---
title: Audit log events
url: /docs/administration/reference/audit-log-events/
---
> This [Pulumi Cloud](/docs/iac/concepts/pulumi-cloud/) feature is available in the [Enterprise and Business Critical editions](/pricing/#audit-logs).



Every event Pulumi Cloud can record in an organization's [audit log](/docs/administration/concepts/audit-logs/), grouped by the product area it belongs to. To view or export your organization's log, see [Audit logs](/docs/administration/concepts/audit-logs/).

Each entry lists:

- **Event** — the name shown in the Pulumi Cloud console and in the `event` field of an exported log.
- **Event ID** — the stable identifier to match on when you process an exported log programmatically.
- **Description** — what the event records, followed where applicable by the permission level the action required, or a note that the event was raised by a failed authentication or authorization check.

Event list last updated on 2026-08-28, synced automatically from the Pulumi Cloud API.

This list is generated from the Pulumi Cloud API, so it stays in step with what your organization's log actually records.

## Authentication and identity

Logins, identity changes, single sign-on configuration, OIDC issuer registration, and permission-denied events.

| Event | Event ID | Description |
|---|---|---|
| Auth Failure Change Request | `auth-failure-change-request` | A user attempted an operation on a change request without the permission it requires. _Recorded as an authentication failure._ |
| Auth Failure Environment | `auth-failure-environment` | A user attempted an operation on an environment without the permission it requires. _Recorded as an authentication failure._ |
| Auth Failure Insights Account | `auth-failure-insights-account` | A user attempted an operation on a Pulumi Insights cloud account without the permission it requires. _Recorded as an authentication failure._ |
| Auth Failure Organization Role | `auth-failure-organization-role` | A user attempted an operation without the organization role it requires. _Recorded as an authentication failure._ |
| Auth Failure SCIM Access Token | `auth-failure-scim-access-token` | A request to an organization's SCIM endpoints presented an invalid access token. _Recorded as an authentication failure._ |
| Auth Failure Stack Permission | `auth-failure-stack-permission` | A user attempted an operation without the stack permission it requires. _Recorded as an authentication failure._ |
| Authorization Policy Updated | `authorization-policy-updated` | The authorization policy governing which OIDC subjects may exchange tokens was updated. |
| OIDC Issuer Deleted | `oidc-issuer-deleted` | A registered OIDC issuer was removed from the organization. |
| OIDC Issuer Registered | `oidc-issuer-registered` | An OIDC issuer was registered with the organization. |
| OIDC Issuer Updated | `oidc-issuer-updated` | A registered OIDC issuer was updated, or its thumbprints were regenerated. |
| OIDC Issuer Validation Failed | `oidc-issuer-validation-failed` | Certificate validation failed for an OIDC issuer, either during CA verification or during thumbprint validation. _Recorded as an authentication failure._ |
| SAML Configuration Updated | `saml-configuration-updated` | An organization's SAML single sign-on configuration was updated. _Requires organization admin._ |
| User Added New Identity to Their Account | `user-added-new-identity-to-their-account` | A user associated a new identity provider login with their Pulumi account. |
| User Login | `user-login` | A user successfully logged in to Pulumi Cloud. |
| User Login Failed | `user-login-failed` | A user tried to log in to Pulumi Cloud and failed, for example by submitting an incorrect password. |

## Access tokens

Creation and revocation of organization, team, and personal access tokens, including tokens issued through OIDC token exchange.

| Event | Event ID | Description |
|---|---|---|
| Deployment Runner Token Created for OIDC Issuer | `deployment-runner-token-created-for-oidc-issuer` | A registered OIDC issuer exchanged a token for a deployment runner access token. |
| Organization Token Created | `organization-token-created` | An organization access token was created. _Requires organization admin._ |
| Organization Token Created for OIDC Issuer | `organization-token-created-for-oidc-issuer` | A registered OIDC issuer exchanged a token for an organization access token. |
| Organization Token Deleted | `organization-token-deleted` | An organization access token was revoked. _Requires organization admin._ |
| Personal Token Created for OIDC Issuer | `personal-token-created-for-oidc-issuer` | A registered OIDC issuer exchanged a token for a personal access token. |
| Team Token Created | `team-token-created` | A team access token was created. _Requires organization admin._ |
| Team Token Created for OIDC Issuer | `team-token-created-for-oidc-issuer` | A registered OIDC issuer exchanged a token for a team access token. |
| Team Token Deleted | `team-token-deleted` | A team access token was revoked. _Requires organization admin._ |

