> ## Documentation Index
> Fetch the complete documentation index at: https://docs.truu.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Event Schema

> TruU event structure, defined by publicly available JSON Schema files.

This page describes the TruU event structure, which is specified by JSON Schema files that are publicly available under the TruU Assets URL.

<Info>
  The schema files are published to a public S3 bucket and can be referenced directly at [https://assets.truu.ai/json-schema/event/v2.20/event.json](https://assets.truu.ai/json-schema/event/v2.20/event.json)
</Info>

## Base rules

### Formatting

* An event record is a JSON structure.
* All attribute names use the `camelCase` convention.
* All enum values are `UPPERCASE`.
* All letters in `UUID`, `MAC address`, `IPv4`, and `IPv6 address` values are `lowercase`.
* All dates and timestamps are strings in UTC, formatted per ISO 8601 (the trailing `Z` is required).

### Structure

<Warning>
  **Only one source of truth.** Avoid duplicating the same information across multiple attributes.
</Warning>

Keep backward compatibility:

* Keep the minimal set of data required.
* Adding new sections and attributes is safe.
* Avoid renaming, removing, or shuffling attributes.

## JSON Schema

### Parts of the JSON Schema

<AccordionGroup>
  <Accordion title="General Event Structure — event.json">
    Contains the main event structure and common related objects, including common abstract objects and objects used in many places (such as Policy).

