AuditLogSummary

countsByActorType
Type: object

Event count per actor type. Counts EVENTS — see distinctActorsByType for a count of principals.

Properties: 1
countsByCategory
Type: object

Event count per category, tier-clamped.

Properties: 1
countsByOutcome
Type: object

Event count per outcome (success, failure, denied).

Properties: 1
distinctActorCount
Type: integer

Sum of distinctActorsByType.
distinctActorsByType
Type: object

Distinct acting principals per actor type, identified by user id or API-key id. System-originated rows have neither and report 0. A user who acted both as themselves and while impersonated counts once under each type.

Properties: 1
flagCounts
Type: object

Event counts for the two metadata flags surfaced as explorer filters, keyed isPrivilegedGrant and dataExposureRisk.

Properties: 1
healthNote
enum
const:
pipeline_not_yet_active

Present only when pipelineHealth is green due to pipeline being not yet active
lastEventAt
Type: stringFormat: date-timenullable

the date-time notation as defined by RFC 3339, section 5.6, for example, 2017-07-21T17:32:28Z
lastHeartbeatAt
Type: stringFormat: date-timenullable

When the heartbeat writer last proved the pipeline alive for this tenant; null before the first heartbeat. pipelineHealth is derived from this, so it shows how stale a non-green signal is.
openGaps
Type: array of object
Properties: 2
pipelineHealth
Type: "green" or "yellow" or "red"enum
windowDays
Type: integer

Length of the aggregation window, in days.