AuditTrailEntry

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/inkseal-net/json-schema/inkseal-net-audit-trail-entry-schema.json",
  "title": "AuditTrailEntry",
  "description": "One recorded event in an envelope's signing evidence.",
  "x-generated": "2026-11-12",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/inkseal-net-openapi.json#/components/schemas/AuditTrailEntry",
  "type": "object",
  "required": [
    "action",
    "actorType",
    "actorEmail",
    "actorName",
    "ipAddress",
    "metadata",
    "createdAt",
    "credential",
    "agentIdentity"
  ],
  "properties": {
    "action": {
      "type": "string",
      "description": "What happened. Envelope lifecycle, signer activity, document handling, and the inbound-mail workflow all record here.",
      "enum": [
        "envelope.created",
        "envelope.sent",
        "envelope.completed",
        "envelope.declined",
        "envelope.voided",
        "envelope.expired",
        "envelope.send_failed",
        "signer.notified",
        "signer.viewed",
        "signer.signed",
        "signer.approved",
        "signer.acknowledged",
        "signer.declined",
        "signer.reminder_sent",
        "document.uploaded",
        "document.converted",
        "document.stamped",
        "document.downloaded",
        "email.received",
        "email.parsed",
        "email.needs_info",
        "email.preview_sent",
        "email.approved",
        "email.cancelled",
        "email.rejected",
        "email.sender_auth",
        "account.email_keyword_approval_updated",
        "envelope.send_approval_requested",
        "envelope.send_approval_decided",
        "account.agent_guardrails_updated"
      ]
    },
    "actorType": {
      "type": "string",
      "description": "Who acted. `service` is a service credential, `user` a dashboard member, `signer` a recipient, `system` a scheduled job.",
      "enum": [
        "user",
        "signer",
        "system",
        "service"
      ]
    },
    "actorEmail": {
      "type": [
        "string",
        "null"
      ],
      "description": "The email of whoever caused the event. For a credential this is the issuing member, which is attribution only. Null on an event recorded about a recipient rather than by an actor: read `metadata.recipientEmail` for those."
    },
    "actorName": {
      "type": [
        "string",
        "null"
      ],
      "description": "Display name of whoever caused the event. For a credential this is its agent identity. Null on an event recorded about a recipient: read `metadata.recipientName` for those."
    },
    "ipAddress": {
      "type": [
        "string",
        "null"
      ],
      "description": "The address the action came from, when one was recorded."
    },
    "metadata": {
      "type": [
        "object",
        "null"
      ],
      "additionalProperties": true,
      "description": "Action-specific detail, parsed from storage. Null when the action recorded none. The four events recorded about a recipient rather than by an actor -- `signer.notified`, `signer.reminder_sent`, `envelope.cc_delivered` and `envelope.cc_delivery_failed` -- carry that person here as `recipientName` and `recipientEmail`."
    },
    "createdAt": {
      "type": "string",
      "format": "date-time"
    },
    "credential": {
      "type": [
        "object",
        "null"
      ],
      "description": "The service credential that produced this event, when one did. Its public id and name only: no key material and no prefix.",
      "required": [
        "id",
        "name"
      ],
      "additionalProperties": false,
      "properties": {
        "id": {
          "type": "string",
          "description": "The credential's public id, stable across rotations."
        },
        "name": {
          "type": "string"
        }
      }
    },
    "agentIdentity": {
      "type": [
        "string",
        "null"
      ],
      "description": "Who the credential acts as, as recorded when the event happened."
    }
  }
}