    **Public URL:** [event.json](https://assets.truu.ai/json-schema/event/v2.20/event.json)

    ```json theme={null}
    {
      "$schema": "https://json-schema.org/draft/2020-12/schema",
      "title": "Event",
      "description": "Common TruU event structure",
      "type": "object",
      "properties": {
        "id": {
          "title": "ID",
          "description": "Event unique identifier",
          "type": "string"
        },
        "published": {
          "title": "Published",
          "description": "Date and time when event was published",
          "$comment": "Always in UTC, formated by ISO 8601",
          "type": "string",
          "format": "date-time"
        },
        "eventCategory": {
          "title": "Event Category",
          "description": "Category of the event, is used for proper processing of the event",
          "$comment": "Category should replace processing by eventType when all producers will populate it",
          "type": "string",
          "enum": ["AUTH", "REG", "HEARTBEAT", "CAUTH", "DEVICE", "SERVICE"]
        },
        "eventType": {
          "title": "Event Type",
          "description": "Type of the event",
          "$comment": "This value is event type discriminator, values are the union of all event type subsets like AuthEvent, RegEvent, etc.",
          "type": "string",
          "enum": [
            "AUTH_EVENT",
            "BIO_AUTH_EVENT",
            "PIN_AUTH_EVENT",
            "BIOMETRIC_AND_PIN_AUTH_EVENT",
            "BIOMETRIC_OR_PIN_AUTH_EVENT",
            "FLUID_UNLOCK_EVENT",
            "BIO_UNLOCK_EVENT",
            "PIN_UNLOCK_EVENT",
            "BIOMETRIC_AND_PIN_UNLOCK_EVENT",
            "POSSESSION_UNLOCK_EVENT",
            "POSSESSION_LOCK_EVENT",
            "THIRD_PARTY_FIDO2_AUTH_EVENT",
            "WORKFLOW_AUTH_EVENT",
            "CONTINUOUS_AUTH_EVENT",
            "WORKSTATION_UNLOCK_PROXIMITY",
            "WORKSTATION_UNLOCK_PROXIMITY_AND_BIOMETRIC",
            "WORKSTATION_UNLOCK_PROXIMITY_AND_PIN",
            "WORKSTATION_UNLOCK_NETWORK",
            "WORKSTATION_UNLOCK_DEVICE_BIOMETRIC",
            "WORKSTATION_LOCK_PROXIMITY",
            "WORKSTATION_LOCK_USER_ACTION",
            "WORKSTATION_LOCK_NETWORK",
            "WORKSTATION_LOGON_PROXIMITY",
            "WORKSTATION_LOGON_PROXIMITY_AND_BIOMETRIC",
            "WORKSTATION_LOGON_PROXIMITY_AND_PIN",
            "WORKSTATION_LOGON_NETWORK",
            "WORKSTATION_LOGOFF_USER_ACTION",
            "WORKSTATION_LOGOFF_NETWORK",
            "WORKSTATION_LOGON_NATIVE_PLUS_PROXIMITY",
            "WORKSTATION_UNLOCK_NATIVE_PLUS_PROXIMITY",
            "WORKSTATION_LOGON_STANDALONE_PIN",
            "WORKSTATION_LOGON_STANDALONE_BIO",
            "POLICY_AUTH_EVENT",
            "BADGE_AUTH_EVENT",
            "BADGE_AND_PIN_AUTH_EVENT",
            "SSO_BEGIN",
            "SSO_END",
            "SSO_SWITCH",
            "REG_EVENT",
            "DEREG_EVENT",
            "USER_DELETE_EVENT",
            "MAGIC_LINK_SENT_EVENT",
            "MAGIC_LINK_USED_EVENT",
            "MAGIC_LINK_EXPIRED_EVENT",
            "FACTOR_CREATE_EVENT",
            "FACTOR_CHANGE_EVENT",
            "FACTOR_DELETE_EVENT",
            "BADGE_TRANSFER_EVENT",
            "BIOMETRIC_CONSENT_GRANTED",
            "BIOMETRIC_CONSENT_REVOKED",
            "ASSET_HEARTBEAT_EVENT",
            "DEVICE_HEARTBEAT_EVENT",
            "DEVICE_HEARTBEAT_EVENT_COLLECTING_DATA",
            "DEVICE_HEARTBEAT_EVENT_DATA_COLLECTED",
            "DEVICE_HEARTBEAT_EVENT_NO_DATA",
            "USER_ENROLLMENT_BEGIN",
            "USER_ENROLLMENT_END",
            "CLIENT_PIN_CHANGE",
            "CLIENT_PIN_CHANGE_START",
            "CLIENT_PIN_RESET",
            "CLIENT_PIN_RESET_START",
            "CLIENT_BIOMETRIC_ADDED",
            "CLIENT_BIOMETRIC_REMOVED",
            "CLIENT_BIOMETRIC_UPDATED",
            "CLIENT_BIOMETRIC_REENROLL_PROMPT",
            "CLIENT_PIN_LOCKED",
            "CLIENT_PIN_UNLOCKED",
            "CLIENT_LOGIN",
            "CLIENT_NETWORK",
            "CLIENT_TPM",
            "CLIENT_DRIVER_MISSING",
            "CLIENT_DRIVER_REPAIR",
            "CLIENT_APP_DOWNLOAD",
            "CLIENT_APP_INSTALLATION",
            "CLIENT_ACCOUNT_UNLOCK",
            "CLIENT_ACCOUNT_UNLOCK_USER_INFO",
            "CLIENT_SECURITY_KEY_REPAIR",
            "WALLET_CONFIGURATION",
            "WALLET_ADD_PASS",
            "TAMS_STARTUP",
            "TAMS_HEALTHCHECK",
            "CAUTH_CRC_RISK_LEVEL_CHANGE",
            "CAUTH_KEYBOARD_MODEL_INITIAL_TRAIN",
            "CAUTH_KEYBOARD_MODEL_PROMOTION",
            "CAUTH_KEYBOARD_MODEL_RESET",
            "CAUTH_NO_KEYBOARD_MODEL_TRAINED",
            "CAUTH_STARTED",
            "CAUTH_STOPPED",
            "CAUTH_CRASHED",
            "CAUTH_SUSPENDED",
            "CAUTH_RESUMED",
            "CAUTH_HEARTBEAT",
            "CAUTH_TRUENV_MODEL_SCAN_COMPLETED"
          ]
        },
        "eventTags": {
          "title": "Event Tags",
          "description": "Event tags used for additional event classification (like UI grouping)",
          "type": "array",
          "items": {
            "type": "string",
            "enum": [
              "AUTHENTICATION",
              "REGISTRATION",
              "DIAGNOSTICS",
              "IDENTITY",
              "RISK",
              "SYSTEM"
            ]
          }
        },
        "version": {
          "title": "Version",
          "description": "Version of the event format",
          "type": "string"
        },
        "severity": {
          "title": "Severity",
          "description": "Event severity",
          "type": "string",
          "enum": ["TRACE", "DEBUG", "INFO", "WARN", "ERROR"]
        },
        "message": {
          "title": "Event Message",
          "description": "Message to display for this event",
          "$ref": "#/$defs/event-message"
        },
        "actor": {
          "title": "Actor",
          "description": "Entity which performs action which initiated this event",
          "$comment": "WHO initiated this action/event? ACTOR!",
          "$ref": "#/$defs/event-entity"
        },
        "client": {
          "title": "Client",
          "description": "Client which requests action which initiated this event",
          "$comment": "WHERE and HOW was initiated this action/event? On CLIENT as HTTP request!",
          "$ref": "#/$defs/event-client"
        },
        "targets": {
          "title": "Targets",
          "description": "Entities which are affected by action initiated this event",
          "$comment": "WHY was initiated this action/event? Reach TARGET(S)!",
          "type": "array",
          "items": {
            "$ref": "#/$defs/event-entity"
          }
        },
        "device": {
          "title": "Device",
          "description": "Device where was handled action which initiated this event",
          "$comment": "HOW it was handled? By the DEVICE!",
          "$ref": "#/$defs/event-device"
        },
        "asset": {
          "title": "Asset",
          "description": "The Asset that initiated this event",
          "$ref": "#/$defs/event-asset"
        },
        "factors": {
          "title": "Factors",
          "description": "Factors where was handled action which initiated this event",
          "$comment": "HOW it was handled? By the FACTOR! (for future, if needed more than one device, could be stored here, device is also type of factor)",
          "type": "array",
          "items": {
            "$ref": "#/$defs/event-factor"
          }
        },
        "domainId": {
          "title": "Domain ID",
          "description": "Domain/tenant unique identifier",
          "type": "string"
        },
        "status": {
          "title": "Status",
          "description": "This is final status of the action which initiated this event",
          "$comment": "This is union of possible statuses from all events, so not every event type can have every available status",
