Audit log events list has drifted: 87 emitted events undocumented, 3 documented events not emitted

[jkodroff]

Summary

The List of audit log events table on /docs/administration/concepts/audit-logs/ has drifted substantially from what the Pulumi Cloud actually emits.

There is no REST API endpoint that serves the enumeration of audit log event types — GET /api/orgs/{org}/auditlogs (and /v2) return instances, not the catalog — so this page can only be kept current by hand against the service source. Today the page lists 63 events; the service defines 147 customer-visible ones.

Source of truth (pulumi/pulumi-service, private): pkg/apitype/audit.go (the wire strings returned in the event field), mapped from cmd/service/model/audit_log_events.go via cmd/service/api/type_conversion.go.

Drift as of 2026-08-24 (pulumi-service 136c495263, docs 84283d923f).

1. 87 emitted events are missing from the page

Grouped below with the wire identifier, a suggested display name in the page's existing Title Case style, and a description derived from the service source comments. (Descriptions are a starting point, not final copy — several constants carry no doc comment and are left blank.)

Access tokens & OIDC

Event (wire identifier)	Suggested display name	Description (from service source)
organization-token-created	Organization Token Created	a user created an organization token
organization-token-deleted	Organization Token Deleted	a user deleted an organization token
team-token-created	Team Token Created	a user created a team token
team-token-deleted	Team Token Deleted	a user deleted a team token
organization-token-created-for-oidc-issuer	Organization Token Created for OIDC Issuer
team-token-created-for-oidc-issuer	Team Token Created for OIDC Issuer
personal-token-created-for-oidc-issuer	Personal Token Created for OIDC Issuer
deployment-runner-token-created-for-oidc-issuer	Deployment Runner Token Created for OIDC Issuer
oidc-issuer-registered	OIDC Issuer Registered
oidc-issuer-updated	OIDC Issuer Updated
oidc-issuer-deleted	OIDC Issuer Deleted

Organization & membership

Event (wire identifier)	Suggested display name	Description (from service source)
organization-backend-changed	Organization Backend Changed	the organization's backend (e.g. GitHub, SAML, Pulumi) has been changed
organization-invite-sent	Organization Invite Sent	an organization admin has sent out an invite for someone to join the organization
organization-invite-accepted	Organization Invite Accepted	one of the organization's pending invites has been accepted, and a new user has been added to the organization
organization-invite-canceled	Organization Invite Canceled	one of the organization's pending invites has been canceled, and is no longer valid
vcs-github-installation-linked	VCS GitHub Installation Linked	an org admin linked an existing GitHub App installation to the organization

Roles, policies & authorization failures

Event (wire identifier)	Suggested display name	Description (from service source)
custom-role-created	Custom Role Created
custom-role-updated	Custom Role Updated
custom-role-deleted	Custom Role Deleted
authorization-policy-updated	Authorization Policy Updated
deployment-settings-role-updated	Deployment Settings Role Updated
auth-failure-environment	Auth Failure Environment	a user tried to perform an operation on an environment but did not have the necessary permission to do so
auth-failure-change-request	Auth Failure Change Request

Deployments

Event (wire identifier)	Suggested display name	Description (from service source)
organization-deployments-paused	Organization Deployments Paused	a user paused all deployments for an entire organizations
organization-deployments-resumed	Organization Deployments Resumed	a user resumed deployments for an organizations
stack-deployments-paused	Stack Deployments Paused	auditLogEventDeploymentsPausedForOrg indicates that a user paused all deployments for a stack
stack-deployments-resumed	Stack Deployments Resumed	auditLogEventDeploymentsPausedForOrg indicates that a user resumed all deployments for a stack
deployment-runner-pool-created	Deployment Runner Pool Created	a user registered a new Deployment Agent Pool
deployment-runner-pool-deleted	Deployment Runner Pool Deleted	a user deleted a Deployment Agent Pool
scheduled-deployment-created	Scheduled Deployment Created
scheduled-deployment-updated	Scheduled Deployment Updated
scheduled-deployment-deleted	Scheduled Deployment Deleted

