# Event catalogue

> All audit log events by category: the code, what is recorded, the operation class and the severity.

Every log entry carries an event code of the form `category.action`. The code is stable — you can rely on it in your SIEM filters and in scripts; the description next to it is what a person sees in the interface. The category is the first part of the code; the filter buttons in the section work by it.

**Operation** is the class of action (create, modify, remove, access, authentication, transfer, execute). **Severity** is info, notice, warning or critical; on a **refusal** the event’s severity goes up one step (a refused sign-in is recorded as a warning).

Both success and refusal are recorded for every event — except routine operations marked “refused”: they go into the log only when refused.

## Sessions and sign-in

| Event code | What is recorded | Operation | Severity |
| --- | --- | --- | --- |
| `session.login` | Sign-in: password accepted, code sent | authentication | info |
| `session.login_confirm` | Sign-in confirmed with a code | authentication | info |
| `session.code_resend` | Confirmation code sent again | authentication | info |
| `session.refresh_denied` | Session refresh refused | authentication | warning |
| `session.logout` | Sign-out | authentication | info |
| `session.register_start` | Sign-up started | create | notice |
| `session.register` | Sign-up completed | create | notice |
| `session.password_reset_start` | Password reset requested | authentication | notice |
| `session.password_reset` | Password reset | authentication | notice |
| `session.password_change_start` | Password change requested | authentication | notice |
| `session.password_change` | Password changed | authentication | notice |
| `session.org_connect` | Connection to the organisation (address and browser) | authentication | info |
| `session.sso_start` | Single sign-on started | authentication | info |
| `session.sso_login` | Sign-in with single sign-on (SSO) — “account created automatically” or “linked” | authentication | info (refusal — warning) |
| `session.operator_login` | Platform operator signed in to the demo account — via a one-time link from the admin panel; the entry names the operator | authentication | notice (refusal — warning) |
| `session.sso_link` | Account linked to the provider’s identity | authentication | notice (refusal — warning) |
| `session.device_approve` | Buff Code device sign-in allowed — the device name and the organisation the sign-in was issued for | authentication | notice |
| `session.device_deny` | Buff Code device sign-in denied — the device name | authentication | notice |
| `session.device_refresh_denied` | Device token refresh refused (refusals only) — the device number | authentication | warning |
| `session.device_reuse_revoked` | Device revoked: its refresh token was used again — the token may have been stolen | remove | warning |
| `session.device_revoke` | Buff Code device revoked — the device number | remove | notice |

Requesting a sign-in code from Buff Code and waiting for confirmation do not count as events — what is recorded is the person’s decision on the sign-in page. Sign-in codes, tokens and the device key never go into the log. See [Sign-in and working context](/en/docs/buff-code/sign-in).

## Organisation

| Event code | What is recorded | Operation | Severity |
| --- | --- | --- | --- |
| `org.create` | Organisation created | create | notice |

## Members and permissions

| Event code | What is recorded | Operation | Severity |
| --- | --- | --- | --- |
| `member.invite` | Member invited | create | notice |
| `member.remove` | Member removed | remove | notice |
| `member.owner_set` | Owner status changed | modify | critical |
| `member.grant_set` | Member rights changed | modify | notice |

## Projects

| Event code | What is recorded | Operation | Severity |
| --- | --- | --- | --- |
| `project.create` | Development project created | create | notice |
| `project.space_create` | Space created | create | notice |
| `project.repo_sync` | Repository sync | execute | info |
| `project.devprep_run` | Tools preparation run | execute | info |
| `project.audit_run` | Project audit run | execute | info |
| `project.tests_refresh` | Test list refresh | execute | info |

## Repositories

| Event code | What is recorded | Operation | Severity |
| --- | --- | --- | --- |
| `repo.import` | Repository added | create | notice |

