The schema files are published to a public S3 bucket and can be referenced directly at https://assets.truu.ai/json-schema/event/v2.20/event.json
Base rules
Formatting
- An event record is a JSON structure.
- All attribute names use the
camelCaseconvention. - All enum values are
UPPERCASE. - All letters in
UUID,MAC address,IPv4, andIPv6 addressvalues arelowercase. - All dates and timestamps are strings in UTC, formatted per ISO 8601 (the trailing
Zis required).
Structure
Only one source of truth. Avoid duplicating the same information across multiple attributes.
- Keep the minimal set of data required.
- Adding new sections and attributes is safe.
- Avoid renaming, removing, or shuffling attributes.
JSON Schema
Parts of the JSON Schema
General Event Structure — event.json
General Event Structure — event.json
Contains the main event structure and common related objects, including common abstract objects and objects used in many places (such as Policy).Public URL: event.json
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"title": "Event",
"description": "Common TruU event structure",
"type": "object",
"properties": {
"id": {
"title": "ID",
"description": "Event unique identifier",
"type": "string"
},
"published": {
"title": "Published",
"description": "Date and time when event was published",
"$comment": "Always in UTC, formated by ISO 8601",
"type": "string",
"format": "date-time"
},
"eventCategory": {
"title": "Event Category",
"description": "Category of the event, is used for proper processing of the event",
"$comment": "Category should replace processing by eventType when all producers will populate it",
"type": "string",
"enum": ["AUTH", "REG", "HEARTBEAT", "CAUTH", "DEVICE", "SERVICE"]
},
"eventType": {
"title": "Event Type",
"description": "Type of the event",
"$comment": "This value is event type discriminator, values are the union of all event type subsets like AuthEvent, RegEvent, etc.",
"type": "string",
"enum": [
"AUTH_EVENT",
"BIO_AUTH_EVENT",
"PIN_AUTH_EVENT",
"BIOMETRIC_AND_PIN_AUTH_EVENT",
"BIOMETRIC_OR_PIN_AUTH_EVENT",
"FLUID_UNLOCK_EVENT",
"BIO_UNLOCK_EVENT",
"PIN_UNLOCK_EVENT",
"BIOMETRIC_AND_PIN_UNLOCK_EVENT",
"POSSESSION_UNLOCK_EVENT",
"POSSESSION_LOCK_EVENT",
"THIRD_PARTY_FIDO2_AUTH_EVENT",
"WORKFLOW_AUTH_EVENT",
"CONTINUOUS_AUTH_EVENT",
"WORKSTATION_UNLOCK_PROXIMITY",
"WORKSTATION_UNLOCK_PROXIMITY_AND_BIOMETRIC",
"WORKSTATION_UNLOCK_PROXIMITY_AND_PIN",
"WORKSTATION_UNLOCK_NETWORK",
"WORKSTATION_UNLOCK_DEVICE_BIOMETRIC",
"WORKSTATION_LOCK_PROXIMITY",
"WORKSTATION_LOCK_USER_ACTION",
"WORKSTATION_LOCK_NETWORK",
"WORKSTATION_LOGON_PROXIMITY",
"WORKSTATION_LOGON_PROXIMITY_AND_BIOMETRIC",
"WORKSTATION_LOGON_PROXIMITY_AND_PIN",
"WORKSTATION_LOGON_NETWORK",
"WORKSTATION_LOGOFF_USER_ACTION",
"WORKSTATION_LOGOFF_NETWORK",
"WORKSTATION_LOGON_NATIVE_PLUS_PROXIMITY",
"WORKSTATION_UNLOCK_NATIVE_PLUS_PROXIMITY",
"WORKSTATION_LOGON_STANDALONE_PIN",
"WORKSTATION_LOGON_STANDALONE_BIO",
"POLICY_AUTH_EVENT",
"BADGE_AUTH_EVENT",
"BADGE_AND_PIN_AUTH_EVENT",
"SSO_BEGIN",
"SSO_END",
"SSO_SWITCH",
"REG_EVENT",
"DEREG_EVENT",
"USER_DELETE_EVENT",
"MAGIC_LINK_SENT_EVENT",
"MAGIC_LINK_USED_EVENT",
"MAGIC_LINK_EXPIRED_EVENT",
"FACTOR_CREATE_EVENT",
"FACTOR_CHANGE_EVENT",
"FACTOR_DELETE_EVENT",
"BADGE_TRANSFER_EVENT",
"BIOMETRIC_CONSENT_GRANTED",
"BIOMETRIC_CONSENT_REVOKED",
"ASSET_HEARTBEAT_EVENT",
"DEVICE_HEARTBEAT_EVENT",
"DEVICE_HEARTBEAT_EVENT_COLLECTING_DATA",
"DEVICE_HEARTBEAT_EVENT_DATA_COLLECTED",
"DEVICE_HEARTBEAT_EVENT_NO_DATA",
"USER_ENROLLMENT_BEGIN",
"USER_ENROLLMENT_END",
"CLIENT_PIN_CHANGE",
"CLIENT_PIN_CHANGE_START",
"CLIENT_PIN_RESET",
"CLIENT_PIN_RESET_START",
"CLIENT_BIOMETRIC_ADDED",
"CLIENT_BIOMETRIC_REMOVED",
"CLIENT_BIOMETRIC_UPDATED",
"CLIENT_BIOMETRIC_REENROLL_PROMPT",
"CLIENT_PIN_LOCKED",
"CLIENT_PIN_UNLOCKED",
"CLIENT_LOGIN",
"CLIENT_NETWORK",
"CLIENT_TPM",
"CLIENT_DRIVER_MISSING",
"CLIENT_DRIVER_REPAIR",
"CLIENT_APP_DOWNLOAD",
"CLIENT_APP_INSTALLATION",
"CLIENT_ACCOUNT_UNLOCK",
"CLIENT_ACCOUNT_UNLOCK_USER_INFO",
"CLIENT_SECURITY_KEY_REPAIR",
"WALLET_CONFIGURATION",
"WALLET_ADD_PASS",
"TAMS_STARTUP",
"TAMS_HEALTHCHECK",
"CAUTH_CRC_RISK_LEVEL_CHANGE",
"CAUTH_KEYBOARD_MODEL_INITIAL_TRAIN",
"CAUTH_KEYBOARD_MODEL_PROMOTION",
"CAUTH_KEYBOARD_MODEL_RESET",
"CAUTH_NO_KEYBOARD_MODEL_TRAINED",
"CAUTH_STARTED",
"CAUTH_STOPPED",
"CAUTH_CRASHED",
"CAUTH_SUSPENDED",
"CAUTH_RESUMED",
"CAUTH_HEARTBEAT",
"CAUTH_TRUENV_MODEL_SCAN_COMPLETED"
]
},
"eventTags": {
"title": "Event Tags",
"description": "Event tags used for additional event classification (like UI grouping)",
"type": "array",
"items": {
"type": "string",
"enum": [
"AUTHENTICATION",
"REGISTRATION",
"DIAGNOSTICS",
"IDENTITY",
"RISK",
"SYSTEM"
]
}
},
"version": {
"title": "Version",
"description": "Version of the event format",
"type": "string"
},
"severity": {
"title": "Severity",
"description": "Event severity",
"type": "string",
"enum": ["TRACE", "DEBUG", "INFO", "WARN", "ERROR"]
},
