Example audit events

Below is a list of common audit events you may see from the HCP platform and the Vault Radar service. These examples can help you set up alerts in your log aggregation service.

Note

This list is not exhaustive and format may change over time.

Event structure

Most HCP audit events follow a similar structure. The following are common across both HCP platform and HCP Vault Radar audit events.

Stream

"stream": {
    "organization_id": "s3sam3st0-b1g7-b1rd-a8a8-fcf8cacf750d",
    "topic": "hashicorp.platform.audit"
  }

Authentication

"service": "HCP",
  "control_plane_event": {
    "authentication_info": {
      "principal": {
        "id": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
        "type": "PRINCIPAL_TYPE_USER",
        "user": {
          "full_name": "Bill Preson",
          "subject": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
          "id": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
          "identity_type": "SOCIAL_GITHUB",
          "email": "bill.preson@example.com"
        }
      }
    }

Metadata

    "metadata": {
      "service_name": "Vault Radar",
      "correlation_id": "4bffd1eb-ba4b-416e-ace9-f0f27a68b801",
      "action_success": true
    }

Description

"description": "Radar - Create Connection",
    "action": "CREATE",
    "authorization_info": [
      {
        "project_id": "70d220a8-8647-47bf-99a9-b3xce3311nt",
        "permissions": [
          "vault-radar.integrations.create"
        ],
        "organization_id": "s3sam3st0-b1g7-b1rd-a8a8-fcf8cacf750d",
        "resource_id": "70d220a8-8647-47bf-99a9-b3xce3311nt"
      }
    ]
  }

Platform

Authentication

The Authenticated successfully event indicates a user successfully logged into their HCP account. This event is not specific to HCP Vault Radar.

{
  "stream": {
    "organization_id": "s3sam3st0-b1g7-b1rd-a8a8-fcf8cacf750d",
    "topic": "hashicorp.platform.audit"
  },
  "service": "HCP",
  "control_plane_event": {
    "authentication_info": {
      "principal": {
        "id": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
        "type": "PRINCIPAL_TYPE_USER",
        "user": {
          "full_name": "bill.preson@example.com",
          "subject": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
          "id": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
          "email": "bill.preson@example.com"
        }
      }
    },
    "metadata": {
      "event_type": "hcp_id_auth_success",
      "user_id": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
      "ip": "192.168.1.1",
      "message": "Authenticated successfully",
      "email": "bill.preson@example.com",
      "timestamp": "2026-01-13 19:05:50 +0000 UTC"
    },
    "status_code": "OK",
    "request_info": {
      "http_path": "/consent/complete",
      "http_verb": "GET"
    },
    "description": "Authenticated successfully",
    "action": "CREATE"
  },
  "id": "019bb8c0-0811-7a53-9137-e88aaa514eaa",
  "timestamp": "2026-01-13T19:05:51.377381296Z"
}

Streaming test

The streaming test event validates a successful connection between HCP and your log destination. This event is not specific to HCP Vault Radar.

{
  "stream": {
    "organization_id": "s3sam3st0-b1g7-b1rd-a8a8-fcf8cacf750d",
    "topic": "hashicorp.log.streaming.DestinationTest"
  },
  "resource": {
    "location": {
      "organization_id": "s3sam3st0-b1g7-b1rd-a8a8-fcf8cacf750d"
    },
    "id": "c6c4256d-57d1-4813-9b50-38e905f190b5",
    "type": "hashicorp.streaming.test"
  },
  "service": "HCP",
  "service_log_event": {
    "json_payload": {
      "time": "2026-01-13T19:53:33Z",
      "message": "This is a test log from HCP, if you are reading this then the test for your log streaming integration was successful.",
      "test_id": "3f6f5256-ab6a-40b7-a1fb-194710f6df04"
    }
  },
  "id": "67b21bf4-4621-4d20-94d8-b1a57ffe7a41",
  "timestamp": "2026-01-13T19:53:33.335116238Z"
}

Create audit log streaming destination

The Created streaming destination event identifies when you add a streaming connection from your HCP account to your log aggregation service. This event is not specific to HCP Vault Radar.

