{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/lightspeed/main/json-schema/lightspeed-audit-log-event-schema.json",
  "title": "Audit Log Event",
  "description": "The structure of the event and security event model",
  "x-generated": "2026-10-12",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/lightspeed-audit-api-openapi.yml#/components/schemas/AuditLogEvent",
  "properties": {
    "action": {
      "description": "The type of the action performed on the object.",
      "enum": [
        "insert",
        "update",
        "delete"
      ],
      "type": "string"
    },
    "created_at": {
      "description": "The timestamp indicating when the event was persisted to the audit log.",
      "format": "date-time",
      "type": "string"
    },
    "data": {
      "description": "An object in JSON format representing the new values of the attributes that were changed by the event.",
      "oneOf": [
        {
          "type": "object"
        },
        {
          "items": {
            "type": "object"
          },
          "type": "array"
        }
      ]
    },
    "entity_id": {
      "description": "The id of the object involved in the event",
      "maxLength": 36,
      "type": "string"
    },
    "id": {
      "description": "Autogenerated object identifier.",
      "type": "string"
    },
    "ip_address": {
      "description": "The ip address from which the request causing the event originated.",
      "format": "ipv4",
      "maxLength": 64,
      "type": "string"
    },
    "occurred_at": {
      "description": "The timestamp indicating when the action causing the event occurred.",
      "format": "date-time",
      "type": "string"
    },
    "old_data": {
      "description": "An object in JSON format representing the old values of the attributes that were changed by the event.",
      "type": "object"
    },
    "type": {
      "description": "The type of the object involved in the event. This may be something like \"security\" for security events or the name of the table the action was performed on, like \"vend_customer\".",
      "maxLength": 64,
      "type": "string"
    },
    "user_agent": {
      "description": "User agent of the http client which submitted the request.",
      "maxLength": 500,
      "type": "string"
    },
    "user_id": {
      "description": "The `id` of the user executing the action registered by this event.",
      "maxLength": 36,
      "type": "string"
    }
  },
  "type": "object"
}