Audit Log Format

Reference for P0 audit log fields, actions, and payload formats streamed to SIEM integrations.

P0 streams structured audit logs to your configured SIEM integration. This reference documents the log payload format, the complete action hierarchy, and example payloads for each action.

General fields

Every audit log event contains the following fields:

Field

Type

Description

vendor_account

string

Your P0 organization (tenant) identifier

data

object

Diff or data associated with the action

user

object

The authenticated user who performed the action

type

string

Event source: api, permission-requests, or notifier

timestamp

string

ISO 8601 formatted timestamp (for example, 2025-01-17T18:15:11.458Z)

action

string

The specific audit action identifier

The user object contains:

Field

Type

Description

isAnonymous

boolean

Whether the user is anonymous

email

string

Email address of the authenticated user

provider

string

Authentication provider

groups

string[]

Groups the user belongs to

uid

string

Unique user identifier

Example payload

{
  "vendor_account": "your-org",
  "data": {},
  "user": {
    "isAnonymous": false,
    "email": "[email protected]",
    "provider": "google.com",
    "groups": ["engineering"],
    "uid": "abc123"
  },
  "type": "api",
  "timestamp": "2025-01-17T18:15:11.458Z",
  "action": "admin.roles.user.added"
}

Action hierarchy

P0 audit actions follow a hierarchical naming convention. The top-level prefix indicates the category of the action.

admin
  .jit
    .approval-configuration.updated
    .expiry-option
      .created
      .deleted
      .reset
    .max-access-duration.set
  .roles
    .user
      .added
      .deleted
    .group
      .added
      .deleted
  .integration
    .installed
    .updated
    .removed
  .api-key
    .created
    .deleted
  .routing-rules.updated
api
  .jit
    .permission-requests
      .created
      .approved
      .denied
      .revoked
    .preapproval
      .created
      .revoked
auth
  .authentication.failed
  .authorization.failed

Routing rule actions

These actions are logged when routing rules are created, updated, or deleted.

`admin.routing-rules.created`

A new routing rule was created. The data field has the difference between the old and new version of the routing rules document.

{
  "timestamp": "2025-08-11T15:29:16.802Z",
  "action": "admin.routing-rules.created",
  "user_agent": "Mozilla/5.0 ...",
  "data": {
    "version": {
      "-": "<old version id>",
      "+": "<new version id>"
    },
    "rules": [
      {
        "action": "admin.routing-rules.created",
        "name": "Test",
        "diff": {
          "+": {
            "disabled": false,
            "resource": { "type": "any" },
            "requestor": { "type": "any" },
            "approval": [{ "type": "persistent" }],
            "name": "Test"
          }
        }
      }
    ]
  },
  "token_id": "<token id>",
  "vendor_account": "your-org",
  "src_ip": "::1",
  "user_id": "[email protected]",
  "user_type": "USER"
}

`admin.routing-rules.updated`

A routing rule update occurred. The data field has the difference between the old and new version of the routing rules document.

{
  "timestamp": "2025-08-11T15:29:16.802Z",
  "action": "admin.routing-rules.updated",
  "user_agent": "Mozilla/5.0 ...",
  "data": {
    "version": {
      "-": "<old version id>",
      "+": "<new version id>"
    },
    "rules": [
      {
        "action": "admin.routing-rules.updated",
        "name": "Test",
        "diff": {
          "approval": [
            {
              "type": {
                "-": "persistent",
                "+": "p0"
              },
              "options": {
                "+": { "allowOneParty": true }
              }
            }
          ]
        }
      }
    ]
  },
  "token_id": "<token id>",
  "vendor_account": "your-org",
  "src_ip": "::1",
  "user_id": "[email protected]",
  "user_type": "USER"
}

`admin.routing-rules.deleted`

A routing rule was deleted. The data field has the difference between the old and new version of the routing rules document.