"message": {
"title": "Event Message",
"description": "Message to display for this event",
"$ref": "#/$defs/event-message"
},
"actor": {
"title": "Actor",
"description": "Entity which performs action which initiated this event",
"$comment": "WHO initiated this action/event? ACTOR!",
"$ref": "#/$defs/event-entity"
},
"client": {
"title": "Client",
"description": "Client which requests action which initiated this event",
"$comment": "WHERE and HOW was initiated this action/event? On CLIENT as HTTP request!",
"$ref": "#/$defs/event-client"
},
"targets": {
"title": "Targets",
"description": "Entities which are affected by action initiated this event",
"$comment": "WHY was initiated this action/event? Reach TARGET(S)!",
"type": "array",
"items": {
"$ref": "#/$defs/event-entity"
}
},
"device": {
"title": "Device",
"description": "Device where was handled action which initiated this event",
"$comment": "HOW it was handled? By the DEVICE!",
"$ref": "#/$defs/event-device"
},
"asset": {
"title": "Asset",
"description": "The Asset that initiated this event",
"$ref": "#/$defs/event-asset"
},
"factors": {
"title": "Factors",
"description": "Factors where was handled action which initiated this event",
"$comment": "HOW it was handled? By the FACTOR! (for future, if needed more than one device, could be stored here, device is also type of factor)",
"type": "array",
"items": {
"$ref": "#/$defs/event-factor"
}
},
"domainId": {
"title": "Domain ID",
"description": "Domain/tenant unique identifier",
"type": "string"
},
"status": {
"title": "Status",
"description": "This is final status of the action which initiated this event",
"$comment": "This is union of possible statuses from all events, so not every event type can have every available status",
"type": "string",
"enum": ["SUCCESS", "TIMEOUT", "FAILURE", "CANCEL"]
},
"errorDetails": {
"title": "Error Details",
"description": "Additional error information for failed or exceptional events",
"$ref": "#/$defs/error-details"
}
},
"required": [
"id",
"published",
"version",
"severity",
"domainId",
"eventType"
],
"$defs": {
"event-entity": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"title": "Event Entity",
"description": "Common TruU event entity structure",
"$comment": "It has two roles, first as actor and second as target in the event",
"type": "object",
"properties": {
"id": {
"title": "ID",
"description": "Entity identifier, unique for each subtype",
"$comment": "For each subtype has that ID different meaning",
"type": "string"
},
"display": {
"title": "Display",
"description": "Event entity display",
"type": "string"
},
"type": {
"title": "Type",
"description": "Type the entity, union of all subtypes of event entity, it discriminates different properties of particular subtype",
"type": "string",
"enum": [
"USER",
"SSO_ADAPTER",
"SERVICE_ADAPTER",
"PHYSICAL_ACCESS",
"DESKTOP_AGENT",
"PAM",
"DIGITAL_ACCESS",
"SHARED_WORKSTATION",
"IOS",
"ANDROID",
"INTEGRATION",
"THIRD_PARTY_FIDO2",
"PASSKEY",
"WINDOWS_TPM",
"MAC_TPM",
"TRU_PIN",
"BADGE",
"WINDOWS_CAUTH",
"MAC_CAUTH",
"SERVICE_TAMS",
"WINDOWS_AGENT",
"MAC_AGENT",
"TRU_FACE",
"ENROLLMENT_SHARE"
]
},
"alternateIds": {
"title": "Alternate IDs",
"description": "Alternate entity identifiers",
"type": "array",
"items": {
"type": "string"
}
}
}
},
"event-client": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"title": "Event Client",
"description": "TruU event client structure (where action initiated that event was performed)",
"type": "object",
"properties": {
"id": {
"title": "ID",
"description": "Client identifier",
"type": "string"
},
"display": {
"title": "Display",
"description": "Event client display",
"type": "string"
},
"type": {
"title": "Type",
"description": "Type of client",
"type": "string",
"enum": ["WEB", "MOBILE", "DESKTOP", "SERVER"]
},
"ipAddress": {
"title": "IP Address",
"description": "IP address related to this client",
"type": "string"
},
"geolocation": {
"title": "Geolocation",
"description": "Geolocation data derived from IP address related to this client",
"$ref": "#/$defs/geolocation"
},
"request": {
"title": "Request",
"description": "Request related to action which initiated this event",
"$ref": "#/$defs/event-request"
},
"screen": {
"title": "Screen",
"description": "Client screen properties like type of screen or resolution",
"$ref": "#/$defs/event-client-screen"
}
}
},
"user-agent": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"title": "User Agent",
"description": "User agent structure",
"type": "object",
"properties": {
"rawUserAgent": {
"title": "Raw User Agent",
"description": "Raw user agent identifier string",
"type": "string"
},
"os": {
"title": "OS",
"description": "Operating system contained in the raw user agent string",
"type": "string"
},
"browser": {
"title": "Browser",
"description": "Browser contained in the raw user agent string",
"type": "string"
}
}
},
"geolocation": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"title": "Geolocation",
