Skip to main content
Pulumi logo Pulumi logo
25.6K Contact us Sign in Dashboard Get started
  1. Docs
  2. Administration
  3. Reference
  4. Audit log events

Audit log events

This Pulumi Cloud feature is available in the Enterprise and Business Critical editions.

    Every event Pulumi Cloud can record in an organization’s audit log, grouped by the product area it belongs to. To view or export your organization’s log, see Audit logs.

    Each entry lists:

    • Event — the name shown in the Pulumi Cloud console and in the event field of an exported log.
    • Event ID — the stable identifier to match on when you process an exported log programmatically.
    • Description — what the event records, followed where applicable by the permission level the action required, or a note that the event was raised by a failed authentication or authorization check.

    Event list last updated on 2026-08-28, synced automatically from the Pulumi Cloud API.

    This list is generated from the Pulumi Cloud API, so it stays in step with what your organization’s log actually records.

    Authentication and identity

    Logins, identity changes, single sign-on configuration, OIDC issuer registration, and permission-denied events.

    EventEvent IDDescription
    Auth Failure Change Requestauth-failure-change-requestA user attempted an operation on a change request without the permission it requires. Recorded as an authentication failure.
    Auth Failure Environmentauth-failure-environmentA user attempted an operation on an environment without the permission it requires. Recorded as an authentication failure.
    Auth Failure Insights Accountauth-failure-insights-accountA user attempted an operation on a Pulumi Insights cloud account without the permission it requires. Recorded as an authentication failure.
    Auth Failure Organization Roleauth-failure-organization-roleA user attempted an operation without the organization role it requires. Recorded as an authentication failure.
    Auth Failure SCIM Access Tokenauth-failure-scim-access-tokenA request to an organization’s SCIM endpoints presented an invalid access token. Recorded as an authentication failure.
    Auth Failure Stack Permissionauth-failure-stack-permissionA user attempted an operation without the stack permission it requires. Recorded as an authentication failure.
    Authorization Policy Updatedauthorization-policy-updatedThe authorization policy governing which OIDC subjects may exchange tokens was updated.
    OIDC Issuer Deletedoidc-issuer-deletedA registered OIDC issuer was removed from the organization.
    OIDC Issuer Registeredoidc-issuer-registeredAn OIDC issuer was registered with the organization.
    OIDC Issuer Updatedoidc-issuer-updatedA registered OIDC issuer was updated, or its thumbprints were regenerated.
    OIDC Issuer Validation Failedoidc-issuer-validation-failedCertificate validation failed for an OIDC issuer, either during CA verification or during thumbprint validation. Recorded as an authentication failure.
    SAML Configuration Updatedsaml-configuration-updatedAn organization’s SAML single sign-on configuration was updated. Requires organization admin.
    User Added New Identity to Their Accountuser-added-new-identity-to-their-accountA user associated a new identity provider login with their Pulumi account.
    User Loginuser-loginA user successfully logged in to Pulumi Cloud.
    User Login Faileduser-login-failedA user tried to log in to Pulumi Cloud and failed, for example by submitting an incorrect password.

    Access tokens

    Creation and revocation of organization, team, and personal access tokens, including tokens issued through OIDC token exchange.

    EventEvent IDDescription
    Deployment Runner Token Created for OIDC Issuerdeployment-runner-token-created-for-oidc-issuerA registered OIDC issuer exchanged a token for a deployment runner access token.
    Organization Token Createdorganization-token-createdAn organization access token was created. Requires organization admin.
    Organization Token Created for OIDC Issuerorganization-token-created-for-oidc-issuerA registered OIDC issuer exchanged a token for an organization access token.
    Organization Token Deletedorganization-token-deletedAn organization access token was revoked. Requires organization admin.
    Personal Token Created for OIDC Issuerpersonal-token-created-for-oidc-issuerA registered OIDC issuer exchanged a token for a personal access token.
    Team Token Createdteam-token-createdA team access token was created. Requires organization admin.
    Team Token Created for OIDC Issuerteam-token-created-for-oidc-issuerA registered OIDC issuer exchanged a token for a team access token.
    Team Token Deletedteam-token-deletedA team access token was revoked. Requires organization admin.

