deployed
      properties:
        guidanceDeployed:
          $ref: '#/components/schemas/svlog.events.GuidanceDeployedEvent'
          title: guidance_deployed
          x-stainless-terraform-configurability: optional
      required:
        - guidanceDeployed
      additionalProperties: false
    svlog.events.EventType.GuidanceDisabled:
      type: object
      title: Guidance Disabled
      properties:
        guidanceDisabled:
          $ref: '#/components/schemas/svlog.events.GuidanceDisabledEvent'
          title: guidance_disabled
          x-stainless-terraform-configurability: optional
      required:
        - guidanceDisabled
      additionalProperties: false
    svlog.events.EventType.GuidanceEnabled:
      type: object
      title: Guidance Enabled
      properties:
        guidanceEnabled:
          $ref: '#/components/schemas/svlog.events.GuidanceEnabledEvent'
          title: guidance_enabled
          x-stainless-terraform-configurability: optional
      required:
        - guidanceEnabled
      additionalProperties: false
    svlog.events.EventType.GuidanceUpdated:
      type: object
      title: Guidance Updated
      properties:
        guidanceUpdated:
          $ref: '#/components/schemas/svlog.events.GuidanceUpdatedEvent'
          title: guidance_updated
          x-stainless-terraform-configurability: optional
      required:
        - guidanceUpdated
      additionalProperties: false
    svlog.events.EventType.HelpAgentSimulationReply:
      type: object
      title: Help Agent Simulation Reply
      properties:
        helpAgentSimulationReply:
          $ref: '#/components/schemas/svlog.events.HelpAgentSimulationReplyEvent'
          title: help_agent_simulation_reply
          description: |-
            A simulated-user reply was sent into an interactive help-agent
             simulation — one record per message, for a who-sent-what trail.
          x-stainless-terraform-configurability: optional
      required:
        - helpAgentSimulationReply
      additionalProperties: false
      description: |-
        A simulated-user reply was sent into an interactive help-agent
         simulation — one record per message, for a who-sent-what trail.
    svlog.events.EventType.HelpAgentSimulationStarted:
      type: object
      title: Help Agent Simulation Started
      properties:
        helpAgentSimulationStarted:
          $ref: '#/components/schemas/svlog.events.HelpAgentSimulationStartedEvent'
          title: help_agent_simulation_started
          description: |-
            A help-agent simulation was started. Emitted for every start from
             svhelp's creation surfaces (user API, public API, Catalyst's private
             API); WARN when it exercised a privileged capability (impersonating
             another user and/or executing live workflows), INFO otherwise.
             Team-scoped; the caller is the actor, targeting the team and the run.
          x-stainless-terraform-configurability: optional
      required:
        - helpAgentSimulationStarted
      additionalProperties: false
      description: |-
        A help-agent simulation was started. Emitted for every start from
         svhelp's creation surfaces (user API, public API, Catalyst's private
         API); WARN when it exercised a privileged capability (impersonating
         another user and/or executing live workflows), INFO otherwise.
         Team-scoped; the caller is the actor, targeting the team and the run.
    svlog.events.EventType.ImpersonationSessionStarted:
      type: object
      title: Impersonation Session Started
      properties:
        impersonationSessionStarted:
          $ref: '#/components/schemas/svlog.events.ImpersonationSessionStartedEvent'
          title: impersonation_session_started
          x-stainless-terraform-configurability: optional
      required:
        - impersonationSessionStarted
      additionalProperties: false
    svlog.events.EventType.ImpersonationSessionTerminated:
      type: object
      title: Impersonation Session Terminated
      properties:
        impersonationSessionTerminated:
          $ref: >-
            #/components/schemas/svlog.events.ImpersonationSessionTerminatedEvent
          title: impersonation_session_terminated
          x-stainless-terraform-configurability: optional
      required:
        - impersonationSessionTerminated
      additionalProperties: false
    svlog.events.EventType.KnowledgeBaseArchived:
      type: object
      title: Knowledge Base Archived
      properties:
        knowledgeBaseArchived:
          $ref: '#/components/schemas/svlog.events.KnowledgeBaseArchivedEvent'
          title: knowledge_base_archived
          x-stainless-terraform-configurability: optional
      required:
        - knowledgeBaseArchived
      additionalProperties: false
    svlog.events.EventType.KnowledgeBaseCreated:
      type: object
      title: Knowledge Base Created
      properties:
        knowledgeBaseCreated:
          $ref: '#/components/schemas/svlog.events.KnowledgeBaseCreatedEvent'
          title: knowledge_base_created
          x-stainless-terraform-configurability: optional
      required:
        - knowledgeBaseCreated
      additionalProperties: false
    svlog.events.EventType.KnowledgeBaseDeleted:
      type: object
      title: Knowledge Base Deleted
      properties:
        knowledgeBaseDeleted:
          $ref: '#/components/schemas/svlog.events.KnowledgeBaseDeletedEvent'
          title: knowledge_base_deleted
          x-stainless-terraform-configurability: optional
      required:
        - knowledgeBaseDeleted
      additionalProperties: false
    svlog.events.EventType.KnowledgeBaseUpdated:
      type: object
      title: Knowledge Base Updated
      properties:
        knowledgeBaseUpdated:
          $ref: '#/components/schemas/svlog.events.KnowledgeBaseUpdatedEvent'
          title: knowledge_base_updated
          x-stainless-terraform-configurability: optional
      required:
        - knowledgeBaseUpdated
      additionalProperties: false
    svlog.events.EventType.KnowledgeDocumentAudienceUpdated:
      type: object
      title: Knowledge Document Audience Updated
      properties:
        knowledgeDocumentAudienceUpdated:
          $ref: >-
            #/components/schemas/svlog.events.KnowledgeDocumentAudienceUpdatedEvent
          title: knowledge_document_audience_updated
          x-stainless-terraform-configurability: optional
      required:
        - knowledgeDocumentAudienceUpdated
      additionalProperties: false
    svlog.events.EventType.KnowledgeDocumentCreated:
      type: object
      title: Knowledge Document Created
      properties:
        knowledgeDocumentCreated:
          $ref: '#/components/schemas/svlog.events.KnowledgeDocumentCreatedEvent'
          title: knowledge_document_created
          x-stainless-terraform-configurability: optional
      required:
        - knowledgeDocumentCreated
      additionalProperties: false
    svlog.events.EventType.KnowledgeDocumentPublished:
      type: object
      title: Knowledge Document Published
      properties:
        knowledgeDocumentPublished:
          $ref: '#/components/schemas/svlog.events.KnowledgeDocumentPublishedEvent'
          title: knowledge_document_published
          x-stainless-terraform-configurability: optional
      required:
        - knowledgeDocumentPublished
      additionalProperties: false
    svlog.events.EventType.LabelCreated:
      type: object
      title: Label Created
      properties:
        labelCreated:
          $ref: '#/components/schemas/svlog.events.LabelCreatedEvent'
          title: label_created
          x-stainless-terraform-configurability: optional
      required:
        - labelCreated
      additionalProperties: false
    svlog.events.EventType.LabelDeleted:
      type: object
      title: Label Deleted
      properties:
        labelDeleted:
          $ref: '#/components/schemas/svlog.events.LabelDeletedEvent'
          title: label_deleted
          x-stainless-terraform-configurability: optional
      required:
        - labelDeleted
      additionalProperties: false
    svlog.events.EventType.LabelUpdated:
      type: object
      title: Label Updated
      properties:
        labelUpdated:
          $ref: '#/components/schemas/svlog.events.LabelUpdatedEvent'
          title: label_updated
          x-stainless-terraform-configurability: optional
      required:
        - labelUpdated
      additionalProperties: false
    svlog.events.EventType.McpOauthAuthorized:
      type: object
      title: Mcp Oauth Authorized
      properties:
        mcpOauthAuthorized:
          $ref: '#/components/schemas/svlog.events.MCPOAuthAuthorizedEvent'
          title: mcp_oauth_authorized
          x-stainless-terraform-configurability: optional
      required:
        - mcpOauthAuthorized
      additionalProperties: false
    svlog.events.EventType.McpOauthDenied:
      type: object
      title: Mcp Oauth Denied
      properties:
        mcpOauthDenied:
          $ref: '#/components/schemas/svlog.events.MCPOAuthDeniedEvent'
          title: mcp_oauth_denied
          x-stainless-terraform-configurability: optional
      required:
        - mcpOauthDenied
      additionalProperties: false
    svlog.events.EventType.McpOauthTokenRevoked:
      type: object
      title: Mcp Oauth Token Revoked
      properties:
        mcpOauthTokenRevoked:
          $ref: '#/components/schemas/svlog.events.MCPOAuthTokenRevokedEvent'
          title: mcp_oauth_token_revoked
          x-stainless-terraform-configurability: optional
      required:
        - mcpOauthTokenRevoked
      additionalProperties: false
    svlog.events.EventType.OrgAuthzTeardown:
      type: object
      title: Org Authz Teardown
      properties:
        orgAuthzTeardown:
          $ref: '#/components/schemas/svlog.events.OrgAuthzTeardownEvent'
          title: org_authz_teardown
          description: |-
            svauth org offboarding: SpiceDB (authorization-engine) teardown at
             soft delete. The companion of org_sso_teardown for the SECOND
             external-trust surface severed at soft delete: the org's engine-held
             access facts (role grants/members, team role-bindings, group
             memberships) are deleted. Emitted from the
             OrganizationManager.TeardownAuthzRelationships seam; org-scoped (no
             team on the envelope). Carries ERROR on the Outcome when the
             teardown aborts partway, so a half-completed revocation is audited.
             Renumbered from 145 to 152: 145/146 were claimed by
             access_review_policy_created/updated on main while this branch was
             in flight — see the reservation note below.
          x-stainless-terraform-configurability: optional
      required:
        - orgAuthzTeardown
      additionalProperties: false
      description: |-
        svauth org offboarding: SpiceDB (authorization-engine) teardown at
         soft delete. The companion of org_sso_teardown for the SECOND
         external-trust surface severed at soft delete: the org's engine-held
         access facts (role grants/members, team role-bindings, group
         memberships) are deleted. Emitted from the
         OrganizationManager.TeardownAuthzRelationships seam; org-scoped (no
         team on the envelope). Carries ERROR on the Outcome when the
         teardown aborts partway, so a half-completed revocation is audited.
         Renumbered from 145 to 152: 145/146 were claimed by
         access_review_policy_created/updated on main while this branch was
         in flight — see the reservation note below.
    svlog.events.EventType.OrgLifecycleStateChanged:
      type: object
      title: Org Lifecycle State Changed
      properties:
        orgLifecycleStateChanged:
          $ref: '#/components/schemas/svlog.events.OrgLifecycleStateChangedEvent'
          title: org_lifecycle_state_changed
          description: |-
            svauth org offboarding lifecycle transition (pause / resume /
             soft-delete / restore / cold-store / purge). Emitted from the
             OrganizationManager transition seam; org-scoped (no team on the
             envelope). The free-text business reason lives in the
             org_lifecycle_events ledger, not this payload, so no PII reaches SIEM.
          x-stainless-terraform-configurability: optional
      required:
        - orgLifecycleStateChanged
      additionalProperties: false
      description: |-
        svauth org offboarding lifecycle transition (pause / resume /
         soft-delete / restore / cold-store / purge). Emitted from the
         OrganizationManager transition seam; org-scoped (no team on the
         envelope). The free-text business reason lives in the
         org_lifecycle_events ledger, not this payload, so no PII reaches SIEM.
    svlog.events.EventType.OrgProviderTrustRevoked:
      type: object
      title: Org Provider Trust Revoked
      properties:
        orgProviderTrustRevoked:
          $ref: '#/components/schemas/svlog.events.OrgProviderTrustRevokedEvent'
          title: org_provider_trust_revoked
          description: |-
            svflow org offboarding: provider OAuth-credential revocation at soft
             delete. The third external-trust surface severed alongside
             org_sso_teardown / org_authz_teardown: every team's app-instance
             OAuth credentials are revoked AT THE EXTERNAL PROVIDER (nothing
             local is deleted — the wipe happens at cold-store). Emitted once per
             org-level teardown pass from the
             integrationrevoke.Revoker.TeardownTrustForTeams seam; org-scoped (no
             team on the envelope). Carries ERROR on the Outcome when enumeration
             aborts the pass partway. Renumbered from 146 to 153 alongside
             org_authz_teardown above.
          x-stainless-terraform-configurability: optional
      required:
        - orgProviderTrustRevoked
      additionalProperties: false
      description: |-
        svflow org offboarding: provider OAuth-credential revocation at soft
         delete. The third external-trust surface severed alongside
         org_sso_teardown / org_authz_teardown: every team's app-instance
         OAuth credentials are revoked AT THE EXTERNAL PROVIDER (nothing
         local is deleted — the wipe happens at cold-store). Emitted once per
         org-level teardown pass from the
         integrationrevoke.Revoker.TeardownTrustForTeams seam; org-scoped (no
         team on the envelope). Carries ERROR on the Outcome when enumeration
         aborts the pass partway. Renumbered from 146 to 153 alongside
         org_authz_teardown above.
    svlog.events.EventType.OrgProvisioned:
      type: object
      title: Org Provisioned
      properties:
        orgProvisioned:
          $ref: '#/components/schemas/svlog.events.OrgProvisionedEvent'
          title: org_provisioned
          description: |-
            A Serval operator provisioned a new customer organization through
             the internal lifecycle console (org + first team + first admin,
             with a setup link issued to the admin). Org-scoped; the operator's
             svsupport-attested Okta identity is carried in the payload because
             svlog's Actor has no Okta-agent variant.
          x-stainless-terraform-configurability: optional
      required:
        - orgProvisioned
      additionalProperties: false
      description: |-
        A Serval operator provisioned a new customer organization through
         the internal lifecycle console (org + first team + first admin,
         with a setup link issued to the admin). Org-scoped; the operator's
         svsupport-attested Okta identity is carried in the payload because
         svlog's Actor has no Okta-agent variant.
    svlog.events.EventType.OrgProvisionedViaAccessCode:
      type: object
      title: Org Provisioned Via Access Code
      properties:
        orgProvisionedViaAccessCode:
          $ref: '#/components/schemas/svlog.events.OrgProvisionedViaAccessCodeEvent'
          title: org_provisioned_via_access_code
          x-stainless-terraform-configurability: optional
      required:
        - orgProvisionedViaAccessCode
      additionalProperties: false
    svlog.events.EventType.OrgRedactionPatternsChanged:
      type: object
      title: Org Redaction Patterns Changed
      properties:
        orgRedactionPatternsChanged:
          $ref: '#/components/schemas/svlog.events.OrgRedactionPatternsChangedEvent'
          title: org_redaction_patterns_changed
          description: >-
            svhelp org-admin custom redaction patterns: create/update/delete of
            a
             regex enforced on persisted ticket content (security-relevant).
          x-stainless-terraform-configurability: optional
      required:
        - orgRedactionPatternsChanged
      additionalProperties: false
      description: |-
        svhelp org-admin custom redaction patterns: create/update/delete of a
         regex enforced on persisted ticket content (security-relevant).
    svlog.events.EventType.OrgSettingsChanged:
      type: object
      title: Org Settings Changed
      properties:
        orgSettingsChanged:
          $ref: '#/components/schemas/svlog.events.OrgSettingsChangedEvent'
          title: org_settings_changed
          x-stainless-terraform-configurability: optional
      required:
        - orgSettingsChanged
      additionalProperties: false
    svlog.events.EventType.OrgSetupLinkResent:
      type: object
      title: Org Setup Link Resent
      properties:
        orgSetupLinkResent:
          $ref: '#/components/schemas/svlog.events.OrgSetupLinkResentEvent'
          title: org_setup_link_resent
          description: |-
            A Serval operator re-issued the first-admin setup link for an
             already-provisioned org whose original link expired. Org-scoped; the
             operator's svsupport-attested Okta identity is carried in the payload
             (svlog's Actor has no Okta-agent variant), mirroring org_provisioned.
          x-stainless-terraform-configurability: optional
      required:
        - orgSetupLinkResent
      additionalProperties: false
      description: |-
        A Serval operator re-issued the first-admin setup link for an
         already-provisioned org whose original link expired. Org-scoped; the
         operator's svsupport-attested Okta identity is carried in the payload
         (svlog's Actor has no Okta-agent variant), mirroring org_provisioned.
    svlog.events.EventType.OrgSsoTeardown:
      type: object
      title: Org Sso Teardown
      properties:
        orgSsoTeardown:
          $ref: '#/components/schemas/svlog.events.OrgSSOTeardownEvent'
          title: org_sso_teardown
          description: |-
            svauth org offboarding: irreversible WorkOS teardown. Distinct from
             org_lifecycle_state_changed (which records the state-machine move):
             this fires when the org's external identity-provider footprint is
             destroyed — its WorkOS SSO connections + Directory Sync directories,
             the WorkOS Organization itself, and the local Serval<->WorkOS mapping
             row (which also stops the SCIM delta-sync fan-out). Emitted from the
             OrganizationManager.TeardownWorkOS seam; org-scoped (no team on the
             envelope). Carries FAILURE/ERROR on the Outcome when the teardown
             aborts partway, so a half-completed destructive revocation is audited.
          x-stainless-terraform-configurability: optional
      required:
        - orgSsoTeardown
      additionalProperties: false
      description: |-
        svauth org offboarding: irreversible WorkOS teardown. Distinct from
         org_lifecycle_state_changed (which records the state-machine move):
         this fires when the org's external identity-provider footprint is
         destroyed — its WorkOS SSO connections + Directory Sync directories,
         the WorkOS Organization itself, and the local Serval<->WorkOS mapping
         row (which also stops the SCIM delta-sync fan-out). Emitted from the
         OrganizationManager.TeardownWorkOS seam; org-scoped (no team on the
         envelope). Carries FAILURE/ERROR on the Outcome when the teardown
         aborts partway, so a half-completed destructive revocation is audited.
    svlog.events.EventType.PermissionDenied:
      type: object
      title: Permission Denied
      properties:
        permissionDenied:
          $ref: '#/components/schemas/svlog.events.PermissionDeniedEvent'
          title: permission_denied
          description: |-
            Cross-cutting authorization denial. Unlike every variant above (each
             owned by one service's handlers), this fires from the shared svauth
             WithAuth seam that fronts every authenticated RPC across all
             services, so it is the single "who was REFUSED access to what" signal
             compliance reviews key on. The actor is on the envelope; the payload
             carries the attempted action + the resource (team/org) the check ran
             against. Always DENIED on the Outcome.
          x-stainless-terraform-configurability: optional
      required:
        - permissionDenied
      additionalProperties: false
      description: |-
        Cross-cutting authorization denial. Unlike every variant above (each
         owned by one service's handlers), this fires from the shared svauth
         WithAuth seam that fronts every authenticated RPC across all
         services, so it is the single "who was REFUSED access to what" signal
         compliance reviews key on. The actor is on the envelope; the payload
         carries the attempted action + the resource (team/org) the check ran
         against. Always DENIED on the Outcome.
    svlog.events.EventType.QueueCreated:
      type: object
      title: Queue Created
      properties:
        queueCreated:
          $ref: '#/components/schemas/svlog.events.QueueCreatedEvent'
          title: queue_created
          x-stainless-terraform-configurability: optional
      required:
        - queueCreated
      additionalProperties: false
    svlog.events.EventType.QueueDeleted:
      type: object
      title: Queue Deleted
      properties:
        queueDeleted:
          $ref: '#/components/schemas/svlog.events.QueueDeletedEvent'
          title: queue_deleted
          x-stainless-terraform-configurability: optional
      required:
        - queueDeleted
      additionalProperties: false
    svlog.events.EventType.QueueUpdated:
      type: object
      title: Queue Updated
      properties:
        queueUpdated:
          $ref: '#/components/schemas/svlog.events.QueueUpdatedEvent'
          title: queue_updated
          x-stainless-terraform-configurability: optional
      required:
        - queueUpdated
      additionalProperties: false
    svlog.events.EventType.RoutingRuleCreated:
      type: object
      title: Routing Rule Created
      properties:
        routingRuleCreated:
          $ref: '#/components/schemas/svlog.events.RoutingRuleCreatedEvent'
          title: routing_rule_created
          x-stainless-terraform-configurability: optional
      required:
        - routingRuleCreated
      additionalProperties: false
    svlog.events.EventType.RoutingRuleDeleted:
      type: object
      title: Routing Rule Deleted
      properties:
        routingRuleDeleted:
          $ref: '#/components/schemas/svlog.events.RoutingRuleDeletedEvent'
          title: routing_rule_deleted
          x-stainless-terraform-configurability: optional
      required:
        - routingRuleDeleted
      additionalProperties: false
    svlog.events.EventType.RoutingRuleUpdated:
      type: object
      title: Routing Rule Updated
      properties:
        routingRuleUpdated:
          $ref: '#/components/schemas/svlog.events.RoutingRuleUpdatedEvent'
          title: routing_rule_updated
          x-stainless-terraform-configurability: optional
      required:
        - routingRuleUpdated
      additionalProperties: false
    svlog.events.EventType.SimulationConfigCreated:
      type: object
      title: Simulation Config Created
      properties:
        simulationConfigCreated:
          $ref: '#/components/schemas/svlog.events.SimulationConfigCreatedEvent'
          title: simulation_config_created
          description: |-
            svhelp saved simulation configs (versioned help-agent scenarios).