{
  "timestamp": "2025-08-11T15:29:16.802Z",
  "action": "admin.routing-rules.deleted",
  "user_agent": "Mozilla/5.0 ...",
  "data": {
    "version": {
      "-": "<old version id>",
      "+": "<new version id>"
    },
    "rules": [
      {
        "name": "Test",
        "diff": {
          "-": {
            "requestor": { "type": "any" },
            "name": "Test",
            "approval": [
              {
                "options": { "allowOneParty": true },
                "type": "p0"
              }
            ],
            "disabled": false,
            "resource": { "type": "any" }
          }
        },
        "action": "admin.routing-rules.deleted"
      }
    ]
  },
  "token_id": "<token id>",
  "vendor_account": "your-org",
  "src_ip": "::1",
  "user_id": "[email protected]",
  "user_type": "USER"
}

In routing rule diff payloads, "+" indicates added values and "-" indicates removed values.

JIT configuration actions

These actions are logged when just-in-time access configuration settings are modified.

Default approval configuration

`admin.jit.approval-configuration.updated`

Logged when the default approval settings are modified on the Settings page under the Routing section. This applies when no routing rules are configured.

{
  "action": "admin.routing-rules.approval-configuration.updated",
  "vendor_account": "your-org",
  "timestamp": "2025-01-17T18:11:26.880Z",
  "data": {
    "requireReason": false
  },
  "type": "api"
}

Expiry options

`admin.jit.expiry-option.created`

An expiry option has been created.

{
  "action": "admin.routing-rules.expiry-option.created",
  "type": "api",
  "vendor_account": "your-org",
  "timestamp": "2025-01-17T18:12:43.766Z"
}

`admin.jit.expiry-option.deleted`

An expiry option has been deleted.

{
  "action": "admin.routing-rules.expiry-option.deleted",
  "type": "api",
  "vendor_account": "your-org",
  "timestamp": "2025-01-17T18:12:43.766Z"
}

`admin.jit.expiry-option.reset`

Expiry options have been reset to defaults.

{
  "action": "admin.routing-rules.expiry-option.reset",
  "timestamp": "2025-01-17T18:15:11.458Z",
  "vendor_account": "your-org",
  "type": "api"
}

Role management actions

The system logs these actions when roles are added or removed from users or groups on the Settings page under the Access Control section.

P0 roles include: owner, iamViewer, and manager (approver). You can assign roles to individual users or to groups.

`admin.roles.user.added`

An admin has assigned a role to a user.

{
  "action": "admin.roles.user.added",
  "vendor_account": "your-org",
  "type": "api"
}

`admin.roles.user.deleted`

An admin removed a role from a user.

{
  "action": "admin.roles.user.deleted",
  "vendor_account": "your-org",
  "type": "api"
}

`admin.roles.group.added`

A role is assigned to a group by the system.

{
  "action": "admin.roles.group.added",
  "vendor_account": "your-org",
  "type": "api"
}

`admin.roles.group.deleted`

The system removes a role from a group.

{
  "action": "admin.roles.group.deleted",
  "vendor_account": "your-org",
  "type": "api"
}

Integration install actions

These actions are logged when integrations are installed, updated, or removed.

Terminology:

Term

Definition

Integration

A resource integration such as Google Cloud, AWS, Kubernetes, SSH, or Snowflake

Component

The type of integration capability (for example, IAM management, IAM assessment, Resource Explorer, HTTP Event Collector)

Item

An individual installation identifier (for example, a Google Cloud project ID or an AWS account ID)

`admin.integration.installed`

A new entry installs an integration component.

{
  "action": "admin.integration.installed",
  "vendor_account": "your-org",
  "data": {
    "component": "iam-assessment",
    "id": "test-project",
    "delta": {
      "state": {
        "+": "installed",
        "-": "configure"
      }
    }
  },
  "type": "api"
}

AWS integration example with federated login configuration:

{
  "action": "admin.integration.configured",
  "vendor_account": "your-org",
  "timestamp": "2025-01-16T22:05:23.273Z",
  "type": "api",
  "data": {
    "id": "123452051234",
    "delta": {
      "login": {
        "identity": {
          "-": { "type": "email" }
        },
        "provider": {
          "+": {
            "identityProvider": "test_okta",
            "appId": "appid1",
            "type": "okta",
            "method": {
              "type": "saml",
              "accountCount": { "type": "single" }
            }
          }
        },
        "type": {
          "-": "iam",
          "+": "federated"
        }
      },
      "state": {
        "+": "installed",
        "-": "configure"
      }
    },
    "component": "iam-write"
  }
}

`admin.integration.removed`

The system removed an installation entry from an integration component. This can apply to an entire integration or a specific item.

