Embedded Json Audit Log Schema

import useBaseUrl from '@docusaurus/useBaseUrl';

The audit log JSON schema functions as a standardized blueprint or schematic that consistently defines how a single event should appear when being written to the audit log, including: field names, data types, objects, and structure.

An outline of the JSON audit logging schema is provided below. See the JSON data model for additional details.

{
    "timestamp": "",       // Event time
    "status": "",          // Success or failure of the audited event or activity
    "event_name": "",      // Logged event name
    "error": {             // Error if status = fail
        "status_code": 0,
        "description": ""
    },
    "actor": {             // The user performing the action
        "user_id": ""           // Unique identifier of the event user
        "session_id": ""        // Unique session identifier of the event user
        "client": ""            // User agent of the client/platform in use by the event user
        "ip_address": ""        // IPv4/IPv6 IP address of the event user
    },
    "event": {             // Event-specific data
        "parameters": {}        // Map containing parameters of the audited event or activity
        "prior_state": {}       // Pre-event state of the object
        "resulting_state": {}   // Post-event state of the object
        "object_type": ""       // Object targeted by the event or activity
    },
    "meta": {
        "api_path": "",                    // API endpoint interacted with for event or activity
        "cluster_id": ""                   // Unique identifier of the cluster in use by the event user
        "non_channel_member_access": false // true if user accessed channel content without being a member (v11.5.0+)
        "user_access_token_id": ""         // Unique identifier of the Personal Access Token used to authenticate the request (v11.11.0+)
    }
}

Audit log record examples¶

Update user preferences¶

{
    "timestamp": "2022-08-17 20:37:52.846 +01:00",
    "event_name": "updatePreferences",
    "status": "success",
    "actor": {
        "user_id": "aw8ehkwaziytzry1qqxi9tsqwh",
        "session_id": "kth3jyadc3b1p84kbz6y3o75na",
        "client": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6 Safari/605.1.15",
        "ip_address": "192.168.0.169"
    },
    "event": {
        "parameters": {},
        "prior_state": {},
        "resulting_state": {},
        "object_type": ""
    },
    "meta": {
        "api_path": "/api/v4/users/aw8ehkwaziytzry1qqxi9tsqwh/preferences",
        "cluster_id": "8dxdbfx6fpdwtki1z6n8whtkho"
    },
    "error": {}
}

Create post¶

{
    "timestamp": "2025-04-30 16:17:44.207 Z",
    "event_name": "createPost",
    "status": "success",
    "actor": {
        "user_id": "i764hi6h5bbz8p1955ed4ahj6y",
        "session_id": "t7894ft76igtpb788nkkej1yoy",
        "client": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36",
        "ip_address": "172.19.0.8"
    },
    "event": {
        "parameters": {
            "post": {
                "channel_id": "pfis7ycuy78o7m3zebajmxqeuo",
                "user_id": "i764hi6h5bbz8p1955ed4ahj6y",
                "message": "Sample post content"
            }
        },
        "prior_state": {},
        "resulting_state": {
            "channel_id": "pfis7ycuy78o7m3zebajmxqeuo",
            "create_at": 1746029864145,
            "id": "xpw97hf6kfncirzhqisb5sym7e",
            "user_id": "i764hi6h5bbz8p1955ed4ahj6y"
        },
        "object_type": "post"
    },
    "meta": {
        "api_path": "/api/v4/posts",
        "cluster_id": "i5twhjm3ainatcifiy3oksshae"
    },
    "error": {}
}

System configuration change¶

{
    "timestamp": "2025-04-30 16:18:30.803 Z",
    "event_name": "patchConfig",
    "status": "success",
    "actor": {
        "user_id": "i764hi6h5bbz8p1955ed4ahj6y",
        "session_id": "t7894ft76igtpb788nkkej1yoy",
        "client": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36",
        "ip_address": "172.19.0.8"
    },
    "event": {
        "parameters": {},
        "prior_state": {
            "config_diffs": [
                {
                    "actual_val": false,
                    "base_val": true,
                    "path": "MetricsSettings.EnableClientMetrics"
                }
            ]
        },
        "resulting_state": {},
        "object_type": "config"
    },
    "meta": {
        "api_path": "/api/v4/config/patch",
        "cluster_id": "i5twhjm3ainatcifiy3oksshae"
    },
    "error": {}
}