"description": "Geolocation structure",
"type": "object",
"properties": {
"display": {
"title": "display",
"description": "Computed display property for display, e.g. in events table",
"type": "string"
},
"city": {
"title": "City",
"description": "City name",
"type": "string"
},
"continent": {
"title": "Continent",
"description": "Continent name",
"type": "string"
},
"country": {
"title": "Country",
"description": "Country name",
"type": "string"
},
"subdivisions": {
"title": "Subdivisions",
"description": "Subdivisions of country (if exists, e.g. districts)",
"type": "array",
"items": {
"type": "string"
}
},
"postalCode": {
"title": "Postal Code",
"description": "Postal code assigned to the city in particular country",
"type": "string"
},
"location": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"title": "Location",
"description": "Location structure",
"type": "object",
"properties": {
"lat": {
"title": "Lat",
"description": "Location latitude in ISO 6709",
"type": "number"
},
"lon": {
"title": "Lon",
"description": "Location longitude in ISO 6709",
"type": "number"
},
"zone": {
"title": "Zone",
"description": "Location time zone",
"type": "string"
}
}
}
}
},
"face-scores": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"title": "Face Scores",
"description": "Contains scores for facial recognition",
"type": "object",
"properties": {
"liveness": {
"title": "Liveness",
"description": "Face liveness confidence",
"type": "number"
},
"livenessThreshold": {
"title": "Liveness Threshold",
"description": "Face liveness confidence threshold",
"type": "number"
},
"similarity": {
"title": "Similarity",
"description": "Face similarity score",
"type": "number"
},
"similarityThreshold": {
"title": "Similarity Threshold",
"description": "Face similarity score threshold",
"type": "number"
}
}
},
"event-request": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"title": "Event Request",
"description": "Common TruU event request structure",
"type": "object",
"properties": {
"id": {
"title": "ID",
"description": "Request identifier",
"type": "string"
},
"type": {
"title": "Type",
"description": "Type of request",
"type": "string",
"enum": ["HTTP"]
}
}
},
"event-client-screen": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"title": "Event Client Screen",
"description": "Event client screen structure",
"type": "object",
"properties": {
"screenType": {
"title": "Screen Type",
"description": "Type of screen",
"$comment": "Enum values must correspond with enum com.truu.id.server.idp.common.AuthorizationMethod (+ historical removed values)",
"type": "string",
"enum": [
"COMPUTER",
"QR",
"AUTH_CODE",
"DEEPLINK",
"FIDO2_HARDWARE_KEY",
"FIDO2_PASS_KEY",
"WORKFLOW",
"PRIMARY_IDENTIFIER",
"USER_IDENTIFIER_PLUS_PIN",
"BADGE",
"LANDING"
]
},
"resolution": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"title": "Resolution",
"description": "Screen resolution",
"type": "object",
"properties": {
"height": {
"title": "Resolution Height",
"description": "Screen resolution height",
"type": "integer"
},
"width": {
"title": "Resolution Width",
"description": "Screen resolution width",
"type": "integer"
}
}
},
"switchMethod": {
"title": "Screen Switch Method",
"description": "Method how screen was switched",
"type": "string",
"enum": ["AUTO", "ON_CLICK"]
}
}
},
"event-factor": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"title": "Event Factor",
"description": "TruU event factor structure",
"type": "object",
"extends": {
"$comment": "Extends common event entity structure",
"$ref": "#/$defs/event-entity"
},
"properties": {
"guid": {
"title": "GUID",
"description": "Global unique identifier",
"type": "string"
},
"ipAddress": {
"title": "IP Address",
"description": "IP address related to this factor",
"$comment": "This IP address is the one extracted from particular request (e.g. authentication)",
"type": "string"
},
"geolocation": {
"title": "Geolocation",
"description": "Geolocation data derived from IP address related to this factor",
"$ref": "#/$defs/geolocation"
},
"assuranceLevel": {
"title": "Assurance level",
"description": "Factor assurance level",
"$ref": "#/$defs/assurance-level"
}
}
},
"event-device": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"title": "Event Device",
"description": "TruU event device structure",
"extends": {
"$comment": "Extends common event structure",
"$ref": "#/$defs/event-factor"
},
"type": "object",
"properties": {
"deviceId": {
"title": "Device ID",
"description": "Device UUID identifier",
"type": "string"
},
"relatedDevices": {
"title": "Related Devices",
"$comment": "Related device, e.g. Windows device for CAUTH on Windows workstation",
"type": "array",
"items": {
"$ref": "#/$defs/event-device"
}
},
"assetId": {
"title": "Device Asset ID",
"description": "Device related asset identifier",
"type": "string"
},
"assetTuid": {
"title": "Device Asset TUID",
"description": "Device related asset UUID identifier",