Component deletion:

{
  "type": "api",
  "data": { "key": "aws" },
  "action": "admin.integration.removed",
  "timestamp": "2025-01-16T21:46:36.144Z",
  "vendor_account": "your-org"
}

Item deletion:

{
  "action": "admin.integration.removed",
  "data": {
    "id": "test-project",
    "component": "iam-assessment"
  },
  "vendor_account": "your-org",
  "type": "api",
  "timestamp": "2025-01-16T22:23:05.096Z"
}

`admin.integration.updated`

An integration component is configured. For example, setting the account ID for an AWS integration before installing any of its components.

{
  "action": "admin.integration.updated",
  "data": {
    "key": "aws",
    "config": {
      "iam-write": {},
      "base": {},
      "inventory": {},
      "iam-assessment": {}
    }
  },
  "timestamp": "2025-01-16T21:46:51.260Z",
  "type": "api",
  "vendor_account": "your-org"
}

API key actions

These actions are logged when API keys for programmatic access to the P0 API are created or deleted.

`admin.api-key.created`

An API key has been created.

{
  "action": "admin.apiKey.created",
  "type": "api",
  "vendor_account": "your-org",
  "timestamp": "2025-01-17T00:48:09.227Z"
}

`admin.api-key.deleted`

An API key has been deleted.

{
  "action": "admin.apiKey.deleted",
  "timestamp": "2025-01-17T00:48:13.129Z",
  "vendor_account": "your-org",
  "type": "api"
}

Permission request actions

These actions are logged when users create, approve, revoke, or deny permission requests through the P0 web application, CLI, or notifier integrations (Slack, Microsoft Teams).

For the approve, revoke, and deny events, the type field is notifier if the user takes the action via Slack or Microsoft Teams, or api if the user takes the action in the P0 web application.

`api.jit.permission-requests.created`

The system has received a request to create a new permission request.

{
  "action": "api.jit.permission-requests.created",
  "user_type": "USER",
  "src_ip": "<ip>",
  "timestamp": "2025-07-07T23:19:20.126Z",
  "user_id": "[email protected]",
  "user_agent": "P0 CLI/0.18.6",
  "vendor_account": "your-org",
  "data": [
    {
      "requestId": "9MMAsmlwAAnHjzNJkE5o",
      "message": "Access requested",
      "processingMillis": 1234,
      "scriptName": "p0",
      "command": [
        "request", "ssh", "session",
        "<instance name>",
        "--public-key", "<public key>"
      ]
    }
  ]
}

`api.jit.permission-requests.approved`

The system has approved a permission request.

{
  "action": "api.jit.permission-requests.approved",
  "vendor_account": "your-org",
  "timestamp": "2025-07-07T23:21:55.636Z",
  "src_ip": "<ip>",
  "params": {
    "requestId": "9MMAsmlwAAnHjzNJkE5o"
  },
  "user_id": "[email protected]",
  "user_agent": "Chrome/137.0.0.0",
  "user_type": "USER"
}

`api.jit.permission-requests.denied`

The system has denied a permission request.

{
  "action": "api.jit.permission-requests.denied",
  "src_ip": "<ip>",
  "params": {
    "requestId": "aeRv8bsBOBvYbMXsNjrI"
  },
  "user_type": "USER",
  "user_id": "[email protected]",
  "vendor_account": "your-org",
  "user_agent": "Chrome/137.0.0.0",
  "timestamp": "2025-07-07T23:30:48.275Z"
}

`api.jit.permission-requests.revoked`

A permission request has been revoked.

