Audit Event Taxonomy

Complete reference of all audit event types, actions, and schemas across MQUAD services

This document defines the complete taxonomy of audit events across all MQUAD services. It covers what to audit, what to skip, the event schema, and which events each service produces.

Scope: What NOT to Audit

The following paths and actions are excluded from audit logging:

  • Health checks (/health, /health/)
  • Metrics (/metrics)
  • Application configuration reads
  • Debug endpoints
  • Static assets

What TO Audit

1. Authentication & Access

ActionDescriptionResource
login.successUser successfully logged inSession
login.failureLogin attempt failedSession
logoutUser logged outSession
password_changedPassword updatedUser
password_resetPassword reset requestedUser
mfa_enabledMFA enabledUser
mfa_disabledMFA disabledUser
token_revokedJWT/token revokedToken
role_changedUser role modifiedUser
permission_changedPermission modifiedRole
user_invitedUser invited to workspaceWorkspace
user_removedUser removed from workspaceWorkspace

2. Tenant/Workspace Management

ActionDescriptionResource
workspace.createdWorkspace createdWorkspace
workspace.deletedWorkspace deletedWorkspace
workspace.settings_changedWorkspace settings modifiedWorkspace
domain_addedCustom domain addedWorkspace
domain_removedCustom domain removedWorkspace

3. Survey Lifecycle

ActionDescriptionResource
survey.createdSurvey createdSurvey
survey.updatedSurvey modifiedSurvey
survey.deletedSurvey deletedSurvey
survey.publishedSurvey publishedSurvey
survey.unpublishedSurvey unpublishedSurvey
xlsform_importedXLSForm importedSurvey
survey_schema_changedSurvey schema version changedSurvey

4. Form Responses

ActionDescriptionResource
response.submittedResponse submittedResponse
response.editedResponse modifiedResponse
response.deletedResponse deletedResponse
responses.bulk_importBulk import of responsesResponse
responses.exportedResponses exportedResponse

5. Media & File Access

ActionDescriptionResource
file.uploadedFile uploadedFile
file.deletedFile deletedFile
signed_url.generatedSigned URL generatedFile
file.downloadedFile downloadedFile

6. Admin / Dangerous Actions

ActionDescriptionResource
feature_flag_changedFeature flag modifiedFeature
system_settings.updatedSystem settings changedSettings
api_key.createdAPI key createdAPIKey
api_key.revokedAPI key revokedAPIKey
webhook.createdWebhook createdWebhook
webhook.modifiedWebhook modifiedWebhook
webhook.deletedWebhook deletedWebhook

Audit Event Schema

{
  "event_id": "uuid",
  "timestamp": "ISO8601 UTC",
  "service_name": "string",
  "environment": "development|production",

  "tenant_id": "uuid",
  "workspace_id": "uuid",

  "actor_type": "user|api_key|system",
  "actor_id": "uuid",
  "actor_email": "email",

  "action": "login.success",
  "resource_type": "survey|response|workspace|user|file|role|api_key",
  "resource_id": "uuid",

  "status": "success|failure",
  "ip_address": "string",
  "user_agent": "string",

  "metadata": {}
}

Services and Their Audit Events

backend (Port 8000)

  • Authentication events (login/logout/password)
  • User management
  • Workspace/tenant events
  • API key management

survey-service (Port 8001)

  • Survey CRUD
  • Survey publish/unpublish
  • XLSForm import
  • Schema changes

data-service (Port 8002)

  • Response submission/editing/deletion
  • Bulk import/export
  • File downloads

form-service (Port 8010)

  • Form building events

webhook-service (Port 8007)

  • Webhook CRUD

media-service (Port 8011)

  • File upload/delete
  • Signed URL generation

Implementation Notes

  1. Whitelist Approach: Only audit events in the whitelist are captured
  2. Skip Paths: Do NOT audit health, metrics, docs, static assets
  3. Action Types: Map HTTP methods to audit actions appropriately
    • POST -> create (only for audit events)
    • PUT/PATCH -> update (only for audit events)
    • DELETE -> delete (only for audit events)
  4. No GET: Reading data is NOT an audit event (except file downloads)
Docs by Sourcey
↑↓ navigate↵ selectesc close