          "type": "string",
          "enum": ["SUCCESS", "TIMEOUT", "FAILURE", "CANCEL"]
        },
        "errorDetails": {
          "title": "Error Details",
          "description": "Additional error information for failed or exceptional events",
          "$ref": "#/$defs/error-details"
        }
      },
      "required": [
        "id",
        "published",
        "version",
        "severity",
        "domainId",
        "eventType"
      ],
      "$defs": {
        "event-entity": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "title": "Event Entity",
          "description": "Common TruU event entity structure",
          "$comment": "It has two roles, first as actor and second as target in the event",
          "type": "object",
          "properties": {
            "id": {
              "title": "ID",
              "description": "Entity identifier, unique for each subtype",
              "$comment": "For each subtype has that ID different meaning",
              "type": "string"
            },
            "display": {
              "title": "Display",
              "description": "Event entity display",
              "type": "string"
            },
            "type": {
              "title": "Type",
              "description": "Type the entity, union of all subtypes of event entity, it discriminates different properties of particular subtype",
              "type": "string",
              "enum": [
                "USER",
                "SSO_ADAPTER",
                "SERVICE_ADAPTER",
                "PHYSICAL_ACCESS",
                "DESKTOP_AGENT",
                "PAM",
                "DIGITAL_ACCESS",
                "SHARED_WORKSTATION",
                "IOS",
                "ANDROID",
                "INTEGRATION",
                "THIRD_PARTY_FIDO2",
                "PASSKEY",
                "WINDOWS_TPM",
                "MAC_TPM",
                "TRU_PIN",
                "BADGE",
                "WINDOWS_CAUTH",
                "MAC_CAUTH",
                "SERVICE_TAMS",
                "WINDOWS_AGENT",
                "MAC_AGENT",
                "TRU_FACE",
                "ENROLLMENT_SHARE"
              ]
            },
            "alternateIds": {
              "title": "Alternate IDs",
              "description": "Alternate entity identifiers",
              "type": "array",
              "items": {
                "type": "string"
              }
            }
          }
        },
        "event-client": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "title": "Event Client",
          "description": "TruU event client structure (where action initiated that event was performed)",
          "type": "object",
          "properties": {
            "id": {
              "title": "ID",
              "description": "Client identifier",
              "type": "string"
            },
            "display": {
              "title": "Display",
              "description": "Event client display",
              "type": "string"
            },
            "type": {
              "title": "Type",
              "description": "Type of client",
              "type": "string",
              "enum": ["WEB", "MOBILE", "DESKTOP", "SERVER"]
            },
            "ipAddress": {
              "title": "IP Address",
              "description": "IP address related to this client",
              "type": "string"
            },
            "geolocation": {
              "title": "Geolocation",
              "description": "Geolocation data derived from IP address related to this client",
              "$ref": "#/$defs/geolocation"
            },
            "request": {
              "title": "Request",
              "description": "Request related to action which initiated this event",
              "$ref": "#/$defs/event-request"
            },
            "screen": {
              "title": "Screen",
              "description": "Client screen properties like type of screen or resolution",
              "$ref": "#/$defs/event-client-screen"
            }
          }
        },
        "user-agent": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "title": "User Agent",
          "description": "User agent structure",
          "type": "object",
          "properties": {
            "rawUserAgent": {
              "title": "Raw User Agent",
              "description": "Raw user agent identifier string",
              "type": "string"
            },
            "os": {
              "title": "OS",
              "description": "Operating system contained in the raw user agent string",
              "type": "string"
            },
            "browser": {
              "title": "Browser",
              "description": "Browser contained in the raw user agent string",
              "type": "string"
            }
          }
        },
        "geolocation": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "title": "Geolocation",
          "description": "Geolocation structure",
          "type": "object",
          "properties": {
            "display": {
              "title": "display",
              "description": "Computed display property for display, e.g. in events table",
              "type": "string"
            },
            "city": {
              "title": "City",
              "description": "City name",
              "type": "string"
            },
            "continent": {
              "title": "Continent",
              "description": "Continent name",
              "type": "string"
            },
            "country": {
              "title": "Country",
              "description": "Country name",
              "type": "string"
            },
            "subdivisions": {
              "title": "Subdivisions",
              "description": "Subdivisions of country (if exists, e.g. districts)",
              "type": "array",
              "items": {
                "type": "string"
              }
            },
            "postalCode": {
              "title": "Postal Code",
              "description": "Postal code assigned to the city in particular country",
              "type": "string"
            },
            "location": {
              "$schema": "https://json-schema.org/draft/2020-12/schema",
              "title": "Location",
              "description": "Location structure",
              "type": "object",
              "properties": {
                "lat": {
                  "title": "Lat",
                  "description": "Location latitude in ISO 6709",
                  "type": "number"
                },
                "lon": {
                  "title": "Lon",
                  "description": "Location longitude in ISO 6709",
                  "type": "number"
                },
                "zone": {
                  "title": "Zone",
                  "description": "Location time zone",
                  "type": "string"
                }
              }
            }
          }
        },
        "face-scores": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "title": "Face Scores",
          "description": "Contains scores for facial recognition",
          "type": "object",
          "properties": {
            "liveness": {
              "title": "Liveness",
              "description": "Face liveness confidence",
              "type": "number"
            },
            "livenessThreshold": {
              "title": "Liveness Threshold",
              "description": "Face liveness confidence threshold",
              "type": "number"
            },
            "similarity": {
              "title": "Similarity",
              "description": "Face similarity score",
              "type": "number"
            },
            "similarityThreshold": {
              "title": "Similarity Threshold",
              "description": "Face similarity score threshold",
              "type": "number"
            }
          }
        },
