Audit Events

Every audit event type TMA Cloud records, with its metadata.

Authentication EventsCopy Anchor Link

• auth.signup - User creates account
• auth.login - User logs in
• auth.login.failure - Failed login attempt
• auth.logout - Session logout
• auth.logout_all - Logout from all devices
• auth.session_revoked - Single session revoked
• auth.other_sessions_revoked - All other sessions revoked
• auth.password_change - Password change attempt. Success records the new newTokenVersion; failures record a reason of session_not_recent, invalid_mfa_code, or invalid_current_password

File EventsCopy Anchor Link

• file.upload - File uploaded
• file.upload.bulk - Multiple files uploaded in a single bulk operation
• file.download - File downloaded (single)
• file.download.bulk - Multiple files/folders downloaded as ZIP
• file.update - File contents replaced in place, via POST /api/files/:id/replace (metadata: fileName, size)
• file.delete - File moved to trash
• file.delete.queued - Large move-to-trash operation queued
• file.delete.permanent.queued - Permanent deletion or Empty Trash operation queued
• file.restore - File restored from trash
• file.restore.queued - Large restore operation queued
• file.rename - File/folder renamed
• file.move - Files/folders moved
• file.copy.queued - File/folder copy operation queued
• file.star - File starred
• file.unstar - File unstarred
• file.lock - Someone started editing a file, so others get it read-only
• file.unlock - The editing lock was released

Rows written by older versions may also hold file.copy and file.delete.permanent, which the queued events replaced.

Folder EventsCopy Anchor Link

• folder.create - Folder created (metadata: folderName, parentId)
• folder.download - Folder downloaded as a ZIP archive (metadata: folderName); logged only after the archive completes

Share EventsCopy Anchor Link

• share.create - Share link created
• share.delete - Share link removed
• share.access - Public view of share (anonymous access)
• share.download - File or folder downloaded from share

Document Events (OnlyOffice)Copy Anchor Link

• document.open - Document opened in OnlyOffice
• document.save - Document saved from OnlyOffice

Admin EventsCopy Anchor Link

• admin.settings.update - Admin setting changed (metadata: setting, e.g. signup_enabled, hide_file_extensions; newValue or hidden)
• admin.settings.read - Admin viewed protected settings. A failure means someone other than the first user tried (metadata: action)
• admin.settings.update with setting: "storage_config" - Bucket saved (metadata: provider, endpoint, bucket, region, targetChanged, credentialsChanged, version). A failed save is logged with status: failure, action: update_storage_config, and the failed step. Credentials are never logged
• admin.user.list - Admin listed all users
• admin.user.update - Admin updated user (e.g. storage limit)
• admin.orphans.scan - Admin scanned for orphans (metadata: graceMinutes, storageOrphans, databaseOrphans)
• admin.orphans.delete - Admin deleted selected orphans (metadata: graceMinutes, requestedStorage, requestedDatabase, storageDeleted, databaseDeleted, storageSkipped, databaseSkipped)

Account EventsCopy Anchor Link

• account.sub_user.create - Sub-user created (metadata: email, permissions; failure when the email is already in use)
• account.sub_user.update - Sub-user permissions replaced (metadata: permissions)
• account.sub_user.delete - Sub-user removed (metadata: email, permissions)
• account.permission_denied - A sub-user attempted something it was not granted (metadata: permission, method, path); always failure
• account.owner_action_denied - A sub-user attempted an owner-only action (metadata: method, path); always failure

Who Performed the ActionCopy Anchor Link

Every row records the acting login and the account it happened under:

• user_id - The login that acted. For a sub-user this is the sub-user's own ID, never the owner's.
• account_owner_id - The account the action belongs to. Equals user_id for owners.
• actor_role - owner or sub_user.

The audit_activity view joins these back to names and emails. See Database Schema.

Event MetadataCopy Anchor Link

The main metadata fields by event group:

• File Events: fileId, fileName, fileSize, fileType. For file.upload.bulk and file.download.bulk, metadata also includes fileIds and fileCount.
• User Events: userId, email, ipAddress
• Share Events: shareLinkId, token, fileIds
• Account Events: email, permissions, and for denials permission, method, path

Related TopicsCopy Anchor Link

• Audit Logs - Audit system guide
• Database Schema - Database structure