Skip to Content
ReferenceEvent Schema

Event Schema

Every event shares a common envelope and carries a category-specific payload. This page documents the full schema for all 7 canonical event categories.

Envelope

All fields apply to every event regardless of category.

FieldTypeRequiredDescription
eventIdUUIDYesClient-generated unique identifier
agentIdstringYesAgent identifier (1–255 chars)
sessionIdstringYesSession identifier (1–255 chars)
sourceTimestampISO 8601YesWhen the event occurred (datetime with timezone)
categorystringYesOne of the 7 categories below
schemaVersionstringYesSchema version (currently "1.0")
payloadobjectYesCategory-specific data
previousHashstringNoSHA-256 hash of the previous event (chain integrity)

Attribution metadata (optional)

These fields are optional on every event and enable richer analysis:

FieldTypeDescription
sourceFrameworkstringSDK/framework that generated the event
traceIdstringDistributed trace identifier
runIdstringExecution run identifier
correlationIdstringCross-session correlation ID
parentEventIdUUIDParent event for causal chains
causationEventIdUUIDDirect cause event
agentVersionstringAgent software version
toolTypestringTool classification (e.g. database, external_api)
targetSystemstringTarget system identifier (e.g. crm, production-db)
operationstringOperation type (e.g. read, write, delete)
initiatorTypestringWho initiated: human, agent, or system
initiatorIdstringInitiator identifier
actorTypestringActor type
actorIdstringActor identifier

Categories

identity

Agent identity assertion. Typically sent at session start.

{ "category": "identity", "payload": { "agentName": "Support Bot", "version": "2.1.0", "capabilities": ["web_search", "database_query"] } }

reasoning

Decision trace capturing the agent’s reasoning process.

{ "category": "reasoning", "payload": { "summary": "Decided to escalate to human reviewer", "confidence": 0.85, "alternatives": ["auto-approve", "request-more-info"] } }

tool_api

Tool or API invocation — the most common event type.

{ "category": "tool_api", "payload": { "toolName": "database_query", "argumentsHash": "sha256:a1b2c3d4...", "responseStatus": 200, "endpoint": "/api/customers" } }

Security note: Never include raw arguments in the payload. Use argumentsHash to capture a hash of the arguments for auditability without exposing sensitive data.

browser_desktop

UI interaction events for browser-based or desktop agents.

{ "category": "browser_desktop", "payload": { "action": "navigate", "url": "https://crm.example.com/customers", "screenshotHash": "sha256:e5f6..." } }

data_movement

Data access, modification, or export events.

{ "category": "data_movement", "payload": { "operation": "export", "objectIds": ["customer-001", "customer-002"], "diffSummary": "Exported 2 customer records to CSV" } }

Supported operations: read, write, delete, export.

approval

Human decision events — approvals or rejections.

{ "category": "approval", "payload": { "approverId": "user-42", "scope": "delete:crm:customers:bulk", "decision": "approved" } }

Supported decisions: approved, rejected.

environment

Runtime context events describing the agent’s operating environment.

{ "category": "environment", "payload": { "isSandbox": false, "networkSegment": "prod-vpc", "workspace": "production-cluster" } }

Validation

The API enforces strict validation on the event envelope — unknown top-level fields are rejected with a 400 error. The payload object accepts arbitrary keys within each category.

Events with an unknown category or missing required payload fields receive a 422 response. The raw event is still stored and can be re-processed when a normalization strategy becomes available.

Idempotency

Sending the same eventId for the same tenant is idempotent. The API returns 202 with the original receivedAt timestamp. No duplicate is created.

Last updated on