             Config CRUD is audited like the other help-desk configuration above;
             simulation RUNS are operational executions and intentionally are not.
          x-stainless-terraform-configurability: optional
      required:
        - simulationConfigCreated
      additionalProperties: false
      description: |-
        svhelp saved simulation configs (versioned help-agent scenarios).
         Config CRUD is audited like the other help-desk configuration above;
         simulation RUNS are operational executions and intentionally are not.
    svlog.events.EventType.SimulationConfigDeleted:
      type: object
      title: Simulation Config Deleted
      properties:
        simulationConfigDeleted:
          $ref: '#/components/schemas/svlog.events.SimulationConfigDeletedEvent'
          title: simulation_config_deleted
          x-stainless-terraform-configurability: optional
      required:
        - simulationConfigDeleted
      additionalProperties: false
    svlog.events.EventType.SimulationConfigUpdated:
      type: object
      title: Simulation Config Updated
      properties:
        simulationConfigUpdated:
          $ref: '#/components/schemas/svlog.events.SimulationConfigUpdatedEvent'
          title: simulation_config_updated
          x-stainless-terraform-configurability: optional
      required:
        - simulationConfigUpdated
      additionalProperties: false
    svlog.events.EventType.SlaDefinitionCreated:
      type: object
      title: Sla Definition Created
      properties:
        slaDefinitionCreated:
          $ref: '#/components/schemas/svlog.events.SlaDefinitionCreatedEvent'
          title: sla_definition_created
          description: |-
            svhelp help-desk configuration lifecycle — first audit coverage wave
             for the admin config entities (SLA definitions, routing rules,
             queues, label options, category options). These CRUD actions
             previously emitted no org-level audit event; they sit alongside the
             already-audited email_intake_config_* events as the rest of svhelp's
             admin config surface. Emitted from svhelp's user-API handlers, where
             the acting user is resolved from the request and the team scope is
             the entity's team. Each carries SUCCESS on the envelope (these
             handler seams only emit after the mutation commits). Per-ticket label
             add/remove and the per-condition / per-action sub-entities
             (SlaCondition, SlaActionDefinition, RoutingRuleCondition/Action) are
             intentionally NOT audited — ticket-level / too granular; the parent
             definition create/update covers the meaningful governance change.
          x-stainless-terraform-configurability: optional
      required:
        - slaDefinitionCreated
      additionalProperties: false
      description: |-
        svhelp help-desk configuration lifecycle — first audit coverage wave
         for the admin config entities (SLA definitions, routing rules,
         queues, label options, category options). These CRUD actions
         previously emitted no org-level audit event; they sit alongside the
         already-audited email_intake_config_* events as the rest of svhelp's
         admin config surface. Emitted from svhelp's user-API handlers, where
         the acting user is resolved from the request and the team scope is
         the entity's team. Each carries SUCCESS on the envelope (these
         handler seams only emit after the mutation commits). Per-ticket label
         add/remove and the per-condition / per-action sub-entities
         (SlaCondition, SlaActionDefinition, RoutingRuleCondition/Action) are
         intentionally NOT audited — ticket-level / too granular; the parent
         definition create/update covers the meaningful governance change.
    svlog.events.EventType.SlaDefinitionDeleted:
      type: object
      title: Sla Definition Deleted
      properties:
        slaDefinitionDeleted:
          $ref: '#/components/schemas/svlog.events.SlaDefinitionDeletedEvent'
          title: sla_definition_deleted
          x-stainless-terraform-configurability: optional
      required:
        - slaDefinitionDeleted
      additionalProperties: false
    svlog.events.EventType.SlaDefinitionUpdated:
      type: object
      title: Sla Definition Updated
      properties:
        slaDefinitionUpdated:
          $ref: '#/components/schemas/svlog.events.SlaDefinitionUpdatedEvent'
          title: sla_definition_updated
          x-stainless-terraform-configurability: optional
      required:
        - slaDefinitionUpdated
      additionalProperties: false
    svlog.events.EventType.SsoConfigChanged:
      type: object
      title: Sso Config Changed
      properties:
        ssoConfigChanged:
          $ref: '#/components/schemas/svlog.events.SSOConfigChangedEvent'
          title: sso_config_changed
          x-stainless-terraform-configurability: optional
      required:
        - ssoConfigChanged
      additionalProperties: false
    svlog.events.EventType.TeamCatalystSettingsChanged:
      type: object
      title: Team Catalyst Settings Changed
      properties:
        teamCatalystSettingsChanged:
          $ref: '#/components/schemas/svlog.events.TeamCatalystSettingsChangedEvent'
          title: team_catalyst_settings_changed
          description: |-
            svmeta team-level Catalyst settings (default worker mode, publish
             review policy).
          x-stainless-terraform-configurability: optional
      required:
        - teamCatalystSettingsChanged
      additionalProperties: false
      description: |-
        svmeta team-level Catalyst settings (default worker mode, publish
         review policy).
    svlog.events.EventType.TeamCreated:
      type: object
      title: Team Created
      properties:
        teamCreated:
          $ref: '#/components/schemas/svlog.events.TeamCreatedEvent'
          title: team_created
          description: |-
            Identity & RBAC change coverage (svauth org-admin surface).
             team_created / team_deleted are wired end-to-end; the rest are
             forward-declared and wired in fast-follows.
          x-stainless-terraform-configurability: optional
      required:
        - teamCreated
      additionalProperties: false
      description: |-
        Identity & RBAC change coverage (svauth org-admin surface).
         team_created / team_deleted are wired end-to-end; the rest are
         forward-declared and wired in fast-follows.
    svlog.events.EventType.TeamDefaultAssigneesChanged:
      type: object
      title: Team Default Assignees Changed
      properties:
        teamDefaultAssigneesChanged:
          $ref: '#/components/schemas/svlog.events.TeamDefaultAssigneesChangedEvent'
          title: team_default_assignees_changed
          x-stainless-terraform-configurability: optional
      required:
        - teamDefaultAssigneesChanged
      additionalProperties: false
    svlog.events.EventType.TeamDeleted:
      type: object
      title: Team Deleted
      properties:
        teamDeleted:
          $ref: '#/components/schemas/svlog.events.TeamDeletedEvent'
          title: team_deleted
          x-stainless-terraform-configurability: optional
      required:
        - teamDeleted
      additionalProperties: false
    svlog.events.EventType.TeamOverrideApproverDecision:
      type: object
      title: Team Override Approver Decision
      properties:
        teamOverrideApproverDecision:
          $ref: '#/components/schemas/svlog.events.TeamOverrideApproverDecisionEvent'
          title: team_override_approver_decision
          description: svflow approval override break-glass
          x-stainless-terraform-configurability: optional
      required:
        - teamOverrideApproverDecision
      additionalProperties: false
      description: svflow approval override break-glass
    svlog.events.EventType.TeamUpdated:
      type: object
      title: Team Updated
      properties:
        teamUpdated:
          $ref: '#/components/schemas/svlog.events.TeamUpdatedEvent'
          title: team_updated
          x-stainless-terraform-configurability: optional
      required:
        - teamUpdated
      additionalProperties: false
    svlog.events.EventType.TicketAssigned:
      type: object
      title: Ticket Assigned
      properties:
        ticketAssigned:
          $ref: '#/components/schemas/svlog.events.TicketAssignedEvent'
          title: ticket_assigned
          x-stainless-terraform-configurability: optional
      required:
        - ticketAssigned
      additionalProperties: false
    svlog.events.EventType.TicketDeleted:
      type: object
      title: Ticket Deleted
      properties:
        ticketDeleted:
          $ref: '#/components/schemas/svlog.events.TicketDeletedEvent'
          title: ticket_deleted
          x-stainless-terraform-configurability: optional
      required:
        - ticketDeleted
      additionalProperties: false
    svlog.events.EventType.TicketEscalated:
      type: object
      title: Ticket Escalated
      properties:
        ticketEscalated:
          $ref: '#/components/schemas/svlog.events.TicketEscalatedEvent'
          title: ticket_escalated
          x-stainless-terraform-configurability: optional
      required:
        - ticketEscalated
      additionalProperties: false
    svlog.events.EventType.TicketLabelAdded:
      type: object
      title: Ticket Label Added
      properties:
        ticketLabelAdded:
          $ref: '#/components/schemas/svlog.events.TicketLabelAddedEvent'
          title: ticket_label_added
          description: |-
            Per-ticket label application by a human agent. The AI/worker
             auto-categorizer applies the same labels through the shared
             TicketManager methods, but those system-actor emits are suppressed
             (same high-volume telemetry concern as ticket_viewed) — only
             user-initiated label changes are audited here.
          x-stainless-terraform-configurability: optional
      required:
        - ticketLabelAdded
      additionalProperties: false
      description: |-
        Per-ticket label application by a human agent. The AI/worker
         auto-categorizer applies the same labels through the shared
         TicketManager methods, but those system-actor emits are suppressed
         (same high-volume telemetry concern as ticket_viewed) — only
         user-initiated label changes are audited here.
    svlog.events.EventType.TicketLabelRemoved:
      type: object
      title: Ticket Label Removed
      properties:
        ticketLabelRemoved:
          $ref: '#/components/schemas/svlog.events.TicketLabelRemovedEvent'
          title: ticket_label_removed
          x-stainless-terraform-configurability: optional
      required:
        - ticketLabelRemoved
      additionalProperties: false
    svlog.events.EventType.TicketModelCreated:
      type: object
      title: Ticket Model Created
      properties:
        ticketModelCreated:
          $ref: '#/components/schemas/svlog.events.TicketModelCreatedEvent'
          title: ticket_model_created
          description: |-
            svhelp ticket-model (change models + custom ticket types) authoring.
             A ticket model defines a ticket type's status lifecycle, transition
             rules, entry-action workflows, and custom fields, so create/update/
             delete of one is a material governance change to how a whole class of
             tickets is triaged and automated. Emitted from the changemodel state
             manager so both the settings user API and the Catalyst public API are
             covered by one seam. ticket_model_updated covers any configuration
             mutation (header rename, lifecycle, transitions, preconditions,
             entry actions) on an existing model.
          x-stainless-terraform-configurability: optional
      required:
        - ticketModelCreated
      additionalProperties: false
      description: |-
        svhelp ticket-model (change models + custom ticket types) authoring.
         A ticket model defines a ticket type's status lifecycle, transition
         rules, entry-action workflows, and custom fields, so create/update/
         delete of one is a material governance change to how a whole class of
         tickets is triaged and automated. Emitted from the changemodel state
         manager so both the settings user API and the Catalyst public API are
         covered by one seam. ticket_model_updated covers any configuration
         mutation (header rename, lifecycle, transitions, preconditions,
         entry actions) on an existing model.
    svlog.events.EventType.TicketModelDeleted:
      type: object
      title: Ticket Model Deleted
      properties:
        ticketModelDeleted:
          $ref: '#/components/schemas/svlog.events.TicketModelDeletedEvent'
          title: ticket_model_deleted
          x-stainless-terraform-configurability: optional
      required:
        - ticketModelDeleted
      additionalProperties: false
    svlog.events.EventType.TicketModelUpdated:
      type: object
      title: Ticket Model Updated
      properties:
        ticketModelUpdated:
          $ref: '#/components/schemas/svlog.events.TicketModelUpdatedEvent'
          title: ticket_model_updated
          x-stainless-terraform-configurability: optional
      required:
        - ticketModelUpdated
      additionalProperties: false
    svlog.events.EventType.TicketOwningGroupChanged:
      type: object
      title: Ticket Owning Group Changed
      properties:
        ticketOwningGroupChanged:
          $ref: '#/components/schemas/svlog.events.TicketOwningGroupChangedEvent'
          title: ticket_owning_group_changed
          description: |-
            svhelp ticket owning ("assignment") group set/cleared/reassigned —
             ownership is security-relevant independent of the AI/HUMAN escalation
             level, so it is audited even when the level is unchanged.
          x-stainless-terraform-configurability: optional
      required:
        - ticketOwningGroupChanged
      additionalProperties: false
      description: |-
        svhelp ticket owning ("assignment") group set/cleared/reassigned —
         ownership is security-relevant independent of the AI/HUMAN escalation
         level, so it is audited even when the level is unchanged.
    svlog.events.EventType.TicketPermanentlyDeleted:
      type: object
      title: Ticket Permanently Deleted
      properties:
        ticketPermanentlyDeleted:
          $ref: '#/components/schemas/svlog.events.TicketPermanentlyDeletedEvent'
          title: ticket_permanently_deleted
          x-stainless-terraform-configurability: optional
      required:
        - ticketPermanentlyDeleted
      additionalProperties: false
    svlog.events.EventType.TicketPriorityChanged:
      type: object
      title: Ticket Priority Changed
      properties:
        ticketPriorityChanged:
          $ref: '#/components/schemas/svlog.events.TicketPriorityChangedEvent'
          title: ticket_priority_changed
          x-stainless-terraform-configurability: optional
      required:
        - ticketPriorityChanged
      additionalProperties: false
    svlog.events.EventType.TicketStatusChanged:
      type: object
      title: Ticket Status Changed
      properties:
        ticketStatusChanged:
          $ref: '#/components/schemas/svlog.events.TicketStatusChangedEvent'
          title: ticket_status_changed
          description: |-
            Ticket state-change events (first coverage wave). These actions
             were previously only recorded in svhelp-local *_events tables and
             never surfaced at the org level. Each carries its Outcome on the
             envelope (incl. DENIED/FAILURE on rejected attempts).
          x-stainless-terraform-configurability: optional
      required:
        - ticketStatusChanged
      additionalProperties: false
      description: |-
        Ticket state-change events (first coverage wave). These actions
         were previously only recorded in svhelp-local *_events tables and
         never surfaced at the org level. Each carries its Outcome on the
         envelope (incl. DENIED/FAILURE on rejected attempts).
    svlog.events.EventType.TicketTeamChanged:
      type: object
      title: Ticket Team Changed
      properties:
        ticketTeamChanged:
          $ref: '#/components/schemas/svlog.events.TicketTeamChangedEvent'
          title: ticket_team_changed
          x-stainless-terraform-configurability: optional
      required:
        - ticketTeamChanged
      additionalProperties: false
    svlog.events.EventType.TicketTrashed:
      type: object
      title: Ticket Trashed
      properties:
        ticketTrashed:
          $ref: '#/components/schemas/svlog.events.TicketTrashedEvent'
          title: ticket_trashed
          description: |-
            Canonical declarations for in-flight coverage PRs. The emit wiring
             lands in those PRs; the variants are declared here so field numbers
             are disjoint across the three (they otherwise collide at 65-68) and
             the audit-equivalence registry can catalog them now.
             svhelp ticket trash lifecycle (#12528)
          x-stainless-terraform-configurability: optional
      required:
        - ticketTrashed
      additionalProperties: false
      description: |-
        Canonical declarations for in-flight coverage PRs. The emit wiring
         lands in those PRs; the variants are declared here so field numbers
         are disjoint across the three (they otherwise collide at 65-68) and
         the audit-equivalence registry can catalog them now.
         svhelp ticket trash lifecycle (#12528)
    svlog.events.EventType.TicketTypeChanged:
      type: object
      title: Ticket Type Changed
      properties:
        ticketTypeChanged:
          $ref: '#/components/schemas/svlog.events.TicketTypeChangedEvent'
          title: ticket_type_changed
          description: >-
            svhelp ticket type/classification change (e.g. request -> incident
            ->
             major_incident). System-driven today — the update-ticket-type
             workflow action and the AI type-inference activity both run as the
             system user — but a reclassification changes how a ticket is triaged
             and reported, a material, security-relevant change audited alongside
             status/priority changes.
          x-stainless-terraform-configurability: optional
      required:
        - ticketTypeChanged
      additionalProperties: false
      description: |-
        svhelp ticket type/classification change (e.g. request -> incident ->
         major_incident). System-driven today — the update-ticket-type
         workflow action and the AI type-inference activity both run as the
         system user — but a reclassification changes how a ticket is triaged
         and reported, a material, security-relevant change audited alongside
         status/priority changes.