        "event-request": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "title": "Event Request",
          "description": "Common TruU event request structure",
          "type": "object",
          "properties": {
            "id": {
              "title": "ID",
              "description": "Request identifier",
              "type": "string"
            },
            "type": {
              "title": "Type",
              "description": "Type of request",
              "type": "string",
              "enum": ["HTTP"]
            }
          }
        },
        "event-client-screen": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "title": "Event Client Screen",
          "description": "Event client screen structure",
          "type": "object",
          "properties": {
            "screenType": {
              "title": "Screen Type",
              "description": "Type of screen",
              "$comment": "Enum values must correspond with enum com.truu.id.server.idp.common.AuthorizationMethod (+ historical removed values)",
              "type": "string",
              "enum": [
                "COMPUTER",
                "QR",
                "AUTH_CODE",
                "DEEPLINK",
                "FIDO2_HARDWARE_KEY",
                "FIDO2_PASS_KEY",
                "WORKFLOW",
                "PRIMARY_IDENTIFIER",
                "USER_IDENTIFIER_PLUS_PIN",
                "BADGE",
                "LANDING"
              ]
            },
            "resolution": {
              "$schema": "https://json-schema.org/draft/2020-12/schema",
              "title": "Resolution",
              "description": "Screen resolution",
              "type": "object",
              "properties": {
                "height": {
                  "title": "Resolution Height",
                  "description": "Screen resolution height",
                  "type": "integer"
                },
                "width": {
                  "title": "Resolution Width",
                  "description": "Screen resolution width",
                  "type": "integer"
                }
              }
            },
            "switchMethod": {
              "title": "Screen Switch Method",
              "description": "Method how screen was switched",
              "type": "string",
              "enum": ["AUTO", "ON_CLICK"]
            }
          }
        },
        "event-factor": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "title": "Event Factor",
          "description": "TruU event factor structure",
          "type": "object",
          "extends": {
            "$comment": "Extends common event entity structure",
            "$ref": "#/$defs/event-entity"
          },
          "properties": {
            "guid": {
              "title": "GUID",
              "description": "Global unique identifier",
              "type": "string"
            },
            "ipAddress": {
              "title": "IP Address",
              "description": "IP address related to this factor",
              "$comment": "This IP address is the one extracted from particular request (e.g. authentication)",
              "type": "string"
            },
            "geolocation": {
              "title": "Geolocation",
              "description": "Geolocation data derived from IP address related to this factor",
              "$ref": "#/$defs/geolocation"
            },
            "assuranceLevel": {
              "title": "Assurance level",
              "description": "Factor assurance level",
              "$ref": "#/$defs/assurance-level"
            }
          }
        },
        "event-device": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "title": "Event Device",
          "description": "TruU event device structure",
          "extends": {
            "$comment": "Extends common event structure",
            "$ref": "#/$defs/event-factor"
          },
          "type": "object",
          "properties": {
            "deviceId": {
              "title": "Device ID",
              "description": "Device UUID identifier",
              "type": "string"
            },
            "relatedDevices": {
              "title": "Related Devices",
              "$comment": "Related device, e.g. Windows device for CAUTH on Windows workstation",
              "type": "array",
              "items": {
                "$ref": "#/$defs/event-device"
              }
            },
            "assetId": {
              "title": "Device Asset ID",
              "description": "Device related asset identifier",
              "type": "string"
            },
            "assetTuid": {
              "title": "Device Asset TUID",
              "description": "Device related asset UUID identifier",
              "type": "string"
            },
            "name": {
              "title": "Name",
              "description": "Event device name",
              "type": "string"
            },
            "appVersion": {
              "title": "Application version",
              "description": "Version of TruU application, used for handling action which initiated this event",
              "type": "string"
            },
            "sdkVersion": {
              "title": "SDK version",
              "description": "Version of TruU SDK, used for handling action which initiated this event",
              "type": "string"
            },
            "deviceRisk": {
              "title": "Device risk",
              "description": "Risk evaluated for this device",
              "type": "integer"
            },
            "riskScoreSource": {
              "title": "Risk Score Source",
              "description": "Source which provide evaluated risk for this device (e.g. Falcon)",
              "type": "string"
            },
            "os": {
              "title": "OS",
              "description": "Operating system details for this device",
              "$ref": "#/$defs/event-os"
            },
            "hw": {
              "title": "HW",
              "description": "Hardware details for this device",
              "$ref": "#/$defs/event-device-hw"
            },
            "interfaces": {
              "title": "Interfaces",
              "description": "Interfaces of this device",
              "$comment": "This interfaces and addresses are obtained from device itself (cauth engine, enrollment, etc.)",
              "type": "array",
              "items": {
                "$ref": "#/$defs/event-device-interface"
              }
            },
            "capabilities": {
              "title": "Capabilities",
              "description": "Capabilities of this device",
              "type": "array",
              "items": {
                "type": "string",
                "enum": [
                  "BIOMETRICS",
                  "PASSCODE",
                  "PIN",
                  "PATTERN",
                  "POSSESSION",
                  "CAUTH",
                  "UNDECLARED"
                ]
              }
            },
            "user": {
              "title": "User",
              "description": "User for the enrollment",
              "$ref": "#/$defs/event-user"
            },
            "euid": {
              "title": "EUID",
              "description": "Enrollment ID",
              "type": "string"
            },
            "lastPinChange": {
              "title": "Last PIN Change",
              "description": "Epoch Timestamp for last pin change",
              "type": "integer",
              "format": "utc-millisec"
            },
            "cauthModelStatus": {
              "title": "CAUTH Model Status",
              "description": "Current status of the CAUTH model",
              "type": "string",
              "enum": ["TRAINED", "LEARNING", "UNAVAILABLE"]
            },
            "locale": {
              "title": "Locale",
              "description": "Locale set on this device",
              "type": "string"
            },
            "sharedWorkstation": {
              "title": "Shared Workstation",