## Organization and members

Organization settings, invitations, membership, custom roles, service accounts, and trials.

| Event | Event ID | Description |
|---|---|---|
| Custom Role Created | `custom-role-created` | A custom role was created in the organization. _Requires organization admin._ |
| Custom Role Deleted | `custom-role-deleted` | A custom role was deleted from the organization. _Requires organization admin._ |
| Custom Role Updated | `custom-role-updated` | A custom role's name, description, or permissions were changed. _Requires organization admin._ |
| Member Added | `member-added` | A member was added to an organization. _Requires organization admin._ |
| Member Removed | `member-removed` | A member was removed from an organization. _Requires organization admin._ |
| Member Role Changed | `member-role-changed` | A member's role in an organization was changed. _Requires organization admin._ |
| Organization Backend Changed | `organization-backend-changed` | An organization's identity backend (GitHub, GitLab, SAML, or Pulumi) was changed. _Requires organization admin._ |
| Organization Deployment Default Role Updated | `organization-deployment-default-role-updated` | The organization's default role for deployments was changed. _Requires organization admin._ |
| Organization Invite Accepted | `organization-invite-accepted` | A pending organization invite was accepted and the invitee joined the organization. |
| Organization Invite Canceled | `organization-invite-canceled` | A pending organization invite was canceled and is no longer valid. _Requires organization admin._ |
| Organization Invite Sent | `organization-invite-sent` | An organization admin invited someone to join the organization. _Requires organization admin._ |
| Organization Settings Changed | `organization-settings-changed` | An organization's settings were changed. _Requires organization admin._ |
| Retrial Ended | `retrial-ended` | A Pulumi site admin ended the organization's retrial. _Requires organization admin._ |
| Retrial Expiration Updated | `retrial-expiration-updated` | A Pulumi site admin changed the expiration date of the organization's active retrial. _Requires organization admin._ |
| Retrial Started | `retrial-started` | A Pulumi site admin started a retrial for the organization. _Requires organization admin._ |
| Service Created | `service-created` | A service account was created in the organization. _Requires organization admin._ |
| Service Deleted | `service-deleted` | A service account was deleted from the organization, revoking its access tokens and permissions. _Requires organization admin._ |
| Service Updated | `service-updated` | A service account's details or membership were changed. _Requires organization admin._ |

## Teams

Creating, updating, and deleting teams.

| Event | Event ID | Description |
|---|---|---|
| Team Created | `team-created` | A team was created in an organization. _Requires organization admin._ |
| Team Deleted | `team-deleted` | A team was deleted from an organization. _Requires organization admin._ |
| Team Updated | `team-updated` | A team's name, description, or membership was changed. _Requires organization admin._ |

## Stacks

Creating, updating, renaming, transferring, and deleting stacks, plus collaborator changes and stack secret decryption.

| Event | Event ID | Description |
|---|---|---|
| Secret Decrypted | `secret-decrypted` | A secret value belonging to a stack was decrypted. |
| Secrets Batch Decrypted | `secrets-batch-decrypted` | A batch of secret values belonging to a stack was decrypted in a single request. |
| Stack Collaborator Added | `stack-collaborator-added` | A collaborator was added to a stack. _Requires organization admin._ |
| Stack Collaborator Permissions Changed | `stack-collaborator-permissions-changed` | A stack collaborator's permissions were changed. _Requires organization admin._ |
| Stack Collaborator Removed | `stack-collaborator-removed` | A collaborator was removed from a stack. _Requires organization admin._ |
| Stack Created | `stack-created` | A stack was created. |
| Stack Created from Template | `stack-created-from-template` | A stack was created from a template. |
| Stack Deleted | `stack-deleted` | A stack was deleted. _Requires stack admin._ |
| Stack Exported | `stack-exported` | A stack's state was exported. |
| Stack Imported | `stack-imported` | A stack's state was imported, replacing its checkpoint. |
| Stack Provider Open | `stack-provider-open` | An ESC environment read a stack's outputs through the pulumi-stacks provider. |
| Stack Renamed | `stack-renamed` | A stack was renamed. _Requires organization admin._ |
| Stack Transferred to Organization | `stack-transferred-to-organization` | A stack was transferred from one organization to another. _Requires organization admin._ |
| Stack Update Canceled | `stack-update-canceled` | A stack update was canceled before it finished. |
| Stack Update Completed | `stack-update-completed` | A stack update finished. |
| Stack Update Started | `stack-update-started` | A stack update started. |