"type": "string"
},
"name": {
"title": "Name",
"description": "Event device name",
"type": "string"
},
"appVersion": {
"title": "Application version",
"description": "Version of TruU application, used for handling action which initiated this event",
"type": "string"
},
"sdkVersion": {
"title": "SDK version",
"description": "Version of TruU SDK, used for handling action which initiated this event",
"type": "string"
},
"deviceRisk": {
"title": "Device risk",
"description": "Risk evaluated for this device",
"type": "integer"
},
"riskScoreSource": {
"title": "Risk Score Source",
"description": "Source which provide evaluated risk for this device (e.g. Falcon)",
"type": "string"
},
"os": {
"title": "OS",
"description": "Operating system details for this device",
"$ref": "#/$defs/event-os"
},
"hw": {
"title": "HW",
"description": "Hardware details for this device",
"$ref": "#/$defs/event-device-hw"
},
"interfaces": {
"title": "Interfaces",
"description": "Interfaces of this device",
"$comment": "This interfaces and addresses are obtained from device itself (cauth engine, enrollment, etc.)",
"type": "array",
"items": {
"$ref": "#/$defs/event-device-interface"
}
},
"capabilities": {
"title": "Capabilities",
"description": "Capabilities of this device",
"type": "array",
"items": {
"type": "string",
"enum": [
"BIOMETRICS",
"PASSCODE",
"PIN",
"PATTERN",
"POSSESSION",
"CAUTH",
"UNDECLARED"
]
}
},
"user": {
"title": "User",
"description": "User for the enrollment",
"$ref": "#/$defs/event-user"
},
"euid": {
"title": "EUID",
"description": "Enrollment ID",
"type": "string"
},
"lastPinChange": {
"title": "Last PIN Change",
"description": "Epoch Timestamp for last pin change",
"type": "integer",
"format": "utc-millisec"
},
"cauthModelStatus": {
"title": "CAUTH Model Status",
"description": "Current status of the CAUTH model",
"type": "string",
"enum": ["TRAINED", "LEARNING", "UNAVAILABLE"]
},
"locale": {
"title": "Locale",
"description": "Locale set on this device",
"type": "string"
},
"sharedWorkstation": {
"title": "Shared Workstation",
"description": "Flag field if the device is shared workstation",
"type": "boolean"
},
"deleted": {
"title": "Deleted",
"description": "Date and time when device was deleted",
"$comment": "Always in UTC, formated by ISO 8601",
"type": "string",
"format": "date-time"
}
}
},
"event-os": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"title": "Event OS",
"description": "TruU event device/asset operating system structure",
"type": "object",
"properties": {
"name": {
"title": "Name",
"description": "Operating system name",
"type": "string"
},
"version": {
"title": "Version",
"description": "Operating system version",
"type": "string"
}
}
},
"event-device-hw": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"title": "Operating System HW",
"description": "TruU event device hardware structure",
"type": "object",
"properties": {
"arch": {
"title": "Arch",
"description": "Hardware architecture",
"type": "string"
},
"spec": {
"title": "Spec",
"description": "Hardware specification",
"type": "string"
},
"hsmVersion": {
"title": "HSM Version",
"description": "Hardware security module version",
"type": "string"
},
"ram": {
"title": "RAM",
"description": "Amount of operating memory (RAM) for that hardware configuration",
"type": "integer"
},
"storage": {
"title": "Storage",
"description": "Amount of local storage for that hardware configuration (in Gigabytes)",
"type": "integer"
}
}
},
"event-device-interface": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"title": "Interface",
"description": "TruU event device interface structure",
"type": "object",
"properties": {
"name": {
"title": "Name",
"description": "Interface name",
"type": "string"
},
"addresses": {
"title": "Addresses",
"description": "Addresses belong to that interface",
"type": "array",
"items": {
"$ref": "#/$defs/event-device-interface-address"
}
}
}
},
"event-device-interface-address": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"title": "Address",
"description": "TruU event device interface address structure",
"type": "object",
"properties": {
"type": {
"title": "Type",
"description": "Address type",
"type": "string",
"enum": ["IPV4", "IPV6", "MAC"]
},
"address": {
"title": "Address",
"description": "Address",
"type": "string"
},
"netmask": {
"title": "Netmask",
"description": "Netmask",
"type": "string"
}
}
},
"event-asset": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"title": "Asset",
"description": "TruU Asset structure",
"type": "object",
"extends": {
"$comment": "Extends common event entity structure",
"$ref": "#/$defs/event-entity"
},
"properties": {
"tuid": {
"title": "Asset Tuid",
"description": "The asset's tuid",
"type": "string"
},
"guid": {
"title": "Asset Guid",
"description": "Asset's directory guid",
"type": "string"
},
"appVersion": {
"title": "Asset App Version",
"description": "The version of TruU Software running on the asset",