              "description": "Flag field if the device is shared workstation",
              "type": "boolean"
            },
            "deleted": {
              "title": "Deleted",
              "description": "Date and time when device was deleted",
              "$comment": "Always in UTC, formated by ISO 8601",
              "type": "string",
              "format": "date-time"
            }
          }
        },
        "event-os": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "title": "Event OS",
          "description": "TruU event device/asset operating system structure",
          "type": "object",
          "properties": {
            "name": {
              "title": "Name",
              "description": "Operating system name",
              "type": "string"
            },
            "version": {
              "title": "Version",
              "description": "Operating system version",
              "type": "string"
            }
          }
        },
        "event-device-hw": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "title": "Operating System HW",
          "description": "TruU event device hardware structure",
          "type": "object",
          "properties": {
            "arch": {
              "title": "Arch",
              "description": "Hardware architecture",
              "type": "string"
            },
            "spec": {
              "title": "Spec",
              "description": "Hardware specification",
              "type": "string"
            },
            "hsmVersion": {
              "title": "HSM Version",
              "description": "Hardware security module version",
              "type": "string"
            },
            "ram": {
              "title": "RAM",
              "description": "Amount of operating memory (RAM) for that hardware configuration",
              "type": "integer"
            },
            "storage": {
              "title": "Storage",
              "description": "Amount of local storage for that hardware configuration (in Gigabytes)",
              "type": "integer"
            }
          }
        },
        "event-device-interface": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "title": "Interface",
          "description": "TruU event device interface structure",
          "type": "object",
          "properties": {
            "name": {
              "title": "Name",
              "description": "Interface name",
              "type": "string"
            },
            "addresses": {
              "title": "Addresses",
              "description": "Addresses belong to that interface",
              "type": "array",
              "items": {
                "$ref": "#/$defs/event-device-interface-address"
              }
            }
          }
        },
        "event-device-interface-address": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "title": "Address",
          "description": "TruU event device interface address structure",
          "type": "object",
          "properties": {
            "type": {
              "title": "Type",
              "description": "Address type",
              "type": "string",
              "enum": ["IPV4", "IPV6", "MAC"]
            },
            "address": {
              "title": "Address",
              "description": "Address",
              "type": "string"
            },
            "netmask": {
              "title": "Netmask",
              "description": "Netmask",
              "type": "string"
            }
          }
        },
        "event-asset": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "title": "Asset",
          "description": "TruU Asset structure",
          "type": "object",
          "extends": {
            "$comment": "Extends common event entity structure",
            "$ref": "#/$defs/event-entity"
          },
          "properties": {
            "tuid": {
              "title": "Asset Tuid",
              "description": "The asset's tuid",
              "type": "string"
            },
            "guid": {
              "title": "Asset Guid",
              "description": "Asset's directory guid",
              "type": "string"
            },
            "appVersion": {
              "title": "Asset App Version",
              "description": "The version of TruU Software running on the asset",
              "type": "string"
            },
            "displayName": {
              "title": "Asset Display Name",
              "description": "Asset's display name",
              "type": "string"
            },
            "machineName": {
              "title": "Asset Machine Name",
              "description": "Asset's hostname",
              "type": "string"
            },
            "hardware": {
              "title": "Asset Hardware",
              "description": "Asset hardware information",
              "$ref": "#/$defs/event-asset-hw"
            },
            "software": {
              "title": "Asset Software",
              "description": "Asset Software Information",
              "$ref": "#/$defs/event-os"
            },
            "interfaces": {
              "title": "Interfaces",
              "description": "Interfaces of this device",
              "$comment": "This interfaces and addresses are obtained from device itself (cauth engine, enrollment, etc.)",
              "type": "array",
              "items": {
                "$ref": "#/$defs/event-device-interface"
              }
            }
          }
        },
        "event-asset-hw": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "title": "Asset Hardware",
          "description": "TruU Asset Hardware structure",
          "type": "object",
          "properties": {
            "hardwareId": {
              "title": "Hardware ID",
              "description": "The calculated hardware identifier",
              "type": "string"
            },
            "secureStorage": {
              "title": "Secure Storage",
              "description": "Boolean indicating if the asset has secure storage",
              "type": "boolean"
            },
            "serialNumber": {
              "title": "Serial Number",
              "description": "The asset serial number",
              "type": "string"
            },
            "manufacturer": {
              "title": "Manufacturer",
              "description": "The asset manufacturer",
              "type": "string"
            },
            "model": {
              "title": "Model",
              "description": "The asset model",
              "type": "string"
            },
            "processor": {
              "title": "Processor",
              "description": "The asset processor",
              "type": "string"
            },
            "biosVersion": {
              "title": "BIOS Version",
              "description": "The asset BIOS version",
              "type": "string"
            }
          }
        },
        "event-policy": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "title": "Event Policy",
          "description": "TruU event policy structure",
          "$comment": "TruU policy involved in handling action which initiated this event",
          "type": "object",
          "properties": {
            "id": {
              "title": "ID",
              "description": "Policy identifier",
              "type": "string"
            },
            "name": {
              "title": "Name",
              "description": "Policy name",
              "type": "string"
            },
            "type": {
              "title": "Type",
              "description": "Policy type",
              "type": "string",
              "enum": [
                "REGISTRATION",
                "AUTHENTICATION",
                "PHYSICAL",
                "PRIVACY",
                "COMPUTER",
                "SERVER",
                "SHARED_WORKSTATION",
                "BIOMETRIC_CONSENT"
              ]
            },
            "version": {