## Tasks

| Event code | What is recorded | Operation | Severity |
| --- | --- | --- | --- |
| `task.create` | Task draft created | create | info |
| `task.edit` | Task draft changed | modify | info |
| `task.submit` | Task submitted for work | execute | notice |
| `task.cancel` | Draft cancelled | remove | info |
| `task.stop` | Task stopped | execute | notice |
| `task.resume` | Task resumed | execute | notice |
| `task.close` | Task closed | modify | notice |
| `task.clarify_answer` | Clarification answered | create | info |
| `task.gate_decide` | Decision on the formulation | modify | notice |
| `task.tests_decide` | Decision on failing tests | modify | notice |

## Review

| Event code | What is recorded | Operation | Severity |
| --- | --- | --- | --- |
| `review.approve` | Changes approved, the PR/MR is being published | transfer | notice |
| `review.rework` | Sent for rework | modify | notice |
| `review.finding_add` | Finding added | create | info |
| `review.finding_decide` | Decision on a finding | modify | info |
| `review.finding_edit` | Finding changed | modify | info |

## Ask

| Event code | What is recorded | Operation | Severity |
| --- | --- | --- | --- |
| `ask.create` | “Ask” conversation created; for a question about development sessions — with the list of sessions in the set | create | info |
| `ask.message` | Message to an “Ask” conversation | create | info |
| `ask.answer` | Answer to the model’s question (“Ask”) | create | info |
| `ask.rename` | “Ask” conversation renamed | modify | info |
| `ask.delete` | “Ask” conversation deleted | remove | notice |

## Development sessions

| Event code | What is recorded | Operation | Severity |
| --- | --- | --- | --- |
| `ide.session_view` | Someone else’s development session viewed — one entry per view | access | notice |
| `ide.session_export` | Development session exported (Markdown or JSON, own or someone else’s) | access | notice |

The list of your own sessions and viewing your own session are reading your own data and are not recorded. Model calls from Buff Code are spending; they are recorded in the session itself and in billing; calls to the connections’ tools are kept in the connector’s call log. See [Audit log and Buff Code](/en/docs/buff-code/sessions/audit).

## Research

| Event code | What is recorded | Operation | Severity |
| --- | --- | --- | --- |
| `research.create` | Research created | create | info |
| `research.message` | Message to research | create | info |
| `research.stop` | Research stopped | execute | notice |
| `research.rename` | Research renamed | modify | info |
| `research.delete` | Research deleted | remove | notice |

## Credentials

| Event code | What is recorded | Operation | Severity |
| --- | --- | --- | --- |
| `credentials.set` | Repository credentials saved | modify | notice |
| `credentials.delete` | Repository credentials deleted | remove | notice |

## Single sign-on

| Event code | What is recorded | Operation | Severity |
| --- | --- | --- | --- |
| `sso.config_set` | Single sign-on set up | modify | critical |
| `sso.config_delete` | Single sign-on turned off | remove | critical |
| `sso.domain_add` | Domain claimed for single sign-on | create | notice |
| `sso.domain_verify` | Domain verified | modify | notice |
| `sso.domain_delete` | Domain removed | remove | notice |

## Plan and models

| Event code | What is recorded | Operation | Severity |
| --- | --- | --- | --- |
| `billing.tariff_set` | Plan changed | modify | notice |
| `billing.model_choose` | Model chosen | modify | notice |
| `billing.request` | Request submitted | create | info |

## Rented capacity

| Event code | What is recorded | Operation | Severity |
| --- | --- | --- | --- |
| `rental.tier_set` | Rented VM class chosen | modify | notice |
| `rental.start` | Rented VM start requested | execute | notice |
| `rental.stop` | Rented VM stopped | execute | notice |

## Connectors

| Event code | What is recorded | Operation | Severity |
| --- | --- | --- | --- |
| `connector.pair_code` | Connector pairing code issued | create | notice |
| `connector.enrol` | Connector paired | create | notice |
| `connector.refresh_denied` | Connector session refresh refused | authentication | warning |
| `connector.report_failed` | Connector report refused | modify | warning |
| `connector.event` | Tracker request accepted | create | notice |
| `connector.event_refused` | Tracker request author refused | create | notice |
| `connector.event_failed` | Tracker request failed | create | warning |
| `connector.repo_import` | Repository import via a connector | create | notice |
| `connector.publish` | PR/MR publication via a connector | transfer | notice |
| `connector.revoke` | Connector revoked | remove | critical |
| `connector.connect` | Connector connected | authentication | info |