Change management

Event (wire identifier)	Suggested display name	Description (from service source)
change-gate-created	Change Gate Created
change-gate-updated	Change Gate Updated
change-gate-deleted	Change Gate Deleted

Environments (ESC)

Event (wire identifier)	Suggested display name	Description (from service source)
environment-draft-open	Environment Draft Open
environment-draft-read-open	Environment Draft Read Open

Secrets

Event (wire identifier)	Suggested display name	Description (from service source)
secrets-batch-decrypted	Secrets Batch Decrypted	a batch of secrets were decrypted

Pulumi Insights

Event (wire identifier)	Suggested display name	Description (from service source)
insights-account-created	Insights Account Created
insights-account-updated	Insights Account Updated
insights-account-deleted	Insights Account Deleted
insights-account-tags-updated	Insights Account Tags Updated
insights-account-scan-started	Insights Account Scan Started
insights-account-scan-canceled	Insights Account Scan Canceled
insights-account-scheduled-scans-paused	Insights Account Scheduled Scans Paused
insights-account-scheduled-scans-resumed	Insights Account Scheduled Scans Resumed
insights-trial-billing-accepted	Insights Trial Billing Accepted
insights-trial-billing-denied	Insights Trial Billing Denied

Registry

Event (wire identifier)	Suggested display name	Description (from service source)
registry-package-version-initialized	Registry Package Version Initialized
registry-package-version-published	Registry Package Version Published
registry-package-version-deleted	Registry Package Version Deleted
registry-template-version-initialized	Registry Template Version Initialized
registry-template-version-published	Registry Template Version Published
registry-template-version-deleted	Registry Template Version Deleted

Services (IDP)

Event (wire identifier)	Suggested display name	Description (from service source)
service-created	Service Created
service-updated	Service Updated
service-deleted	Service Deleted

Neo / AI agents

Event (wire identifier)	Suggested display name	Description (from service source)
agent-task-created	Agent Task Created	a new Neo agent task was created
agent-task-updated	Agent Task Updated	a Neo agent task was updated (e.g., permission mode changed)
agent-task-deleted	Agent Task Deleted	a site admin permanently deleted a Neo agent task
agent-task-shared	Agent Task Shared	a Neo agent task was shared with the organization
agent-task-unshared	Agent Task Unshared	a Neo agent task was unshared
agent-integration-enabled	Agent Integration Enabled	an admin enabled a Neo agent integration from the catalog for the organization
agent-integration-disabled	Agent Integration Disabled	an admin disabled a Neo agent integration from the catalog for the organization
agent-cli-integration-connected	Agent CLI Integration Connected	an admin connected a Neo CLI integration instance (an ESC environment providing credentials for a catalog CLI such as AWS) to the organization
agent-cli-integration-updated	Agent CLI Integration Updated	an admin updated mutable fields (escEnvRef, notes) on a connected Neo CLI integration. Identity fields (catalogId, name) are immutable and not represented in this event
agent-cli-integration-disconnected	Agent CLI Integration Disconnected	an admin removed a connected Neo CLI integration instance from the organization
agent-model-provider-created	Agent Model Provider Created	an org admin registered a Neo BYOK (bring-your-own-key) model provider — storing an envelope-encrypted third-party API key and the endpoint Neo's LLM traffic egresses to
agent-model-provider-updated	Agent Model Provider Updated	an org admin changed a Neo BYOK model provider's configuration (base URL, model map, or auth-header set — a re-sent header set rotates the stored secret). Secret values are never recorded
agent-model-provider-deleted	Agent Model Provider Deleted	an org admin removed a Neo BYOK model provider
agent-model-provider-default-changed	Agent Model Provider Default Changed	an org admin made a Neo BYOK model provider the organization's default, redirecting all of Neo's LLM traffic to that provider's endpoint
neo-slack-identity-connected	Neo Slack Identity Connected	a user linked their Slack identity to their Pulumi user account in an organization for Neo in Slack
neo-slack-identity-disconnected	Neo Slack Identity Disconnected	a user removed the link between their Slack identity and their Pulumi user account in an organization
neo-usage-cap-updated	Neo Usage Cap Updated	an org admin set or changed the organization's monthly Neo usage cap via the self-serve endpoint
neo-usage-cap-cleared	Neo Usage Cap Cleared	an org admin removed the organization's monthly Neo usage cap via the self-serve endpoint