              "title": "Version",
              "description": "Policy version",
              "$comment": "Required to differentiate which version of policy was active in time of publishing this event",
              "type": "integer"
            },
            "decision": {
              "title": "Decision",
              "description": "Evaluation policy final decision",
              "type": "string",
              "enum": [
                "POLICY_GRANTED",
                "POLICY_GRANTED_ON_EMPTY",
                "POLICY_GRANTED_ON_IMPLICIT_DENY",
                "POLICY_DENIED",
                "POLICY_DENIED_ON_EMPTY",
                "POLICY_DENIED_ON_IMPLICIT_DENY"
              ]
            },
            "granted": {
              "title": "Granted",
              "description": "Flag if policy was granted",
              "type": "boolean"
            },
            "assuranceLevel": {
              "title": "Assurance level",
              "description": "Device assurance level",
              "$ref": "#/$defs/assurance-level"
            },
            "errorCode": {
              "title": "Error code",
              "description": "Type of policy denial, if policy not granted, union for all policy types",
              "type": "string",
              "enum": [
                "POLICY_DENIED_BY_GROUP",
                "POLICY_DENIED_BY_DEVICE_CAPABILITIES",
                "POLICY_DENIED_BY_AUTHENTICATOR_TYPE",
                "POLICY_DENIED_IMPLICIT",
                "POLICY_DENIED_ON_EMPTY",
                "POLICY_DENIED_BY_PUBLIC_APP",
                "POLICY_DENIED_BY_INVALID_INPUT",
                "POLICY_DENIED_SMART_CARD_ENROLL_NOT_ALLOWED",
                "POLICY_DENIED_DISALLOWED_DEVICE",
                "POLICY_DENIED_THIRD_PARTY_TOKEN",
                "POLICY_DENIED_DEVICE_ASSURANCE_LEVEL",
                "POLICY_DENIED_MAX_DEVICES_EXCEEDED",
                "POLICY_DENIED_BY_REGISTRATION_DISABLED",
                "POLICY_DENIED_BY_UNMANAGED_DEVICE",
                "POLICY_DENIED_BY_WORKFLOW_AUTH_DISABLED",
                "POLICY_DENIED_FIDO2_PIN_SUPPORT_MISSING",
                "POLICY_DENIED_FIDO2_BIO_SUPPORT_MISSING",
                "POLICY_DENIED_FIDO2_PIN_BIO_SUPPORT_MISSING",
                "POLICY_DENIED_FIDO2_NOT_WHITELISTED"
              ]
            },
            "policyFileName": {
              "title": "Policy file name",
              "description": "Policy file name",
              "type": "string"
            }
          }
        },
        "event-workflow": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "title": "Event Workflow",
          "description": "TruU event workflow structure",
          "$comment": "TruU workflow involved in handling action which initiated this event",
          "type": "object",
          "properties": {
            "name": {
              "title": "Name",
              "description": "Workflow name",
              "type": "string"
            },
            "guid": {
              "title": "GUID",
              "description": "Workflow global unique identifier",
              "type": "string"
            },
            "version": {
              "title": "Version",
              "description": "Workflow version",
              "$comment": "Required to differentiate which version of workflow was active in time of publishing this event",
              "type": "integer"
            }
          }
        },
        "event-message": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "title": "Event Message",
          "description": "TruU event message structure",
          "$comment": "Event message structure, which supports localization by defined key and its params",
          "type": "object",
          "properties": {
            "key": {
              "title": "Message Key",
              "description": "Internal message key, can be used for own message interpretation on presentation client",
              "type": "string"
            },
            "text": {
              "title": "Message Text",
              "description": "Message text used when localized translation is not available (DEFAULT MESSAGE)",
              "type": "string"
            },
            "params": {
              "title": "Message Parameters",
              "description": "Parameters for replacing message pattern placeholders",
              "$comment": "Object without properties, wanted to use here only additionalJsonFields",
              "type": "object"
            },
            "additionalDescription": {
              "title": "Additional Description",
              "description": "Additional description extending message text",
              "$comment": "This will not be localized, it will typically contains details about errors, which will be in programming language dialect e.g. error stacktrace)",
              "type": "string"
            }
          }
        },
        "error-details": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "title": "Error Details",
          "description": "Details of error associated with the event",
          "type": "object",
          "properties": {
            "description": {
              "title": "Error Description",
              "description": "Human-readable description of the error",
              "type": "string"
            },
            "code": {
              "title": "Error Code",
              "description": "Error code identifier",
              "type": "string"
            },
            "subcode": {
              "title": "Error Subcode",
              "description": "More specific error subcode",
              "type": "string"
            }
          }
        },
        "assurance-level": {
          "title": "Assurance level",
          "description": "Assurance level",
          "type": "string",
          "enum": ["UNTRUSTED", "BASIC", "TRUSTED", "CERTIFIED"]
        },
        "event-user": {
          "type": "object",
          "title": "User Event Entity",
          "description": "TruU event entity user specific structure",
          "extends": {
            "$comment": "Extends common event entity structure",
            "$ref": "#/$defs/event-entity"
          },
          "properties": {
            "userPrincipalName": {
              "title": "User Principal Name",
              "description": "User principal name",
              "type": "string"
            },
            "guid": {
              "title": "GUID",
              "description": "Global user identifier (related to source directory)",
              "type": "string"
            },
            "email": {
              "title": "Email",
              "description": "Email Address",
              "type": "string"
            },
            "displayName": {
              "title": "Display Name",
              "description": "User Display Name",
              "type": "string"
            },
            "tuid": {
              "title": "TUID",
              "description": "TruU user identifier (unique over all tenants)",
              "type": "string"
            },
            "title": {
              "title": "Title",
              "description": "Title",
              "type": "string"
            },
            "department": {
              "title": "Department",
              "description": "Department",
              "type": "string"
            },
            "manager": {
              "title": "Manager",
              "description": "User manager identifier",
              "type": "string"
            },
            "directReports": {
              "title": "Direct Reports",
              "description": "Direct Reports",
              "type": "string"
            },
            "roles": {
              "title": "Roles",
              "description": "Roles assigned to the user",
              "type": "array",
              "items": {
                "type": "string"
              }
            }
          }
        }
      }
    }
    ```
  </Accordion>