Audit event types¶

The following tables list the comprehensive audit event types (event_name values) that are captured in Mattermost audit logs:

User Management Events¶

Event Name	Description
`attachDeviceId`	Attaching device IDs to user sessions
`createUser`	Creating new user accounts
`createUserAccessToken`	Creating user access tokens
`deleteUser`	Deleting user accounts
`demoteUserToGuest`	Demoting users to guest status
`disableUserAccessToken`	Disabling user access tokens
`enableUserAccessToken`	Enabling user access tokens
`followThreadByUser`	Following message threads by user
`getUserAudits`	Retrieving user audit logs
`login`	User login events
`logout`	User logout events
`migrateAuthToLdap`	Migrating user authentication to LDAP
`migrateAuthToSaml`	Migrating user authentication to SAML
`patchUser`	Updating user properties
`promoteGuestToUser`	Promoting guest users to regular users
`resetPassword`	Resetting user passwords
`resetPasswordFailedAttempts`	Resetting password failed attempt counters
`revokeUserAccessToken`	Revoking user access tokens
`sendPasswordReset`	Sending password reset emails
`sendVerificationEmail`	Sending email verification messages
`setDefaultProfileImage`	Setting default profile images
`setProfileImage`	Setting custom profile images
`setUnreadThreadByPostId`	Setting unread thread status by post ID
`switchAccountType`	Switching account types
`unfollowThreadByUser`	Unfollowing message threads by user
`updatePassword`	Updating user passwords
`updateReadStateAllThreadsByUser`	Updating read state for all threads by user
`updateReadStateThreadByUser`	Updating read state for specific threads by user
`updateUser`	Updating user account information
`updateUserActive`	Updating user active/inactive status
`updateUserAuth`	Updating user authentication settings
`updateUserMfa`	Updating user multi-factor authentication
`updateUserRoles`	Updating user roles and permissions
`verifyUserEmail`	Verifying user email addresses
`verifyUserEmailWithoutToken`	Verifying user email without token

Channel Management Events¶

Event Name	Description
`addChannelMember`	Adding members to channels
`convertGroupMessageToChannel`	Converting group messages to channels
`createChannel`	Creating new channels
`createChannelBookmark`	Creating channel bookmarks
`createDirectChannel`	Creating direct message channels
`createGroupChannel`	Creating group message channels
`deleteChannel`	Deleting channels
`deleteChannelBookmark`	Deleting channel bookmarks
`moveChannel`	Moving channels between teams
`patchChannel`	Updating channel properties
`patchChannelModerations`	Updating channel moderation settings
`removeChannelMember`	Removing members from channels
`restoreChannel`	Restoring deleted channels
`setChannelMembers`	Bulk set (replace) channel memberships
`updateChannel`	Updating channel information
`updateChannelBookmark`	Updating channel bookmarks
`updateChannelBookmarkSortOrder`	Updating channel bookmark sort order
`updateChannelMemberNotifyProps`	Updating channel member notification properties
`updateChannelMemberRoles`	Updating channel member roles
`updateChannelMemberSchemeRoles`	Updating channel member scheme roles
`updateChannelPrivacy`	Updating channel privacy settings
`updateChannelScheme`	Updating channel permission schemes

Team Management Events¶

Event Name	Description
`addTeamMember`	Adding members to teams
`addTeamMembers`	Adding multiple members to teams
`addUserToTeamFromInvite`	Adding users to teams from invitations
`createTeam`	Creating new teams
`deleteTeam`	Deleting teams
`invalidateAllEmailInvites`	Invalidating all email invitations
`inviteGuestsToChannels`	Inviting guests to channels
`inviteUsersToTeam`	Inviting users to teams
`patchTeam`	Updating team properties
`regenerateTeamInviteId`	Regenerating team invitation IDs
`removeTeamIcon`	Removing team icons
`removeTeamMember`	Removing members from teams
`restoreTeam`	Restoring deleted teams
`setTeamIcon`	Setting team icons
`updateTeam`	Updating team information
`updateTeamMemberRoles`	Updating team member roles
`updateTeamMemberSchemeRoles`	Updating team member scheme roles
`updateTeamPrivacy`	Updating team privacy settings
`updateTeamScheme`	Updating team permission schemes