    svlog.events.EventType.TicketUntrashed:
      type: object
      title: Ticket Untrashed
      properties:
        ticketUntrashed:
          $ref: '#/components/schemas/svlog.events.TicketUntrashedEvent'
          title: ticket_untrashed
          x-stainless-terraform-configurability: optional
      required:
        - ticketUntrashed
      additionalProperties: false
    svlog.events.EventType.TicketViewed:
      type: object
      title: Ticket Viewed
      properties:
        ticketViewed:
          $ref: '#/components/schemas/svlog.events.TicketViewedEvent'
          title: ticket_viewed
          x-stainless-terraform-configurability: optional
      required:
        - ticketViewed
      additionalProperties: false
    svlog.events.EventType.UserAddedToTeam:
      type: object
      title: User Added To Team
      properties:
        userAddedToTeam:
          $ref: '#/components/schemas/svlog.events.UserAddedToTeamEvent'
          title: user_added_to_team
          x-stainless-terraform-configurability: optional
      required:
        - userAddedToTeam
      additionalProperties: false
    svlog.events.EventType.UserAuthMethodUpdated:
      type: object
      title: User Auth Method Updated
      properties:
        userAuthMethodUpdated:
          $ref: '#/components/schemas/svlog.events.UserAuthMethodUpdatedEvent'
          title: user_auth_method_updated
          x-stainless-terraform-configurability: optional
      required:
        - userAuthMethodUpdated
      additionalProperties: false
    svlog.events.EventType.UserCreated:
      type: object
      title: User Created
      properties:
        userCreated:
          $ref: '#/components/schemas/svlog.events.UserCreatedEvent'
          title: user_created
          x-stainless-terraform-configurability: optional
      required:
        - userCreated
      additionalProperties: false
    svlog.events.EventType.UserDeactivated:
      type: object
      title: User Deactivated
      properties:
        userDeactivated:
          $ref: '#/components/schemas/svlog.events.UserDeactivatedEvent'
          title: user_deactivated
          x-stainless-terraform-configurability: optional
      required:
        - userDeactivated
      additionalProperties: false
    svlog.events.EventType.UserInvited:
      type: object
      title: User Invited
      properties:
        userInvited:
          $ref: '#/components/schemas/svlog.events.UserInvitedEvent'
          title: user_invited
          x-stainless-terraform-configurability: optional
      required:
        - userInvited
      additionalProperties: false
    svlog.events.EventType.UserLogin:
      type: object
      title: User Login
      properties:
        userLogin:
          $ref: '#/components/schemas/svlog.events.UserLoginEvent'
          title: user_login
          description: >-
            svauth Tier-1 authentication / session events. Emitted at svauth's
            own
             RPC-handler boundary (Login / FinalizeSession / Logout), NOT inside the
             vendored authenticate clone. user_login_failed carries the attempted
             identity (email only, no resolved user id) since the actor is
             unauthenticated; its Outcome is DENIED (deactivated / password-login
             disabled) or FAILURE (bad credentials / invalid token).
          x-stainless-terraform-configurability: optional
      required:
        - userLogin
      additionalProperties: false
      description: |-
        svauth Tier-1 authentication / session events. Emitted at svauth's own
         RPC-handler boundary (Login / FinalizeSession / Logout), NOT inside the
         vendored authenticate clone. user_login_failed carries the attempted
         identity (email only, no resolved user id) since the actor is
         unauthenticated; its Outcome is DENIED (deactivated / password-login
         disabled) or FAILURE (bad credentials / invalid token).
    svlog.events.EventType.UserLoginFailed:
      type: object
      title: User Login Failed
      properties:
        userLoginFailed:
          $ref: '#/components/schemas/svlog.events.UserLoginFailedEvent'
          title: user_login_failed
          x-stainless-terraform-configurability: optional
      required:
        - userLoginFailed
      additionalProperties: false
    svlog.events.EventType.UserLogout:
      type: object
      title: User Logout
      properties:
        userLogout:
          $ref: '#/components/schemas/svlog.events.UserLogoutEvent'
          title: user_logout
          x-stainless-terraform-configurability: optional
      required:
        - userLogout
      additionalProperties: false
    svlog.events.EventType.UserMfaEnrolled:
      type: object
      title: User Mfa Enrolled
      properties:
        userMfaEnrolled:
          $ref: '#/components/schemas/svlog.events.UserMFAEnrolledEvent'
          title: user_mfa_enrolled
          x-stainless-terraform-configurability: optional
      required:
        - userMfaEnrolled
      additionalProperties: false
    svlog.events.EventType.UserOrganizationRoleChanged:
      type: object
      title: User Organization Role Changed
      properties:
        userOrganizationRoleChanged:
          $ref: '#/components/schemas/svlog.events.UserOrganizationRoleChangedEvent'
          title: user_organization_role_changed
          x-stainless-terraform-configurability: optional
      required:
        - userOrganizationRoleChanged
      additionalProperties: false
    svlog.events.EventType.UserPasswordChanged:
      type: object
      title: User Password Changed
      properties:
        userPasswordChanged:
          $ref: '#/components/schemas/svlog.events.UserPasswordChangedEvent'
          title: user_password_changed
          description: >-
            svauth account-security events, bridged from the vendored
            authenticate
             (gotrue) service's auth.audit_log_entries table by a Temporal cron tail
             (internal/auditbridge), NOT emitted from the authenticate clone itself.
             Each is a recorded, completed action (Outcome = SUCCESS); the actor is
             the user themselves, resolved per-org from auth.users.id →
             users.auth_user_id (one event per associated active org-user).
          x-stainless-terraform-configurability: optional
      required:
        - userPasswordChanged
      additionalProperties: false
      description: |-
        svauth account-security events, bridged from the vendored authenticate
         (gotrue) service's auth.audit_log_entries table by a Temporal cron tail
         (internal/auditbridge), NOT emitted from the authenticate clone itself.
         Each is a recorded, completed action (Outcome = SUCCESS); the actor is
         the user themselves, resolved per-org from auth.users.id →
         users.auth_user_id (one event per associated active org-user).
    svlog.events.EventType.UserRemovedFromTeam:
      type: object
      title: User Removed From Team
      properties:
        userRemovedFromTeam:
          $ref: '#/components/schemas/svlog.events.UserRemovedFromTeamEvent'
          title: user_removed_from_team
          x-stainless-terraform-configurability: optional
      required:
        - userRemovedFromTeam
      additionalProperties: false
    svlog.events.EventType.UserSessionRevoked:
      type: object
      title: User Session Revoked
      properties:
        userSessionRevoked:
          $ref: '#/components/schemas/svlog.events.UserSessionRevokedEvent'
          title: user_session_revoked
          x-stainless-terraform-configurability: optional
      required:
        - userSessionRevoked
      additionalProperties: false
    svlog.events.EventType.UserTeamRoleChanged:
      type: object
      title: User Team Role Changed
      properties:
        userTeamRoleChanged:
          $ref: '#/components/schemas/svlog.events.UserTeamRoleChangedEvent'
          title: user_team_role_changed
          x-stainless-terraform-configurability: optional
      required:
        - userTeamRoleChanged
      additionalProperties: false
    svlog.events.EventType.WidgetCreated:
      type: object
      title: Widget Created
      properties:
        widgetCreated:
          $ref: '#/components/schemas/svlog.events.WidgetCreatedEvent'
          title: widget_created
          x-stainless-terraform-configurability: optional
      required:
        - widgetCreated
      additionalProperties: false
    svlog.events.EventType.WidgetDeleted:
      type: object
      title: Widget Deleted
      properties:
        widgetDeleted:
          $ref: '#/components/schemas/svlog.events.WidgetDeletedEvent'
          title: widget_deleted
          x-stainless-terraform-configurability: optional
      required:
        - widgetDeleted
      additionalProperties: false
    svlog.events.EventType.WidgetUpdated:
      type: object
      title: Widget Updated
      properties:
        widgetUpdated:
          $ref: '#/components/schemas/svlog.events.WidgetUpdatedEvent'
          title: widget_updated
          x-stainless-terraform-configurability: optional
      required:
        - widgetUpdated
      additionalProperties: false
    svlog.events.EventType.WorkflowCreated:
      type: object
      title: Workflow Created
      properties:
        workflowCreated:
          $ref: '#/components/schemas/svlog.events.WorkflowCreatedEvent'
          title: workflow_created
          x-stainless-terraform-configurability: optional
      required:
        - workflowCreated
      additionalProperties: false
    svlog.events.EventType.WorkflowDeleted:
      type: object
      title: Workflow Deleted
      properties:
        workflowDeleted:
          $ref: '#/components/schemas/svlog.events.WorkflowDeletedEvent'
          title: workflow_deleted
          x-stainless-terraform-configurability: optional
      required:
        - workflowDeleted
      additionalProperties: false
    svlog.events.EventType.WorkflowDisabled:
      type: object
      title: Workflow Disabled
      properties:
        workflowDisabled:
          $ref: '#/components/schemas/svlog.events.WorkflowDisabledEvent'
          title: workflow_disabled
          x-stainless-terraform-configurability: optional
      required:
        - workflowDisabled
      additionalProperties: false
    svlog.events.EventType.WorkflowEnabled:
      type: object
      title: Workflow Enabled
      properties:
        workflowEnabled:
          $ref: '#/components/schemas/svlog.events.WorkflowEnabledEvent'
          title: workflow_enabled
          description: svflow workflow / guidance enable-disable (#12592)
          x-stainless-terraform-configurability: optional
      required:
        - workflowEnabled
      additionalProperties: false
      description: svflow workflow / guidance enable-disable (#12592)
    svlog.events.EventType.WorkflowPublished:
      type: object
      title: Workflow Published
      properties:
        workflowPublished:
          $ref: '#/components/schemas/svlog.events.WorkflowPublishedEvent'
          title: workflow_published
          x-stainless-terraform-configurability: optional
      required:
        - workflowPublished
      additionalProperties: false
    svlog.events.EventType.WorkflowRunRequested:
      type: object
      title: Workflow Run Requested
      properties:
        workflowRunRequested:
          $ref: '#/components/schemas/svlog.events.WorkflowRunRequestedEvent'
          title: workflow_run_requested
          x-stainless-terraform-configurability: optional
      required:
        - workflowRunRequested
      additionalProperties: false
    svlog.events.EventType.WorkflowRunStarted:
      type: object
      title: Workflow Run Started
      properties:
        workflowRunStarted:
          $ref: '#/components/schemas/svlog.events.WorkflowRunStartedEvent'
          title: workflow_run_started
          x-stainless-terraform-configurability: optional
      required:
        - workflowRunStarted
      additionalProperties: false
    svlog.events.EventType.WorkflowUpdated:
      type: object
      title: Workflow Updated
      properties:
        workflowUpdated:
          $ref: '#/components/schemas/svlog.events.WorkflowUpdatedEvent'
          title: workflow_updated
          x-stainless-terraform-configurability: optional
      required:
        - workflowUpdated
      additionalProperties: false
    svlog.events.Outcome.Status:
      type: string
      title: Status
      enum:
        - STATUS_UNSPECIFIED
        - STATUS_SUCCESS
        - STATUS_FAILURE
        - STATUS_DENIED
        - STATUS_ERROR
      description: |-
        STATUS_SUCCESS: completed with its intended effect.
         STATUS_FAILURE: attempted, validly rejected for a business / validation
                         / conflict reason (the actor's input; deterministic,
                         4xx-shaped).
         STATUS_DENIED:  rejected by authorization / policy (security-relevant —
                         the status compliance reviews care about most).
         STATUS_ERROR:   unexpected internal / system fault (our fault,
                         5xx-shaped) — distinguishes a real denied/failed attempt
                         from a transient glitch.
    svauth.models.ApiKeyActor:
      type: object
      properties:
        displayName:
          type: string
          title: display_name
          description: Use to simplify display / export for audit logs
          x-stainless-terraform-configurability: optional
      title: ApiKeyActor
      additionalProperties: false
    svauth.models.ImpersonatedUserActor:
      type: object
      properties:
        displayName:
          type: string
          title: display_name
          description: Use to simplify display / export for audit logs
          x-stainless-terraform-configurability: optional
        email:
          type: string
          title: email
          x-stainless-terraform-configurability: optional
        name:
          type: string
          title: name
          x-stainless-terraform-configurability: optional
        supportAgentId:
          type: string
          title: support_agent_id
          description: Okta ID of the support agent
          x-stainless-terraform-configurability: optional
        supportAgentEmail:
          type: string
          title: support_agent_email
          description: Email of the support agent
          x-stainless-terraform-configurability: optional
        supportTokenId:
          type: string
          title: support_token_id
          description: ID of the support token used for impersonation
          x-stainless-terraform-configurability: optional
      title: ImpersonatedUserActor
      additionalProperties: false
      description: >-
        ImpersonatedUserActor represents actions taken by a support agent on
        behalf of a user.
         The user fields (display_name, email, name) describe the impersonated customer,
         while the support_agent_* fields identify the support agent performing the action.
    svauth.models.SystemActor:
      type: object
      properties:
        displayName:
          type: string
          title: display_name
          description: Use to simplify display / export for audit logs
          x-stainless-terraform-configurability: optional
      title: SystemActor
      additionalProperties: false
    svauth.models.UserActor:
      type: object
      properties:
        displayName:
          type: string
          title: display_name
          description: Use to simplify display / export for audit logs
          x-stainless-terraform-configurability: optional
        email:
          type: string
          title: email
          x-stainless-terraform-configurability: optional
        name:
          type: string
          title: name
          x-stainless-terraform-configurability: optional
      title: UserActor
      additionalProperties: false
    svauth.models.WorkerActor:
      type: object
      properties:
        displayName:
          type: string
          title: display_name
          description: Use to simplify display / export for audit logs
          x-stainless-terraform-configurability: optional
      title: WorkerActor
      additionalProperties: false
    svlog.events.AccessDeprovisionedEvent:
      type: object
      properties:
        accessRequest:
          $ref: '#/components/schemas/svlog.events.AccessRequest'
          title: access_request
          description: metadata, not a SIEM target
          x-stainless-terraform-configurability: optional
        entitlement:
          $ref: '#/components/schemas/svlog.events.Entitlement'
          title: entitlement
          x-stainless-terraform-configurability: optional
        resource:
          $ref: '#/components/schemas/svlog.events.Resource'
          title: resource
          x-stainless-terraform-configurability: optional
        user:
          $ref: '#/components/schemas/svlog.events.User'
          title: user
          description: The user whose access was removed
          x-stainless-terraform-configurability: optional
        reason:
          type: string
          title: reason
          description: Optional free-form reason (e.g., "expired", "revoked")
          x-stainless-terraform-configurability: optional
        ticket:
          $ref: '#/components/schemas/svlog.events.Ticket'
          title: ticket
          description: metadata, not a SIEM target
          x-stainless-terraform-configurability: optional
        accessReviewRemediationAction:
          $ref: '#/components/schemas/svlog.events.AccessReviewRemediationAction'
          title: access_review_remediation_action
          description: |-
            Set when this deprovisioning was driven by a UAR remediation action.
             Discriminates UAR-driven vs user-driven deprov in the audit feed. metadata, not a SIEM target
          x-stainless-terraform-configurability: optional
      title: AccessDeprovisionedEvent
      additionalProperties: false
      description: Emitted when a user's access has been deprovisioned for an entitlement
    svlog.events.AccessPolicyApprovalProcedureCreatedEvent:
      type: object
      properties:
        accessPolicy:
          $ref: '#/components/schemas/svlog.events.AccessPolicy'
          title: access_policy
          x-stainless-terraform-configurability: optional
        approvalProcedureId:
          type: string
          title: approval_procedure_id
          x-stainless-terraform-configurability: optional
        stepCount:
          type: integer
          title: step_count
          format: int32
          description: Number of approval steps configured.
          x-stainless-terraform-configurability: optional
      title: AccessPolicyApprovalProcedureCreatedEvent
      additionalProperties: false
      description: >-
        Approval-procedure lifecycle on an access policy (the 0-or-1 approval
        gate
         that access requests under the policy must pass). The policy CRUD events
         above don't cover it: the procedure is a separate svflow resource, so its
         mutations previously left no audit trail even though they change who can
         approve access.
    svlog.events.AccessPolicyApprovalProcedureDeletedEvent:
      type: object
      properties:
        accessPolicy:
          $ref: '#/components/schemas/svlog.events.AccessPolicy'
          title: access_policy
          x-stainless-terraform-configurability: optional
        approvalProcedureId:
          type: string
          title: approval_procedure_id
          x-stainless-terraform-configurability: optional
      title: AccessPolicyApprovalProcedureDeletedEvent
      additionalProperties: false
    svlog.events.AccessPolicyApprovalProcedureUpdatedEvent:
      type: object
      properties:
        accessPolicy:
          $ref: '#/components/schemas/svlog.events.AccessPolicy'
          title: access_policy
          x-stainless-terraform-configurability: optional
        approvalProcedureId:
          type: string
          title: approval_procedure_id
          x-stainless-terraform-configurability: optional
        stepCount:
          type: integer
          title: step_count
          format: int32
          description: |-
            Number of approval steps after the replacement (steps are replaced
             wholesale, not patched).
          x-stainless-terraform-configurability: optional
      title: AccessPolicyApprovalProcedureUpdatedEvent
      additionalProperties: false
    svlog.events.AccessPolicyCreatedEvent:
      type: object
      properties:
        accessPolicy:
          $ref: '#/components/schemas/svlog.events.AccessPolicy'
          title: access_policy
          x-stainless-terraform-configurability: optional
      title: AccessPolicyCreatedEvent
      additionalProperties: false
    svlog.events.AccessPolicyDeletedEvent:
      type: object
      properties:
        accessPolicy:
          $ref: '#/components/schemas/svlog.events.AccessPolicy'
          title: access_policy
          x-stainless-terraform-configurability: optional
      title: AccessPolicyDeletedEvent
      additionalProperties: false
    svlog.events.AccessPolicyUpdatedEvent:
      type: object
      properties:
        accessPolicy:
          $ref: '#/components/schemas/svlog.events.AccessPolicy'
          title: access_policy
          x-stainless-terraform-configurability: optional
        changes:
          type: array
          items:
            $ref: '#/components/schemas/svlog.events.FieldChange'
          title: changes
          description: What actually changed
          x-stainless-terraform-configurability: optional
      title: AccessPolicyUpdatedEvent
      additionalProperties: false
    svlog.events.AccessProvisionedEvent:
      type: object
      properties:
        accessRequest:
          $ref: '#/components/schemas/svlog.events.AccessRequest'
          title: access_request
          description: metadata, not a SIEM target
          x-stainless-terraform-configurability: optional
        entitlement:
          $ref: '#/components/schemas/svlog.events.Entitlement'
          title: entitlement
          x-stainless-terraform-configurability: optional
        resource:
          $ref: '#/components/schemas/svlog.events.Resource'
          title: resource
          x-stainless-terraform-configurability: optional
        user:
          $ref: '#/components/schemas/svlog.events.User'
          title: user
          description: The user who now has access
          x-stainless-terraform-configurability: optional
        ticket:
          $ref: '#/components/schemas/svlog.events.Ticket'
          title: ticket
          description: metadata, not a SIEM target
          x-stainless-terraform-configurability: optional
      title: AccessProvisionedEvent
      additionalProperties: false
      description: Emitted when a user's access has been provisioned for an entitlement
    svlog.events.AccessReviewPolicyCreatedEvent:
      type: object
      properties:
        policy:
          $ref: '#/components/schemas/svlog.events.AccessReviewPolicy'
          title: policy
          x-stainless-terraform-configurability: optional
      title: AccessReviewPolicyCreatedEvent
      additionalProperties: false
    svlog.events.AccessReviewPolicyDeletedEvent:
      type: object
      properties:
        policy:
          $ref: '#/components/schemas/svlog.events.AccessReviewPolicy'
          title: policy
          x-stainless-terraform-configurability: optional
      title: AccessReviewPolicyDeletedEvent
      additionalProperties: false
      description: Soft delete; reviews that pinned a config revision keep enforcing it.
