Audit Event Types
This document provides a reference of all audit event types emitted by the Verified Orchestration platform. Each event has a stable Event Type ID that can be used for filtering and alerting in SIEM systems.
Event Schema
Audit events are sent to Azure Log Analytics with the following structure:
| Field | Description |
|---|---|
EventTime | ISO 8601 timestamp of when the event occurred |
EventTypeId | Stable event code (e.g., VO0010) - never changes once assigned |
EventType | Semantic event type (e.g., api.graphql.operation) |
Message | Human-readable description of the event |
Properties | Additional context specific to the event type |
Event Type ID Format
Event Type IDs follow the format VO#### where:
VO= Verified Orchestration (organization prefix)####= Sequential number assigned to each event type
Important: Event Type IDs are stable identifiers that never change once assigned. Use these for SIEM rules and alerts.
API Events
Events related to API operations including GraphQL queries, mutations, and subscriptions.
| Event Type ID | Event Type | Description |
|---|---|---|
VO0010 | api.graphql.operation | API GraphQL operation |
VO0011 | api.graphql.query | API GraphQL query |
VO0012 | api.graphql.mutation | API GraphQL mutation |
VO0013 | api.graphql.subscription | API GraphQL subscription |
OIDC Events
Events related to OpenID Connect authentication flows, including login, logout, and authorization.
| Event Type ID | Event Type | Description |
|---|---|---|
VO0030 | oidc.interaction.started | OIDC interaction started |
VO0031 | oidc.interaction.ended | OIDC interaction ended |
VO0032 | oidc.par.succeeded | OIDC PAR succeeded |
VO0033 | oidc.authorization.succeeded | OIDC authorization succeeded |
VO0034 | oidc.authorization.failed | OIDC authorization failed |
VO0035 | oidc.grant.succeeded | OIDC grant succeeded |
VO0036 | oidc.backchannel.succeeded | OIDC backchannel succeeded |
VO0037 | oidc.registration.created | OIDC registration created |
VO0038 | oidc.registration.updated | OIDC registration updated |
VO0039 | oidc.registration.deleted | OIDC registration deleted |
VO0040 | oidc.presentation.created | OIDC presentation created |
VO0041 | oidc.session.started | OIDC session started |
VO0042 | oidc.session.ended | OIDC session ended |
VO0043 | oidc.session.started~passkey | OIDC session started passkey |
VO0180 | oidc.passkey.registered | OIDC passkey registered |
VO0181 | oidc.passkey.renamed | OIDC passkey renamed |
VO0182 | oidc.passkey.deactivated~holder | OIDC passkey deactivated holder |
VO0183 | oidc.passkey.deactivated~admin | OIDC passkey deactivated admin |
Presentation Events
Events related to verifiable credential presentations (verification requests).
| Event Type ID | Event Type | Description |
|---|---|---|
VO0060 | presentation.request.created | Presentation request created |
VO0061 | presentation.request.retrieved | Presentation request retrieved |
VO0062 | presentation.request.completed | Presentation request completed |
VO0063 | presentation.request.failed | Presentation request failed |
VO0071 | presentation.identity-resolver.failed | Presentation identity resolver failed |
VO0072 | presentation.identity-resolution.failed | Presentation identity resolution failed |
VO0073 | presentation.identity.resolved | Presentation identity resolved |
Issuance Events
Events related to verifiable credential issuance.
| Event Type ID | Event Type | Description |
|---|---|---|
VO0080 | issuance.request.created | Issuance request created |
VO0081 | issuance.request.retrieved | Issuance request retrieved |
VO0082 | issuance.credential.issued | Issuance credential issued |
VO0083 | issuance.credential.revoked | Issuance credential revoked |
VO0084 | issuance.credential.failed | Issuance credential failed |
VO0085 | issuance.request.cancelled | Issuance request cancelled |
Async Issuance Events
Events related to async (remote) issuance workflows, including notifications and request lifecycle.