Posts & Content Events¶

Event Name	Description
`createPost`	Creating new posts
`createSchedulePost`	Creating scheduled posts
`deletePost`	Deleting posts
`deleteScheduledPost`	Deleting scheduled posts
`moveThread`	Moving message threads
`patchPost`	Updating post properties
`restorePostVersion`	Restoring previous post versions
`saveIsPinnedPost`	Saving pinned post status
`searchPosts`	Searching through posts
`updatePost`	Updating post content
`updateScheduledPost`	Updating scheduled posts

From Mattermost v11.5.0, audit log entries for posts and content access events include a non_channel_member_access field in the meta object. When a user accesses posts or content in a channel they are not a member of, this field is set to true. Admins can use this indicator to identify and review unauthorized or unexpected content access in their audit logs.

From Mattermost v11.11.0, audit log entries for requests authenticated via a Personal Access Token include a user_access_token_id field in the meta object, identifying the token used. This lets admins trace which token was used for a given request without cross-referencing the Sessions database table.

Post Delivery Events¶

Mattermost v12.0 introduces the postDelivered audit log event, which records each delivery of a message's content to a user or an integration. It's emitted only when post delivery audit logging is enabled, which is disabled by default. Unlike the other audit log events on this page, postDelivered is emitted at the dedicated audit-delivery log level and so requires its own audit log target. See that page for the record format, the payload fields, and the full set of delivery mechanisms.

Event Name	Description
`postDelivered`	Delivering post content to a user or integration
`updateDeliveryTrackingConfig`	Updating the post delivery audit logging configuration

Authentication and Security Events¶

Event Name	Description
`addLdapPrivateCertificate`	Adding LDAP private certificates
`addLdapPublicCertificate`	Adding LDAP public certificates
`addSamlIdpCertificate`	Adding SAML IDP certificates
`addSamlPrivateCertificate`	Adding SAML private certificates
`addSamlPublicCertificate`	Adding SAML public certificates
`completeSaml`	Completing SAML authentication. `meta.user_created` is true when the login provisioned a new account via JIT.
`extendSessionExpiry`	Extending session expiry times
`idMigrateLdap`	Migrating IDs to LDAP
`linkLdapGroup`	Linking LDAP groups
`removeLdapPrivateCertificate`	Removing LDAP private certificates
`removeLdapPublicCertificate`	Removing LDAP public certificates
`removeSamlIdpCertificate`	Removing SAML IDP certificates
`removeSamlPrivateCertificate`	Removing SAML private certificates
`removeSamlPublicCertificate`	Removing SAML public certificates
`revokeAllSessionsAllUsers`	Revoking all sessions for all users
`revokeAllSessionsForUser`	Revoking all sessions for specific user
`revokeSession`	Revoking individual sessions
`syncLdap`	Synchronizing LDAP data
`unlinkLdapGroup`	Unlinking LDAP groups

System Administration Events¶

Event Name	Description
`clearServerBusy`	Clearing server busy status
`completeOnboarding`	Completing system onboarding
`configReload`	Reloading system configuration
`databaseRecycle`	Recycling database connections
`downloadLogs`	Downloading system logs
`getAppliedSchemaMigrations`	Getting applied schema migrations
`getAudits`	Retrieving audit logs
`getConfig`	Getting system configuration
`getLogs`	Getting system logs
`getOnboarding`	Getting onboarding status
`invalidateCaches`	Invalidating system caches
`migrateConfig`	Migrating configuration
`muteHealthFinding`	Muting a Health Dashboard finding
`patchConfig`	Updating configuration properties
`queryLogs`	Querying system logs
`restartServer`	Restarting server
`setServerBusy`	Setting server busy status
`unmuteHealthFinding`	Unmuting a Health Dashboard finding
`updateConfig`	Updating system configuration
`updateViewedProductNotices`	Updating viewed product notices
`upgradeToEnterprise`	Upgrading to Enterprise edition

