Every event the audit webhook delivers, generated from the code: catalogue version 250, the number of event types. This page has the runs; approvals and refusals are on the second page, and seats, the record of the work and the team on the third.
What a delivery looks like
One JSON document with id, at (ISO time), team, type, actor (the account's email), chatId (the discussion, when there is one), runId and technique where they apply, source and detail. The HMAC-SHA256 of the exact body travels in the X-LetThemChat-Signature header. No event carries a transcript, a prompt, a key, or a masked value.
Runs
| Type | Reported by | When | Detail carries |
|---|---|---|---|
run.started | Mac and server | A discussion starts a run. | title, mode, leader (Mac); seats, depth (server) |
run.finished | Mac | A run ends with an answer. | agreed, usd |
run.stopped | Mac | A run is stopped before an answer. | agreed, usd |
run.failed | Mac and server | A run failed: what, the seat or tool at fault, the steps blocked (row 336). | what, seat, tool, blockedSteps |
run.repaired | Server | A failed discussion's later run ended agreed; the minutes between are its time to repair (row 336). | minutes |
skill.provisioned | Mac | Built-in skills were written, refreshed or removed (row 252). | written, refreshed, kept, removed |
skill.installed | Mac | A skill was installed from the team's skills registry (row 252). | name, sha256, from |
skill.deleted | Mac | A person deleted one of their skills in Settings → Skills. | name |
chat.compacted | Mac and server | Earlier turns were folded into a note (row 256). | by, folded |
runs.cut_off | Mac | Every run on this Mac ended at once, as on quit. | count |
worktree.kept | Mac | A deleted discussion's checkout was kept: it held unmerged work. | reason |
egress.remote_added | Mac | A git remote added mid-run named a new host, kept off the allowlist. | host, dir |
delegate.started | Mac | The lead hands a bounded piece of the job to a discussion of its own. | title, parent |
delegate.finished | Mac | A delegated discussion reports back. | title, status, usd |
delegate.parallel | Mac | Delegated tasks started side by side, each in its own worktree. | parent, tasks, slots |
delegate.landed | Mac | A delegated task's change is brought back into its parent. | parent, child, applied, files |
compare.started | Mac | One task went to several leads at once, ranked blind. | entrants, seats |
compare.ranked | Mac | The seats ranked the lettered attempts. | entrants, judges, first, usd |
compare.taken | Mac | A person applied one attempt to their checkout. | attempt, seat, applied, files |
replay.started | Mac | Agreed discussions were replayed by one seat from their starting commits, to be held against what was agreed. | count, seat, model |
replay.finished | Mac | The replays finished; each pair was judged blind. | count, finished, judged, preferredReplay, usd |
background.wake | Mac | Background work woke its discussion. | kinds, count |
cost.nudge | Mac | A run cost more than usual; the person was told in time to stop. | usd, factor |
list.started | Mac | A backlog run through a list of tickets starts. | count, branch |
list.pr | Mac | A backlog run opens its pull request. | url |
list.ended | Mac | A backlog run ends. | done, failed |
issue.started | Mac | Work starts from an issue, on its own branch. | number, branch |
issue.triaged | Mac | An issue was triaged at the door: ready, spec, person or parked. | number, verdict |
linear.key.set | Mac | A Linear API key was checked with Linear and kept on this Mac, for starting from Linear issues. | nothing beyond when |
browser.cookies.imported | Mac | Sign-ins for chosen sites were copied from the person's browser into the app's browser pane. | browser, sites, cookies (counts only) |
browser.cookies.forgotten | Mac | Imported sign-ins for chosen sites were removed from the browser pane. | sites, cookies (counts only) |
app.quit.background | Mac | The app was quit while discussions were running, and kept working in the menu bar until they finished. | runs |
run.identity | Mac | A run assumed its named AWS role, or ran with none. | role, from, assumed, session, why |