{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/microsoft-graph/json-schema/microsoft-graph-microsoft-graph-audit-event-schema.json",
  "title": "microsoft.graph.auditEvent",
  "x-generated": "2026-11-04",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/microsoft-graph-devicemanagement-auditevent-api-openapi.yml#/components/schemas/microsoft.graph.auditEvent",
  "allOf": [
    {
      "$ref": "#/$defs/microsoft.graph.entity"
    },
    {
      "title": "auditEvent",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "activity": {
          "type": [
            "string",
            "null"
          ],
          "description": "Friendly name of the activity."
        },
        "activityDateTime": {
          "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
          "type": "string",
          "description": "The date time in UTC when the activity was performed.",
          "format": "date-time"
        },
        "activityOperationType": {
          "type": [
            "string",
            "null"
          ],
          "description": "The HTTP operation type of the activity."
        },
        "activityResult": {
          "type": [
            "string",
            "null"
          ],
          "description": "The result of the activity."
        },
        "activityType": {
          "type": [
            "string",
            "null"
          ],
          "description": "The type of activity that was being performed."
        },
        "actor": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.auditActor"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "AAD user and application that are associated with the audit event."
        },
        "category": {
          "type": [
            "string",
            "null"
          ],
          "description": "Audit category."
        },
        "componentName": {
          "type": [
            "string",
            "null"
          ],
          "description": "Component name."
        },
        "correlationId": {
          "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
          "type": "string",
          "description": "The client request Id that is used to correlate activity within the system.",
          "format": "uuid"
        },
        "displayName": {
          "type": [
            "string",
            "null"
          ],
          "description": "Event display name."
        },
        "resources": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.auditResource"
          },
          "description": "Resources being modified."
        },
        "@odata.type": {
          "type": "string"
        }
      },
      "description": "A class containing the properties for Audit Event."
    }
  ],
  "x-ms-discriminator-value": "#microsoft.graph.auditEvent",
  "$defs": {
    "microsoft.graph.auditActor": {
      "title": "auditActor",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "applicationDisplayName": {
          "type": [
            "string",
            "null"
          ],
          "description": "Name of the Application."
        },
        "applicationId": {
          "type": [
            "string",
            "null"
          ],
          "description": "AAD Application Id."
        },
        "auditActorType": {
          "type": [
            "string",
            "null"
          ],
          "description": "Actor Type."
        },
        "ipAddress": {
          "type": [
            "string",
            "null"
          ],
          "description": "IPAddress."
        },
        "servicePrincipalName": {
          "type": [
            "string",
            "null"
          ],
          "description": "Service Principal Name (SPN)."
        },
        "userId": {
          "type": [
            "string",
            "null"
          ],
          "description": "User Id."
        },
        "userPermissions": {
          "type": "array",
          "items": {
            "type": [
              "string",
              "null"
            ]
          },
          "description": "List of user permissions when the audit was performed."
        },
        "userPrincipalName": {
          "type": [
            "string",
            "null"
          ],
          "description": "User Principal Name (UPN)."
        },
        "@odata.type": {
          "type": "string"
        }
      },
      "description": "A class containing the properties for Audit Actor."
    },
    "microsoft.graph.auditProperty": {
      "title": "auditProperty",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "displayName": {
          "type": [
            "string",
            "null"
          ],
          "description": "Display name."
        },
        "newValue": {
          "type": [
            "string",
            "null"
          ],
          "description": "New value."
        },
        "oldValue": {
          "type": [
            "string",
            "null"
          ],
          "description": "Old value."
        },
        "@odata.type": {
          "type": "string"
        }
      },
      "description": "A class containing the properties for Audit Property."
    },
    "microsoft.graph.auditResource": {
      "title": "auditResource",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "auditResourceType": {
          "type": [
            "string",
            "null"
          ],
          "description": "Audit resource's type."
        },
        "displayName": {
          "type": [
            "string",
            "null"
          ],
          "description": "Display name."
        },
        "modifiedProperties": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.auditProperty"
          },
          "description": "List of modified properties."
        },
        "resourceId": {
          "type": [
            "string",
            "null"
          ],
          "description": "Audit resource's Id."
        },
        "@odata.type": {
          "type": "string"
        }
      },
      "description": "A class containing the properties for Audit Resource."
    },
    "microsoft.graph.entity": {
      "title": "entity",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "id": {
          "type": "string",
          "description": "The unique identifier for an entity. Read-only."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    }
  }
}