What changed on the team itself: settings, the policy, the domain, members, budgets, tokens, a teammate's folder deleted, the pause and the resume.
The team
| Type | Reported by | When | Detail carries |
|---|---|---|---|
team.changed | Server | A team setting changed: policies, keys, the audit sink, or membership (invited, joined, declined, removed, role). | what changed |
folder.deleted | Server | An owner or admin deleted a teammate's folder. | folder, owner, subfolders |
baseline.deviation | Server | Today differed from the 28-day baseline: an out-of-hours run, a new host, actor, origin or device. | day, deviations, baselineDays |
team.paused | Server | An owner or admin paused the team: runs stop, tokens revoked. | by |
team.resumed | Server | The team was resumed. | by |
budget.requested | Server | A member asked for more budget where they were stopped. | usd, why |
budget.granted | Server | An owner or admin granted a budget request for the month. | member, usd, month |
budget.declined | Server | An owner or admin declined a budget request. | member, usd, month |
device.silent | Server | A desktop went quiet past the team's stale line (row 345). | hostId, name, lastSeen, staleDays |
audit.reset | Server | A desktop's audit counter went backwards: its record was reset (row 345). | hostId, name, before, now |
schedule.overnight | Server | An overnight batch ended: answered at half price, or failed or expired. | scheduleId, provider, model, status, usd, hours, note |
spend.spike | Server | Today's spend reached a multiple of a usual day; mailed once a day. | scope, day, todayUsd, baselineUsd, ratio, top |
code.health.alert | Server | A repository's code-health signals crossed the line; owner and admins told weekly. | teamId, week, repos |
spend.exported | Server | The team's spend export was pulled from Usage or by API key. | from, to, rows, via |
rates.moved | Server | A team or agreed rate crossed last month's bound with enough runs, or a model answered as a new snapshot. | key, kind, rate or model, snapshot, from, to, runs, month, sentence |
token.revoked | Server | An admin revoked every API token and app connection of a member. | member, count |
policy.acknowledged | Server | A member read the team's policy and clicked understood. | version |
objective.tripped | Server | A rate missed its objective with enough runs; its consequence applies. | rate, value, target, consequence, sentence |
objective.lifted | Server | A tripped objective's rate met its target again; the consequence is lifted. | rate, value, target, consequence, sentence |
domain.verified | Server | An admin proved the team's domain with a DNS record. | domain |
sso.configured | Server | An admin saved the team's company sign-in (issuer and client). | issuer |
sso.required | Server | An admin required company sign-in for everyone on the verified domain. | — |
sso.optional | Server | An admin stopped requiring company sign-in. | — |
sso.removed | Server | An admin removed the team's company sign-in and any requirement. | — |
member.joined | Server | An account joined by verified domain, or was admitted by an admin. | by, domain or admittedBy |
member.pending | Server | A verified-domain account signed in and waits for an admin or a seat. | domain, why |
test | Server | A test event from the Team page. | sentence |
team.scanned | Server | What the team holds was scanned for credentials and personal data. | places |
Who reports them
Every event here is reported by the server, so a Mac with admin access cannot suppress one. The actor is the account that made the change; a budget grant names the member it was for.