## Deployments

Pulumi Deployments configuration, including deployment settings, schedules, self-hosted runner pools, and pausing or resuming deployments.

| Event | Event ID | Description |
|---|---|---|
| Deployment Runner Pool Created | `deployment-runner-pool-created` | A self-hosted deployment runner pool was registered with the organization. _Requires organization admin._ |
| Deployment Runner Pool Deleted | `deployment-runner-pool-deleted` | A self-hosted deployment runner pool was removed from the organization. _Requires organization admin._ |
| Deployment Settings Role Updated | `deployment-settings-role-updated` | A stack's deployment settings were assigned the role its deployments run as. |
| Organization Deployments Paused | `organization-deployments-paused` | Deployments were paused for an entire organization. _Requires organization admin._ |
| Organization Deployments Resumed | `organization-deployments-resumed` | Deployments were resumed for an entire organization. _Requires organization admin._ |
| Scheduled Deployment Created | `scheduled-deployment-created` | A deployment was scheduled for a stack. |
| Scheduled Deployment Deleted | `scheduled-deployment-deleted` | A stack's deployment schedule was deleted. |
| Scheduled Deployment Updated | `scheduled-deployment-updated` | A stack's deployment schedule was changed. |
| Stack Deployments Paused | `stack-deployments-paused` | Deployments were paused for a single stack. _Requires stack admin._ |
| Stack Deployments Resumed | `stack-deployments-resumed` | Deployments were resumed for a single stack. _Requires stack admin._ |

## Environments

Opening, reading, editing, tagging, cloning, scheduling, and rotating Pulumi ESC environments.

| Event | Event ID | Description |
|---|---|---|
| Environment Cloned | `environment-cloned` | An ESC environment was cloned into a new environment. |
| Environment Created | `environment-created` | An ESC environment was created. |
| Environment Decrypted | `environment-decrypted` | An ESC environment's definition was read with its secrets decrypted. |
| Environment Deleted | `environment-deleted` | An ESC environment was deleted. |
| Environment Deletion Protection Disabled | `environment-deletion-protection-disabled` | Deletion protection was disabled on an ESC environment. |
| Environment Deletion Protection Enabled | `environment-deletion-protection-enabled` | Deletion protection was enabled on an ESC environment. |
| Environment Draft Open | `environment-draft-open` | A draft revision of an ESC environment, proposed by a change request, was opened. |
| Environment Draft Read Open | `environment-draft-read-open` | The resolved values of an open ESC environment draft were read. |
| Environment Open | `environment-open` | An ESC environment was opened, evaluating its definition and resolving its providers. |
| Environment Read | `environment-read` | An ESC environment's definition was read. |
| Environment Read Open | `environment-read-open` | The resolved values of an open ESC environment session were read. |
| Environment Restored | `environment-restored` | A deleted ESC environment was restored. |
| Environment Revision Retracted | `environment-revision-retracted` | A revision of an ESC environment was retracted. |
| Environment Revision Tag Created | `environment-revision-tag-created` | A version tag was created on a revision of an ESC environment. |
| Environment Revision Tag Delete | `environment-revision-tag-delete` | A version tag was deleted from an ESC environment. |
| Environment Revision Tag Open | `environment-revision-tag-open` | An ESC environment was opened at a specific version tag. |
| Environment Revision Tag Read | `environment-revision-tag-read` | A version tag on an ESC environment was read. |
| Environment Revision Tag Update | `environment-revision-tag-update` | A version tag on an ESC environment was moved to a different revision. |
| Environment Rotated | `environment-rotated` | A secret rotation ran for an ESC environment. The event description records whether it succeeded or failed. |
| Environment Schedule Created | `environment-schedule-created` | A schedule was created on an ESC environment. |
| Environment Schedule Deleted | `environment-schedule-deleted` | A schedule was deleted from an ESC environment. |
| Environment Schedule Updated | `environment-schedule-updated` | A schedule on an ESC environment was changed. |
| Environment Tag Created | `environment-tag-created` | A tag was added to an ESC environment. |
| Environment Tag Deleted | `environment-tag-deleted` | A tag was removed from an ESC environment. |
| Environment Tag Updated | `environment-tag-updated` | A tag on an ESC environment was changed. |
| Environment Unauthorized Open | `environment-unauthorized-open` | A user tried to open, clone, or import an ESC environment they do not have permission to read. |
| Environment Updated | `environment-updated` | An ESC environment's definition was updated. |