"type": "string"
},
"displayName": {
"title": "Asset Display Name",
"description": "Asset's display name",
"type": "string"
},
"machineName": {
"title": "Asset Machine Name",
"description": "Asset's hostname",
"type": "string"
},
"hardware": {
"title": "Asset Hardware",
"description": "Asset hardware information",
"$ref": "#/$defs/event-asset-hw"
},
"software": {
"title": "Asset Software",
"description": "Asset Software Information",
"$ref": "#/$defs/event-os"
},
"interfaces": {
"title": "Interfaces",
"description": "Interfaces of this device",
"$comment": "This interfaces and addresses are obtained from device itself (cauth engine, enrollment, etc.)",
"type": "array",
"items": {
"$ref": "#/$defs/event-device-interface"
}
}
}
},
"event-asset-hw": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"title": "Asset Hardware",
"description": "TruU Asset Hardware structure",
"type": "object",
"properties": {
"hardwareId": {
"title": "Hardware ID",
"description": "The calculated hardware identifier",
"type": "string"
},
"secureStorage": {
"title": "Secure Storage",
"description": "Boolean indicating if the asset has secure storage",
"type": "boolean"
},
"serialNumber": {
"title": "Serial Number",
"description": "The asset serial number",
"type": "string"
},
"manufacturer": {
"title": "Manufacturer",
"description": "The asset manufacturer",
"type": "string"
},
"model": {
"title": "Model",
"description": "The asset model",
"type": "string"
},
"processor": {
"title": "Processor",
"description": "The asset processor",
"type": "string"
},
"biosVersion": {
"title": "BIOS Version",
"description": "The asset BIOS version",
"type": "string"
}
}
},
"event-policy": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"title": "Event Policy",
"description": "TruU event policy structure",
"$comment": "TruU policy involved in handling action which initiated this event",
"type": "object",
"properties": {
"id": {
"title": "ID",
"description": "Policy identifier",
"type": "string"
},
"name": {
"title": "Name",
"description": "Policy name",
"type": "string"
},
"type": {
"title": "Type",
"description": "Policy type",
"type": "string",
"enum": [
"REGISTRATION",
"AUTHENTICATION",
"PHYSICAL",
"PRIVACY",
"COMPUTER",
"SERVER",
"SHARED_WORKSTATION",
"BIOMETRIC_CONSENT"
]
},
"version": {
"title": "Version",
"description": "Policy version",
"$comment": "Required to differentiate which version of policy was active in time of publishing this event",
"type": "integer"
},
"decision": {
"title": "Decision",
"description": "Evaluation policy final decision",
"type": "string",
"enum": [
"POLICY_GRANTED",
"POLICY_GRANTED_ON_EMPTY",
"POLICY_GRANTED_ON_IMPLICIT_DENY",
"POLICY_DENIED",
"POLICY_DENIED_ON_EMPTY",
"POLICY_DENIED_ON_IMPLICIT_DENY"
]
},
"granted": {
"title": "Granted",
"description": "Flag if policy was granted",
"type": "boolean"
},
"assuranceLevel": {
"title": "Assurance level",
"description": "Device assurance level",
"$ref": "#/$defs/assurance-level"
},
"errorCode": {
"title": "Error code",
"description": "Type of policy denial, if policy not granted, union for all policy types",
"type": "string",
"enum": [
"POLICY_DENIED_BY_GROUP",
"POLICY_DENIED_BY_DEVICE_CAPABILITIES",
"POLICY_DENIED_BY_AUTHENTICATOR_TYPE",
"POLICY_DENIED_IMPLICIT",
"POLICY_DENIED_ON_EMPTY",
"POLICY_DENIED_BY_PUBLIC_APP",
"POLICY_DENIED_BY_INVALID_INPUT",
"POLICY_DENIED_SMART_CARD_ENROLL_NOT_ALLOWED",
"POLICY_DENIED_DISALLOWED_DEVICE",
"POLICY_DENIED_THIRD_PARTY_TOKEN",
"POLICY_DENIED_DEVICE_ASSURANCE_LEVEL",
"POLICY_DENIED_MAX_DEVICES_EXCEEDED",
"POLICY_DENIED_BY_REGISTRATION_DISABLED",
"POLICY_DENIED_BY_UNMANAGED_DEVICE",
"POLICY_DENIED_BY_WORKFLOW_AUTH_DISABLED",
"POLICY_DENIED_FIDO2_PIN_SUPPORT_MISSING",
"POLICY_DENIED_FIDO2_BIO_SUPPORT_MISSING",
"POLICY_DENIED_FIDO2_PIN_BIO_SUPPORT_MISSING",
"POLICY_DENIED_FIDO2_NOT_WHITELISTED"
]
},
"policyFileName": {
"title": "Policy file name",
"description": "Policy file name",
"type": "string"
}
}
},
"event-workflow": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"title": "Event Workflow",
"description": "TruU event workflow structure",
"$comment": "TruU workflow involved in handling action which initiated this event",
"type": "object",
"properties": {
"name": {
"title": "Name",
"description": "Workflow name",
"type": "string"
},
"guid": {
"title": "GUID",
"description": "Workflow global unique identifier",
"type": "string"
},
"version": {
"title": "Version",
"description": "Workflow version",
"$comment": "Required to differentiate which version of workflow was active in time of publishing this event",
"type": "integer"
}
}
},
"event-message": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"title": "Event Message",
"description": "TruU event message structure",
"$comment": "Event message structure, which supports localization by defined key and its params",
"type": "object",
"properties": {
"key": {
"title": "Message Key",