    svlog.events.AccessReviewPolicySetTeamDefaultEvent:
      type: object
      properties:
        policy:
          $ref: '#/components/schemas/svlog.events.AccessReviewPolicy'
          title: policy
          x-stainless-terraform-configurability: optional
        previousDefault:
          $ref: '#/components/schemas/svlog.events.AccessReviewPolicy'
          title: previous_default
          x-stainless-terraform-configurability: optional
      title: AccessReviewPolicySetTeamDefaultEvent
      additionalProperties: false
      description: previous_default is unset when the team had no default before.
    svlog.events.AccessReviewPolicyUpdatedEvent:
      type: object
      properties:
        policy:
          $ref: '#/components/schemas/svlog.events.AccessReviewPolicy'
          title: policy
          x-stainless-terraform-configurability: optional
        changes:
          type: array
          items:
            $ref: '#/components/schemas/svlog.events.FieldChange'
          title: changes
          x-stainless-terraform-configurability: optional
      title: AccessReviewPolicyUpdatedEvent
      additionalProperties: false
      description: |-
        A config change appends a new pinned-config revision; the target carries
         the post-update identity.
    svlog.events.AgentConfigCreatedEvent:
      type: object
      properties:
        agentConfig:
          $ref: '#/components/schemas/svlog.events.AgentConfig'
          title: agent_config
          x-stainless-terraform-configurability: optional
      title: AgentConfigCreatedEvent
      additionalProperties: false
    svlog.events.AgentConfigDeletedEvent:
      type: object
      properties:
        agentConfig:
          $ref: '#/components/schemas/svlog.events.AgentConfig'
          title: agent_config
          x-stainless-terraform-configurability: optional
      title: AgentConfigDeletedEvent
      additionalProperties: false
    svlog.events.AgentConfigUpdatedEvent:
      type: object
      properties:
        agentConfig:
          $ref: '#/components/schemas/svlog.events.AgentConfig'
          title: agent_config
          x-stainless-terraform-configurability: optional
      title: AgentConfigUpdatedEvent
      additionalProperties: false
    svlog.events.AgentInstalledEvent:
      type: object
      properties:
        agentConfig:
          $ref: '#/components/schemas/svlog.events.AgentConfig'
          title: agent_config
          x-stainless-terraform-configurability: optional
      title: AgentInstalledEvent
      additionalProperties: false
    svlog.events.AgentSessionTriggeredEvent:
      type: object
      properties:
        agentConfig:
          $ref: '#/components/schemas/svlog.events.AgentConfig'
          title: agent_config
          x-stainless-terraform-configurability: optional
      title: AgentSessionTriggeredEvent
      additionalProperties: false
    svlog.events.ApiKeyCreatedEvent:
      type: object
      properties:
        apiKey:
          $ref: '#/components/schemas/svlog.events.ApiKey'
          title: api_key
          x-stainless-terraform-configurability: optional
      title: ApiKeyCreatedEvent
      additionalProperties: false
      description: |-
        Emitted when an API key is created. Forward-declared. Token material is
         never logged — only the key's id / display name.
    svlog.events.ApiKeyRevokedEvent:
      type: object
      properties:
        apiKey:
          $ref: '#/components/schemas/svlog.events.ApiKey'
          title: api_key
          x-stainless-terraform-configurability: optional
      title: ApiKeyRevokedEvent
      additionalProperties: false
      description: Emitted when an API key is revoked. Forward-declared.
    svlog.events.AppInstanceAuthRefreshedEvent:
      type: object
      properties:
        appInstance:
          $ref: '#/components/schemas/svlog.events.AppInstance'
          title: app_instance
          x-stainless-terraform-configurability: optional
      title: AppInstanceAuthRefreshedEvent
      additionalProperties: false
    svlog.events.AppInstanceCreatedEvent:
      type: object
      properties:
        appInstance:
          $ref: '#/components/schemas/svlog.events.AppInstance'
          title: app_instance
          x-stainless-terraform-configurability: optional
      title: AppInstanceCreatedEvent
      additionalProperties: false
    svlog.events.AppInstanceDeletedEvent:
      type: object
      properties:
        appInstance:
          $ref: '#/components/schemas/svlog.events.AppInstance'
          title: app_instance
          x-stainless-terraform-configurability: optional
      title: AppInstanceDeletedEvent
      additionalProperties: false
    svlog.events.AppInstanceReconnectedEvent:
      type: object
      properties:
        appInstance:
          $ref: '#/components/schemas/svlog.events.AppInstance'
          title: app_instance
          x-stainless-terraform-configurability: optional
      title: AppInstanceReconnectedEvent
      additionalProperties: false
    svlog.events.AppInstanceSharedEvent:
      type: object
      properties:
        appInstance:
          $ref: '#/components/schemas/svlog.events.AppInstance'
          title: app_instance
          x-stainless-terraform-configurability: optional
        sharedWithTeam:
          $ref: '#/components/schemas/svlog.events.Team'
          title: shared_with_team
          description: |-
            The team the app instance was shared WITH (the grant recipient). The
             owning team is the app_instance's own team and is the envelope scope.
          x-stainless-terraform-configurability: optional
      title: AppInstanceSharedEvent
      additionalProperties: false
    svlog.events.AppInstanceUnsharedEvent:
      type: object
      properties:
        appInstance:
          $ref: '#/components/schemas/svlog.events.AppInstance'
          title: app_instance
          x-stainless-terraform-configurability: optional
        sharedWithTeam:
          $ref: '#/components/schemas/svlog.events.Team'
          title: shared_with_team
          description: The team whose shared access was revoked.
          x-stainless-terraform-configurability: optional
      title: AppInstanceUnsharedEvent
      additionalProperties: false
    svlog.events.CatalystAgentInstalledEvent:
      type: object
      properties:
        scheduledSession:
          $ref: '#/components/schemas/svlog.events.CatalystScheduledSession'
          title: scheduled_session
          x-stainless-terraform-configurability: optional
      title: CatalystAgentInstalledEvent
      additionalProperties: false
    svlog.events.CatalystChangeSetReviewedEvent:
      type: object
      properties:
        changeSet:
          $ref: '#/components/schemas/svlog.events.CatalystChangeSet'
          title: change_set
          x-stainless-terraform-configurability: optional
      title: CatalystChangeSetReviewedEvent
      additionalProperties: false
    svlog.events.CatalystChangesAppliedEvent:
      type: object
      properties:
        session:
          $ref: '#/components/schemas/svlog.events.CatalystSession'
          title: session
          x-stainless-terraform-configurability: optional
        changeSet:
          $ref: '#/components/schemas/svlog.events.CatalystChangeSet'
          title: change_set
          x-stainless-terraform-configurability: optional
      title: CatalystChangesAppliedEvent
      additionalProperties: false
    svlog.events.CatalystScheduledSessionCreatedEvent:
      type: object
      properties:
        scheduledSession:
          $ref: '#/components/schemas/svlog.events.CatalystScheduledSession'
          title: scheduled_session
          x-stainless-terraform-configurability: optional
      title: CatalystScheduledSessionCreatedEvent
      additionalProperties: false
    svlog.events.CatalystScheduledSessionTriggeredEvent:
      type: object
      properties:
        scheduledSession:
          $ref: '#/components/schemas/svlog.events.CatalystScheduledSession'
          title: scheduled_session
          x-stainless-terraform-configurability: optional
      title: CatalystScheduledSessionTriggeredEvent
      additionalProperties: false
    svlog.events.CatalystSessionSharingChangedEvent:
      type: object
      properties:
        session:
          $ref: '#/components/schemas/svlog.events.CatalystSession'
          title: session
          x-stainless-terraform-configurability: optional
        shared:
          type: boolean
          title: shared
          x-stainless-terraform-configurability: computed_optional
      title: CatalystSessionSharingChangedEvent
      additionalProperties: false
    svlog.events.CatalystSkillDeployedEvent:
      type: object
      properties:
        skill:
          $ref: '#/components/schemas/svlog.events.CatalystSkill'
          title: skill
          x-stainless-terraform-configurability: optional
      title: CatalystSkillDeployedEvent
      additionalProperties: false
    svlog.events.CategoryCreatedEvent:
      type: object
      properties:
        category:
          $ref: '#/components/schemas/svlog.events.Category'
          title: category
          x-stainless-terraform-configurability: optional
      title: CategoryCreatedEvent
      additionalProperties: false
      description: 'category_created: a new ticket category option was created.'
    svlog.events.CategoryDeletedEvent:
      type: object
      properties:
        category:
          $ref: '#/components/schemas/svlog.events.Category'
          title: category
          x-stainless-terraform-configurability: optional
      title: CategoryDeletedEvent
      additionalProperties: false
      description: >-
        category_deleted: a category option (and its subcategories) was deleted.
        The
         delete handler resolves the category before deletion so the event carries
         the full identity.
    svlog.events.CategoryUpdatedEvent:
      type: object
      properties:
        category:
          $ref: '#/components/schemas/svlog.events.Category'
          title: category
          x-stainless-terraform-configurability: optional
      title: CategoryUpdatedEvent
      additionalProperties: false
      description: >-
        category_updated: an existing category option's name, description, or
        parent
         changed. The category carries the post-update identity as a target.
    svlog.events.CustomRoleCreatedEvent:
      type: object
      properties:
        customRole:
          $ref: '#/components/schemas/svlog.events.CustomRole'
          title: custom_role
          x-stainless-terraform-configurability: optional
      title: CustomRoleCreatedEvent
      additionalProperties: false
    svlog.events.CustomRoleDeletedEvent:
      type: object
      properties:
        customRole:
          $ref: '#/components/schemas/svlog.events.CustomRole'
          title: custom_role
          x-stainless-terraform-configurability: optional
      title: CustomRoleDeletedEvent
      additionalProperties: false
    svlog.events.CustomRoleGrantsSetEvent:
      type: object
      properties:
        customRole:
          $ref: '#/components/schemas/svlog.events.CustomRole'
          title: custom_role
          x-stainless-terraform-configurability: optional
        grantedActions:
          type: array
          items:
            type: string
          title: granted_actions
          description: The full granted set after the change (action slugs).
          x-stainless-terraform-configurability: optional
      title: CustomRoleGrantsSetEvent
      additionalProperties: false
      description: Emitted when an admin replaces the set of actions a custom role grants.
    svlog.events.CustomRoleMemberAssignedEvent:
      type: object
      properties:
        customRole:
          $ref: '#/components/schemas/svlog.events.CustomRole'
          title: custom_role
          x-stainless-terraform-configurability: optional
        memberUser:
          $ref: '#/components/schemas/svlog.events.User'
          title: member_user
          description: Exactly one of these is set, depending on the subject kind.
          nullable: true
          x-stainless-terraform-configurability: optional
        memberGroup:
          $ref: '#/components/schemas/svlog.events.Group'
          title: member_group
          nullable: true
          x-stainless-terraform-configurability: optional
      title: CustomRoleMemberAssignedEvent
      additionalProperties: false
    svlog.events.CustomRoleMemberUnassignedEvent:
      type: object
      properties:
        customRole:
          $ref: '#/components/schemas/svlog.events.CustomRole'
          title: custom_role
          x-stainless-terraform-configurability: optional
        memberUser:
          $ref: '#/components/schemas/svlog.events.User'
          title: member_user
          nullable: true
          x-stainless-terraform-configurability: optional
        memberGroup:
          $ref: '#/components/schemas/svlog.events.Group'
          title: member_group
          nullable: true
          x-stainless-terraform-configurability: optional
      title: CustomRoleMemberUnassignedEvent
      additionalProperties: false
    svlog.events.CustomRoleTeamBoundEvent:
      type: object
      properties:
        customRole:
          $ref: '#/components/schemas/svlog.events.CustomRole'
          title: custom_role
          x-stainless-terraform-configurability: optional
        team:
          $ref: '#/components/schemas/svlog.events.Team'
          title: team
          x-stainless-terraform-configurability: optional
      title: CustomRoleTeamBoundEvent
      additionalProperties: false
    svlog.events.CustomRoleTeamUnboundEvent:
      type: object
      properties:
        customRole:
          $ref: '#/components/schemas/svlog.events.CustomRole'
          title: custom_role
          x-stainless-terraform-configurability: optional
        team:
          $ref: '#/components/schemas/svlog.events.Team'
          title: team
          x-stainless-terraform-configurability: optional
      title: CustomRoleTeamUnboundEvent
      additionalProperties: false
    svlog.events.CustomRoleUpdatedEvent:
      type: object
      properties:
        customRole:
          $ref: '#/components/schemas/svlog.events.CustomRole'
          title: custom_role
          x-stainless-terraform-configurability: optional
        changes:
          type: array
          items:
            $ref: '#/components/schemas/svlog.events.FieldChange'
          title: changes
          description: What actually changed
          x-stainless-terraform-configurability: optional
      title: CustomRoleUpdatedEvent
      additionalProperties: false
    svlog.events.DashboardCreatedEvent:
      type: object
      properties:
        dashboard:
          $ref: '#/components/schemas/svlog.events.Dashboard'
          title: dashboard
          x-stainless-terraform-configurability: optional
      title: DashboardCreatedEvent
      additionalProperties: false
      description: 'dashboard_created: a new analytics dashboard was created for a team.'
    svlog.events.DashboardDeletedEvent:
      type: object
      properties:
        dashboard:
          $ref: '#/components/schemas/svlog.events.Dashboard'
          title: dashboard
          x-stainless-terraform-configurability: optional
      title: DashboardDeletedEvent
      additionalProperties: false
      description: >-
        dashboard_deleted: a dashboard was deleted. Emitted from the delete
        handler,
         which resolves the dashboard (and its team scope) before deletion so the
         audit event still carries the full identity.
    svlog.events.DashboardUpdatedEvent:
      type: object
      properties:
        dashboard:
          $ref: '#/components/schemas/svlog.events.Dashboard'
          title: dashboard
          x-stainless-terraform-configurability: optional
      title: DashboardUpdatedEvent
      additionalProperties: false
      description: >-
        dashboard_updated: an existing dashboard's name, description, or
        variables
         changed (the content edits, not pure layout reflows). The dashboard carries
         the post-update identity as a target.
    svlog.events.EmailIntakeConfigCreatedEvent:
      type: object
      properties:
        config:
          $ref: '#/components/schemas/svlog.events.EmailIntakeConfig'
          title: config
          x-stainless-terraform-configurability: optional
      title: EmailIntakeConfigCreatedEvent
      additionalProperties: false
    svlog.events.EmailIntakeConfigDeletedEvent:
      type: object
      properties:
        config:
          $ref: '#/components/schemas/svlog.events.EmailIntakeConfig'
          title: config
          x-stainless-terraform-configurability: optional
      title: EmailIntakeConfigDeletedEvent
      additionalProperties: false
    svlog.events.EmailIntakeConfigUpdatedEvent:
      type: object
      properties:
        config:
          $ref: '#/components/schemas/svlog.events.EmailIntakeConfig'
          title: config
          x-stainless-terraform-configurability: optional
        changes:
          type: array
          items:
            $ref: '#/components/schemas/svlog.events.FieldChange'
          title: changes
          description: What actually changed
          x-stainless-terraform-configurability: optional
      title: EmailIntakeConfigUpdatedEvent
      additionalProperties: false
    svlog.events.EntitlementCreatedEvent:
      type: object
      properties:
        entitlement:
          $ref: '#/components/schemas/svlog.events.Entitlement'
          title: entitlement
          x-stainless-terraform-configurability: optional
        resource:
          $ref: '#/components/schemas/svlog.events.Resource'
          title: resource
          x-stainless-terraform-configurability: optional
      title: EntitlementCreatedEvent
      additionalProperties: false
      description: >-
        entitlement_created: a new entitlement (a grantable unit of access on an
        app
         resource) was created. Both the entitlement and its parent resource are
         carried as targets so SIEM can pivot on either.
    svlog.events.EntitlementDeletedEvent:
      type: object
      properties:
        entitlement:
          $ref: '#/components/schemas/svlog.events.Entitlement'
          title: entitlement
          x-stainless-terraform-configurability: optional
        resource:
          $ref: '#/components/schemas/svlog.events.Resource'
          title: resource
          x-stainless-terraform-configurability: optional
      title: EntitlementDeletedEvent
      additionalProperties: false
      description: >-
        entitlement_deleted: an entitlement was deleted (soft-deleted). Emitted
        from
         the delete handler, which resolves the entitlement (and its team scope)
         before deletion so the audit event still carries the full identity.
    svlog.events.EntitlementRequestabilityChangedEvent:
      type: object
      properties:
        entitlement:
          $ref: '#/components/schemas/svlog.events.Entitlement'
          title: entitlement
          x-stainless-terraform-configurability: optional
        resource:
          $ref: '#/components/schemas/svlog.events.Resource'
          title: resource
          x-stainless-terraform-configurability: optional
        requestable:
          type: boolean
          title: requestable
          x-stainless-terraform-configurability: computed_optional
      title: EntitlementRequestabilityChangedEvent
      additionalProperties: false
      description: |-
        entitlement_requestability_changed: the requests_enabled toggle on an
         entitlement flipped — whether end users can request this role through
         Serval. Carries the new value so SIEM can distinguish opening up a role
         from locking it down without diffing consecutive events.
    svlog.events.EntitlementUpdatedEvent:
      type: object
      properties:
        entitlement:
          $ref: '#/components/schemas/svlog.events.Entitlement'
          title: entitlement
          x-stainless-terraform-configurability: optional
        resource:
          $ref: '#/components/schemas/svlog.events.Resource'
          title: resource
          x-stainless-terraform-configurability: optional
      title: EntitlementUpdatedEvent
      additionalProperties: false
      description: >-
        entitlement_updated: an existing entitlement's configuration changed
        (name,
         description, provisioning method, access policy, linked entitlements, etc.).