{
  "action": "api.jit.permission-requests.revoked",
  "params": {
    "requestId": "9MMAsmlwAAnHjzNJkE5o"
  },
  "user_agent": "Chrome/137.0.0.0",
  "user_id": "[email protected]",
  "user_type": "USER",
  "timestamp": "2025-07-07T23:26:00.701Z",
  "vendor_account": "your-org",
  "src_ip": "<ip>"
}

Permission request lifecycle

The following audit events are logged as P0 processes a permission request through its lifecycle. These are system-generated events that track internal state transitions.

`permission-requests.created`

A permission request has been created and is in the NEW state.

{
  "action": "permission-requests.created",
  "timestamp": "2025-07-08T21:46:13.323Z",
  "request_id": "kYdqnPxnb7Gugp2iqKR5",
  "data": {
    "commandLine": "request ssh session <instance name> --sudo false",
    "requestor": "[email protected]",
    "approvedOnly": false,
    "access": "session",
    "permission": {
      "provider": "gcloud",
      "destination": "<instance name>",
      "sudo": false,
      "publicKey": "<public key>",
      "parent": "<project id>",
      "resource": {
        "zone": "<zone>",
        "projectId": "<project id>",
        "instanceName": "<instance name>",
        "fullName": "<resource id>"
      },
      "zone": "<zone>"
    },
    "lastUpdatedTimestamp": 1752011173323,
    "type": "ssh",
    "principal": "[email protected]",
    "status": "NEW",
    "requestedTimestamp": 1752011173323
  }
}

`permission-requests.granted`

A permission request has been granted and access has been provisioned.

{
  "action": "permission-requests.granted",
  "timestamp": "2025-07-07T23:22:05.166Z",
  "request_id": "9MMAsmlwAAnHjzNJkE5o",
  "data": {
    "access": "session",
    "approvalDetails": {
      "approvalSource": "webapp",
      "approvedTimestamp": 1751930515300,
      "id": "[email protected]",
      "email": "[email protected]",
      "name": "[email protected]"
    },
    "principal": "[email protected]",
    "canEscalate": false,
    "requestedTimestamp": 1751930359906,
    "grantTimestamp": 1751930525165,
    "permission": {
      "zone": "<zone>",
      "parent": "<project id>",
      "provider": "gcloud",
      "resource": {
        "fullName": "<resource name>",
        "instanceName": "<instance name>",
        "zone": "<zone>",
        "projectId": "<project id>"
      },
      "destination": "<instance name>",
      "publicKey": "<public key>",
      "sudo": false
    },
    "type": "ssh",
    "requestor": "[email protected]",
    "lastUpdatedTimestamp": 1751930525166,
    "status": "DONE",
    "approvedOnly": false,
    "expiryTimestamp": 1751930815529,
    "isAwaitingExpiry": true,
    "commandLine": "request ssh session <instance name> --sudo false"
  }
}

`permission-requests.denied`

The system has denied the permission request.

{
  "action": "permission-requests.denied",
  "request_id": "Dc7PgjoZSYpG47wAi7H4",
  "data": {
    "approvalDetails.id": "[email protected]",
    "approvalDetails.email": "[email protected]",
    "approvalDetails.name": "[email protected]",
    "approvalDetails.approvedTimestamp": 1751995305355,
    "approvalDetails.approvalSource": "webapp",
    "status": "DENIED"
  },
  "timestamp": "2025-07-08T17:21:45.497Z"
}

`permission-requests.revoked`

A permission request has been revoked and access has been deprovisioned.