    Organization and members

    Organization settings, invitations, membership, custom roles, service accounts, and trials.

    EventEvent IDDescription
    Custom Role Createdcustom-role-createdA custom role was created in the organization. Requires organization admin.
    Custom Role Deletedcustom-role-deletedA custom role was deleted from the organization. Requires organization admin.
    Custom Role Updatedcustom-role-updatedA custom role’s name, description, or permissions were changed. Requires organization admin.
    Member Addedmember-addedA member was added to an organization. Requires organization admin.
    Member Removedmember-removedA member was removed from an organization. Requires organization admin.
    Member Role Changedmember-role-changedA member’s role in an organization was changed. Requires organization admin.
    Organization Backend Changedorganization-backend-changedAn organization’s identity backend (GitHub, GitLab, SAML, or Pulumi) was changed. Requires organization admin.
    Organization Deployment Default Role Updatedorganization-deployment-default-role-updatedThe organization’s default role for deployments was changed. Requires organization admin.
    Organization Invite Acceptedorganization-invite-acceptedA pending organization invite was accepted and the invitee joined the organization.
    Organization Invite Canceledorganization-invite-canceledA pending organization invite was canceled and is no longer valid. Requires organization admin.
    Organization Invite Sentorganization-invite-sentAn organization admin invited someone to join the organization. Requires organization admin.
    Organization Settings Changedorganization-settings-changedAn organization’s settings were changed. Requires organization admin.
    Retrial Endedretrial-endedA Pulumi site admin ended the organization’s retrial. Requires organization admin.
    Retrial Expiration Updatedretrial-expiration-updatedA Pulumi site admin changed the expiration date of the organization’s active retrial. Requires organization admin.
    Retrial Startedretrial-startedA Pulumi site admin started a retrial for the organization. Requires organization admin.
    Service Createdservice-createdA service account was created in the organization. Requires organization admin.
    Service Deletedservice-deletedA service account was deleted from the organization, revoking its access tokens and permissions. Requires organization admin.
    Service Updatedservice-updatedA service account’s details or membership were changed. Requires organization admin.

    Teams

    Creating, updating, and deleting teams.

    EventEvent IDDescription
    Team Createdteam-createdA team was created in an organization. Requires organization admin.
    Team Deletedteam-deletedA team was deleted from an organization. Requires organization admin.
    Team Updatedteam-updatedA team’s name, description, or membership was changed. Requires organization admin.

    Stacks

    Creating, updating, renaming, transferring, and deleting stacks, plus collaborator changes and stack secret decryption.

    EventEvent IDDescription
    Secret Decryptedsecret-decryptedA secret value belonging to a stack was decrypted.
    Secrets Batch Decryptedsecrets-batch-decryptedA batch of secret values belonging to a stack was decrypted in a single request.
    Stack Collaborator Addedstack-collaborator-addedA collaborator was added to a stack. Requires organization admin.
    Stack Collaborator Permissions Changedstack-collaborator-permissions-changedA stack collaborator’s permissions were changed. Requires organization admin.
    Stack Collaborator Removedstack-collaborator-removedA collaborator was removed from a stack. Requires organization admin.
    Stack Createdstack-createdA stack was created.
    Stack Created from Templatestack-created-from-templateA stack was created from a template.
    Stack Deletedstack-deletedA stack was deleted. Requires stack admin.
    Stack Exportedstack-exportedA stack’s state was exported.
    Stack Importedstack-importedA stack’s state was imported, replacing its checkpoint.
    Stack Provider Openstack-provider-openAn ESC environment read a stack’s outputs through the pulumi-stacks provider.
    Stack Renamedstack-renamedA stack was renamed. Requires organization admin.
    Stack Transferred to Organizationstack-transferred-to-organizationA stack was transferred from one organization to another. Requires organization admin.
    Stack Update Canceledstack-update-canceledA stack update was canceled before it finished.
    Stack Update Completedstack-update-completedA stack update finished.
    Stack Update Startedstack-update-startedA stack update started.

    Deployments

    Pulumi Deployments configuration, including deployment settings, schedules, self-hosted runner pools, and pausing or resuming deployments.