## Policy as code

Policy packs, policy groups, and the change gates that require approval before a change proceeds.

| Event | Event ID | Description |
|---|---|---|
| Change Gate Created | `change-gate-created` | A change gate was created, requiring approval before changes to whatever it targets. _Requires organization admin._ |
| Change Gate Deleted | `change-gate-deleted` | A change gate was deleted. _Requires organization admin._ |
| Change Gate Updated | `change-gate-updated` | A change gate's rule, target, or enabled state was changed. _Requires organization admin._ |
| Policy Group Created | `policy-group-created` | A policy group was created. _Requires organization admin._ |
| Policy Group Deleted | `policy-group-deleted` | A policy group was deleted. _Requires organization admin._ |
| Policy Group Updated | `policy-group-updated` | A policy group's stacks or policy packs were changed. _Requires organization admin._ |
| Policy Pack Created | `policy-pack-created` | A policy pack was published to an organization. _Requires organization admin._ |
| Policy Pack Deleted | `policy-pack-deleted` | A policy pack was deleted from an organization. _Requires organization admin._ |
| Policy Pack Disabled | `policy-pack-disabled` | A policy pack was disabled for a policy group. _Requires organization admin._ |
| Policy Pack Enabled | `policy-pack-enabled` | A policy pack was enabled for a policy group. _Requires organization admin._ |

## Discovery

Cloud accounts connected for resource discovery, and the scans run against them.

| Event | Event ID | Description |
|---|---|---|
| Insights Account Created | `insights-account-created` | A cloud account was connected to Pulumi Insights. _Requires organization admin._ |
| Insights Account Deleted | `insights-account-deleted` | A cloud account was disconnected from Pulumi Insights. _Requires organization admin._ |
| Insights Account Scan Canceled | `insights-account-scan-canceled` | A running resource scan was canceled for a Pulumi Insights cloud account. |
| Insights Account Scan Started | `insights-account-scan-started` | A resource scan was started for a Pulumi Insights cloud account. |
| Insights Account Scheduled Scans Paused | `insights-account-scheduled-scans-paused` | Scheduled scans were paused for a Pulumi Insights cloud account. |
| Insights Account Scheduled Scans Resumed | `insights-account-scheduled-scans-resumed` | Scheduled scans were resumed for a Pulumi Insights cloud account. |
| Insights Account Tags Updated | `insights-account-tags-updated` | The tags on a Pulumi Insights cloud account were updated. _Requires organization admin._ |
| Insights Account Updated | `insights-account-updated` | A Pulumi Insights cloud account's configuration was updated. _Requires organization admin._ |
| Insights Trial Billing Accepted | `insights-trial-billing-accepted` | An organization accepted billing to keep using Pulumi Insights after its trial. |
| Insights Trial Billing Denied | `insights-trial-billing-denied` | An organization declined to convert its Pulumi Insights trial into a paid subscription. |

## Neo and AI agents

Pulumi Neo tasks, model providers, CLI integrations, Slack identities, and usage caps.