         The entitlement and resource carry the post-update identity as targets.
    svlog.events.EntityCreatedEvent:
      type: object
      properties:
        entity:
          $ref: '#/components/schemas/svlog.events.Entity'
          title: entity
          x-stainless-terraform-configurability: optional
      title: EntityCreatedEvent
      additionalProperties: false
    svlog.events.EntityDeletedEvent:
      type: object
      properties:
        entity:
          $ref: '#/components/schemas/svlog.events.Entity'
          title: entity
          x-stainless-terraform-configurability: optional
      title: EntityDeletedEvent
      additionalProperties: false
    svlog.events.EntityTypeCreatedEvent:
      type: object
      properties:
        entityType:
          $ref: '#/components/schemas/svlog.events.EntityType'
          title: entity_type
          x-stainless-terraform-configurability: optional
        entitySchema:
          $ref: '#/components/schemas/svlog.events.EntitySchema'
          title: entity_schema
          x-stainless-terraform-configurability: optional
      title: EntityTypeCreatedEvent
      additionalProperties: false
    svlog.events.EntityTypeDeletedEvent:
      type: object
      properties:
        entityType:
          $ref: '#/components/schemas/svlog.events.EntityType'
          title: entity_type
          x-stainless-terraform-configurability: optional
      title: EntityTypeDeletedEvent
      additionalProperties: false
    svlog.events.EntityTypeFieldCreatedEvent:
      type: object
      properties:
        field:
          $ref: '#/components/schemas/svlog.events.EntityTypeField'
          title: field
          x-stainless-terraform-configurability: optional
        entityType:
          $ref: '#/components/schemas/svlog.events.EntityType'
          title: entity_type
          x-stainless-terraform-configurability: optional
      title: EntityTypeFieldCreatedEvent
      additionalProperties: false
    svlog.events.EntityTypeFieldDeletedEvent:
      type: object
      properties:
        field:
          $ref: '#/components/schemas/svlog.events.EntityTypeField'
          title: field
          x-stainless-terraform-configurability: optional
        entityType:
          $ref: '#/components/schemas/svlog.events.EntityType'
          title: entity_type
          x-stainless-terraform-configurability: optional
      title: EntityTypeFieldDeletedEvent
      additionalProperties: false
    svlog.events.EntityTypeUpdatedEvent:
      type: object
      properties:
        entityType:
          $ref: '#/components/schemas/svlog.events.EntityType'
          title: entity_type
          x-stainless-terraform-configurability: optional
        changes:
          type: array
          items:
            $ref: '#/components/schemas/svlog.events.FieldChange'
          title: changes
          x-stainless-terraform-configurability: optional
      title: EntityTypeUpdatedEvent
      additionalProperties: false
    svlog.events.EntityUpdatedEvent:
      type: object
      properties:
        entity:
          $ref: '#/components/schemas/svlog.events.Entity'
          title: entity
          x-stainless-terraform-configurability: optional
      title: EntityUpdatedEvent
      additionalProperties: false
    svlog.events.FolderCreatedEvent:
      type: object
      properties:
        folder:
          $ref: '#/components/schemas/svlog.events.Folder'
          title: folder
          x-stainless-terraform-configurability: optional
      title: FolderCreatedEvent
      additionalProperties: false
      description: >-
        folder_created: a new folder was created for a team, under the root or
        an
         existing parent folder.
    svlog.events.FolderDeletedEvent:
      type: object
      properties:
        folder:
          $ref: '#/components/schemas/svlog.events.Folder'
          title: folder
          x-stainless-terraform-configurability: optional
      title: FolderDeletedEvent
      additionalProperties: false
      description: |-
        folder_deleted: a folder was deleted (soft-deleted). Its direct contents
         (subfolders and workflow/skill files) are reparented to the root rather than
         cascade-deleted. Emitted from the delete handler, which resolves the folder
         (and its team scope) before deletion so the event still carries the identity.
    svlog.events.FolderResourceLocationSetEvent:
      type: object
      properties:
        resource:
          $ref: '#/components/schemas/svlog.events.FolderResource'
          title: resource
          x-stainless-terraform-configurability: optional
        folder:
          $ref: '#/components/schemas/svlog.events.Folder'
          title: folder
          x-stainless-terraform-configurability: optional
      title: FolderResourceLocationSetEvent
      additionalProperties: false
      description: >-
        folder_resource_location_set: a workflow or skill/guidance was placed
        into a
         folder or moved back to the team root. The moved resource is always carried
         as a target; the destination folder is carried when the resource was placed
         into one (unset means it was moved to the root).
    svlog.events.FolderUpdatedEvent:
      type: object
      properties:
        folder:
          $ref: '#/components/schemas/svlog.events.Folder'
          title: folder
          x-stainless-terraform-configurability: optional
      title: FolderUpdatedEvent
      additionalProperties: false
      description: |-
        folder_updated: an existing folder was renamed and/or reparented (moved
         under a different parent, or to the root). The folder carries the
         post-update identity as the target.
    svlog.events.GroupCreatedEvent:
      type: object
      properties:
        group:
          $ref: '#/components/schemas/svlog.events.Group'
          title: group
          x-stainless-terraform-configurability: optional
      title: GroupCreatedEvent
      additionalProperties: false
      description: Emitted when a group is created. The new group is the SIEM target.
    svlog.events.GroupDeletedEvent:
      type: object
      properties:
        group:
          $ref: '#/components/schemas/svlog.events.Group'
          title: group
          x-stainless-terraform-configurability: optional
      title: GroupDeletedEvent
      additionalProperties: false
      description: >-
        Emitted when a group is deleted. The delete handler resolves the group
        before
         deletion so the event still carries the full identity.
    svlog.events.GroupUpdatedEvent:
      type: object
      properties:
        group:
          $ref: '#/components/schemas/svlog.events.Group'
          title: group
          x-stainless-terraform-configurability: optional
      title: GroupUpdatedEvent
      additionalProperties: false
      description: >-
        Emitted when a group's name and/or membership changes. The group carries
        the
         post-update identity as the target.
    svlog.events.GuidanceCreatedEvent:
      type: object
      properties:
        guidance:
          $ref: '#/components/schemas/svlog.events.Guidance'
          title: guidance
          x-stainless-terraform-configurability: optional
      title: GuidanceCreatedEvent
      additionalProperties: false
    svlog.events.GuidanceDeletedEvent:
      type: object
      properties:
        guidance:
          $ref: '#/components/schemas/svlog.events.Guidance'
          title: guidance
          x-stainless-terraform-configurability: optional
      title: GuidanceDeletedEvent
      additionalProperties: false
    svlog.events.GuidanceDeployedEvent:
      type: object
      properties:
        guidance:
          $ref: '#/components/schemas/svlog.events.Guidance'
          title: guidance
          x-stainless-terraform-configurability: optional
        previousVersion:
          $ref: '#/components/schemas/svlog.events.GuidanceVersion'
          title: previous_version
          description: null if first deployed — context only, not a target
          nullable: true
          x-stainless-terraform-configurability: optional
        deployedVersion:
          $ref: '#/components/schemas/svlog.events.GuidanceVersion'
          title: deployed_version
          x-stainless-terraform-configurability: optional
      title: GuidanceDeployedEvent
      additionalProperties: false
    svlog.events.GuidanceDisabledEvent:
      type: object
      properties:
        guidance:
          $ref: '#/components/schemas/svlog.events.Guidance'
          title: guidance
          x-stainless-terraform-configurability: optional
      title: GuidanceDisabledEvent
      additionalProperties: false
    svlog.events.GuidanceEnabledEvent:
      type: object
      properties:
        guidance:
          $ref: '#/components/schemas/svlog.events.Guidance'
          title: guidance
          x-stainless-terraform-configurability: optional
      title: GuidanceEnabledEvent
      additionalProperties: false
    svlog.events.GuidanceUpdatedEvent:
      type: object
      properties:
        guidance:
          $ref: '#/components/schemas/svlog.events.Guidance'
          title: guidance
          x-stainless-terraform-configurability: optional
        version:
          $ref: '#/components/schemas/svlog.events.GuidanceVersion'
          title: version
          x-stainless-terraform-configurability: optional
        changes:
          type: array
          items:
            $ref: '#/components/schemas/svlog.events.FieldChange'
          title: changes
          description: What actually changed
          x-stainless-terraform-configurability: optional
      title: GuidanceUpdatedEvent
      additionalProperties: false
    svlog.events.HelpAgentSimulationReplyEvent:
      type: object
      properties:
        team:
          $ref: '#/components/schemas/svlog.events.Team'
          title: team
          x-stainless-terraform-configurability: optional
        simulationRun:
          $ref: '#/components/schemas/svlog.events.HelpAgentSimulationRun'
          title: simulation_run
          x-stainless-terraform-configurability: optional
        speakerEmail:
          type: string
          title: speaker_email
          description: >-
            The simulated user this reply was spoken as (the ticket requester or
            an
             additional participant), so an auditor can see whose voice drove the turn.
          x-stainless-terraform-configurability: optional
      title: HelpAgentSimulationReplyEvent
      additionalProperties: false
      description: |-
        help_agent_simulation_reply: a simulated-user reply was sent into an
         interactive help-agent simulation. Emitted once per reply and attributed to
         the user who sent it (which, when replying to a shared/other user's run, may
         differ from who started it), giving a complete "who sent each message" trail
         for transparency. Emitted for every reply, not only live-workflow runs, so
         it is INFO baseline rather than WARN. Two SIEM targets: the team and the run.
    svlog.events.HelpAgentSimulationStartedEvent:
      type: object
      properties:
        team:
          $ref: '#/components/schemas/svlog.events.Team'
          title: team
          x-stainless-terraform-configurability: optional
        simulationRun:
          $ref: '#/components/schemas/svlog.events.HelpAgentSimulationRun'
          title: simulation_run
          description: >-
            The simulation run this start created, so the event links directly
            to the
             durable simulation_runs row rather than only to its team.
          x-stainless-terraform-configurability: optional
        simulatedUserCount:
          type: integer
          title: simulated_user_count
          format: int32
          description: |-
            How many users the simulation role-plays (the requester plus any
             additional simulated participants). Equals len(simulated_user_emails).
          x-stainless-terraform-configurability: optional
        simulatedUserEmails:
          type: array
          items:
            type: string
          title: simulated_user_emails
          description: |-
            Emails of the simulated users, for observability — answers "who was
             role-played" (and, on an impersonation start, who was impersonated)
             without a join back to the run. This is PII, deliberately carried here;
             for a plain self-simulation it is just the caller's own email.
          x-stainless-terraform-configurability: optional
        impersonation:
          type: boolean
          title: impersonation
          description: >-
            True when the simulation runs as someone other than the caller (or
            the
             caller has no user identity, e.g. an API key), which required the
             RUN_SIMULATION_AS_OTHER_USER grant.
          x-stainless-terraform-configurability: computed_optional
        liveWorkflows:
          type: boolean
          title: live_workflows
          description: >-
            True when the simulation was configured to execute live (real)
            workflows,
             which required the RUN_PUBLISHED_WORKFLOW grant.
          x-stainless-terraform-configurability: computed_optional
      title: HelpAgentSimulationStartedEvent
      additionalProperties: false
      description: >-
        help_agent_simulation_started: a help-agent simulation was started.
        Emitted
         for every start so the log carries who started each simulation; severity is
         WARN when the start exercised a privileged capability (impersonation and/or
         live workflows) and INFO for a plain self-simulation with mocked tools. Two
         SIEM targets: the team the simulation runs in, and the simulation run itself
         (so an auditor can pivot straight to the run). The caller (a user or an API
         key) is the envelope actor. The simulated users are recorded by count and by
         email, so an auditor can see who was role-played; the two booleans record
         which privileged gate(s), if any, the start cleared.
    svlog.events.ImpersonationSessionStartedEvent:
      type: object
      properties:
        impersonatedUser:
          $ref: '#/components/schemas/svlog.events.User'
          title: impersonated_user
          description: The user being impersonated
          x-stainless-terraform-configurability: optional
        supportTokenId:
          type: string
          title: support_token_id
          description: ID of the support token used for impersonation
          x-stainless-terraform-configurability: optional
        supportAgentId:
          type: string
          title: support_agent_id
          description: Okta ID of the support agent
          x-stainless-terraform-configurability: optional
        supportAgentEmail:
          type: string
          title: support_agent_email
          description: Email of the support agent
          x-stainless-terraform-configurability: optional
      title: ImpersonationSessionStartedEvent
      additionalProperties: false
      description: >-
        Emitted when a support agent starts an impersonation session by
        redeeming a support token
    svlog.events.ImpersonationSessionTerminatedEvent:
      type: object
      properties:
        impersonatedUser:
          $ref: '#/components/schemas/svlog.events.User'
          title: impersonated_user
          description: The user who was being impersonated
          x-stainless-terraform-configurability: optional
        supportTokenId:
          type: string
          title: support_token_id
          description: ID of the support token that was deleted
          x-stainless-terraform-configurability: optional
        sessionsTerminatedCount:
          type: integer
          title: sessions_terminated_count
          format: int32
          description: Number of sessions that were terminated
          x-stainless-terraform-configurability: optional
        reason:
          type: string
          title: reason
          description: Reason for termination (e.g., "user_revoked", "admin_revoked")
          x-stainless-terraform-configurability: optional
        supportAgentId:
          type: string
          title: support_agent_id
          description: >-
            Okta ID of the support agent whose impersonation session was
            terminated.
             Resolved from the support token's redemption record; empty if no
             redemption is found.
          x-stainless-terraform-configurability: optional
        supportAgentEmail:
          type: string
          title: support_agent_email
          description: >-
            Email of the support agent whose impersonation session was
            terminated.
          x-stainless-terraform-configurability: optional
      title: ImpersonationSessionTerminatedEvent
      additionalProperties: false
      description: >-
        Emitted when impersonation sessions are terminated (e.g., when user
        clears support tokens)
    svlog.events.KnowledgeBaseArchivedEvent:
      type: object
      properties:
        knowledgeBase:
          $ref: '#/components/schemas/svlog.events.KnowledgeBase'
          title: knowledge_base
          x-stainless-terraform-configurability: optional
      title: KnowledgeBaseArchivedEvent
      additionalProperties: false
    svlog.events.KnowledgeBaseCreatedEvent:
      type: object
      properties:
        knowledgeBase:
          $ref: '#/components/schemas/svlog.events.KnowledgeBase'
          title: knowledge_base
          x-stainless-terraform-configurability: optional
      title: KnowledgeBaseCreatedEvent
      additionalProperties: false
    svlog.events.KnowledgeBaseDeletedEvent:
      type: object
      properties:
        knowledgeBase:
          $ref: '#/components/schemas/svlog.events.KnowledgeBase'
          title: knowledge_base
          x-stainless-terraform-configurability: optional
      title: KnowledgeBaseDeletedEvent
      additionalProperties: false
    svlog.events.KnowledgeBaseUpdatedEvent:
      type: object
      properties:
        knowledgeBase:
          $ref: '#/components/schemas/svlog.events.KnowledgeBase'
          title: knowledge_base
          x-stainless-terraform-configurability: optional
        changes:
          type: array
          items:
            $ref: '#/components/schemas/svlog.events.FieldChange'
          title: changes
          x-stainless-terraform-configurability: optional
      title: KnowledgeBaseUpdatedEvent
      additionalProperties: false
    svlog.events.KnowledgeDocumentAudienceUpdatedEvent:
      type: object
      properties:
        document:
          $ref: '#/components/schemas/svlog.events.KnowledgeDocument'
          title: document
          x-stainless-terraform-configurability: optional
        changes:
          type: array
          items:
            $ref: '#/components/schemas/svlog.events.FieldChange'
          title: changes
          x-stainless-terraform-configurability: optional
      title: KnowledgeDocumentAudienceUpdatedEvent
      additionalProperties: false
    svlog.events.KnowledgeDocumentCreatedEvent:
      type: object
      properties:
        document:
          $ref: '#/components/schemas/svlog.events.KnowledgeDocument'
          title: document
          x-stainless-terraform-configurability: optional
      title: KnowledgeDocumentCreatedEvent
      additionalProperties: false
    svlog.events.KnowledgeDocumentPublishedEvent:
      type: object
      properties:
        document:
          $ref: '#/components/schemas/svlog.events.KnowledgeDocument'
          title: document
          x-stainless-terraform-configurability: optional
      title: KnowledgeDocumentPublishedEvent
      additionalProperties: false
    svlog.events.LabelCreatedEvent:
      type: object
      properties:
        label:
          $ref: '#/components/schemas/svlog.events.Label'
          title: label
          x-stainless-terraform-configurability: optional
      title: LabelCreatedEvent
      additionalProperties: false
      description: 'label_created: a new ticket label option was created.'
    svlog.events.LabelDeletedEvent:
      type: object
      properties:
        label:
          $ref: '#/components/schemas/svlog.events.Label'
          title: label
          x-stainless-terraform-configurability: optional
      title: LabelDeletedEvent
      additionalProperties: false
      description: >-
        label_deleted: a label option was deleted (cascading off any tickets).
        The
         delete handler resolves the label before deletion so the event carries the
         full identity.
    svlog.events.LabelUpdatedEvent:
      type: object
      properties:
        label:
          $ref: '#/components/schemas/svlog.events.Label'
          title: label
          x-stainless-terraform-configurability: optional
      title: LabelUpdatedEvent
      additionalProperties: false
      description: |-
        label_updated: an existing label option's name, description, or color
         changed. The label carries the post-update identity as a target.
    svlog.events.MCPOAuthAuthorizedEvent:
      type: object
      properties:
        clientId:
          type: string
          title: client_id
          x-stainless-terraform-configurability: optional
        redirectUri:
          type: string
          title: redirect_uri
          x-stainless-terraform-configurability: optional
        client:
          $ref: '#/components/schemas/svlog.events.McpClient'
          title: client
          description: >-
            The client granted access. Duplicates client_id as the entity's id
            so
             the WorkOS export has a target (WorkOS rejects targetless events).
          x-stainless-terraform-configurability: optional
      title: MCPOAuthAuthorizedEvent
      additionalProperties: false
      description: Emitted when a user approves an MCP OAuth authorization request
    svlog.events.MCPOAuthDeniedEvent:
      type: object
      properties:
        clientId:
          type: string
          title: client_id
          x-stainless-terraform-configurability: optional
        redirectUri:
          type: string
          title: redirect_uri
          x-stainless-terraform-configurability: optional
        client:
          $ref: '#/components/schemas/svlog.events.McpClient'
          title: client
          description: The client denied access. See MCPOAuthAuthorizedEvent.client.
          x-stainless-terraform-configurability: optional
      title: MCPOAuthDeniedEvent
      additionalProperties: false
      description: Emitted when a user denies an MCP OAuth authorization request
    svlog.events.MCPOAuthTokenRevokedEvent:
      type: object
      properties:
        user:
          $ref: '#/components/schemas/svlog.events.User'
          title: user
          description: |-
            The user whose token was revoked. The revocation endpoint (RFC 7009)
             only receives the token itself, so the resolved token owner — not the
             OAuth client — is the entity acted on. Token values are intentionally
             not logged.
          x-stainless-terraform-configurability: optional
      title: MCPOAuthTokenRevokedEvent
      additionalProperties: false
      description: Emitted when an MCP OAuth refresh token is revoked
    svlog.events.OrgAuthzTeardownEvent:
      type: object
      properties:
        organization:
          $ref: '#/components/schemas/svlog.events.Organization'
          title: organization
          x-stainless-terraform-configurability: optional
        rolesTornDown:
          type: integer
          title: roles_torn_down
          format: int32
          x-stainless-terraform-configurability: optional
        teamsTornDown:
          type: integer
          title: teams_torn_down
          format: int32
          x-stainless-terraform-configurability: optional
        groupsTornDown:
          type: integer
          title: groups_torn_down
          format: int32
          x-stainless-terraform-configurability: optional
      title: OrgAuthzTeardownEvent
      additionalProperties: false
      description: >-
        Emitted when an org's SpiceDB (authorization-engine) footprint is torn
        down
         as part of offboarding: the relationship tuples keyed by the org's roles,
         teams, and groups are deleted from the engine. The org is the SIEM target;
         org-scoped. Counts are per-category ENTITY counts (roles/teams/groups whose
         tuples were fully swept before any abort) — SpiceDB's DeleteRelationships
         reports no per-tuple counts, and the entity ids are deliberately omitted,
         keeping the payload enumeration-free like org_sso_teardown. The Outcome on
         the envelope records SUCCESS on a clean teardown or ERROR when it aborts
         partway.