{
  "stream": {
    "organization_id": "s3sam3st0-b1g7-b1rd-a8a8-fcf8cacf750d",
    "topic": "hashicorp.platform.audit"
  },
  "resource": {
    "description": "asdf",
    "location": {
      "organization_id": "s3sam3st0-b1g7-b1rd-a8a8-fcf8cacf750d"
    },
    "id": "c47343ab-0d05-4263-8d14-1898267a68e1",
    "type": "hashicorp.streaming.destination"
  },
  "service": "HCP",
  "control_plane_event": {
    "authentication_info": {
      "principal": {
        "id": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
        "type": "PRINCIPAL_TYPE_USER",
        "user": {
          "full_name": "Bill Preson",
          "subject": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
          "id": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
          "identity_type": "SOCIAL_GITHUB",
          "email": "bill.preson@example.com"
        }
      }
    },
    "status_code": "OK",
    "request_info": {
      "http_path": "/logs/2021-03-30/organizations/s3sam3st0-b1g7-b1rd-a8a8-fcf8cacf750d/destinations",
      "http_client_ip": "192.168.1.1",
      "http_verb": "POST",
      "http_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
    },
    "description": "Created streaming destination",
    "action": "CREATE",
    "authorization_info": [
      {
        "permissions": [
          "log.streaming.create"
        ],
        "organization_id": "s3sam3st0-b1g7-b1rd-a8a8-fcf8cacf750d"
      }
    ]
  },
  "id": "019bb8ec-cde9-7d64-96d0-9d4daa91af53",
  "timestamp": "2026-01-13T19:54:45.609557740Z"
}

Delete audit log streaming destination

The Disabled streaming destination event identifies the removal of a streaming connection between your HCP account and log aggregation service. This event is not specific to HCP Vault Radar.

Warning

If you have only one streaming destination configured, deleting it will stop all audit log streaming from HCP, including the event for removing the single streaming destination.

{
  "stream": {
    "organization_id": "s3sam3st0-b1g7-b1rd-a8a8-fcf8cacf750d",
    "topic": "hashicorp.platform.audit"
  },
  "resource": {
    "description": "delete",
    "location": {
      "organization_id": "s3sam3st0-b1g7-b1rd-a8a8-fcf8cacf750d"
    },
    "id": "f3064df9-0d59-40b6-a03a-7ee947a8b68c",
    "type": "hashicorp.streaming.destination"
  },
  "service": "HCP",
  "control_plane_event": {
    "authentication_info": {
      "principal": {
        "id": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
        "type": "PRINCIPAL_TYPE_USER",
        "user": {
          "full_name": "Bill Preson",
          "subject": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
          "id": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
          "identity_type": "SOCIAL_GITHUB",
          "email": "bill.preson@example.com"
        }
      }
    },
    "status_code": "OK",
    "request_info": {
      "http_path": "/logs/2021-03-30/organizations/s3sam3st0-b1g7-b1rd-a8a8-fcf8cacf750d/destinations/f3064df9-0d59-40b6-a03a-7ee947a8b68c",
      "http_client_ip": "192.168.1.1",
      "http_verb": "DELETE",
      "http_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
    },
    "description": "Disabled streaming destination",
    "action": "DELETE",
    "authorization_info": [
      {
        "permissions": [
          "log.streaming.delete",
          "log.streaming.delete-filter"
        ],
        "organization_id": "s3sam3st0-b1g7-b1rd-a8a8-fcf8cacf750d"
      }
    ]
  },
  "id": "019bb8f1-5fe2-7a8b-bf17-5c1d8cb0182a",
  "timestamp": "2026-01-13T19:59:45.122111885Z"
}

Data source

Create data source connection

The Radar - Create Connection event identifies a connection between HCP Vault Radar and a data source such as GitHub or GitLab or integrations such as Jira or Slack.

