---
title: Audit event fields
description: "What every field in an audit event means, on the Organisation and Authentication tabs and in CSV and JSON exports of the audit log."
section: Reference
order: 30
audience: [owner, admin]
status: published
lastVerified: 2026-09-15
sources:
  - web/src/components/app/audit/audit-utils.ts
  - web/src/components/app/audit/AuditEventDialog.tsx
  - web/src/components/app/audit/AuditFilters.tsx
  - web/src/components/app/audit/useAuditEvents.ts
---

## Organisation events

| Field | Meaning |
| --- | --- |
| Timestamp | When it happened. |
| User, User ID | The person who did it, by email and by ID. For share-link downloads, the person who created the link. |
| Action | What happened, like `PUT` (upload), `GET` (download), `DELETE`, `LIST`, `ROLE_UPDATED`, or `MEMBER_REMOVED`. |
| Result | `allowed` or `denied`. |
| Bucket, Prefix, Key | Which bucket, folder, and file, when the event is about storage. |
| Resource type, Resource ID | Which quickS3 item was affected, like a role or a connection. |
| Target user | The person affected, for membership and role changes. |
| Event ID | A unique ID for this event. |
| Details | Extra context that depends on the action. For example, `via: share_link` on share-link downloads, or which AI client acted. |

## Authentication events

| Field | Meaning |
| --- | --- |
| Timestamp | When it happened. |
| User, User ID | The account's email and ID, when known. |
| Action | Like `MAGIC_LINK_REQUESTED`, `MAGIC_LINK_VERIFY_SUCCESS`, `MAGIC_LINK_VERIFY_FAILED`, `LOGIN`, `LOGOUT`, or `INVITE_ACCEPTED`. |
| Result | `Success` or `Failed`. |
| IP address, User agent | Where the request came from and which browser sent it. |
| Event ID | A unique ID for this event. |

A "link requested" event doesn't mean someone signed in. Requested links can go unused.

## What an event never contains

File contents, passwords, storage keys, sign-in tokens, or signed links. If you ever see one of these in an audit event, report it as a security issue.

Events are kept for 14 days. See [the audit log](/docs/audit/overview/).