  <Accordion title="Application Authentication Event — auth-event.json">
    Contains specific event detail for the application authentication event.

    **Public URL:** [auth-event.json](https://assets.truu.ai/json-schema/event/v2.20/auth-event.json)

    ```json theme={null}
    {
      "$schema": "https://json-schema.org/draft/2020-12/schema",
      "type": "object",
      "title": "Auth Event",
      "description": "Application authentication event specific structure",
      "extends": {
        "$comment": "Extends common event structure",
        "$ref": "event.json"
      },
      "properties": {
        "principalType": {
          "title": "Principal Type",
          "description": "Type of principal",
          "type": "string"
        },
        "identityRequestId": {
          "title": "Identity Request ID",
          "description": "Identity request identifier",
          "type": "string"
        },
        "authenticationMethods": {
          "title": "Authentication Methods",
          "description": "List of authentication methods involved in this authentication resolution",
          "type": "array",
          "items": {
            "type": "string",
            "enum": [
              "BIO",
              "PIN",
              "WORKFLOW",
              "CAUTH",
              "SEAMLESS",
              "TRU_PIN",
              "BADGE",
              "FIDO2",
              "PASSKEY",
              "FACE",
              "FINGERPRINT"
            ]
          }
        },
        "assertionType": {
          "title": "Assertion Type",
          "description": "Type of assertion",
          "$comment": "Describes how was authentication action (request) resolved, which assertion was involved",
          "type": "string",
          "enum": [
            "BIOMETRIC",
            "BEHAVIORAL",
            "POSSESSION",
            "BADGE",
            "BADGE_AND_PIN",
            "BIOMETRIC_UNLOCK",
            "BEHAVIORAL_UNLOCK",
            "POSSESSION_UNLOCK",
            "POSSESSION_LOCK",
            "PIN",
            "PIN_UNLOCK",
            "BIOMETRIC_AND_PIN",
            "BIOMETRIC_AND_PIN_UNLOCK",
            "UNKNOWN",
            "UNKNOWN_UNLOCK",
            "EMPTY",
            "EMPTY_UNLOCK",
            "THIRD_PARTY_FIDO2",
            "WORKFLOW_AUTH",
            "WORKSTATION_UNLOCK_PROXIMITY",
            "WORKSTATION_UNLOCK_PROXIMITY_AND_BIOMETRIC",
            "WORKSTATION_UNLOCK_PROXIMITY_AND_PIN",
            "WORKSTATION_UNLOCK_NETWORK",
            "WORKSTATION_UNLOCK_DEVICE_BIOMETRIC",
            "WORKSTATION_LOCK_PROXIMITY",
            "WORKSTATION_LOCK_USER_ACTION",
            "WORKSTATION_LOCK_NETWORK",
            "WORKSTATION_LOGON_PROXIMITY",
            "WORKSTATION_LOGON_PROXIMITY_AND_BIOMETRIC",
            "WORKSTATION_LOGON_PROXIMITY_AND_PIN",
            "WORKSTATION_LOGON_NETWORK",
            "WORKSTATION_LOGOFF_USER_ACTION",
            "WORKSTATION_LOGOFF_NETWORK",
            "WORKSTATION_LOGON_NATIVE_PLUS_PROXIMITY",
            "WORKSTATION_UNLOCK_NATIVE_PLUS_PROXIMITY",
            "WORKSTATION_LOGON_STANDALONE_PIN",
            "WORKSTATION_LOGON_STANDALONE_BIO",
            "SEAMLESS"
          ]
        },
        "identificationAnnotation": {
          "title": "Identification Annotation",
          "description": "DEPRECATED: removed from event before processing. Identification annotation",
          "deprecated": true,
          "type": "string",
          "enum": [
            "BIO_REQUIRED_BY_POLICY",
            "ENFORCE_BIO_REQUESTED",
            "FLUID_ID_POSITIVE",
            "FLUID_ID_NEGATIVE",
            "PLATFORM_UNAVAILABLE",
            "BIOMETRIC_INVALID",
            "BIOMETRIC_CANCELLED",
            "BIOMETRIC_OTHER",
            "FLUID_ID_NO_MODEL",
            "FLUID_ID_NOT_ENOUGH_DATA",
            "FLUID_ID_INVALID_SCORE",
            "FLUID_ID_LOCKOUT_INVALID_SCORE",
            "FLUID_ID_NO_DATA",
            "POSSESSION_REQUIRED_BY_POLICY"
          ]
        },
        "policy": {
          "title": "Policy",
          "description": "Policy if any involved in action initiated this event",
          "$ref": "event.json#/$defs/event-policy"
        },
        "workflow": {
          "title": "Workflow",
          "description": "Workflow if any involved in action initiated this event",
          "$ref": "event.json#/$defs/event-workflow"
        },
        "tcat": {
          "title": "TCAT",
          "description": "DEPRECATED: replaced by cauthMetrics. TCAT metrics involved in action initiated this event",
          "$ref": "#/$defs/auth-event-cauth",
          "deprecated": true
        },
        "cauthMetrics": {
          "title": "CAUTH",
          "description": "CAUTH metrics involved in action initiated this event",
          "$comment": "Property called metrics, they are evaluated and sent by WA/MA for auth events",
          "$ref": "#/$defs/auth-event-cauth"
        },
        "ssoSessionId": {
          "title": "SSO Session ID",
          "description": "SSO session identifier",
          "type": "string"
        },
        "faceScores": {
          "title": "Face Scores",
          "description": "Scores for facial recognition",
          "$ref": "event.json#/$defs/face-scores"
        }
      },
      "$defs": {
        "auth-event-cauth": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "title": "CAUTH",
          "description": "CAUTH metrics involved in action initiated this event",
          "type": "object",
          "properties": {
            "decayedRisk": {
              "title": "Decayed Risk",
              "description": "Continuous authentication score which controls seamless-SSO or other similar passive decisions that aren't necessarily taken simultaneously with user actively providing behavioral biometric",
              "type": "integer"
            }
          }
        }
      }
    }
    ```
  </Accordion>

  <Accordion title="Registration Event — reg-event.json">
    Contains specific event detail for the registration event.

    **Public URL:** [reg-event.json](https://assets.truu.ai/json-schema/event/v2.20/reg-event.json)

    ```json theme={null}
    {
      "$schema": "https://json-schema.org/draft/2020-12/schema",
      "type": "object",
      "title": "Reg Event",
      "description": "Registration event specific structure",
      "extends": {
        "$comment": "Extends common event structure",
        "$ref": "event.json"
      },
      "properties": {
        "requestId": {
          "title": "Request ID",
          "description": "Registration request identifier",
          "type": "string"
        },
        "enrollmentId": {
          "title": "Enrollment ID",
          "description": "Enrollment identifier",
          "type": "string"
        },
        "policy": {
          "title": "Policy",
          "description": "Policy if any involved in action initiated this event",
          "$ref": "event.json#/$defs/event-policy"
        },
        "workflow": {
          "title": "Workflow",
          "description": "Workflow if any involved in action initiated this event",
          "$ref": "event.json#/$defs/event-workflow"
        },
        "faceScores": {
          "title": "Face Scores",
          "description": "Scores for facial recognition",
          "$ref": "event.json#/$defs/face-scores"
        }
      }
    }
    ```
  </Accordion>

  <Accordion title="Device Event — device-event.json">
    Contains specific event detail for the device event. Typically used by system and diagnostics events from the device.