{
  "stream": {
    "project_id": "70d220a8-c83e-47bf-99a9-7a2ce0f98156",
    "organization_id": "s3sam3st0-b1g7-b1rd-a8a8-fcf8cacf750d",
    "topic": "hashicorp.platform.audit"
  },
  "service": "HCP",
  "control_plane_event": {
    "authentication_info": {
      "principal": {
        "id": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
        "type": "PRINCIPAL_TYPE_USER",
        "user": {
          "full_name": "Bill Preson",
          "subject": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
          "id": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
          "identity_type": "SOCIAL_GITHUB",
          "email": "bill.preson@example.com"
        }
      }
    },
    "metadata": {
      "service_name": "Vault Radar",
      "correlation_id": "4bffd1eb-ba4b-416e-ace9-f0f27a68b801",
      "action_success": true
    },
    "status_code": "OK",
    "request_info": {
      "http_path": "/2023-05-01/vault-radar/projects/70d220a8-c83e-47bf-99a9-7a2ce0f98156/api/integrations/connections",
      "http_client_ip": "192.168.1.1",
      "http_verb": "POST",
      "http_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
    },
    "description": "Radar - Create Connection",
    "action": "CREATE",
    "authorization_info": [
      {
        "project_id": "70d220a8-c83e-47bf-99a9-7a2ce0f98156",
        "permissions": [
          "vault-radar.integrations.create"
        ],
        "organization_id": "s3sam3st0-b1g7-b1rd-a8a8-fcf8cacf750d",
        "resource_id": "70d220a8-c83e-47bf-99a9-7a2ce0f98156"
      }
    ]
  },
  "id": "019bb8c4-0587-7a81-8778-da6f74219b90",
  "timestamp": "2026-01-13T19:10:12.871977897Z"
}

Add data source

The Radar - Create Data Source event identifies adding a specific data source such as a GitHub or GitLab organization and HCP Vault Radar.

{
  "stream": {
    "project_id": "70d220a8-c83e-47bf-99a9-7a2ce0f98156",
    "organization_id": "s3sam3st0-b1g7-b1rd-a8a8-fcf8cacf750d",
    "topic": "hashicorp.platform.audit"
  },
  "service": "HCP",
  "control_plane_event": {
    "authentication_info": {
      "principal": {
        "id": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
        "type": "PRINCIPAL_TYPE_USER",
        "user": {
          "full_name": "Bill Preson",
          "subject": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
          "id": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
          "identity_type": "SOCIAL_GITHUB",
          "email": "bill.preson@example.com"
        }
      }
    },
    "metadata": {
      "service_name": "Vault Radar",
      "correlation_id": "58af2a91-8c80-41d6-8950-20d4b3c40b56",
      "action_success": true
    },
    "status_code": "OK",
    "request_info": {
      "http_path": "/2023-05-01/vault-radar/projects/70d220a8-c83e-47bf-99a9-7a2ce0f98156/api/data-source-registrations",
      "http_client_ip": "192.168.1.1",
      "http_verb": "POST",
      "http_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
    },
    "description": "Radar - Create Data Source",
    "action": "CREATE",
    "authorization_info": [
      {
        "project_id": "70d220a8-c83e-47bf-99a9-7a2ce0f98156",
        "permissions": [
          "vault-radar.data-source-registrations.create"
        ],
        "organization_id": "s3sam3st0-b1g7-b1rd-a8a8-fcf8cacf750d",
        "resource_id": "70d220a8-c83e-47bf-99a9-7a2ce0f98156"
      }
    ]
  },
  "id": "019bb8c4-0bd0-7c9e-b603-dfb68ef07a41",
  "timestamp": "2026-01-13T19:10:14.480940711Z"
}

Update data source

The Radar - Update Data Source event identifies a change to a specific data source such as adding or removing a GitHub or GitLab organization and HCP Vault Radar.