    EventEvent IDDescription
    Deployment Runner Pool Createddeployment-runner-pool-createdA self-hosted deployment runner pool was registered with the organization. Requires organization admin.
    Deployment Runner Pool Deleteddeployment-runner-pool-deletedA self-hosted deployment runner pool was removed from the organization. Requires organization admin.
    Deployment Settings Role Updateddeployment-settings-role-updatedA stack’s deployment settings were assigned the role its deployments run as.
    Organization Deployments Pausedorganization-deployments-pausedDeployments were paused for an entire organization. Requires organization admin.
    Organization Deployments Resumedorganization-deployments-resumedDeployments were resumed for an entire organization. Requires organization admin.
    Scheduled Deployment Createdscheduled-deployment-createdA deployment was scheduled for a stack.
    Scheduled Deployment Deletedscheduled-deployment-deletedA stack’s deployment schedule was deleted.
    Scheduled Deployment Updatedscheduled-deployment-updatedA stack’s deployment schedule was changed.
    Stack Deployments Pausedstack-deployments-pausedDeployments were paused for a single stack. Requires stack admin.
    Stack Deployments Resumedstack-deployments-resumedDeployments were resumed for a single stack. Requires stack admin.

    Environments

    Opening, reading, editing, tagging, cloning, scheduling, and rotating Pulumi ESC environments.

    EventEvent IDDescription
    Environment Clonedenvironment-clonedAn ESC environment was cloned into a new environment.
    Environment Createdenvironment-createdAn ESC environment was created.
    Environment Decryptedenvironment-decryptedAn ESC environment’s definition was read with its secrets decrypted.
    Environment Deletedenvironment-deletedAn ESC environment was deleted.
    Environment Deletion Protection Disabledenvironment-deletion-protection-disabledDeletion protection was disabled on an ESC environment.
    Environment Deletion Protection Enabledenvironment-deletion-protection-enabledDeletion protection was enabled on an ESC environment.
    Environment Draft Openenvironment-draft-openA draft revision of an ESC environment, proposed by a change request, was opened.
    Environment Draft Read Openenvironment-draft-read-openThe resolved values of an open ESC environment draft were read.
    Environment Openenvironment-openAn ESC environment was opened, evaluating its definition and resolving its providers.
    Environment Readenvironment-readAn ESC environment’s definition was read.
    Environment Read Openenvironment-read-openThe resolved values of an open ESC environment session were read.
    Environment Restoredenvironment-restoredA deleted ESC environment was restored.
    Environment Revision Retractedenvironment-revision-retractedA revision of an ESC environment was retracted.
    Environment Revision Tag Createdenvironment-revision-tag-createdA version tag was created on a revision of an ESC environment.
    Environment Revision Tag Deleteenvironment-revision-tag-deleteA version tag was deleted from an ESC environment.
    Environment Revision Tag Openenvironment-revision-tag-openAn ESC environment was opened at a specific version tag.
    Environment Revision Tag Readenvironment-revision-tag-readA version tag on an ESC environment was read.
    Environment Revision Tag Updateenvironment-revision-tag-updateA version tag on an ESC environment was moved to a different revision.
    Environment Rotatedenvironment-rotatedA secret rotation ran for an ESC environment. The event description records whether it succeeded or failed.
    Environment Schedule Createdenvironment-schedule-createdA schedule was created on an ESC environment.
    Environment Schedule Deletedenvironment-schedule-deletedA schedule was deleted from an ESC environment.
    Environment Schedule Updatedenvironment-schedule-updatedA schedule on an ESC environment was changed.
    Environment Tag Createdenvironment-tag-createdA tag was added to an ESC environment.
    Environment Tag Deletedenvironment-tag-deletedA tag was removed from an ESC environment.
    Environment Tag Updatedenvironment-tag-updatedA tag on an ESC environment was changed.
    Environment Unauthorized Openenvironment-unauthorized-openA user tried to open, clone, or import an ESC environment they do not have permission to read.
    Environment Updatedenvironment-updatedAn ESC environment’s definition was updated.