    **Public URL:** [device-event.json](https://assets.truu.ai/json-schema/event/v2.20/device-event.json)

    ```json theme={null}
    {
      "$schema": "https://json-schema.org/draft/2020-12/schema",
      "type": "object",
      "title": "Device Event",
      "description": "The desktop or mobile device produced event specific structure.",
      "$comment": "This is used typically by the system and diagnostics events from the device.",
      "extends": {
        "$comment": "Extends common event structure",
        "$ref": "event.json"
      },
      "properties": {
        "installationDirective": {
          "title": "Installation directive",
          "description": "The app installation directive. The event containing installationDirective reacts on particular installation directive the client got from IDS. Used when eventType is for example CLIENT_APP_DOWNLOAD, CLIENT_APP_INSTALLATION...",
          "$ref": "#/$defs/event-installation-directive"
        },
        "biometricMethods": {
          "title": "Biometric Methods",
          "description": "List of biometric methods involved in this event. Used when eventType is related to biometric manipulation, for example CLIENT_BIOMETRIC_ADDED.",
          "type": "array",
          "items": {
            "type": "string",
            "enum": [
              "FACE",
              "FINGERPRINT"
            ]
          }
        }
      },
      "$defs": {
        "event-installation-directive": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "title": "Installation directive",
          "description": "Defines what should be installed on asset",
          "type": "object",
          "properties": {
            "id": {
              "title": "Id",
              "description": "The identifier of the installation directive. Used as correlation to track the status.",
              "$comment": "Used as correlation to track the status.",
              "type": "string"
            },
            "artifacts": {
              "title": "Artifacts",
              "description": "The artifacts which should be installed on the asset.",
              "type": "array",
              "items": {
                "$ref": "#/$defs/software-artifact"
              }
            }
          }
        },
        "software-artifact": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "title": "Software artifact",
          "description": "Software artifact which can be installed on the asset.",
          "type": "object",
          "properties": {
            "name": {
              "title": "Name",
              "description": "The display name of the artifact",
              "type": "string"
            },
            "artifactId": {
              "title": "Artifact id",
              "description": "The identifier of the artifact",
              "type": "string"
            },
            "version": {
              "title": "Artifact version",
              "description": "The version of the artifact",
              "type": "string"
            }
          }
        }
      }
    }
    ```
  </Accordion>

  <Accordion title="Asset Heartbeat Event — asset-heartbeat-event.json">
    Contains specific event detail for the asset heartbeat event.

    **Public URL:** [asset-heartbeat-event.json](https://assets.truu.ai/json-schema/event/v2.20/asset-heartbeat-event.json)

    ```json theme={null}
    {
      "$schema": "https://json-schema.org/draft/2020-12/schema",
      "type": "object",
      "title": "Asset Heartbeat Event",
      "description": "Application authentication event specific structure",
      "extends": {
        "$comment": "Extends common event structure",
        "$ref": "event.json"
      },
      "properties": {
        "enrollments": {
          "title": "User Enrollments",
          "description": "List of enrollments belonging to the asset",
          "type": "array",
          "items": {
            "$ref": "event.json#/$defs/event-device"
          }
        },
        "currentEnrollment": {
          "title": "Current Enrollment",
          "description": "Identifier for the currently logged in enrollment",
          "type": "string"
        }
      }
    }
    ```
  </Accordion>
</AccordionGroup>

### Other Structures

Specific structures for the general structures defined in the main schema definition.

<AccordionGroup>
  <Accordion title="Resource Event Entity — resource-event-entity.json">
    A subtype of Event Entity. Typically represents a resource entity as the target of the action that initiated the event (see types in the main entity).

    **Public URL:** [resource-event-entity.json](https://assets.truu.ai/json-schema/event/v2.20/resource-event-entity.json)

    ```json theme={null}
    {
      "$schema": "https://json-schema.org/draft/2020-12/schema",
      "type": "object",
      "title": "Resource Event Entity",
      "description": "TruU event entity resource specific structure",
      "$comment": "That will typically represents resource entity as target of action which initiated this event (see types in main entity)",
      "extends": {
        "$comment": "Extends common event entity structure",
        "$ref": "event.json#/$defs/event-entity"
      },
      "properties": {
        "name": {
          "title": "Name",
          "description": "Resource name",
          "type": "string"
        },
        "version": {
          "title": "Version",
          "description": "Resource version",
          "type": "string"
        }
      }
    }
    ```
  </Accordion>

  <Accordion title="Http Event Request — http-event-request.json">
    A subtype of Event Request.

    **Public URL:** [http-event-request.json](https://assets.truu.ai/json-schema/event/v2.20/http-event-request.json)

    ```json theme={null}
    {
      "$schema": "https://json-schema.org/draft/2020-12/schema",
      "title": "Http Event Request",
      "description": "TruU event request http specific structure",
      "type": "object",
      "extends": {
        "$comment": "Extends common event request structure",
        "$ref": "event.json#/$defs/event-request"
      },
      "properties": {
        "userAgent": {
          "title": "User Agent",
          "description": "User agent related to request performed by action initiated this event",
          "$ref": "event.json#/$defs/user-agent"
        },
        "method": {
          "title": "Method",
          "description": "Http Method",
          "type": "string",
          "enum": ["GET", "HEAD", "POST", "PUT", "DELETE", "CONNECT", "OPTIONS", "TRACE", "PATCH"]
        },
        "host": {
          "title": "Host",
          "description": "Host",
          "type": "string"
        },
        "path": {
          "title": "Path",
          "description": "Request path",
          "type": "string"
        },
        "scheme": {
          "title": "Schema",
          "description": "Schema",
          "type": "string"
        },
        "queryParams": {
          "title": "Query Parameters",
          "description": "Query parameters as list of key value pairs",
          "$comment": "Object without properties, wanted to use here only its additionalJsonFields",
          "type": "object"
        }
      }
    }
    ```
  </Accordion>
</AccordionGroup>

## How the TruU Platform Uses Schema Fields

The schema includes three related elements that serve different purposes for the platform.

<Tabs>
  <Tab title="Event Category">
    * Determines the Kafka topic onto which a message is published. Different platform and Next-Gen applications subscribe to a subset of Kafka topics, so the choice of Event Category affects which consumers process an event.
    * Determines the Elastic/OpenSearch index into which an event is saved. Heartbeat events are tracked separately from authentication and registration events, for instance, due to volume and velocity.
  </Tab>

  <Tab title="Event Type">
    * A unique event type identifier, which may be used for more specific event handling — for example, biometric events are used to add location (based on IP address) to the biometric consent status for a user.
    * Used by the Event UI (filtering) v1 and by event export adapters.
    * Serves as a basic discriminator for processors and event consumers.
  </Tab>

  <Tab title="Event Tags">
    * An array that can contain zero or more strings.
    * Used for event classification across different purposes, including event grouping and filtering in Event UI v2. For example, telemetry events captured during user enrollment can carry a `DIAGNOSTICS` tag when an event indicates that a user has successfully created a PIN but has not yet finalized enrollment.
    * Think of tags as metadata that helps with classification or additional processing — for example, a tag could be used to exclude an event from export.
  </Tab>
</Tabs>