"description": "Internal message key, can be used for own message interpretation on presentation client",
"type": "string"
},
"text": {
"title": "Message Text",
"description": "Message text used when localized translation is not available (DEFAULT MESSAGE)",
"type": "string"
},
"params": {
"title": "Message Parameters",
"description": "Parameters for replacing message pattern placeholders",
"$comment": "Object without properties, wanted to use here only additionalJsonFields",
"type": "object"
},
"additionalDescription": {
"title": "Additional Description",
"description": "Additional description extending message text",
"$comment": "This will not be localized, it will typically contains details about errors, which will be in programming language dialect e.g. error stacktrace)",
"type": "string"
}
}
},
"error-details": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"title": "Error Details",
"description": "Details of error associated with the event",
"type": "object",
"properties": {
"description": {
"title": "Error Description",
"description": "Human-readable description of the error",
"type": "string"
},
"code": {
"title": "Error Code",
"description": "Error code identifier",
"type": "string"
},
"subcode": {
"title": "Error Subcode",
"description": "More specific error subcode",
"type": "string"
}
}
},
"assurance-level": {
"title": "Assurance level",
"description": "Assurance level",
"type": "string",
"enum": ["UNTRUSTED", "BASIC", "TRUSTED", "CERTIFIED"]
},
"event-user": {
"type": "object",
"title": "User Event Entity",
"description": "TruU event entity user specific structure",
"extends": {
"$comment": "Extends common event entity structure",
"$ref": "#/$defs/event-entity"
},
"properties": {
"userPrincipalName": {
"title": "User Principal Name",
"description": "User principal name",
"type": "string"
},
"guid": {
"title": "GUID",
"description": "Global user identifier (related to source directory)",
"type": "string"
},
"email": {
"title": "Email",
"description": "Email Address",
"type": "string"
},
"displayName": {
"title": "Display Name",
"description": "User Display Name",
"type": "string"
},
"tuid": {
"title": "TUID",
"description": "TruU user identifier (unique over all tenants)",
"type": "string"
},
"title": {
"title": "Title",
"description": "Title",
"type": "string"
},
"department": {
"title": "Department",
"description": "Department",
"type": "string"
},
"manager": {
"title": "Manager",
"description": "User manager identifier",
"type": "string"
},
"directReports": {
"title": "Direct Reports",
"description": "Direct Reports",
"type": "string"
},
"roles": {
"title": "Roles",
"description": "Roles assigned to the user",
"type": "array",
"items": {
"type": "string"
}
}
}
}
}
}
Application Authentication Event — auth-event.json
Application Authentication Event — auth-event.json
Contains specific event detail for the application authentication event.Public URL: auth-event.json
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"type": "object",
"title": "Auth Event",
"description": "Application authentication event specific structure",
"extends": {
"$comment": "Extends common event structure",
"$ref": "event.json"
},
"properties": {
"principalType": {
"title": "Principal Type",
"description": "Type of principal",
"type": "string"
},
"identityRequestId": {
"title": "Identity Request ID",
"description": "Identity request identifier",
"type": "string"
},
"authenticationMethods": {
"title": "Authentication Methods",
"description": "List of authentication methods involved in this authentication resolution",
"type": "array",
"items": {
"type": "string",
"enum": [
"BIO",
"PIN",
"WORKFLOW",
"CAUTH",
"SEAMLESS",
"TRU_PIN",
"BADGE",
"FIDO2",
"PASSKEY",
"FACE",
"FINGERPRINT"
]
}
},
"assertionType": {
"title": "Assertion Type",
"description": "Type of assertion",
"$comment": "Describes how was authentication action (request) resolved, which assertion was involved",
"type": "string",
"enum": [
"BIOMETRIC",
"BEHAVIORAL",
"POSSESSION",
"BADGE",
"BADGE_AND_PIN",
"BIOMETRIC_UNLOCK",
"BEHAVIORAL_UNLOCK",
"POSSESSION_UNLOCK",
"POSSESSION_LOCK",
"PIN",
"PIN_UNLOCK",
"BIOMETRIC_AND_PIN",
"BIOMETRIC_AND_PIN_UNLOCK",
"UNKNOWN",
"UNKNOWN_UNLOCK",
"EMPTY",
"EMPTY_UNLOCK",
"THIRD_PARTY_FIDO2",
"WORKFLOW_AUTH",
"WORKSTATION_UNLOCK_PROXIMITY",
"WORKSTATION_UNLOCK_PROXIMITY_AND_BIOMETRIC",
"WORKSTATION_UNLOCK_PROXIMITY_AND_PIN",
"WORKSTATION_UNLOCK_NETWORK",
"WORKSTATION_UNLOCK_DEVICE_BIOMETRIC",
"WORKSTATION_LOCK_PROXIMITY",
"WORKSTATION_LOCK_USER_ACTION",
"WORKSTATION_LOCK_NETWORK",
"WORKSTATION_LOGON_PROXIMITY",
"WORKSTATION_LOGON_PROXIMITY_AND_BIOMETRIC",
"WORKSTATION_LOGON_PROXIMITY_AND_PIN",
"WORKSTATION_LOGON_NETWORK",
"WORKSTATION_LOGOFF_USER_ACTION",
"WORKSTATION_LOGOFF_NETWORK",
"WORKSTATION_LOGON_NATIVE_PLUS_PROXIMITY",
"WORKSTATION_UNLOCK_NATIVE_PLUS_PROXIMITY",
"WORKSTATION_LOGON_STANDALONE_PIN",
"WORKSTATION_LOGON_STANDALONE_BIO",
"SEAMLESS"
]
},
"identificationAnnotation": {