{
  "action": "permission-requests.revoked",
  "request_id": "9MMAsmlwAAnHjzNJkE5o",
  "timestamp": "2025-07-07T23:26:03.241Z",
  "data": {
    "requestor": "[email protected]",
    "requestedTimestamp": 1751930359906,
    "isAwaitingExpiry": false,
    "approvalDetails": {
      "approvedTimestamp": 1751930515300,
      "id": "[email protected]",
      "name": "[email protected]",
      "email": "[email protected]",
      "approvalSource": "webapp"
    },
    "grantTimestamp": 1751930525165,
    "principal": "[email protected]",
    "approvedOnly": false,
    "commandLine": "request ssh session <instance name> --sudo false",
    "type": "ssh",
    "expiryTimestamp": 1751930815529,
    "access": "session",
    "permission": {
      "destination": "<instance name>",
      "sudo": false,
      "parent": "<project id>",
      "zone": "<zone>",
      "resource": {
        "fullName": "<resource name>",
        "zone": "<zone>",
        "instanceName": "<instance name>",
        "projectId": "<project id>"
      },
      "publicKey": "<public key>",
      "provider": "gcloud"
    },
    "lastUpdatedTimestamp": 1751930763241,
    "status": "REVOKED",
    "canEscalate": false,
    "revokedTimestamp": 1751930763241
  }
}

`permission-requests.expired`

A permission request has expired and access has been automatically deprovisioned.

{
  "action": "permission-requests.expired",
  "timestamp": "2025-07-08T16:52:37.198Z",
  "request_id": "R4EuCBttAGQIPfreDfVC",
  "data": {
    "principal": "[email protected]",
    "approvalDetails": {
      "approvalSource": "webapp",
      "email": "[email protected]",
      "name": "[email protected]",
      "id": "[email protected]",
      "approvedTimestamp": 1751993254002
    },
    "isAwaitingExpiry": false,
    "approvedOnly": false,
    "access": "session",
    "permission": {
      "provider": "gcloud",
      "parent": "<project id>",
      "publicKey": "<public key>",
      "zone": "<zone>",
      "resource": {
        "projectId": "<project id>",
        "zone": "<zone>",
        "instanceName": "<instance name>",
        "fullName": "<resource name>"
      },
      "sudo": false,
      "destination": "<instance name>"
    },
    "expiryTimestamp": 1751993554159,
    "revokedTimestamp": 1751993557198,
    "lastUpdatedTimestamp": 1751993557198,
    "type": "ssh",
    "requestor": "[email protected]",
    "commandLine": "request ssh session <instance name> --sudo false",
    "status": "EXPIRED",
    "grantTimestamp": 1751993258475,
    "requestedTimestamp": 1751993250693,
    "canEscalate": false
  }
}

Pre-approval lifecycle actions

These actions are logged when pre-approvals are created or revoked.

`api.jit.preapproval.created`

A new pre-approval was created.

{
  "action": "api.jit.preapproval.created",
  "data": {
    "type": "ssh",
    "access": "group",
    "permission": {
      "provider": "aws",
      "name": "group-name",
      "key": "Developer",
      "sudo": false,
      "parent": "391052057035",
      "alias": "p0-dev",
      "resource": {}
    },
    "allowId": "32cdcab1-bae1-4a21-9fc3-a4234cac87f6",
    "source": "allow",
    "principal": "[email protected]",
    "isAwaitingExpirationReminder": true,
    "expirationReminderTimestamp": 1755302400000,
    "approver": {
      "approvalSource": "evidence",
      "approvedTimestamp": 1754330463656,
      "id": "[email protected]",
      "name": "[email protected]",
      "email": "[email protected]"
    },
    "startsAt": 1754330463656,
    "endsAt": 1756512000000,
    "createdAt": 1754330463723
  },
  "prior_approval_id": "PzCPjpJeYgAGw3koW6Tb",
  "status": "created",
  "timestamp": 1754330464112,
  "type": "prior-approval"
}

`api.jit.preapproval.revoked`

An existing pre-approval has been manually revoked.

{
  "action": "api.jit.preapproval.revoked",
  "data": {
    "evidenceId": "TX7lyLXt29zcGumgxWyW"
  },
  "params": {
    "evidenceId": "TX7lyLXt29zcGumgxWyW"
  },
  "status": "created",
  "timestamp": 1754331366618,
  "vendor_account": "your-org",
  "src_ip": "::1",
  "type": "api",
  "user_agent": "Mozilla/5.0 ...",
  "user_type": "USER",
  "user_id": "[email protected]",
  "token_id": "<token id>"
}

Authentication and authorization actions

These actions are logged when P0 receives invalid authentication or authorization requests.