{
  "stream": {
    "project_id": "70d220a8-c83e-47bf-99a9-7a2ce0f98156",
    "organization_id": "s3sam3st0-b1g7-b1rd-a8a8-fcf8cacf750d",
    "topic": "hashicorp.platform.audit"
  },
  "service": "HCP",
  "control_plane_event": {
    "authentication_info": {
      "principal": {
        "id": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
        "type": "PRINCIPAL_TYPE_USER",
        "user": {
          "full_name": "Bill Preson",
          "subject": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
          "id": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
          "identity_type": "SOCIAL_GITHUB",
          "email": "bill.preson@example.com"
        }
      }
    },
    "metadata": {
      "service_name": "Vault Radar",
      "correlation_id": "7a385dcc-8c54-4840-be56-0c44ed530da6",
      "action_success": true
    },
    "status_code": "OK",
    "request_info": {
      "http_path": "/2023-05-01/vault-radar/projects/70d220a8-c83e-47bf-99a9-7a2ce0f98156/api/data-source-registrations",
      "http_client_ip": "192.168.1.1",
      "http_verb": "PUT",
      "http_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
    },
    "description": "Radar - Update Data Source",
    "action": "UPDATE",
    "authorization_info": [
      {
        "project_id": "70d220a8-c83e-47bf-99a9-7a2ce0f98156",
        "permissions": [
          "vault-radar.data-source-registrations.update"
        ],
        "organization_id": "s3sam3st0-b1g7-b1rd-a8a8-fcf8cacf750d",
        "resource_id": "70d220a8-c83e-47bf-99a9-7a2ce0f98156"
      }
    ]
  },
  "id": "019bb8c5-4952-7eaf-9ef6-ba3975c5fb12",
  "timestamp": "2026-01-13T19:11:35.762970576Z"
}

Events and rules

Update event rules

The Radar - Update Rules event identifies a change from the default setting of a HCP Vault Radar event rule.

{
  "stream": {
    "project_id": "70d220a8-c83e-47bf-99a9-7a2ce0f98156",
    "organization_id": "s3sam3st0-b1g7-b1rd-a8a8-fcf8cacf750d",
    "topic": "hashicorp.platform.audit"
  },
  "service": "HCP",
  "control_plane_event": {
    "authentication_info": {
      "principal": {
        "id": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
        "type": "PRINCIPAL_TYPE_USER",
        "user": {
          "full_name": "Bill Preson",
          "subject": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
          "id": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
          "identity_type": "SOCIAL_GITHUB",
          "email": "bill.preson@example.com"
        }
      }
    },
    "metadata": {
      "service_name": "Vault Radar",
      "correlation_id": "cc54b524-7178-45ae-beac-7e057be5e24b",
      "action_success": true
    },
    "status_code": "OK",
    "request_info": {
      "http_path": "/2023-05-01/vault-radar/projects/70d220a8-c83e-47bf-99a9-7a2ce0f98156/api/rules",
      "http_client_ip": "192.168.1.1",
      "http_verb": "POST",
      "http_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
    },
    "description": "Radar - Update Rules",
    "action": "UPDATE",
    "authorization_info": [
      {
        "project_id": "70d220a8-c83e-47bf-99a9-7a2ce0f98156",
        "permissions": [
          "vault-radar.rules.update"
        ],
        "organization_id": "s3sam3st0-b1g7-b1rd-a8a8-fcf8cacf750d",
        "resource_id": "70d220a8-c83e-47bf-99a9-7a2ce0f98156"
      }
    ]
  },
  "id": "019bb8c7-2bd4-7eb1-9a36-789939c6672c",
  "timestamp": "2026-01-13T19:13:39.284691110Z"
}

Delete event rule

The Radar - Delete Rule event identifies a change from a custom setting back to the default setting of a HCP Vault Radar event rule.

{
  "stream": {
    "project_id": "70d220a8-c83e-47bf-99a9-7a2ce0f98156",
    "organization_id": "s3sam3st0-b1g7-b1rd-a8a8-fcf8cacf750d",
    "topic": "hashicorp.platform.audit"
  },
  "service": "HCP",
  "control_plane_event": {
    "authentication_info": {
      "principal": {
        "id": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
        "type": "PRINCIPAL_TYPE_USER",
        "user": {
          "full_name": "Bill Preson",
          "subject": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
          "id": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
          "identity_type": "SOCIAL_GITHUB",
          "email": "bill.preson@example.com"
        }
      }
    },
    "metadata": {
      "service_name": "Vault Radar",
      "correlation_id": "82cfd46a-4f65-4178-a446-0a1c8e2d9056",
      "action_success": true
    },
    "status_code": "OK",
    "request_info": {
      "http_path": "/2023-05-01/vault-radar/projects/70d220a8-c83e-47bf-99a9-7a2ce0f98156/api/rules/1783",
      "http_client_ip": "192.168.1.1",
      "http_verb": "DELETE",
      "http_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
    },
    "description": "Radar - Delete Rule",
    "action": "DELETE",
    "authorization_info": [
      {
        "project_id": "70d220a8-c83e-47bf-99a9-7a2ce0f98156",
        "permissions": [
          "vault-radar.rules.delete"
        ],
        "organization_id": "s3sam3st0-b1g7-b1rd-a8a8-fcf8cacf750d",
        "resource_id": "70d220a8-c83e-47bf-99a9-7a2ce0f98156"
      }
    ]
  },
  "id": "019bb8c7-bbff-7a85-a91f-4d659f2095f9",
  "timestamp": "2026-01-13T19:14:16.191709965Z"
}