File Management Events¶

Event Name	Description
`createUpload`	Creating file uploads
`getFile`	Retrieving files
`getFileLink`	Getting file links
`uploadData`	Uploading data
`uploadFileMultipart`	Uploading multipart files
`uploadFileMultipartLegacy`	Uploading legacy multipart files
`uploadFileSimple`	Uploading simple files

OAuth Applications Events¶

Event Name	Description
`authorizeOAuthApp`	Authorizing OAuth applications
`authorizeOAuthPage`	OAuth authorization page access
`completeOAuth`	Completing OAuth/OIDC authentication. `meta.user_created` is true when the login provisioned a new account via JIT.
`createOAuthApp`	Creating OAuth applications
`deauthorizeOAuthApp`	Deauthorizing OAuth applications
`deleteOAuthApp`	Deleting OAuth applications
`getAccessToken`	Getting OAuth access tokens
`loginWithOAuth`	Login with OAuth
`mobileLoginWithOAuth`	Mobile login with OAuth
`regenerateOAuthAppSecret`	Regenerating OAuth app secrets
`signupWithOAuth`	Signup with OAuth
`updateOAuthApp`	Updating OAuth applications

Webhooks Events¶

Event Name	Description
`createIncomingHook`	Creating incoming webhooks
`createOutgoingHook`	Creating outgoing webhooks
`deleteIncomingHook`	Deleting incoming webhooks
`deleteOutgoingHook`	Deleting outgoing webhooks
`getIncomingHook`	Getting incoming webhooks
`getOutgoingHook`	Getting outgoing webhooks
`regenOutgoingHookToken`	Regenerating outgoing webhook tokens
`updateIncomingHook`	Updating incoming webhooks
`updateOutgoingHook`	Updating outgoing webhooks

Slash Commands Events¶

Event Name	Description
`createCommand`	Creating slash commands
`deleteCommand`	Deleting slash commands
`executeCommand`	Executing slash commands
`moveCommand`	Moving slash commands
`regenCommandToken`	Regenerating command tokens
`updateCommand`	Updating slash commands

Plugins Events¶

Event Name	Description
`disablePlugin`	Disabling plugins
`enablePlugin`	Enabling plugins
`getFirstAdminVisitMarketplaceStatus`	Getting first admin visit marketplace status
`installMarketplacePlugin`	Installing marketplace plugins
`installPluginFromURL`	Installing plugins from URL
`removePlugin`	Removing plugins
`setFirstAdminVisitMarketplaceStatus`	Setting first admin visit marketplace status
`uploadPlugin`	Uploading plugins

Groups & LDAP Events¶

Event Name	Description
`addGroupMembers`	Adding members to groups
`addUserToGroupSyncables`	Adding users to group syncables
`createGroup`	Creating new groups
`deleteGroup`	Deleting groups
`deleteGroupMembers`	Removing members from groups
`linkGroupSyncable`	Linking group syncables to teams/channels
`patchGroup`	Updating group properties
`patchGroupSyncable`	Updating group syncable properties
`restoreGroup`	Restoring deleted groups
`unlinkGroupSyncable`	Unlinking group syncables from teams/channels

Remote Clusters Events¶

Event Name	Description
`createRemoteCluster`	Creating remote cluster connections
`deleteRemoteCluster`	Deleting remote cluster connections
`generateRemoteClusterInvite`	Generating invites for remote clusters
`inviteRemoteClusterToChannel`	Inviting remote clusters to channels
`patchRemoteCluster`	Updating remote cluster properties
`remoteClusterAcceptInvite`	Accepting remote cluster invites
`remoteClusterAcceptMessage`	Accepting messages from remote clusters
`remoteUploadProfileImage`	Uploading profile images from remote clusters
`uninviteRemoteClusterToChannel`	Removing remote cluster invites from channels
`uploadRemoteData`	Uploading data from remote clusters

