{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/1password/json-schema/1password-log-events-schema.json",
  "title": "LogEvents",
  "x-generated": "2026-11-10",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/1password-audit-log-api-openapi.yml#/components/schemas/LogEvents",
  "type": "object",
  "properties": {
    "next": {
      "type": "string",
      "description": "A cursor URL for the next page of results. Unlike the rest of the SaaS Manager API (which returns no value once paging is complete), the audit log is an append-only stream: this URL always points at where to resume, so keep following it to receive new events as they are written. The same URL is also returned in the `link` response header with `rel=\"next\"`."
    },
    "results": {
      "type": "array",
      "items": {
        "$ref": "#/$defs/LogEvent"
      },
      "description": "The audit log events for this page, oldest first (or newest first when sortOrder is DESCENDING)."
    }
  },
  "additionalProperties": false,
  "$defs": {
    "LogEvent": {
      "type": "object",
      "properties": {
        "id": {
          "type": "integer",
          "description": "The SaaS Manager ID for the event.",
          "format": "int64"
        },
        "published": {
          "type": "string",
          "description": "The date and time the event occurred.",
          "format": "date-time"
        },
        "eventType": {
          "type": "string",
          "description": "The event type, e.g. \"employee_login_success\". See the list of event types in the documentation."
        },
        "actor": {
          "allOf": [
            {
              "$ref": "#/$defs/LogEventActor"
            }
          ],
          "description": "The user who performed the action."
        },
        "client": {
          "allOf": [
            {
              "$ref": "#/$defs/LogEventClient"
            }
          ],
          "description": "The client the action originated from. Omitted for SaaS Manager system events."
        },
        "target": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/LogEventTarget"
          },
          "description": "The objects the action was performed on. Not all events have targets."
        },
        "details": {
          "description": "Detailed information about the event. The shape varies by event type, e.g. field-value changes or counts of objects updated by an integration."
        }
      },
      "additionalProperties": false
    },
    "LogEventActor": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string",
          "description": "The SaaS Manager ID of the target."
        },
        "type": {
          "type": "string",
          "description": "The type of the target, e.g. \"User\", \"CustomerIntegration\", \"CustomerApp\" or \"ApiClient\"."
        },
        "displayName": {
          "type": "string",
          "description": "The display name of the target."
        },
        "alternateId": {
          "type": "string",
          "description": "An alternate identifier for the target, typically the target's email address."
        }
      },
      "additionalProperties": false
    },
    "LogEventClient": {
      "type": "object",
      "properties": {
        "ipAddress": {
          "type": "string",
          "description": "The IP address from which the event originated."
        }
      },
      "additionalProperties": false
    },
    "LogEventTarget": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string",
          "description": "The SaaS Manager ID of the target."
        },
        "type": {
          "type": "string",
          "description": "The type of the target, e.g. \"User\", \"CustomerIntegration\", \"CustomerApp\" or \"ApiClient\"."
        },
        "displayName": {
          "type": "string",
          "description": "The display name of the target."
        },
        "alternateId": {
          "type": "string",
          "description": "An alternate identifier for the target, typically the target's email address."
        }
      },
      "additionalProperties": false
    }
  }
}