Update ignore rule

The Radar - Update Global Ignore Rules event triggers when you edit an ignore rule in HCP Vault Radar.

{
  "stream": {
    "project_id": "70d220a8-c83e-47bf-99a9-7a2ce0f98156",
    "organization_id": "s3sam3st0-b1g7-b1rd-a8a8-fcf8cacf750d",
    "topic": "hashicorp.platform.audit"
  },
  "service": "HCP",
  "control_plane_event": {
    "authentication_info": {
      "principal": {
        "id": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
        "type": "PRINCIPAL_TYPE_USER",
        "user": {
          "full_name": "Bill Preson",
          "subject": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
          "id": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
          "identity_type": "SOCIAL_GITHUB",
          "email": "bill.preson@example.com"
        }
      }
    },
    "metadata": {
      "service_name": "Vault Radar",
      "correlation_id": "b4676b2b-82aa-4cfd-a73a-2bebab35ac18",
      "action_success": true
    },
    "status_code": "OK",
    "request_info": {
      "http_path": "/2023-05-01/vault-radar/projects/70d220a8-c83e-47bf-99a9-7a2ce0f98156/api/settings/blubracket-ignores",
      "http_client_ip": "192.168.1.1",
      "http_verb": "POST",
      "http_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
    },
    "description": "Radar - Update Global Ignore Rules",
    "action": "UPDATE",
    "authorization_info": [
      {
        "project_id": "70d220a8-c83e-47bf-99a9-7a2ce0f98156",
        "permissions": [
          "vault-radar.admin-settings.create"
        ],
        "organization_id": "s3sam3st0-b1g7-b1rd-a8a8-fcf8cacf750d",
        "resource_id": "70d220a8-c83e-47bf-99a9-7a2ce0f98156"
      }
    ]
  },
  "id": "019bb8c8-edd0-7a85-aa0c-1729f14ee514",
  "timestamp": "2026-01-13T19:15:34.480649486Z"
}

Update remediation

The Radar - Update Remediation event triggers when you change the settings of a remediation guidance for HCP Vault Radar.

{
  "stream": {
    "project_id": "70d220a8-c83e-47bf-99a9-7a2ce0f98156",
    "organization_id": "s3sam3st0-b1g7-b1rd-a8a8-fcf8cacf750d",
    "topic": "hashicorp.platform.audit"
  },
  "service": "HCP",
  "control_plane_event": {
    "authentication_info": {
      "principal": {
        "id": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
        "type": "PRINCIPAL_TYPE_USER",
        "user": {
          "full_name": "Bill Preson",
          "subject": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
          "id": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
          "identity_type": "SOCIAL_GITHUB",
          "email": "bill.preson@example.com"
        }
      }
    },
    "metadata": {
      "service_name": "Vault Radar",
      "correlation_id": "cbce45ab-b0a3-459b-929b-95d8c7cc8ac3",
      "action_success": true
    },
    "status_code": "OK",
    "request_info": {
      "http_path": "/2023-05-01/vault-radar/projects/70d220a8-c83e-47bf-99a9-7a2ce0f98156/api/remediations",
      "http_client_ip": "192.168.1.1",
      "http_verb": "PUT",
      "http_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
    },
    "description": "Radar - Update Remediation",
    "action": "UPDATE",
    "authorization_info": [
      {
        "project_id": "70d220a8-c83e-47bf-99a9-7a2ce0f98156",
        "permissions": [
          "vault-radar.remediations.update"
        ],
        "organization_id": "s3sam3st0-b1g7-b1rd-a8a8-fcf8cacf750d",
        "resource_id": "70d220a8-c83e-47bf-99a9-7a2ce0f98156"
      }
    ]
  },
  "id": "019bb8c9-c535-7ca3-a8ee-3b51d99271d4",
  "timestamp": "2026-01-13T19:16:29.621530760Z"
}