Pulumi-initiated (site admin / internal service)

Event (wire identifier)	Suggested display name	Description (from service source)
retrial-started	Retrial Started	a Pulumi site admin started a retrial for an organization
retrial-ended	Retrial Ended	a Pulumi site admin ended a retrial for an organization
retrial-expiration-updated	Retrial Expiration Updated	a Pulumi site admin changed the expiration date of an organization's active retrial
internal-org-lock	Internal Org Lock	an internal service locked or unlocked an organization
internal-org-feature	Internal Org Feature	an internal service changed organization feature settings
internal-subscription-trial	Internal Subscription Trial	an internal service changed subscription trial settings
internal-subscription-service-managed	Internal Subscription Service Managed	an internal service changed service-managed subscription settings
internal-subscription-update	Internal Subscription Update	an internal service updated a subscription
internal-subscription-convert-to-self-service	Internal Subscription Convert to Self Service	an internal service converted a subscription to self-service
internal-subscription-self-service-plan-change	Internal Subscription Self Service Plan Change	an internal service changed a self-service subscription plan
internal-subscription-sync-salesforce	Internal Subscription Sync Salesforce	an internal service synced subscription state with Salesforce
internal-subscription-pricing-family-change	Internal Subscription Pricing Family Change	an internal service changed a self-service subscription pricing family

2. Three documented events are not actually emitted on the wire

Documented event	Problem
Environment Schedule Created	AuditLogEventEnvironmentScheduleCreated exists in the service model but has no apitype string mapping, so it can never appear in an API response or export.
Environment Schedule Updated	same
Environment Schedule Deleted	same

These three are a service bug, not a docs bug — cmd/service/api/type_conversion.go has no entry for them, so convertModelAuditLogEventType returns unknown-event-type. Sixteen model events are affected in total (also deletion-protection-enabled/disabled, oidc-issuer-validation-failed, org-deployment-default-role-updated, auth-check-failure-insights-account, neo-member-usage-cap-updated/cleared, and the five registry-terraform-module-* events). That needs a separate fix in pulumi-service; noting it here so we don't leave the schedule events documented as working, and so the other thirteen aren't added to this page until they're mapped.

3. Suggested structural improvements

• Add a column for the wire identifier. The page lists prettified display names only (e.g. "Stack Transferred to Organization"), but the API response, CSV export, and CEF export all carry the kebab-case string (stack-transferred-to-organization). Anyone writing a SIEM rule or filtering the export needs the identifier, and today they have to reverse-engineer it.
• Group the table by area (stacks, environments, tokens/OIDC, deployments, Insights, registry, Neo, …). At ~150 rows a flat alphabetical-ish table is hard to scan.
• Note the naming mismatch on the ESC revision-tag events. The page says "Environment Version Retracted" / "Environment Version Tag *"; the wire identifiers say environment-revision-retracted / environment-revision-tag-*. Same for "Environment Clone" vs environment-cloned.
• Consider a drift check. Since there's no API to enumerate these, the list will drift again. Worth discussing whether pulumi-service should expose the catalog (e.g. GET /api/orgs/{org}/auditlogs/event-types) or publish a generated JSON that docs can render.

---

Filed from an automated comparison of the docs table against pkg/apitype/audit.go.