    svlog.events.OrgLifecycleStateChangedEvent:
      type: object
      properties:
        organization:
          $ref: '#/components/schemas/svlog.events.Organization'
          title: organization
          x-stainless-terraform-configurability: optional
        fromState:
          type: string
          title: from_state
          x-stainless-terraform-configurability: optional
        toState:
          type: string
          title: to_state
          x-stainless-terraform-configurability: optional
      title: OrgLifecycleStateChangedEvent
      additionalProperties: false
      description: |-
        Emitted on a customer-org offboarding lifecycle transition. from_state /
         to_state are org_lifecycle_state values ("active", "paused", "soft_deleted",
         "cold_stored", "purged"). The org is the SIEM target; org-scoped.
    svlog.events.OrgProviderTrustRevokedEvent:
      type: object
      properties:
        organization:
          $ref: '#/components/schemas/svlog.events.Organization'
          title: organization
          x-stainless-terraform-configurability: optional
        credentialsRevoked:
          type: integer
          title: credentials_revoked
          format: int32
          x-stainless-terraform-configurability: optional
        credentialsUnsupported:
          type: integer
          title: credentials_unsupported
          format: int32
          x-stainless-terraform-configurability: optional
        credentialsFailed:
          type: integer
          title: credentials_failed
          format: int32
          x-stainless-terraform-configurability: optional
        dryRun:
          type: boolean
          title: dry_run
          x-stainless-terraform-configurability: computed_optional
      title: OrgProviderTrustRevokedEvent
      additionalProperties: false
      description: |-
        Emitted when an org's provider OAuth credentials are revoked at their
         external providers as part of offboarding (svflow's revoke-only trust
         teardown at soft delete — no local row is deleted; the wipe happens at
         cold-store). One event per org-level teardown pass, not per credential. The
         org is the SIEM target; org-scoped. Counts summarize the per-credential
         outcomes across every team's app instances (no credential / integration ids
         are ever carried). dry_run mirrors the pass's manifest; a dry run is never
         emitted (it mutates nothing), so it is false on every recorded event. The
         Outcome on the envelope records SUCCESS on a completed pass — provider-side
         failures are best-effort, tallied under credentials_failed — or ERROR when
         enumeration aborts the pass partway.
    svlog.events.OrgProvisionedEvent:
      type: object
      properties:
        organization:
          $ref: '#/components/schemas/svlog.events.Organization'
          title: organization
          x-stainless-terraform-configurability: optional
        operatorAgentEmail:
          type: string
          title: operator_agent_email
          description: |-
            Okta identity of the Serval operator who provisioned the org
             (svsupport-attested, never a raw wire claim).
          x-stainless-terraform-configurability: optional
        adminEmail:
          type: string
          title: admin_email
          description: >-
            The customer's first admin: created as org_admin and sent the setup
            link.
          x-stainless-terraform-configurability: optional
        operatorAdminEmail:
          type: string
          title: operator_admin_email
          description: >-
            Set when the operator additionally created an org_admin for
            themselves
             in the new org (equals operator_agent_email), having attested the
             customer authorized staff access. Empty when no staff user was created.
          x-stainless-terraform-configurability: optional
      title: OrgProvisionedEvent
      additionalProperties: false
      description: >-
        OrgProvisionedEvent is the durable record of operator-driven
        customer-org
         creation (the onboarding counterpart of the offboarding events above). The
         emails identify who exercised the privileged surface and who was granted
         first-admin — the attribution is the point of the event.
    svlog.events.OrgProvisionedViaAccessCodeEvent:
      type: object
      properties:
        organization:
          $ref: '#/components/schemas/svlog.events.Organization'
          title: organization
          description: The newly created organization (the SIEM target).
          x-stainless-terraform-configurability: optional
        mintedByAgentEmail:
          type: string
          title: minted_by_agent_email
          description: >-
            Email of the Serval support agent who minted the redeemed access
            code.
          x-stainless-terraform-configurability: optional
      title: OrgProvisionedViaAccessCodeEvent
      additionalProperties: false
      description: >-
        Emitted when a new organization is created by redeeming a single-use
        signup
         access code (signup-disabled / locked-down deployments). Customer-visible:
         surfaces in the new org's audit log as "provisioned by Serval support",
         naming the minting agent for transparency.
    svlog.events.OrgRedactionPatternsChangedEvent:
      type: object
      properties:
        organization:
          $ref: '#/components/schemas/svlog.events.Organization'
          title: organization
          x-stainless-terraform-configurability: optional
        changes:
          type: array
          items:
            $ref: '#/components/schemas/svlog.events.FieldChange'
          title: changes
          description: What actually changed
          x-stainless-terraform-configurability: optional
      title: OrgRedactionPatternsChangedEvent
      additionalProperties: false
      description: >-
        Emitted when an org admin creates, updates, or deletes a custom
        redaction
         pattern (svhelp). These patterns govern what is scrubbed from persisted
         ticket content, so every change is security-relevant. The changes carry the
         affected pattern (label/regex/enabled) as before→after field changes.
    svlog.events.OrgSettingsChangedEvent:
      type: object
      properties:
        organization:
          $ref: '#/components/schemas/svlog.events.Organization'
          title: organization
          x-stainless-terraform-configurability: optional
        changes:
          type: array
          items:
            $ref: '#/components/schemas/svlog.events.FieldChange'
          title: changes
          description: What actually changed
          x-stainless-terraform-configurability: optional
      title: OrgSettingsChangedEvent
      additionalProperties: false
      description: Emitted when organization-level settings change. Forward-declared.
    svlog.events.OrgSetupLinkResentEvent:
      type: object
      properties:
        organization:
          $ref: '#/components/schemas/svlog.events.Organization'
          title: organization
          x-stainless-terraform-configurability: optional
        operatorAgentEmail:
          type: string
          title: operator_agent_email
          description: |-
            Okta identity of the Serval operator who re-issued the link
             (svsupport-attested, never a raw wire claim).
          x-stainless-terraform-configurability: optional
        adminEmail:
          type: string
          title: admin_email
          description: The first admin the fresh setup link was re-issued to.
          x-stainless-terraform-configurability: optional
      title: OrgSetupLinkResentEvent
      additionalProperties: false
      description: >-
        OrgSetupLinkResentEvent is the durable record of an operator re-issuing
        the
         first-admin setup link for an already-provisioned org (the recovery
         counterpart of org_provisioned, for when the original 24h link expired before
         the admin completed setup). The emails identify who exercised the privileged
         surface and which first-admin the fresh link was issued to.
    svlog.events.OrgSSOTeardownEvent:
      type: object
      properties:
        organization:
          $ref: '#/components/schemas/svlog.events.Organization'
          title: organization
          x-stainless-terraform-configurability: optional
        workosOrgId:
          type: string
          title: workos_org_id
          description: >-
            The WorkOS Organization id that was torn down. Not a secret — an
            opaque
             provider handle — but the SSO connection / directory ids are deliberately
             omitted (count only), keeping the payload PII- and enumeration-free.
          x-stainless-terraform-configurability: optional
        connectionsDeleted:
          type: integer
          title: connections_deleted
          format: int32
          x-stainless-terraform-configurability: optional
        directoriesDeleted:
          type: integer
          title: directories_deleted
          format: int32
          x-stainless-terraform-configurability: optional
      title: OrgSSOTeardownEvent
      additionalProperties: false
      description: >-
        Emitted when an org's WorkOS (external identity-provider) footprint is
        torn
         down as part of offboarding: its SSO connections + Directory Sync directories
         are deleted, the WorkOS Organization is deleted, and the local
         Serval<->WorkOS mapping row is dropped. Irreversible; the org is the SIEM
         target; org-scoped. Counts summarize what was removed (no connection /
         directory ids or secrets are ever carried). The Outcome on the envelope
         records SUCCESS on a clean teardown or ERROR when it aborts partway.
    svlog.events.PermissionDeniedEvent:
      type: object
      properties:
        resource:
          $ref: '#/components/schemas/svlog.events.AuthorizationResource'
          title: resource
          description: >-
            The team or org the denied check was scoped to. id is the team_id
            (or
             org_id when the check was org-scoped); display_name is left empty because
             resolving it would require an extra RPC on the denial path. Marked as the
             audit target so the WorkOS export keys the event on the contested
             resource.
          x-stainless-terraform-configurability: optional
        action:
          type: string
          title: action
          description: >-
            The authorization action string that was checked and refused (the
            svauth
             Action enum value, e.g. "MANAGE_TEAM"). This is the "what was attempted".
          x-stainless-terraform-configurability: optional
        rpcMethod:
          type: string
          title: rpc_method
          description: >-
            The RPC method the denial occurred on, when resolvable from the
            request
             context (e.g. "/svhelp.user.SvUserService/DeleteQueue"); empty otherwise.
          x-stainless-terraform-configurability: optional
      title: PermissionDeniedEvent
      additionalProperties: false
      description: >-
        permission_denied: an authenticated request was rejected by an
        authorization
         check at the shared svauth WithAuth seam (the central CheckPermission step
         every service's authenticated RPCs pass through). The actor who was refused
         is on the envelope; the Outcome is always DENIED, with reason_code stable for
         SIEM ("permission_denied") and reason_detail human-readable (the attempted
         action + RPC method, no secrets/PII). resource is the team/org the check ran
         against, carried as the target so SIEM can pivot on "who was refused access
         to which resource". The actor is frequently unresolved here: the central
         check denies before the request context is enriched with the principal, so
         the envelope actor may be absent — the action + resource + actor IP/UA still
         make the denial actionable.
    svlog.events.QueueCreatedEvent:
      type: object
      properties:
        queue:
          $ref: '#/components/schemas/svlog.events.Queue'
          title: queue
          x-stainless-terraform-configurability: optional
      title: QueueCreatedEvent
      additionalProperties: false
      description: 'queue_created: a new ticket queue was created.'
    svlog.events.QueueDeletedEvent:
      type: object
      properties:
        queue:
          $ref: '#/components/schemas/svlog.events.Queue'
          title: queue
          x-stainless-terraform-configurability: optional
      title: QueueDeletedEvent
      additionalProperties: false
      description: >-
        queue_deleted: a queue was deleted. Emitted from the delete handler,
        which
         resolves the queue (and its team scope) before deletion.
    svlog.events.QueueUpdatedEvent:
      type: object
      properties:
        queue:
          $ref: '#/components/schemas/svlog.events.Queue'
          title: queue
          x-stainless-terraform-configurability: optional
      title: QueueUpdatedEvent
      additionalProperties: false
      description: >-
        queue_updated: an existing queue's name, description, filter, or
        match-all
         flag changed. The queue carries the post-update identity as a target.
    svlog.events.RoutingRuleCreatedEvent:
      type: object
      properties:
        routingRule:
          $ref: '#/components/schemas/svlog.events.RoutingRule'
          title: routing_rule
          x-stainless-terraform-configurability: optional
      title: RoutingRuleCreatedEvent
      additionalProperties: false
      description: >-
        routing_rule_created: a new ticket-routing rule was created. Routing
        rules
         have no display name (they are identified by their condition/action set), so
         the target carries the id only.
    svlog.events.RoutingRuleDeletedEvent:
      type: object
      properties:
        routingRule:
          $ref: '#/components/schemas/svlog.events.RoutingRule'
          title: routing_rule
          x-stainless-terraform-configurability: optional
      title: RoutingRuleDeletedEvent
      additionalProperties: false
      description: >-
        routing_rule_deleted: a routing rule was deleted. Emitted from the
        delete
         handler, which resolves the rule (and its team scope) before deletion.
    svlog.events.RoutingRuleUpdatedEvent:
      type: object
      properties:
        routingRule:
          $ref: '#/components/schemas/svlog.events.RoutingRule'
          title: routing_rule
          x-stainless-terraform-configurability: optional
      title: RoutingRuleUpdatedEvent
      additionalProperties: false
      description: |-
        routing_rule_updated: an existing routing rule's conditions or actions
         changed (the handler bumps the rule's updated_at). The rule carries its
         identity as a target.
    svlog.events.SimulationConfigCreatedEvent:
      type: object
      properties:
        simulationConfig:
          $ref: '#/components/schemas/svlog.events.SimulationConfig'
          title: simulation_config
          x-stainless-terraform-configurability: optional
      title: SimulationConfigCreatedEvent
      additionalProperties: false
      description: |-
        simulation_config_created: a saved help-agent simulation scenario was
         created (revision 1).
    svlog.events.SimulationConfigDeletedEvent:
      type: object
      properties:
        simulationConfig:
          $ref: '#/components/schemas/svlog.events.SimulationConfig'
          title: simulation_config
          x-stainless-terraform-configurability: optional
      title: SimulationConfigDeletedEvent
      additionalProperties: false
      description: |-
        simulation_config_deleted: a saved simulation config was soft-deleted.
         Emitted from the delete handler, which resolves the config before deletion
         so the event carries the full identity.
    svlog.events.SimulationConfigUpdatedEvent:
      type: object
      properties:
        simulationConfig:
          $ref: '#/components/schemas/svlog.events.SimulationConfig'
          title: simulation_config
          x-stainless-terraform-configurability: optional
      title: SimulationConfigUpdatedEvent
      additionalProperties: false
      description: |-
        simulation_config_updated: a saved simulation config was renamed,
         re-described, or had a new scenario revision minted. The config carries the
         post-update identity as a target.
    svlog.events.SlaDefinitionCreatedEvent:
      type: object
      properties:
        slaDefinition:
          $ref: '#/components/schemas/svlog.events.SlaDefinition'
          title: sla_definition
          x-stainless-terraform-configurability: optional
      title: SlaDefinitionCreatedEvent
      additionalProperties: false
      description: |-
        sla_definition_created: a new SLA definition (the team-scoped target /
         response-time policy) was created.
    svlog.events.SlaDefinitionDeletedEvent:
      type: object
      properties:
        slaDefinition:
          $ref: '#/components/schemas/svlog.events.SlaDefinition'
          title: sla_definition
          x-stainless-terraform-configurability: optional
      title: SlaDefinitionDeletedEvent
      additionalProperties: false
      description: |-
        sla_definition_deleted: an SLA definition was deleted. Emitted from the
         delete handler, which resolves the definition (and its team scope) before
         deletion so the audit event still carries the full identity.
    svlog.events.SlaDefinitionUpdatedEvent:
      type: object
      properties:
        slaDefinition:
          $ref: '#/components/schemas/svlog.events.SlaDefinition'
          title: sla_definition
          x-stainless-terraform-configurability: optional
      title: SlaDefinitionUpdatedEvent
      additionalProperties: false
      description: >-
        sla_definition_updated: an existing SLA definition's name, target
        duration,
         schedule, or attachment criteria changed. The definition carries the
         post-update identity as a target.
    svlog.events.SSOConfigChangedEvent:
      type: object
      properties:
        organization:
          $ref: '#/components/schemas/svlog.events.Organization'
          title: organization
          x-stainless-terraform-configurability: optional
        changes:
          type: array
          items:
            $ref: '#/components/schemas/svlog.events.FieldChange'
          title: changes
          description: What actually changed
          x-stainless-terraform-configurability: optional
      title: SSOConfigChangedEvent
      additionalProperties: false
      description: |-
        Emitted when an organization's SSO / SAML configuration changes.
         Forward-declared. Secrets / certs are never logged.
    svlog.events.TeamCatalystSettingsChangedEvent:
      type: object
      properties:
        team:
          $ref: '#/components/schemas/svlog.events.CatalystTeam'
          title: team
          x-stainless-terraform-configurability: optional
      title: TeamCatalystSettingsChangedEvent
      additionalProperties: false
    svlog.events.TeamCreatedEvent:
      type: object
      properties:
        team:
          $ref: '#/components/schemas/svlog.events.Team'
          title: team
          x-stainless-terraform-configurability: optional
      title: TeamCreatedEvent
      additionalProperties: false
      description: Emitted when a team is created. The new team is the SIEM target.
    svlog.events.TeamDefaultAssigneesChangedEvent:
      type: object
      properties:
        team:
          $ref: '#/components/schemas/svlog.events.Team'
          title: team
          x-stainless-terraform-configurability: optional
      title: TeamDefaultAssigneesChangedEvent
      additionalProperties: false
      description: >-
        team_default_assignees_changed: a team's default ticket assignee set
        changed.
    svlog.events.TeamDeletedEvent:
      type: object
      properties:
        team:
          $ref: '#/components/schemas/svlog.events.Team'
          title: team
          x-stainless-terraform-configurability: optional
      title: TeamDeletedEvent
      additionalProperties: false
      description: Emitted when a team is deleted (soft-delete).
    svlog.events.TeamOverrideApproverDecisionEvent:
      type: object
      properties:
        team:
          $ref: '#/components/schemas/svlog.events.Team'
          title: team
          description: >-
            The team that owns the decided approval — the audited target. Used
            as the
             universal target because override decisions span access, workflow-run, and
             inline approvals; WorkOS requires every action to carry at least one.
          x-stainless-terraform-configurability: optional
        approvalRequestId:
          type: string
          title: approval_request_id
          x-stainless-terraform-configurability: optional
        stepId:
          type: string
          title: step_id
          x-stainless-terraform-configurability: optional
        approved:
          type: boolean
          title: approved
          description: true = approved, false = denied.
          x-stainless-terraform-configurability: computed_optional
        justification:
          type: string
          title: justification
          x-stainless-terraform-configurability: optional
        bypassedApproverUserIds:
          type: array
          items:
            type: string
          title: bypassed_approver_user_ids
          description: >-
            The assigned (non-override) approvers who were stepped over by this
            override
             decision, captured at decision time so the audit record is self-contained
             (forensics shouldn't need to re-join the DB, whose state may have changed).
          x-stainless-terraform-configurability: optional
      title: TeamOverrideApproverDecisionEvent
      additionalProperties: false
      description: >-
        Emitted when a designated override approver decides (approves/denies)
        the
         current in-flight step of an approval request, stepping in for the assigned
         approvers. The actor on the envelope is the override approver. Exercising the
         standing bypass is security-relevant, so it is always audited.
    svlog.events.TeamUpdatedEvent:
      type: object
      properties:
        team:
          $ref: '#/components/schemas/svlog.events.Team'
          title: team
          x-stainless-terraform-configurability: optional
        changes:
          type: array
          items:
            $ref: '#/components/schemas/svlog.events.FieldChange'
          title: changes
          description: What actually changed
          x-stainless-terraform-configurability: optional
      title: TeamUpdatedEvent
      additionalProperties: false
      description: |-
        Emitted when a team's settings change (e.g. name). Forward-declared;
         call-site wiring lands in a fast-follow.
    svlog.events.TicketAssignedEvent:
      type: object
      properties:
        ticket:
          $ref: '#/components/schemas/svlog.events.Ticket'
          title: ticket
          x-stainless-terraform-configurability: optional
        assignee:
          $ref: '#/components/schemas/svlog.events.User'
          title: assignee
          x-stainless-terraform-configurability: optional
        previousAssignee:
          $ref: '#/components/schemas/svlog.events.User'
          title: previous_assignee
          x-stainless-terraform-configurability: optional
      title: TicketAssignedEvent
      additionalProperties: false
      description: |-
        Emitted when a ticket's assignee changes. assignee is empty on unassign;
         previous_assignee is context only (not a SIEM target).
    svlog.events.TicketDeletedEvent:
      type: object
      properties:
        ticket:
          $ref: '#/components/schemas/svlog.events.Ticket'
          title: ticket
          x-stainless-terraform-configurability: optional
      title: TicketDeletedEvent
      additionalProperties: false
      description: |-
        Emitted when a ticket is hard-deleted via the public DeleteTicket API
         for data-retention purposes. Irreversible cross-service wipe (svhelp +
         svflow + svrunstate).
    svlog.events.TicketEscalatedEvent:
      type: object
      properties:
        ticket:
          $ref: '#/components/schemas/svlog.events.Ticket'
          title: ticket
          x-stainless-terraform-configurability: optional
        oldLevel:
          type: string
          title: old_level
          x-stainless-terraform-configurability: optional
        newLevel:
          type: string
          title: new_level
          x-stainless-terraform-configurability: optional
      title: TicketEscalatedEvent
      additionalProperties: false
      description: Emitted when a ticket's escalation level changes (e.g. "AI" -> "HUMAN").
    svlog.events.TicketLabelAddedEvent:
      type: object
      properties:
        ticket:
          $ref: '#/components/schemas/svlog.events.Ticket'
          title: ticket
          x-stainless-terraform-configurability: optional
        label:
          $ref: '#/components/schemas/svlog.events.Label'
          title: label
          x-stainless-terraform-configurability: optional
      title: TicketLabelAddedEvent
      additionalProperties: false
      description: >-
        Emitted when a human agent applies a label to a ticket (single, bulk, or
        the
         create-label-and-apply flow). Both the ticket and the applied label are SIEM
         targets so "who tagged ticket X with label Y" is answerable. Bulk operations
         emit one event per (ticket, label) actually affected.
    svlog.events.TicketLabelRemovedEvent:
      type: object
      properties:
        ticket:
          $ref: '#/components/schemas/svlog.events.Ticket'
          title: ticket
          x-stainless-terraform-configurability: optional
        label:
          $ref: '#/components/schemas/svlog.events.Label'
          title: label
          x-stainless-terraform-configurability: optional
      title: TicketLabelRemovedEvent
      additionalProperties: false
      description: >-
        Emitted when a human agent removes a label from a ticket (single or
        bulk).