Custom expressions

Create custom expression

The Radar - Create Custom Expression event triggers when you add a custom regular expression check in HCP Vault Radar.

{
  "stream": {
    "project_id": "70d220a8-c83e-47bf-99a9-7a2ce0f98156",
    "organization_id": "s3sam3st0-b1g7-b1rd-a8a8-fcf8cacf750d",
    "topic": "hashicorp.platform.audit"
  },
  "service": "HCP",
  "control_plane_event": {
    "authentication_info": {
      "principal": {
        "id": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
        "type": "PRINCIPAL_TYPE_USER",
        "user": {
          "full_name": "Bill Preson",
          "subject": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
          "id": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
          "identity_type": "SOCIAL_GITHUB",
          "email": "bill.preson@example.com"
        }
      }
    },
    "metadata": {
      "service_name": "Vault Radar",
      "correlation_id": "f05f4b56-6521-4476-990e-e7ec5259de93",
      "action_success": true
    },
    "status_code": "OK",
    "request_info": {
      "http_path": "/2023-05-01/vault-radar/projects/70d220a8-c83e-47bf-99a9-7a2ce0f98156/api/repo-scans/custom-regexes",
      "http_client_ip": "192.168.1.1",
      "http_verb": "POST",
      "http_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
    },
    "description": "Radar - Create Custom Expression",
    "action": "CREATE",
    "authorization_info": [
      {
        "project_id": "70d220a8-c83e-47bf-99a9-7a2ce0f98156",
        "permissions": [
          "vault-radar.custom-regexes.create"
        ],
        "organization_id": "s3sam3st0-b1g7-b1rd-a8a8-fcf8cacf750d",
        "resource_id": "70d220a8-c83e-47bf-99a9-7a2ce0f98156"
      }
    ]
  },
  "id": "019bb8cb-46b7-7eb1-8586-0c0d01a4a950",
  "timestamp": "2026-01-13T19:18:08.311571245Z"
}

Update custom expression

The Radar - Update Custom Expression event triggers when you change an existing custom regular expression check in HCP Vault Radar.

{
  "stream": {
    "project_id": "70d220a8-c83e-47bf-99a9-7a2ce0f98156",
    "organization_id": "s3sam3st0-b1g7-b1rd-a8a8-fcf8cacf750d",
    "topic": "hashicorp.platform.audit"
  },
  "service": "HCP",
  "control_plane_event": {
    "authentication_info": {
      "principal": {
        "id": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
        "type": "PRINCIPAL_TYPE_USER",
        "user": {
          "full_name": "Bill Preson",
          "subject": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
          "id": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
          "identity_type": "SOCIAL_GITHUB",
          "email": "bill.preson@example.com"
        }
      }
    },
    "metadata": {
      "service_name": "Vault Radar",
      "correlation_id": "e26b2b9f-7a3b-43e0-8541-df50c1134a2a",
      "action_success": true
    },
    "status_code": "OK",
    "request_info": {
      "http_path": "/2023-05-01/vault-radar/projects/70d220a8-c83e-47bf-99a9-7a2ce0f98156/api/repo-scans/custom-regexes",
      "http_client_ip": "192.168.1.1",
      "http_verb": "PUT",
      "http_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
    },
    "description": "Radar - Update Custom Expression",
    "action": "UPDATE",
    "authorization_info": [
      {
        "project_id": "70d220a8-c83e-47bf-99a9-7a2ce0f98156",
        "permissions": [
          "vault-radar.custom-regexes.update"
        ],
        "organization_id": "s3sam3st0-b1g7-b1rd-a8a8-fcf8cacf750d",
        "resource_id": "70d220a8-c83e-47bf-99a9-7a2ce0f98156"
      }
    ]
  },
  "id": "019bb8cb-f16e-7a87-a807-10b62a82bdc6",
  "timestamp": "2026-01-13T19:18:52.014884996Z"
}

Delete custom expression

The Radar - Delete Custom Expression event triggers when you delete an existing custom regular expression check for HCP Vault Radar.