Data Retention Events¶

Event Name	Description
`addChannelsToPolicy`	Adding channels to data retention policies
`addTeamsToPolicy`	Adding teams to data retention policies
`createPolicy`	Creating data retention policies
`deletePolicy`	Deleting data retention policies
`patchPolicy`	Updating data retention policies
`removeChannelsFromPolicy`	Removing channels from data retention policies
`removeTeamsFromPolicy`	Removing teams from data retention policies

Jobs Events¶

Event Name	Description
`cancelJob`	Canceling background jobs
`createJob`	Creating new background jobs
`jobServer`	Job server operations
`updateJobStatus`	Updating job status/progress

Licensing Events¶

Event Name	Description
`addLicense`	Adding enterprise licenses
`localAddLicense`	Local license addition (cluster mode)
`localRemoveLicense`	Local license removal (cluster mode)
`removeLicense`	Removing enterprise licenses
`requestTrialLicense`	Requesting trial licenses

Bot Management Events¶

Event Name	Description
`assignBot`	Assigning bots to users
`convertBotToUser`	Converting bot accounts to user accounts
`convertUserToBot`	Converting user accounts to bot accounts
`createBot`	Creating new bot accounts
`patchBot`	Updating bot account properties
`updateBotActive`	Updating bot account active/inactive status

Custom Emojis Events¶

Event Name	Description
`createEmoji`	Creating custom emojis
`deleteEmoji`	Deleting custom emojis

Branding Events¶

Event Name	Description
`deleteBrandImage`	Deleting brand images
`uploadBrandImage`	Uploading brand images

Search Events¶

Event Name	Description
`purgeBleveIndexes`	Purging Bleve search indexes
`purgeElasticsearchIndexes`	Purging Elasticsearch search indexes

Roles and Schemes Events¶

Event Name	Description
`createScheme`	Creating permission schemes
`deleteScheme`	Deleting permission schemes
`patchRole`	Updating role permissions
`patchScheme`	Updating permission schemes

Preferences Events¶

Event Name	Description
`deletePreferences`	Deleting user preferences
`updatePreferences`	Updating user preferences

Channel Categories Events¶

Event Name \| Description
`createCategoryForTeamForUser` \| Creating channel categories for users
`deleteCategoryForTeamForUser`		Deleting channel categories for users
`updateCategoriesForTeamForUser`		Updating multiple channel categories for users
`updateCategoryForTeamForUser`		Updating single channel category for users
`updateCategoryOrderForTeamForUser`		Updating channel category order for users

Export and Import Events¶

Event Name	Description
`bulkExport`	Bulk data export operations
`bulkImport`	Bulk data import operations
`deleteExport`	Deleting export files
`deleteImport`	Deleting import files
`generatePresignURLExport`	Generating presigned URLs for exports
`scheduleExport`	Scheduling export operations

Access Control Events¶

Event Name	Description
`applyIPFilters`	Applying IP filtering rules
`assignAccessPolicy`	Assigning access policies to users/teams
`createAccessControlPolicy`	Creating new access control policies
`deleteAccessControlPolicy`	Deleting access control policies
`unassignAccessPolicy`	Unassigning access policies from users/teams
`updateActiveStatus`	Updating active status of access control policies

User Attributes Events¶

Event Name	Description
`createCPAField`	Creating custom profile attribute fields
`deleteCPAField`	Deleting custom profile attribute fields
`patchCPAField`	Updating custom profile attribute fields
`patchCPAValues`	Updating custom profile attribute values

Outgoing OAuth Connections Events¶

Event Name	Description
`createOutgoingOauthConnection`	Creating outgoing OAuth connections
`deleteOutgoingOAuthConnection`	Deleting outgoing OAuth connections
`updateOutgoingOAuthConnection`	Updating outgoing OAuth connections
`validateOutgoingOAuthConnectionCredentials`	Validating outgoing OAuth connection credentials

Terms of Service Events¶

Event Name	Description
`createTermsOfService`	Creating terms of service
`saveUserTermsOfService`	Saving user acceptance of terms of service