| Event Type ID | Event Type | Description |
|---|---|---|
VO0100 | async-issuance.request.created | Async issuance request created |
VO0101 | async-issuance.request.claimed | Async issuance request claimed |
VO0102 | async-issuance.contact.fetched | Async issuance contact fetched |
VO0103 | async-issuance.contact.updated | Async issuance contact updated |
VO0104 | async-issuance.notification~email.sent | Async issuance notification email sent |
VO0105 | async-issuance.notification~sms.sent | Async issuance notification SMS sent |
VO0106 | async-issuance.notification.resend~queued | Async issuance notification resend queued |
VO0107 | async-issuance.notification~email.status | Async issuance notification email status |
VO0108 | async-issuance.notification~sms.status | Async issuance notification SMS status |
VO0109 | async-issuance.notification.resend~failed | Async issuance notification resend failed |
VO0110 | async-issuance.notification~email.failed | Async issuance notification email failed |
VO0111 | async-issuance.notification~sms.failed | Async issuance notification SMS failed |
VO0112 | async-issuance.notification~job.failed | Async issuance notification job failed |
VO0113 | async-issuance.request.cancelled~queued | Async issuance request cancelled queued |
VO0114 | async-issuance.request.cancelled~command | Async issuance request cancelled command |
VO0115 | async-issuance.request.cancelled~job | Async issuance request cancelled job |
VO0116 | async-issuance.request.cancelled~failed | Async issuance request cancelled failed |
VO0117 | async-issuance.issuance-request.created | Async issuance issuance request created |
VO0160 | async-issuance.identity-verification.fetched | Async issuance identity verification fetched |
Other Events
| Event Type ID | Event Type | Description |
|---|---|---|
VO0064 | presentation-flow.created | Presentation flow created |
VO0065 | presentation-flow.cancelled | Presentation flow cancelled |
VO0066 | presentation-flow.submitted | Presentation flow submitted |
VO0067 | presentation-flow.template.created | Presentation flow template created |
VO0068 | presentation-flow.template.updated | Presentation flow template updated |
VO0069 | presentation-flow.template.deleted | Presentation flow template deleted |
VO0070 | presentation-flow.request.created | Presentation flow request created |
VO0074 | presentation-flow.contact.updated | Presentation flow contact updated |
VO0075 | presentation-flow.notification~email.sent | Presentation flow notification email sent |
VO0076 | presentation-flow.notification~sms.sent | Presentation flow notification SMS sent |
VO0077 | presentation-flow.notification~email.failed | Presentation flow notification email failed |
VO0078 | presentation-flow.notification~sms.failed | Presentation flow notification SMS failed |
VO0079 | presentation-flow.notification~job.failed | Presentation flow notification job failed |
VO0130 | microsoft-entra-temporary-access-pass.self-issued | Microsoft entra temporary access pass self issued |
VO0131 | microsoft-entra-temporary-access-pass.issuance-failed | Microsoft entra temporary access pass issuance failed |
VO0140 | presentation-flow.notification~email.status | Presentation flow notification email status |
VO0141 | presentation-flow.notification~sms.status | Presentation flow notification SMS status |
VO0142 | presentation-flow.notification.resend~failed | Presentation flow notification resend failed |
VO0143 | mdoc-presentation-flow.created | Mdoc presentation flow created |
VO0151 | idv.session.completed | Idv session completed |
VO0152 | idv.session.failed~rejected | Idv session failed rejected |
VO0153 | idv.session.expired | Idv session expired |
VO0154 | idv.session.failed~nonames | Idv session failed nonames |
VO0155 | idv.session.failed~noaccesskey | Idv session failed noaccesskey |
VO0156 | idv.session.failed~noclient | Idv session failed noclient |
VO0157 | idv.session.failed~fetcherror | Idv session failed fetcherror |
VO0158 | idv.session.failed~noperson | Idv session failed noperson |
VO0159 | idv.session.failed~mismatch | Idv session failed mismatch |
VO0161 | idv.session.completed~verified | Idv session completed verified |
VO0162 | idv.session.results-access-key.fetched | Idv session results access key fetched |
VO0163 | issuance-verification.completed | Issuance verification completed |
VO0164 | issuance-verification.failed | Issuance verification failed |
VO0165 | issuance-verification.expired | Issuance verification expired |
VO0166 | issuance-verification.concierge-signin.completed | Issuance verification concierge signin completed |
VO0167 | issuance-verification.started | Issuance verification started |
VO0168 | idv.session.results.fetched | Idv session results fetched |
SIEM Integration
When integrating with your SIEM system, we recommend:
- Filter by EventTypeId for precise event matching
- Use EventType for human-readable categorization
- Parse Properties for detailed event context
Machine-Readable Event Catalog
Download the complete event catalog in JSON format for import into your SIEM:
This file is automatically generated and kept in sync with the platform.
See the Audit documentation for sample audit entries and integration guidance.