{
  "stream": {
    "project_id": "70d220a8-c83e-47bf-99a9-7a2ce0f98156",
    "organization_id": "s3sam3st0-b1g7-b1rd-a8a8-fcf8cacf750d",
    "topic": "hashicorp.platform.audit"
  },
  "service": "HCP",
  "control_plane_event": {
    "authentication_info": {
      "principal": {
        "id": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
        "type": "PRINCIPAL_TYPE_USER",
        "user": {
          "full_name": "Bill Preson",
          "subject": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
          "id": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
          "identity_type": "SOCIAL_GITHUB",
          "email": "bill.preson@example.com"
        }
      }
    },
    "metadata": {
      "service_name": "Vault Radar",
      "correlation_id": "0f1f0497-84df-42c5-9c5c-714c0f99a0f0",
      "action_success": true
    },
    "status_code": "OK",
    "request_info": {
      "http_path": "/2023-05-01/vault-radar/projects/70d220a8-c83e-47bf-99a9-7a2ce0f98156/api/repo-scans/custom-regexes",
      "http_client_ip": "192.168.1.1",
      "http_verb": "DELETE",
      "http_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
    },
    "description": "Radar - Delete Custom Expression",
    "action": "DELETE",
    "authorization_info": [
      {
        "project_id": "70d220a8-c83e-47bf-99a9-7a2ce0f98156",
        "permissions": [
          "vault-radar.custom-regexes.delete"
        ],
        "organization_id": "s3sam3st0-b1g7-b1rd-a8a8-fcf8cacf750d",
        "resource_id": "70d220a8-c83e-47bf-99a9-7a2ce0f98156"
      }
    ]
  },
  "id": "019bb8cc-8aa6-7ca4-8f2e-3416eb1edd7b",
  "timestamp": "2026-01-13T19:19:31.238470110Z"
}

Integrations

Create integration connection

The Radar - Create Connection event triggers when you add a new integration such as Jira, Slack, or Teams for HCP Vault Radar.

{
  "stream": {
    "project_id": "70d220a8-c83e-47bf-99a9-7a2ce0f98156",
    "organization_id": "s3sam3st0-b1g7-b1rd-a8a8-fcf8cacf750d",
    "topic": "hashicorp.platform.audit"
  },
  "service": "HCP",
  "control_plane_event": {
    "authentication_info": {
      "principal": {
        "id": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
        "type": "PRINCIPAL_TYPE_USER",
        "user": {
          "full_name": "Bill Preson",
          "subject": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
          "id": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
          "identity_type": "SOCIAL_GITHUB",
          "email": "bill.preson@example.com"
        }
      }
    },
    "metadata": {
      "service_name": "Vault Radar",
      "correlation_id": "edc5b7b3-b71a-4697-93cf-e070a81650c9",
      "action_success": true
    },
    "status_code": "OK",
    "request_info": {
      "http_path": "/2023-05-01/vault-radar/projects/70d220a8-c83e-47bf-99a9-7a2ce0f98156/api/integrations/connections",
      "http_client_ip": "192.168.1.1",
      "http_verb": "POST",
      "http_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
    },
    "description": "Radar - Create Connection",
    "action": "CREATE",
    "authorization_info": [
      {
        "project_id": "70d220a8-c83e-47bf-99a9-7a2ce0f98156",
        "permissions": [
          "vault-radar.integrations.create"
        ],
        "organization_id": "s3sam3st0-b1g7-b1rd-a8a8-fcf8cacf750d",
        "resource_id": "70d220a8-c83e-47bf-99a9-7a2ce0f98156"
      }
    ]
  },
  "id": "019bb8cf-c52a-7a87-8731-ba0f9953aec3",
  "timestamp": "2026-01-13T19:23:02.826803173Z"
}

Update integration connection

The Radar - Update Connection event triggers when you modify an existing integration such as Jira, Slack, or Teams for HCP Vault Radar.