Compliance and Audit Events¶

Event Name	Description
`addAuditLogCertificate`	Adding audit log certificates
`createComplianceReport`	Creating compliance reports
`downloadComplianceReport`	Downloading compliance reports
`getComplianceReport`	Getting compliance reports
`getComplianceReports`	Getting multiple compliance reports
`removeAuditLogCertificate`	Removing audit log certificates

Local Operations Events¶

Event Name	Description
`localCheckIntegrity`	Local integrity checks
`localCreateChannel`	Local channel creation
`localCreateCommand`	Local command creation
`localCreateIncomingHook`	Local incoming webhook creation
`localCreateTeam`	Local team creation
`localDeleteChannel`	Local channel deletion
`localDeletePost`	Local post deletion
`localDeleteTeam`	Local team deletion
`localDeleteUser`	Local user deletion
`localGetClientConfig`	Local client configuration retrieval
`localGetConfig`	Local configuration retrieval
`localInviteUsersToTeam`	Local user invitation to teams
`localMoveChannel`	Local channel moving
`localPatchChannel`	Local channel patching
`localPatchConfig`	Local configuration patching
`localPermanentDeleteAllUsers`	Local permanent deletion of all users
`localRemoveChannelMember`	Local channel member removal
`localRestoreChannel`	Local channel restoration
`localUpdateChannelPrivacy`	Local channel privacy update
`localUpdateConfig`	Local configuration update

AI Recap Events¶

Recap events include a channel_id in the event parameters, indicating which channel's content was accessed during the recap operation. Use this field when reviewing audit logs for compliance or access monitoring.

Event Name	Description
`createRecap`	Creating channel recaps
`deleteRecap`	Deleting channel recaps
`getRecap`	Retrieving channel recaps
`getRecaps`	Retrieving multiple channel recaps
`markRecapAsRead`	Marking channel recaps as read
`regenerateRecap`	Regenerating channel recaps

This comprehensive list includes all audit events captured by Mattermost across all major system operations. Additional events may be logged depending on your Mattermost version, enabled features, and configuration settings. Enterprise and Enterprise Advanced features may generate additional audit events.

JSON data model¶

Name	Type	Description
timestamp	int64	Date/time when event or activity has taken place. \| Mattermost currently supports three log formats: plain, JSON, and \| GELF. \| \| - Plain log format uses RFC3339 by default. \| See the plain log format configuration documentation for supported options. \| - JSON log format uses RFC3339 by default. \| See the JSON log format configuration documentation for supported options. \| \| - GELF log format uses unixtime. \| See the GELF log format configuration documentation for supported options. \|
event_name	string	Unique name and identifier of the event type taking place. See the audit event types section for a comprehensive list of all supported event names.
status	string	Success or failure of the audited event.
event	EventData	Event parameters and object states.
actor	EventActor	User involved with the event.
meta	EventMeta	Related event metadata.
error	EventError	The resulting error if the status is in a failed state.

EventData¶

Field name	Data type	Description
parameters	map	Payload and parameters being processed as part of the request.
prior_state	map	Prior state of the entity being modified. `null` if there was no prior state.
resulting_state	map	Resulting entity after creating or modifying it.
object_type	string	String representation of the entity type (e.g. post)

EventActor¶

Field name	Data type	Description
user_id	string	Unique identifier of the event actor.
session_id	string	Unique session identifier of the event actor.
client	string	User agent of the client/platform in use by the event actor.
ip_address	string	IPv4/IPv6 IP address of the event actor.

EventMeta¶

Field name	Data type	Description
api_path	string	The REST endpoint which caused the event.
cluster_id	integer	Cluster identifier.
non_channel_member_access	boolean	(Optional) Available from v11.5.0. Set to `true` when a user \| accesses posts or content in a channel they are not a member of.
user_access_token_id	string	(Optional) Available from v11.11.0. Unique identifier of the Personal Access Token used to authenticate the request. Present only when the session is authenticated via a Personal Access Token (human or bot).

EventError¶

Field name	Data type	Description
description	string	(Optional) Error description.
status_code	integer	(Optional) Error status code.