Events catalog

✅ Verified

Enumerated from Axowl.Core/Models/**/Events/*.cs (origin/main) — 2026-06-22. List is representative (the largest groups); the envelope/payload shape per event is ⚠️ not documented here.

Axowl publishes a sealed domain event for each consequential mutation; events feed the hash-chained audit log (see Seals & integrity). Events are records under Axowl.Core/Models/<domain>/Events/.

By domain

Domain	Event types
Users	UserCreated/Updated/Deleted/Recovered/Merged/Anonymized, UserLoggedIn/Out, EmailVerified, SealerCreated, AnomalousActivityDetected
Sessions	SessionCreated/Refreshed/Terminated/Expired/Locked/Unlocked/Heartbeat, SessionsBulkRevoked, ConcurrentLogin
Roles & permissions	RoleCreated/Updated/Deleted/Assigned/Revoked, RolePermissionAdded, PermissionCreated/Granted/Evaluated, CustomEventRegistered
Applications	ApplicationCreated/Updated/Deleted/StatusChanged, AppGroupCreated/Updated/Deleted
Org settings & keys	OrgApiKeyCreated/Revoked, OrgSigningKeyRotated, OrgWebhookSecretRegenerated, OrgPluginTokenCreated/Revoked, OrganizationSettingsUpdated, OrganizationPolicyUpdated, OrganizationSessionEntered/Exited
Reporting	TeamCreated, TeamLeadChanged, RelationshipAdded/Removed, MembershipAdded/Removed
Devices	DeviceRegistered, DeviceStatusChanged
End users	EndUserCreated/Registered/Activated/Suspended/Deleted/LoggedIn/Out, EndUserLoginFailed
Integrity / security	IntegrityTamperingDetected, IntegrityViolationResolved, IntegrityRestorePerformed
SCIM	ScimUserDeactivated, InboundEventReceived
Business	MeetingCreated/Updated/Cancelled

Note

Base types: BaseDomainEvent, TenantBaseEvent, SystemBaseEvent. To document the full payload of a given event, read its record under Axowl.Core/Models/.

Login failures

EndUserLoginFailed (enduser.security.login_failed) is emitted on every rejected end-user sign-in, so you can chart a failure rate rather than successes alone. It carries a reason code on the envelope’s rc field:

Group	Reason codes
Credential	invalid_credentials, unknown_credential, assertion_failed, invalid_token, mfa_failed
Policy	suspended, badge_inactive, access_revoked, registration_closed, bot_check_failed

Count only the credential group when watching for credential-stuffing spikes — the policy group means the credential was fine and a rule rejected the sign-in, so mixing them inflates the rate.

Caution

The attempted end user is not always known — a sign-in against an unregistered email or passkey is precisely the attack signal, and there is no EndUser row to attribute it to. Those attempts appear in the audit event log and the archived event stream, but not in the per-end-user event table, whose foreign key requires a real end user. Query the audit log, not the per-user table, if you need a complete failure count.

Emission is gated by the app group’s end-user event toggle, the same switch that governs EndUserLoggedIn.