    Policy as code

    Policy packs, policy groups, and the change gates that require approval before a change proceeds.

    EventEvent IDDescription
    Change Gate Createdchange-gate-createdA change gate was created, requiring approval before changes to whatever it targets. Requires organization admin.
    Change Gate Deletedchange-gate-deletedA change gate was deleted. Requires organization admin.
    Change Gate Updatedchange-gate-updatedA change gate’s rule, target, or enabled state was changed. Requires organization admin.
    Policy Group Createdpolicy-group-createdA policy group was created. Requires organization admin.
    Policy Group Deletedpolicy-group-deletedA policy group was deleted. Requires organization admin.
    Policy Group Updatedpolicy-group-updatedA policy group’s stacks or policy packs were changed. Requires organization admin.
    Policy Pack Createdpolicy-pack-createdA policy pack was published to an organization. Requires organization admin.
    Policy Pack Deletedpolicy-pack-deletedA policy pack was deleted from an organization. Requires organization admin.
    Policy Pack Disabledpolicy-pack-disabledA policy pack was disabled for a policy group. Requires organization admin.
    Policy Pack Enabledpolicy-pack-enabledA policy pack was enabled for a policy group. Requires organization admin.

    Discovery

    Cloud accounts connected for resource discovery, and the scans run against them.

    EventEvent IDDescription
    Insights Account Createdinsights-account-createdA cloud account was connected to Pulumi Insights. Requires organization admin.
    Insights Account Deletedinsights-account-deletedA cloud account was disconnected from Pulumi Insights. Requires organization admin.
    Insights Account Scan Canceledinsights-account-scan-canceledA running resource scan was canceled for a Pulumi Insights cloud account.
    Insights Account Scan Startedinsights-account-scan-startedA resource scan was started for a Pulumi Insights cloud account.
    Insights Account Scheduled Scans Pausedinsights-account-scheduled-scans-pausedScheduled scans were paused for a Pulumi Insights cloud account.
    Insights Account Scheduled Scans Resumedinsights-account-scheduled-scans-resumedScheduled scans were resumed for a Pulumi Insights cloud account.
    Insights Account Tags Updatedinsights-account-tags-updatedThe tags on a Pulumi Insights cloud account were updated. Requires organization admin.
    Insights Account Updatedinsights-account-updatedA Pulumi Insights cloud account’s configuration was updated. Requires organization admin.
    Insights Trial Billing Acceptedinsights-trial-billing-acceptedAn organization accepted billing to keep using Pulumi Insights after its trial.
    Insights Trial Billing Deniedinsights-trial-billing-deniedAn organization declined to convert its Pulumi Insights trial into a paid subscription.

    Neo and AI agents

    Pulumi Neo tasks, model providers, CLI integrations, Slack identities, and usage caps.