`auth.authentication.failed`

A call to the API lacked a valid access token.

{
  "action": "auth.authentication.failed",
  "src_ip": "209.169.98.86",
  "status": "CREATED",
  "timestamp": 1754006124918,
  "type": "api",
  "user_agent": "Mozilla/5.0 ...",
  "vendor_account": "your-org",
  "user_type": "USER",
  "user_id": "[email protected]",
  "token_id": "<token id>"
}

`auth.authorization.failed`

A call to the API had a valid access token but attempted an action the user lacked permissions for.

{
  "action": "auth.authorization.failed",
  "src_ip": "209.169.98.86",
  "status": "CREATED",
  "timestamp": 1754006124918,
  "type": "api",
  "user_agent": "Mozilla/5.0 ...",
  "vendor_account": "your-org",
  "user_type": "USER",
  "user_id": "[email protected]",
  "token_id": "<token id>",
  "data": {
    "permissions": ["integration.read", "catalog.view"],
    "roles": ["owner"]
  }
}

PreviousSIEM Integrations NextDatadog Setup

Last updated 12 days ago

hashtagGeneral fields

hashtagExample payload

hashtagAction hierarchy

hashtagRouting rule actions

hashtagadmin.routing-rules.created

hashtagadmin.routing-rules.updated

hashtagadmin.routing-rules.deleted

hashtagJIT configuration actions

hashtagDefault approval configuration

hashtagadmin.jit.approval-configuration.updated

hashtagExpiry options

hashtagadmin.jit.expiry-option.created

hashtagadmin.jit.expiry-option.deleted

hashtagadmin.jit.expiry-option.reset

hashtagRole management actions

hashtagadmin.roles.user.added

hashtagadmin.roles.user.deleted

hashtagadmin.roles.group.added

hashtagadmin.roles.group.deleted

hashtagIntegration install actions

hashtagadmin.integration.installed

hashtagadmin.integration.removed

hashtagadmin.integration.updated

hashtagAPI key actions

hashtagadmin.api-key.created

hashtagadmin.api-key.deleted

hashtagPermission request actions

hashtagapi.jit.permission-requests.created

hashtagapi.jit.permission-requests.approved

hashtagapi.jit.permission-requests.denied

hashtagapi.jit.permission-requests.revoked

hashtagPermission request lifecycle

hashtagpermission-requests.created

hashtagpermission-requests.granted

hashtagpermission-requests.denied

hashtagpermission-requests.revoked

hashtagpermission-requests.expired

hashtagPre-approval lifecycle actions

hashtagapi.jit.preapproval.created

hashtagapi.jit.preapproval.revoked

hashtagAuthentication and authorization actions

hashtagauth.authentication.failed

hashtagauth.authorization.failed

General fields

Example payload

Action hierarchy

Routing rule actions

`admin.routing-rules.created`

`admin.routing-rules.updated`

`admin.routing-rules.deleted`

JIT configuration actions

Default approval configuration

`admin.jit.approval-configuration.updated`

Expiry options

`admin.jit.expiry-option.created`

`admin.jit.expiry-option.deleted`

`admin.jit.expiry-option.reset`

Role management actions

`admin.roles.user.added`

`admin.roles.user.deleted`

`admin.roles.group.added`

`admin.roles.group.deleted`

Integration install actions

`admin.integration.installed`

`admin.integration.removed`

`admin.integration.updated`

API key actions

`admin.api-key.created`

`admin.api-key.deleted`

Permission request actions

`api.jit.permission-requests.created`

`api.jit.permission-requests.approved`

`api.jit.permission-requests.denied`

`api.jit.permission-requests.revoked`

Permission request lifecycle

`permission-requests.created`

`permission-requests.granted`

`permission-requests.denied`

`permission-requests.revoked`

`permission-requests.expired`

Pre-approval lifecycle actions

`api.jit.preapproval.created`

`api.jit.preapproval.revoked`

Authentication and authorization actions

`auth.authentication.failed`

`auth.authorization.failed`