Audit Events

Complete list of audit event types in TMA Cloud.

Authentication Events

• auth.signup - User creates account
• auth.login - User logs in
• auth.login.failure - Failed login attempt
• auth.logout - Session logout
• auth.logout_all - Logout from all devices
• auth.session_revoked - Single session revoked
• auth.other_sessions_revoked - All other sessions revoked
• auth.password_change - Password change attempt. Success records the new newTokenVersion; failures record a reason of session_not_recent, invalid_mfa_code, or invalid_current_password

File Events

• file.upload - File uploaded
• file.upload.bulk - Multiple files uploaded in a single bulk operation
• file.download - File downloaded (single)
• file.download.bulk - Multiple files/folders downloaded as ZIP
• file.update - File contents replaced in place, via POST /api/files/:id/replace (metadata: fileName, size)
• file.delete - File moved to trash
• file.delete.queued - Large move-to-trash operation queued
• file.delete.permanent - File permanently deleted by the earlier synchronous flow
• file.delete.permanent.queued - Permanent deletion or Empty Trash operation queued
• file.restore - File restored from trash
• file.restore.queued - Large restore operation queued
• file.rename - File/folder renamed
• file.move - Files/folders moved
• file.copy - Files/folders copied by the earlier synchronous flow
• file.copy.queued - File/folder copy operation queued
• file.star - File starred
• file.unstar - File unstarred

Folder Events

• folder.create - Folder created (metadata: folderName, parentId)
• folder.download - Folder downloaded as a ZIP archive (metadata: folderName); logged only after the archive completes

Share Events

• share.create - Share link created
• share.delete - Share link removed
• share.access - Public view of share (anonymous access)
• share.download - File or folder downloaded from share

Document Events (OnlyOffice)

• document.open - Document opened in OnlyOffice
• document.save - Document saved from OnlyOffice

Admin Events

• admin.settings.update - Admin setting changed (metadata: setting, e.g. signup_enabled, hide_file_extensions; newValue or hidden)
• admin.settings.read - Admin viewed protected settings (failure when unauthorized)
• admin.user.list - Admin listed all users
• admin.user.update - Admin updated user (e.g. storage limit)
• admin.orphans.scan - Admin scanned for orphans (metadata: graceMinutes, storageOrphans, databaseOrphans)
• admin.orphans.delete - Admin deleted selected orphans (metadata: graceMinutes, requestedStorage, requestedDatabase, storageDeleted, databaseDeleted, storageSkipped, databaseSkipped)
• admin.orphans.access - Non-admin attempted an orphan endpoint (metadata: action, reason); always failure

Account Events

• account.sub_user.create - Sub-user created (metadata: email, permissions; failure when the email is already in use)
• account.sub_user.update - Sub-user permissions replaced (metadata: permissions)
• account.sub_user.delete - Sub-user removed (metadata: email, permissions)
• account.permission_denied - A sub-user attempted something it was not granted (metadata: permission, method, path); always failure
• account.owner_action_denied - A sub-user attempted an owner-only action (metadata: method, path); always failure

Who Performed the Action

Every row records the acting login and the account it happened under:

• user_id - The login that acted. For a sub-user this is the sub-user's own ID, never the owner's.
• account_owner_id - The account the action belongs to. Equals user_id for owners.
• actor_role - owner or sub_user.

The audit_activity view joins these back to names and emails. See Database Schema.

Event Metadata

Each event includes metadata with relevant information:

• File Events: fileId, fileName, fileSize, fileType. For file.upload.bulk and file.download.bulk, metadata also includes fileIds and fileCount.
• User Events: userId, email, ipAddress
• Share Events: shareLinkId, token, fileIds
• Account Events: email, permissions, and for denials permission, method, path

Related Topics

• Audit Logs - Audit system guide
• Database Schema - Database structure