         Mirrors TicketLabelAddedEvent: both ticket and label are SIEM targets, one
         event per (ticket, label) actually affected.
    svlog.events.TicketModelCreatedEvent:
      type: object
      properties:
        ticketModel:
          $ref: '#/components/schemas/svlog.events.TicketModel'
          title: ticket_model
          x-stainless-terraform-configurability: optional
      title: TicketModelCreatedEvent
      additionalProperties: false
      description: >-
        ticket_model_created: a new ticket model (change model or custom ticket
        type)
         was authored.
    svlog.events.TicketModelDeletedEvent:
      type: object
      properties:
        ticketModel:
          $ref: '#/components/schemas/svlog.events.TicketModel'
          title: ticket_model
          x-stainless-terraform-configurability: optional
      title: TicketModelDeletedEvent
      additionalProperties: false
      description: >-
        ticket_model_deleted: a ticket model was deleted. The delete path
        resolves
         the model (and its team scope) before deletion so the event carries the full
         identity.
    svlog.events.TicketModelUpdatedEvent:
      type: object
      properties:
        ticketModel:
          $ref: '#/components/schemas/svlog.events.TicketModel'
          title: ticket_model
          x-stainless-terraform-configurability: optional
      title: TicketModelUpdatedEvent
      additionalProperties: false
      description: |-
        ticket_model_updated: an existing ticket model's header or configuration
         (lifecycle, transitions, preconditions, entry actions) changed. The model
         carries the post-update identity as the target.
    svlog.events.TicketOwningGroupChangedEvent:
      type: object
      properties:
        ticket:
          $ref: '#/components/schemas/svlog.events.Ticket'
          title: ticket
          x-stainless-terraform-configurability: optional
        oldGroup:
          $ref: '#/components/schemas/svlog.events.Group'
          title: old_group
          x-stainless-terraform-configurability: optional
        newGroup:
          $ref: '#/components/schemas/svlog.events.Group'
          title: new_group
          x-stainless-terraform-configurability: optional
      title: TicketOwningGroupChangedEvent
      additionalProperties: false
      description: |-
        Emitted when a ticket's owning ("assignment") group is set, cleared, or
         reassigned, independent of the individual assignee. new_group is the group
         the ticket is now owned by (a SIEM target); old_group is context only. Either
         may be unset (unowned ticket gaining a group / a group being cleared).
    svlog.events.TicketPermanentlyDeletedEvent:
      type: object
      properties:
        ticket:
          $ref: '#/components/schemas/svlog.events.Ticket'
          title: ticket
          x-stainless-terraform-configurability: optional
      title: TicketPermanentlyDeletedEvent
      additionalProperties: false
    svlog.events.TicketPriorityChangedEvent:
      type: object
      properties:
        ticket:
          $ref: '#/components/schemas/svlog.events.Ticket'
          title: ticket
          x-stainless-terraform-configurability: optional
        oldPriority:
          type: string
          title: old_priority
          x-stainless-terraform-configurability: optional
        newPriority:
          type: string
          title: new_priority
          x-stainless-terraform-configurability: optional
      title: TicketPriorityChangedEvent
      additionalProperties: false
      description: |-
        Emitted when a ticket's priority changes. old/new are priority option
         display names.
    svlog.events.TicketStatusChangedEvent:
      type: object
      properties:
        ticket:
          $ref: '#/components/schemas/svlog.events.Ticket'
          title: ticket
          x-stainless-terraform-configurability: optional
        oldStatus:
          type: string
          title: old_status
          x-stainless-terraform-configurability: optional
        newStatus:
          type: string
          title: new_status
          x-stainless-terraform-configurability: optional
        reason:
          type: string
          title: reason
          x-stainless-terraform-configurability: optional
      title: TicketStatusChangedEvent
      additionalProperties: false
      description: |-
        Emitted when a ticket's status changes (or a status change is attempted
         and rejected — see AuditLogEvent.outcome). old/new are status option
         display names; reason mirrors the user-facing status-change reason.
    svlog.events.TicketTeamChangedEvent:
      type: object
      properties:
        ticket:
          $ref: '#/components/schemas/svlog.events.Ticket'
          title: ticket
          x-stainless-terraform-configurability: optional
        oldTeam:
          $ref: '#/components/schemas/svlog.events.Team'
          title: old_team
          x-stainless-terraform-configurability: optional
        newTeam:
          $ref: '#/components/schemas/svlog.events.Team'
          title: new_team
          x-stainless-terraform-configurability: optional
        reason:
          type: string
          title: reason
          x-stainless-terraform-configurability: optional
      title: TicketTeamChangedEvent
      additionalProperties: false
      description: >-
        Emitted when a ticket is moved between teams. new_team is the entity
        acted
         toward (a SIEM target); old_team is context only.
    svlog.events.TicketTrashedEvent:
      type: object
      properties:
        ticket:
          $ref: '#/components/schemas/svlog.events.Ticket'
          title: ticket
          x-stainless-terraform-configurability: optional
      title: TicketTrashedEvent
      additionalProperties: false
    svlog.events.TicketTypeChangedEvent:
      type: object
      properties:
        ticket:
          $ref: '#/components/schemas/svlog.events.Ticket'
          title: ticket
          x-stainless-terraform-configurability: optional
        oldType:
          type: string
          title: old_type
          x-stainless-terraform-configurability: optional
        newType:
          type: string
          title: new_type
          x-stainless-terraform-configurability: optional
      title: TicketTypeChangedEvent
      additionalProperties: false
      description: |-
        Emitted when a ticket's type/classification changes (e.g. "request" ->
         "incident"). old/new are ticket_type enum values.
    svlog.events.TicketUntrashedEvent:
      type: object
      properties:
        ticket:
          $ref: '#/components/schemas/svlog.events.Ticket'
          title: ticket
          x-stainless-terraform-configurability: optional
      title: TicketUntrashedEvent
      additionalProperties: false
    svlog.events.TicketViewedEvent:
      type: object
      properties:
        ticket:
          $ref: '#/components/schemas/svlog.events.Ticket'
          title: ticket
          x-stainless-terraform-configurability: optional
        viewType:
          $ref: '#/components/schemas/svlog.events.TicketViewedEvent.ViewType'
          title: view_type
          x-stainless-terraform-configurability: optional
      title: TicketViewedEvent
      additionalProperties: false
      description: |-
        Emitted when a user accesses a ticket (detail view). Dedup'd per
         (user, ticket) at the emit site so React Query refetches collapse.
    svlog.events.UserAddedToTeamEvent:
      type: object
      properties:
        user:
          $ref: '#/components/schemas/svlog.events.User'
          title: user
          x-stainless-terraform-configurability: optional
        team:
          $ref: '#/components/schemas/svlog.events.Team'
          title: team
          x-stainless-terraform-configurability: optional
        role:
          type: string
          title: role
          x-stainless-terraform-configurability: optional
      title: UserAddedToTeamEvent
      additionalProperties: false
    svlog.events.UserAuthMethodUpdatedEvent:
      type: object
      properties:
        affectedUser:
          $ref: '#/components/schemas/svlog.events.User'
          title: affected_user
          x-stainless-terraform-configurability: optional
        newAuthMethod:
          type: string
          title: new_auth_method
          description: '"magic_link" or "" (cleared/revoked)'
          x-stainless-terraform-configurability: optional
      title: UserAuthMethodUpdatedEvent
      additionalProperties: false
      description: >-
        Emitted when an org admin grants or revokes magic-link SSO bypass for a
        user.
    svlog.events.UserCreatedEvent:
      type: object
      properties:
        user:
          $ref: '#/components/schemas/svlog.events.User'
          title: user
          x-stainless-terraform-configurability: optional
      title: UserCreatedEvent
      additionalProperties: false
      description: |-
        Emitted when a user account is created / an invitation is accepted — as
         distinct from UserInvitedEvent, which fires when the invite is *sent*.
         Forward-declared; call-site wiring lands in a fast-follow.
    svlog.events.UserDeactivatedEvent:
      type: object
      properties:
        deactivatedUser:
          $ref: '#/components/schemas/svlog.events.User'
          title: deactivated_user
          x-stainless-terraform-configurability: optional
      title: UserDeactivatedEvent
      additionalProperties: false
      description: Emitted when a user is deactivated (soft-deleted) from an organization
    svlog.events.UserInvitedEvent:
      type: object
      properties:
        invitedUser:
          $ref: '#/components/schemas/svlog.events.User'
          title: invited_user
          x-stainless-terraform-configurability: optional
        invitation:
          $ref: '#/components/schemas/svlog.events.UserInvitation'
          title: invitation
          description: invitation record is metadata; the user is the entity acted on
          x-stainless-terraform-configurability: optional
      title: UserInvitedEvent
      additionalProperties: false
    svlog.events.UserLoginEvent:
      type: object
      properties:
        user:
          $ref: '#/components/schemas/svlog.events.User'
          title: user
          x-stainless-terraform-configurability: optional
        organization:
          $ref: '#/components/schemas/svlog.events.Organization'
          title: organization
          x-stainless-terraform-configurability: optional
        method:
          type: string
          title: method
          x-stainless-terraform-configurability: optional
      title: UserLoginEvent
      additionalProperties: false
      description: |-
        user_login: a user successfully authenticated and bound a session to an
         organization. Emitted from svauth's FinalizeSession handler (where the user
         is fully resolved), not the vendored authenticate clone. method records the
         login mechanism (e.g. "password", "magic_link", "sso") as metadata; the
         organization the session bound to is carried as a target so SIEM can pivot on
         both the user and the org they entered.
    svlog.events.UserLoginFailedEvent:
      type: object
      properties:
        attemptedIdentity:
          $ref: '#/components/schemas/svlog.events.User'
          title: attempted_identity
          x-stainless-terraform-configurability: optional
        method:
          type: string
          title: method
          x-stainless-terraform-configurability: optional
      title: UserLoginFailedEvent
      additionalProperties: false
      description: |-
        user_login_failed: an authentication attempt was rejected. The actor is
         unauthenticated (no resolved principal), so the attempted identity is carried
         in the payload as a User target with email only and no id — never as a
         resolved user. method is the attempted mechanism; the Outcome on the envelope
         carries the machine-stable reason_code (DENIED for deactivated /
         password-login-disabled, FAILURE for bad credentials / invalid token).
    svlog.events.UserLogoutEvent:
      type: object
      properties:
        user:
          $ref: '#/components/schemas/svlog.events.User'
          title: user
          x-stainless-terraform-configurability: optional
      title: UserLogoutEvent
      additionalProperties: false
      description: |-
        user_logout: a user ended their session(s). Emitted from svauth's Logout
         handler after the session teardown succeeds. Global-scope logout revokes the
         user's refresh tokens across devices.
    svlog.events.UserMFAEnrolledEvent:
      type: object
      properties:
        user:
          $ref: '#/components/schemas/svlog.events.User'
          title: user
          x-stainless-terraform-configurability: optional
        factorId:
          type: string
          title: factor_id
          x-stainless-terraform-configurability: optional
        factorType:
          type: string
          title: factor_type
          description: e.g. "totp"; empty when gotrue did not record it
          x-stainless-terraform-configurability: optional
      title: UserMFAEnrolledEvent
      additionalProperties: false
      description: >-
        user_mfa_enrolled: a user enrolled a new multi-factor authentication
        factor.
         Bridged from the gotrue `factor_in_progress` audit action, which fires once
         when a new (still-unverified) factor is created during enrollment — the
         enrollment signal. (`verification_attempted` was rejected as the source: it
         also fires on every MFA login challenge, so it is not enrollment-specific.)
         factor_id / factor_type are lifted from the gotrue entry's traits; factor_type
         is empty when the enroll path did not record one (the TOTP enroll endpoint
         records only factor_id).
    svlog.events.UserOrganizationRoleChangedEvent:
      type: object
      properties:
        user:
          $ref: '#/components/schemas/svlog.events.User'
          title: user
          x-stainless-terraform-configurability: optional
        organizationId:
          type: string
          title: organization_id
          x-stainless-terraform-configurability: optional
        oldRole:
          type: string
          title: old_role
          x-stainless-terraform-configurability: optional
        newRole:
          type: string
          title: new_role
          x-stainless-terraform-configurability: optional
      title: UserOrganizationRoleChangedEvent
      additionalProperties: false
    svlog.events.UserPasswordChangedEvent:
      type: object
      properties:
        user:
          $ref: '#/components/schemas/svlog.events.User'
          title: user
          x-stainless-terraform-configurability: optional
      title: UserPasswordChangedEvent
      additionalProperties: false
      description: >-
        user_password_changed: a user changed their own password. Bridged from
        the
         gotrue `user_updated_password` audit action. Carries no secret material —
         only the user whose password changed.
    svlog.events.UserRemovedFromTeamEvent:
      type: object
      properties:
        user:
          $ref: '#/components/schemas/svlog.events.User'
          title: user
          x-stainless-terraform-configurability: optional
        team:
          $ref: '#/components/schemas/svlog.events.Team'
          title: team
          x-stainless-terraform-configurability: optional
        role:
          type: string
          title: role
          description: The role they had before removal
          x-stainless-terraform-configurability: optional
      title: UserRemovedFromTeamEvent
      additionalProperties: false
    svlog.events.UserSessionRevokedEvent:
      type: object
      properties:
        user:
          $ref: '#/components/schemas/svlog.events.User'
          title: user
          x-stainless-terraform-configurability: optional
      title: UserSessionRevokedEvent
      additionalProperties: false
      description: >-
        user_session_revoked: a user's session / refresh token was revoked.