"title": "Identification Annotation",
"description": "DEPRECATED: removed from event before processing. Identification annotation",
"deprecated": true,
"type": "string",
"enum": [
"BIO_REQUIRED_BY_POLICY",
"ENFORCE_BIO_REQUESTED",
"FLUID_ID_POSITIVE",
"FLUID_ID_NEGATIVE",
"PLATFORM_UNAVAILABLE",
"BIOMETRIC_INVALID",
"BIOMETRIC_CANCELLED",
"BIOMETRIC_OTHER",
"FLUID_ID_NO_MODEL",
"FLUID_ID_NOT_ENOUGH_DATA",
"FLUID_ID_INVALID_SCORE",
"FLUID_ID_LOCKOUT_INVALID_SCORE",
"FLUID_ID_NO_DATA",
"POSSESSION_REQUIRED_BY_POLICY"
]
},
"policy": {
"title": "Policy",
"description": "Policy if any involved in action initiated this event",
"$ref": "event.json#/$defs/event-policy"
},
"workflow": {
"title": "Workflow",
"description": "Workflow if any involved in action initiated this event",
"$ref": "event.json#/$defs/event-workflow"
},
"tcat": {
"title": "TCAT",
"description": "DEPRECATED: replaced by cauthMetrics. TCAT metrics involved in action initiated this event",
"$ref": "#/$defs/auth-event-cauth",
"deprecated": true
},
"cauthMetrics": {
"title": "CAUTH",
"description": "CAUTH metrics involved in action initiated this event",
"$comment": "Property called metrics, they are evaluated and sent by WA/MA for auth events",
"$ref": "#/$defs/auth-event-cauth"
},
"ssoSessionId": {
"title": "SSO Session ID",
"description": "SSO session identifier",
"type": "string"
},
"faceScores": {
"title": "Face Scores",
"description": "Scores for facial recognition",
"$ref": "event.json#/$defs/face-scores"
}
},
"$defs": {
"auth-event-cauth": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"title": "CAUTH",
"description": "CAUTH metrics involved in action initiated this event",
"type": "object",
"properties": {
"decayedRisk": {
"title": "Decayed Risk",
"description": "Continuous authentication score which controls seamless-SSO or other similar passive decisions that aren't necessarily taken simultaneously with user actively providing behavioral biometric",
"type": "integer"
}
}
}
}
}
Registration Event — reg-event.json
Registration Event — reg-event.json
Contains specific event detail for the registration event.Public URL: reg-event.json
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"type": "object",
"title": "Reg Event",
"description": "Registration event specific structure",
"extends": {
"$comment": "Extends common event structure",
"$ref": "event.json"
},
"properties": {
"requestId": {
"title": "Request ID",
"description": "Registration request identifier",
"type": "string"
},
"enrollmentId": {
"title": "Enrollment ID",
"description": "Enrollment identifier",
"type": "string"
},
"policy": {
"title": "Policy",
"description": "Policy if any involved in action initiated this event",
"$ref": "event.json#/$defs/event-policy"
},
"workflow": {
"title": "Workflow",
"description": "Workflow if any involved in action initiated this event",
"$ref": "event.json#/$defs/event-workflow"
},
"faceScores": {
"title": "Face Scores",
"description": "Scores for facial recognition",
"$ref": "event.json#/$defs/face-scores"
}
}
}
Device Event — device-event.json
Device Event — device-event.json
Contains specific event detail for the device event. Typically used by system and diagnostics events from the device.Public URL: device-event.json
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"type": "object",
"title": "Device Event",
"description": "The desktop or mobile device produced event specific structure.",
"$comment": "This is used typically by the system and diagnostics events from the device.",
"extends": {
"$comment": "Extends common event structure",
"$ref": "event.json"
},
"properties": {
"installationDirective": {
"title": "Installation directive",
"description": "The app installation directive. The event containing installationDirective reacts on particular installation directive the client got from IDS. Used when eventType is for example CLIENT_APP_DOWNLOAD, CLIENT_APP_INSTALLATION...",
"$ref": "#/$defs/event-installation-directive"
},
"biometricMethods": {
"title": "Biometric Methods",
"description": "List of biometric methods involved in this event. Used when eventType is related to biometric manipulation, for example CLIENT_BIOMETRIC_ADDED.",
"type": "array",
"items": {
"type": "string",
"enum": [
"FACE",
"FINGERPRINT"
]
}
}
},
"$defs": {
"event-installation-directive": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"title": "Installation directive",
"description": "Defines what should be installed on asset",
"type": "object",
"properties": {
"id": {
"title": "Id",
"description": "The identifier of the installation directive. Used as correlation to track the status.",
"$comment": "Used as correlation to track the status.",
"type": "string"
},
"artifacts": {
"title": "Artifacts",
"description": "The artifacts which should be installed on the asset.",
"type": "array",
"items": {
"$ref": "#/$defs/software-artifact"
}
}
}
},
"software-artifact": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"title": "Software artifact",