    EventEvent IDDescription
    Agent CLI Integration Connectedagent-cli-integration-connectedAn org admin connected a Neo CLI integration instance (an ESC environment supplying credentials for a catalog CLI such as AWS) to the organization. Requires organization admin.
    Agent CLI Integration Disconnectedagent-cli-integration-disconnectedAn org admin removed a connected Neo CLI integration instance from the organization. Requires organization admin.
    Agent CLI Integration Updatedagent-cli-integration-updatedAn org admin changed the ESC environment reference or the notes on a connected Neo CLI integration instance. Requires organization admin.
    Agent Integration Disabledagent-integration-disabledAn org admin disabled a Neo integration for the organization. Requires organization admin.
    Agent Integration Enabledagent-integration-enabledAn org admin enabled a Neo integration from the catalog for the organization. Requires organization admin.
    Agent Model Provider Createdagent-model-provider-createdAn org admin registered a Neo bring-your-own-key model provider, storing an encrypted third-party API key and the endpoint Neo’s LLM traffic egresses to. Requires organization admin.
    Agent Model Provider Default Changedagent-model-provider-default-changedAn org admin made a Neo bring-your-own-key model provider the organization’s default, redirecting Neo’s LLM traffic to that provider’s endpoint. Requires organization admin.
    Agent Model Provider Deletedagent-model-provider-deletedAn org admin removed a Neo bring-your-own-key model provider. Requires organization admin.
    Agent Model Provider Updatedagent-model-provider-updatedAn org admin changed a Neo bring-your-own-key model provider’s base URL, model map, or auth headers. Re-sending the header set rotates the stored secret; secret values are never recorded. Requires organization admin.
    Agent Task Createdagent-task-createdA Neo agent task was created.
    Agent Task Deletedagent-task-deletedA Pulumi site admin permanently deleted a Neo agent task. Requires organization admin.
    Agent Task Sharedagent-task-sharedA Neo agent task was shared with the organization.
    Agent Task Unsharedagent-task-unsharedA Neo agent task was unshared, making it visible only to its owner again.
    Agent Task Updatedagent-task-updatedA Neo agent task was updated, for example by changing its permission mode.
    Neo Member Usage Cap Clearedneo-member-usage-cap-clearedAn org admin removed a member’s monthly Neo usage cap. Requires organization admin.
    Neo Member Usage Cap Updatedneo-member-usage-cap-updatedAn org admin set or changed a member’s monthly Neo usage cap. Requires organization admin.
    Neo Slack Identity Connectedneo-slack-identity-connectedA user linked their Slack identity to their Pulumi account for Neo in Slack.
    Neo Slack Identity Disconnectedneo-slack-identity-disconnectedA user removed the link between their Slack identity and their Pulumi account.
    Neo Usage Cap Clearedneo-usage-cap-clearedAn org admin removed the organization’s monthly Neo usage cap. Requires organization admin.
    Neo Usage Cap Updatedneo-usage-cap-updatedAn org admin set or changed the organization’s monthly Neo usage cap. Requires organization admin.

    Registry

    Packages, templates, and Terraform modules published to or removed from the Pulumi Registry.

    EventEvent IDDescription
    Registry Package Version Deletedregistry-package-version-deletedA package version was deleted from the Pulumi Registry.
    Registry Package Version Initializedregistry-package-version-initializedA package version was initialized in the Pulumi Registry, reserving it before its contents are uploaded.
    Registry Package Version Publishedregistry-package-version-publishedA package version was published to the Pulumi Registry.
    Registry Template Version Deletedregistry-template-version-deletedA template version was deleted from the Pulumi Registry.
    Registry Template Version Initializedregistry-template-version-initializedA template version was initialized in the Pulumi Registry, reserving it before its contents are uploaded.
    Registry Template Version Publishedregistry-template-version-publishedA template version was published to the Pulumi Registry.
    Registry Terraform Module Createdregistry-terraform-module-createdA Terraform module was created in the Pulumi Registry.
    Registry Terraform Module Deletedregistry-terraform-module-deletedA Terraform module was deleted from the Pulumi Registry.
    Registry Terraform Module Version Deletedregistry-terraform-module-version-deletedA Terraform module version was deleted from the Pulumi Registry.
    Registry Terraform Module Version Initializedregistry-terraform-module-version-initializedA Terraform module version was initialized in the Pulumi Registry, reserving it before its contents are uploaded.
    Registry Terraform Module Version Publishedregistry-terraform-module-version-publishedA Terraform module version was published to the Pulumi Registry.

    Encryption keys

    Customer-managed keys used to encrypt organization secrets.

    EventEvent IDDescription
    Customer Managed Key Addedcustomer-managed-key-addedA customer-managed key was added to the organization. Requires organization admin.
    Customer Managed Key Disabledcustomer-managed-key-disabledA customer-managed key was disabled and the secrets it protected were re-encrypted with another key. Requires organization admin.
    Customer Managed Key Disabled Allcustomer-managed-key-disabled-allEvery customer-managed key in the organization was disabled. Requires organization admin.
    Customer Managed Key Set Defaultcustomer-managed-key-set-defaultA customer-managed key was made the organization’s default for encrypting secrets. Requires organization admin.

    Integrations

    Source control and other third-party integrations linked to the organization.

    EventEvent IDDescription
    VCS GitHub Installation Linkedvcs-github-installation-linkedAn org admin linked an existing GitHub App installation to the organization. Requires organization admin.

      The infrastructure as code platform for any cloud.

      Contact us Get started