{
  "stream": {
    "project_id": "70d220a8-c83e-47bf-99a9-7a2ce0f98156",
    "organization_id": "s3sam3st0-b1g7-b1rd-a8a8-fcf8cacf750d",
    "topic": "hashicorp.platform.audit"
  },
  "service": "HCP",
  "control_plane_event": {
    "authentication_info": {
      "principal": {
        "id": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
        "type": "PRINCIPAL_TYPE_USER",
        "user": {
          "full_name": "Bill Preson",
          "subject": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
          "id": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
          "identity_type": "SOCIAL_GITHUB",
          "email": "bill.preson@example.com"
        }
      }
    },
    "metadata": {
      "service_name": "Vault Radar",
      "correlation_id": "6b98d12d-6f8f-43a0-8191-9305a9e0b923",
      "action_success": true
    },
    "status_code": "OK",
    "request_info": {
      "http_path": "/2023-05-01/vault-radar/projects/70d220a8-c83e-47bf-99a9-7a2ce0f98156/api/integrations/connections",
      "http_client_ip": "192.168.1.1",
      "http_verb": "PUT",
      "http_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
    },
    "description": "Radar - Update Connection",
    "action": "UPDATE",
    "authorization_info": [
      {
        "project_id": "70d220a8-c83e-47bf-99a9-7a2ce0f98156",
        "permissions": [
          "vault-radar.integrations.update"
        ],
        "organization_id": "s3sam3st0-b1g7-b1rd-a8a8-fcf8cacf750d",
        "resource_id": "70d220a8-c83e-47bf-99a9-7a2ce0f98156"
      }
    ]
  },
  "id": "019bb8d1-97fe-7ca5-bc3e-734e5325dba9",
  "timestamp": "2026-01-13T19:25:02.334371138Z"
}

Delete integration connection

The Radar - Delete Connection event triggers when you delete an existing integration such as Jira, Slack, or Teams for HCP Vault Radar.

{
  "stream": {
    "project_id": "70d220a8-c83e-47bf-99a9-7a2ce0f98156",
    "organization_id": "s3sam3st0-b1g7-b1rd-a8a8-fcf8cacf750d",
    "topic": "hashicorp.platform.audit"
  },
  "service": "HCP",
  "control_plane_event": {
    "authentication_info": {
      "principal": {
        "id": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
        "type": "PRINCIPAL_TYPE_USER",
        "user": {
          "full_name": "Bill Preson",
          "subject": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
          "id": "3xc311lnet-adv3-tur3-a42b-afd5e8fd5bc8",
          "identity_type": "SOCIAL_GITHUB",
          "email": "bill.preson@example.com"
        }
      }
    },
    "metadata": {
      "service_name": "Vault Radar",
      "correlation_id": "2753ba30-d80b-46f7-aec3-439abec490a8",
      "action_success": true
    },
    "status_code": "OK",
    "request_info": {
      "http_path": "/2023-05-01/vault-radar/projects/70d220a8-c83e-47bf-99a9-7a2ce0f98156/api/integrations/connections/ab5ec525-2679-4f27-95f7-337d998edb74",
      "http_client_ip": "192.168.1.1",
      "http_verb": "DELETE",
      "http_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
    },
    "description": "Radar - Delete Connection",
    "action": "DELETE",
    "authorization_info": [
      {
        "project_id": "70d220a8-c83e-47bf-99a9-7a2ce0f98156",
        "permissions": [
          "vault-radar.integrations.delete"
        ],
        "organization_id": "s3sam3st0-b1g7-b1rd-a8a8-fcf8cacf750d",
        "resource_id": "70d220a8-c83e-47bf-99a9-7a2ce0f98156"
      }
    ]
  },
  "id": "019bb8cf-3383-7eb3-9f1e-5cfa6072d288",
  "timestamp": "2026-01-13T19:22:25.539490049Z"
}