"description": "Software artifact which can be installed on the asset.",
"type": "object",
"properties": {
"name": {
"title": "Name",
"description": "The display name of the artifact",
"type": "string"
},
"artifactId": {
"title": "Artifact id",
"description": "The identifier of the artifact",
"type": "string"
},
"version": {
"title": "Artifact version",
"description": "The version of the artifact",
"type": "string"
}
}
}
}
}
Asset Heartbeat Event — asset-heartbeat-event.json
Asset Heartbeat Event — asset-heartbeat-event.json
Contains specific event detail for the asset heartbeat event.Public URL: asset-heartbeat-event.json
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"type": "object",
"title": "Asset Heartbeat Event",
"description": "Application authentication event specific structure",
"extends": {
"$comment": "Extends common event structure",
"$ref": "event.json"
},
"properties": {
"enrollments": {
"title": "User Enrollments",
"description": "List of enrollments belonging to the asset",
"type": "array",
"items": {
"$ref": "event.json#/$defs/event-device"
}
},
"currentEnrollment": {
"title": "Current Enrollment",
"description": "Identifier for the currently logged in enrollment",
"type": "string"
}
}
}
Other Structures
Specific structures for the general structures defined in the main schema definition.Resource Event Entity — resource-event-entity.json
Resource Event Entity — resource-event-entity.json
A subtype of Event Entity. Typically represents a resource entity as the target of the action that initiated the event (see types in the main entity).Public URL: resource-event-entity.json
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"type": "object",
"title": "Resource Event Entity",
"description": "TruU event entity resource specific structure",
"$comment": "That will typically represents resource entity as target of action which initiated this event (see types in main entity)",
"extends": {
"$comment": "Extends common event entity structure",
"$ref": "event.json#/$defs/event-entity"
},
"properties": {
"name": {
"title": "Name",
"description": "Resource name",
"type": "string"
},
"version": {
"title": "Version",
"description": "Resource version",
"type": "string"
}
}
}
Http Event Request — http-event-request.json
Http Event Request — http-event-request.json
A subtype of Event Request.Public URL: http-event-request.json
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"title": "Http Event Request",
"description": "TruU event request http specific structure",
"type": "object",
"extends": {
"$comment": "Extends common event request structure",
"$ref": "event.json#/$defs/event-request"
},
"properties": {
"userAgent": {
"title": "User Agent",
"description": "User agent related to request performed by action initiated this event",
"$ref": "event.json#/$defs/user-agent"
},
"method": {
"title": "Method",
"description": "Http Method",
"type": "string",
"enum": ["GET", "HEAD", "POST", "PUT", "DELETE", "CONNECT", "OPTIONS", "TRACE", "PATCH"]
},
"host": {
"title": "Host",
"description": "Host",
"type": "string"
},
"path": {
"title": "Path",
"description": "Request path",
"type": "string"
},
"scheme": {
"title": "Schema",
"description": "Schema",
"type": "string"
},
"queryParams": {
"title": "Query Parameters",
"description": "Query parameters as list of key value pairs",
"$comment": "Object without properties, wanted to use here only its additionalJsonFields",
"type": "object"
}
}
}
How the TruU Platform Uses Schema Fields
The schema includes three related elements that serve different purposes for the platform.- Event Category
- Event Type
- Event Tags
- Determines the Kafka topic onto which a message is published. Different platform and Next-Gen applications subscribe to a subset of Kafka topics, so the choice of Event Category affects which consumers process an event.
- Determines the Elastic/OpenSearch index into which an event is saved. Heartbeat events are tracked separately from authentication and registration events, for instance, due to volume and velocity.
- A unique event type identifier, which may be used for more specific event handling — for example, biometric events are used to add location (based on IP address) to the biometric consent status for a user.
- Used by the Event UI (filtering) v1 and by event export adapters.
- Serves as a basic discriminator for processors and event consumers.
- An array that can contain zero or more strings.
- Used for event classification across different purposes, including event grouping and filtering in Event UI v2. For example, telemetry events captured during user enrollment can carry a
DIAGNOSTICStag when an event indicates that a user has successfully created a PIN but has not yet finalized enrollment. - Think of tags as metadata that helps with classification or additional processing — for example, a tag could be used to exclude an event from export.