        Bridged
         from the gotrue `token_revoked` audit action. Distinct from user_logout
         (already emitted by svauth's Logout RPC for user-initiated logout); this
         covers the gotrue-side revocations that have no Serval RPC handler.
    svlog.events.UserTeamRoleChangedEvent:
      type: object
      properties:
        user:
          $ref: '#/components/schemas/svlog.events.User'
          title: user
          x-stainless-terraform-configurability: optional
        team:
          $ref: '#/components/schemas/svlog.events.Team'
          title: team
          x-stainless-terraform-configurability: optional
        oldRole:
          type: string
          title: old_role
          x-stainless-terraform-configurability: optional
        newRole:
          type: string
          title: new_role
          x-stainless-terraform-configurability: optional
      title: UserTeamRoleChangedEvent
      additionalProperties: false
    svlog.events.WidgetCreatedEvent:
      type: object
      properties:
        widget:
          $ref: '#/components/schemas/svlog.events.Widget'
          title: widget
          x-stainless-terraform-configurability: optional
      title: WidgetCreatedEvent
      additionalProperties: false
      description: 'widget_created: a new widget was created on a dashboard.'
    svlog.events.WidgetDeletedEvent:
      type: object
      properties:
        widget:
          $ref: '#/components/schemas/svlog.events.Widget'
          title: widget
          x-stainless-terraform-configurability: optional
      title: WidgetDeletedEvent
      additionalProperties: false
      description: >-
        widget_deleted: a widget was deleted. Emitted from the delete handler,
        which
         resolves the widget before deletion so the audit event still carries the
         full identity.
    svlog.events.WidgetUpdatedEvent:
      type: object
      properties:
        widget:
          $ref: '#/components/schemas/svlog.events.Widget'
          title: widget
          x-stainless-terraform-configurability: optional
      title: WidgetUpdatedEvent
      additionalProperties: false
      description: |-
        widget_updated: an existing widget's title, type, workflow binding, or
         config changed. The widget carries the post-update identity as a target.
    svlog.events.WorkflowCreatedEvent:
      type: object
      properties:
        workflow:
          $ref: '#/components/schemas/svlog.events.Workflow'
          title: workflow
          x-stainless-terraform-configurability: optional
      title: WorkflowCreatedEvent
      additionalProperties: false
    svlog.events.WorkflowDeletedEvent:
      type: object
      properties:
        workflow:
          $ref: '#/components/schemas/svlog.events.Workflow'
          title: workflow
          x-stainless-terraform-configurability: optional
      title: WorkflowDeletedEvent
      additionalProperties: false
    svlog.events.WorkflowDisabledEvent:
      type: object
      properties:
        workflow:
          $ref: '#/components/schemas/svlog.events.Workflow'
          title: workflow
          x-stainless-terraform-configurability: optional
      title: WorkflowDisabledEvent
      additionalProperties: false
    svlog.events.WorkflowEnabledEvent:
      type: object
      properties:
        workflow:
          $ref: '#/components/schemas/svlog.events.Workflow'
          title: workflow
          x-stainless-terraform-configurability: optional
      title: WorkflowEnabledEvent
      additionalProperties: false
    svlog.events.WorkflowPublishedEvent:
      type: object
      properties:
        workflow:
          $ref: '#/components/schemas/svlog.events.Workflow'
          title: workflow
          x-stainless-terraform-configurability: optional
        previousVersion:
          $ref: '#/components/schemas/svlog.events.WorkflowVersion'
          title: previous_version
          description: null if first published — context only, not a target
          nullable: true
          x-stainless-terraform-configurability: optional
        publishedVersion:
          $ref: '#/components/schemas/svlog.events.WorkflowVersion'
          title: published_version
          x-stainless-terraform-configurability: optional
      title: WorkflowPublishedEvent
      additionalProperties: false
    svlog.events.WorkflowRunRequestedEvent:
      type: object
      properties:
        workflow:
          $ref: '#/components/schemas/svlog.events.Workflow'
          title: workflow
          x-stainless-terraform-configurability: optional
        version:
          $ref: '#/components/schemas/svlog.events.WorkflowVersion'
          title: version
          description: version is captured in the run record; not exported as a target
          x-stainless-terraform-configurability: optional
        workflowRun:
          $ref: '#/components/schemas/svlog.events.WorkflowRun'
          title: workflow_run
          x-stainless-terraform-configurability: optional
      title: WorkflowRunRequestedEvent
      additionalProperties: false
    svlog.events.WorkflowRunStartedEvent:
      type: object
      properties:
        workflow:
          $ref: '#/components/schemas/svlog.events.Workflow'
          title: workflow
          x-stainless-terraform-configurability: optional
        version:
          $ref: '#/components/schemas/svlog.events.WorkflowVersion'
          title: version
          description: version is captured in the run record; not exported as a target
          x-stainless-terraform-configurability: optional
        workflowRun:
          $ref: '#/components/schemas/svlog.events.WorkflowRun'
          title: workflow_run
          x-stainless-terraform-configurability: optional
      title: WorkflowRunStartedEvent
      additionalProperties: false
    svlog.events.WorkflowUpdatedEvent:
      type: object
      properties:
        workflow:
          $ref: '#/components/schemas/svlog.events.Workflow'
          title: workflow
          x-stainless-terraform-configurability: optional
        version:
          $ref: '#/components/schemas/svlog.events.WorkflowVersion'
          title: version
          x-stainless-terraform-configurability: optional
        changes:
          type: array
          items:
            $ref: '#/components/schemas/svlog.events.FieldChange'
          title: changes
          description: What actually changed
          x-stainless-terraform-configurability: optional
      title: WorkflowUpdatedEvent
      additionalProperties: false
    svlog.events.AccessRequest:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
      title: AccessRequest
      additionalProperties: false
    svlog.events.Entitlement:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
        displayName:
          type: string
          title: display_name
          x-stainless-terraform-configurability: optional
      title: Entitlement
      additionalProperties: false
    svlog.events.Resource:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
        displayName:
          type: string
          title: display_name
          x-stainless-terraform-configurability: optional
      title: Resource
      additionalProperties: false
    svlog.events.User:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
        displayName:
          type: string
          title: display_name
          x-stainless-terraform-configurability: optional
        email:
          type: string
          title: email
          description: Email serves as display name for users
          x-stainless-terraform-configurability: optional
        name:
          type: string
          title: name
          description: Full name if available
          x-stainless-terraform-configurability: optional
      title: User
      additionalProperties: false
    svlog.events.Ticket:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
        displayName:
          type: string
          title: display_name
          x-stainless-terraform-configurability: optional
      title: Ticket
      additionalProperties: false
    svlog.events.AccessReviewRemediationAction:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
      title: AccessReviewRemediationAction
      additionalProperties: false
      description: |-
        Identifies the svhelp access_review_remediation_actions row that drove a
         UAR-triggered deprov. Metadata only — not a SIEM target.
    svlog.events.AccessPolicy:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
        displayName:
          type: string
          title: display_name
          x-stainless-terraform-configurability: optional
      title: AccessPolicy
      additionalProperties: false
    svlog.events.FieldChange:
      type: object
      oneOf:
        - $ref: '#/components/schemas/svlog.events.FieldChange.BoolChange'
        - $ref: '#/components/schemas/svlog.events.FieldChange.JsonChange'
        - $ref: '#/components/schemas/svlog.events.FieldChange.NumberChange'
        - $ref: '#/components/schemas/svlog.events.FieldChange.StringChange'
        - $ref: '#/components/schemas/svlog.events.FieldChange.TimestampChange'
      title: FieldChange
      description: |-
        Generic field change tracking - We keep this generic
         to minimize the amount of schema we have to keep in sync
         just to track field changes.
    svlog.events.AccessReviewPolicy:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
        displayName:
          type: string
          title: display_name
          x-stainless-terraform-configurability: optional
      title: AccessReviewPolicy
      additionalProperties: false
    svlog.events.AgentConfig:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
        displayName:
          type: string
          title: display_name
          x-stainless-terraform-configurability: optional
      title: AgentConfig
      additionalProperties: false
    svlog.events.ApiKey:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
        displayName:
          type: string
          title: display_name
          x-stainless-terraform-configurability: optional
      title: ApiKey
      additionalProperties: false
      description: |-
        An API key. Only the key's id and display name are ever carried — the
         token/secret material is never logged.
    svlog.events.AppInstance:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
        displayName:
          type: string
          title: display_name
          x-stainless-terraform-configurability: optional
        service:
          type: string
          title: service
          x-stainless-terraform-configurability: optional
      title: AppInstance
      additionalProperties: false
    svlog.events.Team:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
        displayName:
          type: string
          title: display_name
          x-stainless-terraform-configurability: optional
      title: Team
      additionalProperties: false
    svlog.events.CatalystScheduledSession:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
        displayName:
          type: string
          title: display_name
          x-stainless-terraform-configurability: optional
      title: CatalystScheduledSession
      additionalProperties: false
    svlog.events.CatalystChangeSet:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
      title: CatalystChangeSet
      additionalProperties: false
    svlog.events.CatalystSession:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
        displayName:
          type: string
          title: display_name
          x-stainless-terraform-configurability: optional
      title: CatalystSession
      additionalProperties: false
    svlog.events.CatalystSkill:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
        displayName:
          type: string
          title: display_name
          x-stainless-terraform-configurability: optional
      title: CatalystSkill
      additionalProperties: false
    svlog.events.Category:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
        displayName:
          type: string
          title: display_name
          x-stainless-terraform-configurability: optional
      title: Category
      additionalProperties: false
    svlog.events.CustomRole:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
        displayName:
          type: string
          title: display_name
          x-stainless-terraform-configurability: optional
      title: CustomRole
      additionalProperties: false
    svlog.events.Group:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
        displayName:
          type: string
          title: display_name
          x-stainless-terraform-configurability: optional
      title: Group
      additionalProperties: false
    svlog.events.Dashboard:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
        displayName:
          type: string
          title: display_name
          x-stainless-terraform-configurability: optional
      title: Dashboard
      additionalProperties: false
    svlog.events.EmailIntakeConfig:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
        displayName:
          type: string
          title: display_name
          description: The intake email address
          x-stainless-terraform-configurability: optional
        teamId:
          type: string
          title: team_id
          x-stainless-terraform-configurability: optional
      title: EmailIntakeConfig
      additionalProperties: false
    svlog.events.Entity:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
        displayName:
          type: string
          title: display_name
          x-stainless-terraform-configurability: optional
        entityTypeId:
          type: string
          title: entity_type_id
          x-stainless-terraform-configurability: optional
      title: Entity
      additionalProperties: false
    svlog.events.EntityType:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
        displayName:
          type: string
          title: display_name
          x-stainless-terraform-configurability: optional
        entitySchemaId:
          type: string
          title: entity_schema_id
          x-stainless-terraform-configurability: optional
      title: EntityType
      additionalProperties: false
    svlog.events.EntitySchema:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
        displayName:
          type: string
          title: display_name
          x-stainless-terraform-configurability: optional
      title: EntitySchema
      additionalProperties: false
    svlog.events.EntityTypeField:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
        displayName:
          type: string
          title: display_name
          x-stainless-terraform-configurability: optional
        entityTypeId:
          type: string
          title: entity_type_id
          x-stainless-terraform-configurability: optional
      title: EntityTypeField
      additionalProperties: false
    svlog.events.Folder:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
        displayName:
          type: string
          title: display_name
          x-stainless-terraform-configurability: optional
      title: Folder
      additionalProperties: false
      description: >-
        A svflow folder (the per-team tree node that organizes workflows or
        skills).
    svlog.events.FolderResource:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
        resourceType:
          type: string
          title: resource_type
          description: '"workflow" or "guidance".'
          x-stainless-terraform-configurability: optional
      title: FolderResource
      additionalProperties: false
      description: >-
        The workflow or skill/guidance whose folder placement changed. The
        resource
         keeps its own display name in its create/update audit events, so the move
         event carries only the identity (id + kind) needed to link the two.
    svlog.events.Guidance:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
        displayName:
          type: string
          title: display_name
          description: >-
            Should generally include a name where possible as makes it easier to
            identify the object on export to SIEM without complex hydration
          x-stainless-terraform-configurability: optional
      title: Guidance
      additionalProperties: false
    svlog.events.GuidanceVersion:
      type: object
      properties:
        id:
          type: string
          title: id
          description: This is the version ID, not the guidance ID
          x-stainless-terraform-configurability: optional
        displayName:
          type: string
          title: display_name
          x-stainless-terraform-configurability: optional
        guidanceId:
          type: string
          title: guidance_id
          x-stainless-terraform-configurability: optional
        versionNumber:
          type: integer
          title: version_number
          format: int32
          x-stainless-terraform-configurability: optional
      title: GuidanceVersion
      additionalProperties: false
    svlog.events.HelpAgentSimulationRun:
      type: object
      properties:
        id:
          type: string
          title: id
          description: No obvious display name for simulation runs, so we skip that field
          x-stainless-terraform-configurability: optional
      title: HelpAgentSimulationRun
      additionalProperties: false
    svlog.events.KnowledgeBase:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
        displayName:
          type: string
          title: display_name
          x-stainless-terraform-configurability: optional
      title: KnowledgeBase
      additionalProperties: false
    svlog.events.KnowledgeDocument:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
        displayName:
          type: string
          title: display_name
          x-stainless-terraform-configurability: optional
        knowledgeBaseId:
          type: string
          title: knowledge_base_id
          x-stainless-terraform-configurability: optional
      title: KnowledgeDocument
      additionalProperties: false
    svlog.events.Label:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
        displayName:
          type: string
          title: display_name
          x-stainless-terraform-configurability: optional
      title: Label
      additionalProperties: false
    svlog.events.McpClient:
      type: object
      properties:
        id:
          type: string
          title: id
          description: The OAuth client_id
          x-stainless-terraform-configurability: optional
      title: McpClient
      additionalProperties: false
      description: |-
        An OAuth client of the MCP authorization server. MCP clients register
         dynamically and carry no human-readable name, so the OAuth client_id is
         the identifier; there is no display_name field (same as WorkflowRun).
    svlog.events.Organization:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
        displayName:
          type: string
          title: display_name
          x-stainless-terraform-configurability: optional
      title: Organization
      additionalProperties: false
    svlog.events.AuthorizationResource:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
        displayName:
          type: string
          title: display_name
          x-stainless-terraform-configurability: optional
      title: AuthorizationResource
      additionalProperties: false
      description: |-
        AuthorizationResource identifies the resource an authorization check ran
         against. It is deliberately a thin (id + display_name) target shape — the id
         is a team_id or org_id — so the permission_denied export keys on the
         contested resource without the denial path needing a name-resolving RPC.
    svlog.events.Queue:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
        displayName:
          type: string
          title: display_name
          x-stainless-terraform-configurability: optional
      title: Queue
      additionalProperties: false
    svlog.events.RoutingRule:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
        displayName:
          type: string
          title: display_name
          description: >-
            Routing rules have no name column; display_name is left empty and
            the
             target is keyed on the id.
          x-stainless-terraform-configurability: optional
      title: RoutingRule
      additionalProperties: false
    svlog.events.SimulationConfig:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
        displayName:
          type: string
          title: display_name
          x-stainless-terraform-configurability: optional
      title: SimulationConfig
      additionalProperties: false
    svlog.events.SlaDefinition:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
        displayName:
          type: string
          title: display_name
          x-stainless-terraform-configurability: optional
      title: SlaDefinition
      additionalProperties: false
    svlog.events.CatalystTeam:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
      title: CatalystTeam
      additionalProperties: false
    svlog.events.TicketModel:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
        displayName:
          type: string
          title: display_name
          x-stainless-terraform-configurability: optional
        ticketType:
          type: string
          title: ticket_type
          x-stainless-terraform-configurability: optional
        ticketSubtype:
          type: string
          title: ticket_subtype
          x-stainless-terraform-configurability: optional
      title: TicketModel
      additionalProperties: false
      description: >-
        TicketModel is the audit-target identity for a ticket model.
        display_name is
         the model's admin-facing name; ticket_type / ticket_subtype disambiguate
         which type family and slug the model configures (e.g. change/normal or a
         custom type's derived subtype).
    svlog.events.TicketViewedEvent.ViewType:
      type: string
      title: ViewType
      enum:
        - VIEW_TYPE_UNSPECIFIED
        - VIEW_TYPE_TEAM
        - VIEW_TYPE_LIMITED
        - VIEW_TYPE_JOURNEY
        - VIEW_TYPE_PUBLIC_API
    svlog.events.UserInvitation:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
      title: UserInvitation
      additionalProperties: false
    svlog.events.Widget:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
        displayName:
          type: string
          title: display_name
          x-stainless-terraform-configurability: optional
      title: Widget
      additionalProperties: false
    svlog.events.Workflow:
      type: object
      properties:
        id:
          type: string
          title: id
          x-stainless-terraform-configurability: optional
        displayName:
          type: string
          title: display_name
          description: >-
            Should generally include a name where possible as makes it easier to
            identify the object on export to SIEM without complex hydration
          x-stainless-terraform-configurability: optional
      title: Workflow
      additionalProperties: false
    svlog.events.WorkflowVersion:
      type: object
      properties:
        id:
          type: string
          title: id
          description: This is the version ID, not the workflow ID
          x-stainless-terraform-configurability: optional
        displayName:
          type: string
          title: display_name
          x-stainless-terraform-configurability: optional
        workflowId:
          type: string
          title: workflow_id
          x-stainless-terraform-configurability: optional
        versionNumber:
          type: integer
          title: version_number
          format: int32
          x-stainless-terraform-configurability: optional
      title: WorkflowVersion
      additionalProperties: false
    svlog.events.WorkflowRun:
      type: object
      properties:
        id:
          type: string
          title: id
          description: No obvious display name for workflow runs, so we skip that field
          x-stainless-terraform-configurability: optional
        workflowId:
          type: string
          title: workflow_id
          x-stainless-terraform-configurability: optional
      title: WorkflowRun
      additionalProperties: false
    svlog.events.FieldChange.BoolChange:
      type: object
      title: Bool Change
      properties:
        boolChange:
          $ref: '#/components/schemas/svlog.events.BoolFieldChange'
          title: bool_change
          x-stainless-terraform-configurability: optional
        fieldName:
          type: string
          title: field_name
          description: e.g., "name", "description", "enabled"
          x-stainless-terraform-configurability: optional
      required:
        - boolChange
      additionalProperties: false
    svlog.events.FieldChange.JsonChange:
      type: object
      title: Json Change
      properties:
        jsonChange:
          $ref: '#/components/schemas/svlog.events.JsonFieldChange'
          title: json_change
          x-stainless-terraform-configurability: optional
        fieldName:
          type: string
          title: field_name
          description: e.g., "name", "description", "enabled"
          x-stainless-terraform-configurability: optional
      required:
        - jsonChange
      additionalProperties: false
    svlog.events.FieldChange.NumberChange:
      type: object
      title: Number Change
      properties:
        numberChange:
          $ref: '#/components/schemas/svlog.events.NumberFieldChange'
          title: number_change
          x-stainless-terraform-configurability: optional
        fieldName:
          type: string
          title: field_name
          description: e.g., "name", "description", "enabled"
          x-stainless-terraform-configurability: optional
      required:
        - numberChange
      additionalProperties: false
    svlog.events.FieldChange.StringChange:
      type: object
      title: String Change
      properties:
        stringChange:
          $ref: '#/components/schemas/svlog.events.StringFieldChange'
          title: string_change
          x-stainless-terraform-configurability: optional
        fieldName:
          type: string
          title: field_name
          description: e.g., "name", "description", "enabled"
          x-stainless-terraform-configurability: optional
      required:
        - stringChange
      additionalProperties: false
    svlog.events.FieldChange.TimestampChange:
      type: object
      title: Timestamp Change
      properties:
        timestampChange:
          $ref: '#/components/schemas/svlog.events.TimestampFieldChange'
          title: timestamp_change
          x-stainless-terraform-configurability: optional
        fieldName:
          type: string
          title: field_name
          description: e.g., "name", "description", "enabled"
          x-stainless-terraform-configurability: optional
      required:
        - timestampChange
      additionalProperties: false
    svlog.events.BoolFieldChange:
      type: object
      properties:
        oldValue:
          type: boolean
          title: old_value
          x-stainless-terraform-configurability: computed_optional
        newValue:
          type: boolean
          title: new_value
          x-stainless-terraform-configurability: computed_optional
      title: BoolFieldChange
      additionalProperties: false
    svlog.events.JsonFieldChange:
      type: object
      properties:
        oldValue:
          type: string
          title: old_value
          description: JSON string
          x-stainless-terraform-configurability: optional
        newValue:
          type: string
          title: new_value
          description: JSON string
          x-stainless-terraform-configurability: optional
      title: JsonFieldChange
      additionalProperties: false
    svlog.events.NumberFieldChange:
      type: object
      properties:
        oldValue:
          type: number
          title: old_value
          format: double
          description: Can represent int or float
          x-stainless-terraform-configurability: optional
        newValue:
          type: number
          title: new_value
          format: double
          x-stainless-terraform-configurability: optional
      title: NumberFieldChange
      additionalProperties: false
    svlog.events.StringFieldChange:
      type: object
      properties:
        oldValue:
          type: string
          title: old_value
          x-stainless-terraform-configurability: optional
        newValue:
          type: string
          title: new_value
          x-stainless-terraform-configurability: optional
      title: StringFieldChange
      additionalProperties: false
    svlog.events.TimestampFieldChange:
      type: object
      properties:
        oldValue:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          title: old_value
          x-stainless-terraform-configurability: optional
        newValue:
          $ref: '#/components/schemas/google.protobuf.Timestamp'
          title: new_value
          x-stainless-terraform-configurability: optional
      title: TimestampFieldChange
      additionalProperties: false
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer

````