## Knowledge base

| Event code | What is recorded | Operation | Severity |
| --- | --- | --- | --- |
| `knowledge.create` | Knowledge created; if the entry was proposed by the model in Buff Code and confirmed by the developer — “from Buff Code” | create | info |
| `knowledge.edit` | Knowledge changed | modify | info |
| `knowledge.flag_set` | Knowledge flags changed (“show to the model upfront” / “permanent”) | modify | notice |
| `knowledge.archive` | Knowledge archived | remove | notice |
| `knowledge.archive_task` | Task finished: the knowledge in its scope moved to the archive (one event per task, with the list of names) | remove | notice |
| `knowledge.restore` | Knowledge restored from the archive | create | notice |
| `knowledge.reviewed` | “Needs review” flag removed | modify | info |
| `knowledge.flag_review` | The model flagged knowledge as “needs review” (a pipeline action) | modify | notice |
| `knowledge.refresh` | Knowledge base pass started | execute | info |

What is recorded is the **entry name, its scope** (for a task entry — “project · task #N”) **and type**, which fields changed and what the flags were before and after; **the entry body does not go into the log** — the log is not a text store. Everything the model does with the knowledge base — at any stage of the work and in passes — arrives as pipeline actions (the actor is “system”) with the stage and the task in the details. Viewing the section is not logged, like any reading. See [Knowledge base](/en/docs/knowledge).

## Audit log

| Event code | What is recorded | Operation | Severity |
| --- | --- | --- | --- |
| `auditlog.export` | Audit log exported | access | notice |
| `auditlog.verify` | Log integrity checked | access | info |

## Pipeline (system)

| Event code | What is recorded | Operation | Severity |
| --- | --- | --- | --- |
| `pipeline.*` | Pipeline actions (task closed, merge conflict, review, VM…) | execute | info |

## Platform operator

| Event code | What is recorded | Operation | Severity |
| --- | --- | --- | --- |
| `operator.*` | Platform operator actions on the organisation | modify | notice |

## Notes on individual events

- **`session.login`** — the password was accepted and a confirmation code sent; the sign-in itself completes with the `session.login_confirm` event. A refusal in `session.login` means a wrong password or login; a refusal in `session.login_confirm` means a wrong code. Both are recorded in **all** the organisations the person belongs to: the owner of each sees their member’s sign-in attempts.
- **`session.org_connect`** — connecting to the organisation’s space; this is where the address and browser are captured for the later actions in this session. Recorded every time the app is opened.
- **`session.refresh_denied`** — session renewal refused: the token was revoked (sign-out, password change) or reused — the latter is worth checking.
- **`session.register_start` / `session.register`** — recorded in the new organisation’s log: it begins with its registration.
- **`member.owner_set`** — appointing or removing an owner; a critical event.
- **`credentials.set` / `credentials.delete`** — a repository token saved or deleted; the token value is absent from the log.
- **`connector.enrol`** — the agent was paired with a code; the actor is the connector itself (its identifier), the address is where it connected from. **`connector.revoke`** is critical.
- **`connector.event` / `connector.event_refused`** — a question, research or task from a comment in a tracker: every request and every refusal to an author who is not on the “Who may ask the bot” list. The tracker, the ticket and who asked (name, login and email, if the tracker shows them) are recorded — without the text of the question. Delivering the same comment again does not produce a second entry.
- **`auditlog.export`** — a log export: by whom, in which format, with which filters and how many rows. An attempt to export without the permission is recorded as a refusal.
- **`pipeline.*`** — pipeline actions; instead of `*` — the notification feed event type: `task_closed`, `merge_conflict`, `review_needed`, `vm_ready`, `flow_failed` and others. The actor is “system”.
- **`operator.*`** — actions of a platform employee on your organisation: `operator.billing.balance.topup`, `operator.billing.balance.adjust`, `operator.connector.disable`, `operator.demo.open` (the operator opened the demo organisation’s workspace under its owner’s account). The actor is “operator” with their account.