| Event | Event ID | Description |
|---|---|---|
| Agent CLI Integration Connected | `agent-cli-integration-connected` | An org admin connected a Neo CLI integration instance (an ESC environment supplying credentials for a catalog CLI such as AWS) to the organization. _Requires organization admin._ |
| Agent CLI Integration Disconnected | `agent-cli-integration-disconnected` | An org admin removed a connected Neo CLI integration instance from the organization. _Requires organization admin._ |
| Agent CLI Integration Updated | `agent-cli-integration-updated` | An org admin changed the ESC environment reference or the notes on a connected Neo CLI integration instance. _Requires organization admin._ |
| Agent Integration Disabled | `agent-integration-disabled` | An org admin disabled a Neo integration for the organization. _Requires organization admin._ |
| Agent Integration Enabled | `agent-integration-enabled` | An org admin enabled a Neo integration from the catalog for the organization. _Requires organization admin._ |
| Agent Model Provider Created | `agent-model-provider-created` | An org admin registered a Neo bring-your-own-key model provider, storing an encrypted third-party API key and the endpoint Neo's LLM traffic egresses to. _Requires organization admin._ |
| Agent Model Provider Default Changed | `agent-model-provider-default-changed` | An org admin made a Neo bring-your-own-key model provider the organization's default, redirecting Neo's LLM traffic to that provider's endpoint. _Requires organization admin._ |
| Agent Model Provider Deleted | `agent-model-provider-deleted` | An org admin removed a Neo bring-your-own-key model provider. _Requires organization admin._ |
| Agent Model Provider Updated | `agent-model-provider-updated` | An org admin changed a Neo bring-your-own-key model provider's base URL, model map, or auth headers. Re-sending the header set rotates the stored secret; secret values are never recorded. _Requires organization admin._ |
| Agent Task Created | `agent-task-created` | A Neo agent task was created. |
| Agent Task Deleted | `agent-task-deleted` | A Pulumi site admin permanently deleted a Neo agent task. _Requires organization admin._ |
| Agent Task Shared | `agent-task-shared` | A Neo agent task was shared with the organization. |
| Agent Task Unshared | `agent-task-unshared` | A Neo agent task was unshared, making it visible only to its owner again. |
| Agent Task Updated | `agent-task-updated` | A Neo agent task was updated, for example by changing its permission mode. |
| Neo Member Usage Cap Cleared | `neo-member-usage-cap-cleared` | An org admin removed a member's monthly Neo usage cap. _Requires organization admin._ |
| Neo Member Usage Cap Updated | `neo-member-usage-cap-updated` | An org admin set or changed a member's monthly Neo usage cap. _Requires organization admin._ |
| Neo Slack Identity Connected | `neo-slack-identity-connected` | A user linked their Slack identity to their Pulumi account for Neo in Slack. |
| Neo Slack Identity Disconnected | `neo-slack-identity-disconnected` | A user removed the link between their Slack identity and their Pulumi account. |
| Neo Usage Cap Cleared | `neo-usage-cap-cleared` | An org admin removed the organization's monthly Neo usage cap. _Requires organization admin._ |
| Neo Usage Cap Updated | `neo-usage-cap-updated` | An org admin set or changed the organization's monthly Neo usage cap. _Requires organization admin._ |

## Registry

Packages, templates, and Terraform modules published to or removed from the Pulumi Registry.

| Event | Event ID | Description |
|---|---|---|
| Registry Package Version Deleted | `registry-package-version-deleted` | A package version was deleted from the Pulumi Registry. |
| Registry Package Version Initialized | `registry-package-version-initialized` | A package version was initialized in the Pulumi Registry, reserving it before its contents are uploaded. |
| Registry Package Version Published | `registry-package-version-published` | A package version was published to the Pulumi Registry. |
| Registry Template Version Deleted | `registry-template-version-deleted` | A template version was deleted from the Pulumi Registry. |
| Registry Template Version Initialized | `registry-template-version-initialized` | A template version was initialized in the Pulumi Registry, reserving it before its contents are uploaded. |
| Registry Template Version Published | `registry-template-version-published` | A template version was published to the Pulumi Registry. |
| Registry Terraform Module Created | `registry-terraform-module-created` | A Terraform module was created in the Pulumi Registry. |
| Registry Terraform Module Deleted | `registry-terraform-module-deleted` | A Terraform module was deleted from the Pulumi Registry. |
| Registry Terraform Module Version Deleted | `registry-terraform-module-version-deleted` | A Terraform module version was deleted from the Pulumi Registry. |
| Registry Terraform Module Version Initialized | `registry-terraform-module-version-initialized` | A Terraform module version was initialized in the Pulumi Registry, reserving it before its contents are uploaded. |
| Registry Terraform Module Version Published | `registry-terraform-module-version-published` | A Terraform module version was published to the Pulumi Registry. |

## Encryption keys

Customer-managed keys used to encrypt organization secrets.

| Event | Event ID | Description |
|---|---|---|
| Customer Managed Key Added | `customer-managed-key-added` | A customer-managed key was added to the organization. _Requires organization admin._ |
| Customer Managed Key Disabled | `customer-managed-key-disabled` | A customer-managed key was disabled and the secrets it protected were re-encrypted with another key. _Requires organization admin._ |
| Customer Managed Key Disabled All | `customer-managed-key-disabled-all` | Every customer-managed key in the organization was disabled. _Requires organization admin._ |
| Customer Managed Key Set Default | `customer-managed-key-set-default` | A customer-managed key was made the organization's default for encrypting secrets. _Requires organization admin._ |

## Integrations

Source control and other third-party integrations linked to the organization.

| Event | Event ID | Description |
|---|---|---|
| VCS GitHub Installation Linked | `vcs-github-installation-linked` | An org admin linked an existing GitHub App installation to the organization. _Requires organization admin._ |