Data model
The event, change package, and change levels that make up an audit trail entry.
Every audit trail entry starts as an event: one occurrence of a Flow run, a Schedule execution, an API call, or a manual action. The module's configuration and REST API call the same thing a change chain — the two terms refer to the same object; "event" is the term used in the UI.
An event groups its changes on two further levels:
- Change package — everything that happened to one identity within the event. A single event can produce zero, one, or many packages; a Schedule run that updates 23 users produces 23 packages under one event.
- Change — one field-level write: which field, its value before and after, which object it was written to, and whether it succeeded.
A change package also carries a package type — a short code such as UserCreated or GroupMembershipAdded that the UI turns into a readable label like "Created user" where a label is defined, and shows as-is otherwise.
Where events come from
Section titled “Where events come from”| Source | What starts an event | Initiator shown |
|---|---|---|
| Flow | One Flow run | The signed-in user who ran the flow |
| Schedule | One scheduled job execution | The schedule itself |
| API | One API call | The calling integration, or a person named in the request if it asserts it acts on their behalf |
| Manual | A change made outside the usual entry points | Depends on how the change was recorded |
Enrichment
Section titled “Enrichment”Changes are recorded with the raw values a connected system actually used — an LDAP distinguished name, a raw attribute name, a technical field identifier. When the module's LDAP enrichment is configured for an object type, those raw values are paired with human-readable ones: a person's display name instead of their DN, a field label instead of its raw attribute name. Enrichment is best-effort — if a lookup fails, the raw change is still recorded, only the enriched values are missing.
Enrichment also determines who a change is attributed to. A write to a group's membership list, for example, is attributed to the person added or removed, not to the group — even though the group is what was technically written to. See Enriching LDAP changes for how this is configured.