Audit logs

This page describes how Prophecy generates, stores, and shares audit logs for Prophecy deployments. Setting up audit logs requires collaboration with Prophecy. Contact Prophecy to:

Export audit logs on demand.
Configure automatic syncing to your own storage.
Set a custom retention period for stored logs.

Storage location

Prophecy stores audit logs in the same cloud platform as your deployment:

For AWS deployments, audit logs are stored in Amazon S3.
For Azure deployments, audit logs are stored in Azure Blob Storage.
For Google Cloud Platform deployments, audit logs are stored in Google Cloud Storage.

Audit event reference

When audit logs are enabled for your Prophecy deployment, they capture the following information:

User interactions with the Prophecy UI.
GraphQL API calls made to the control plane.
Actions performed directly on the execution plane, such as fabric, connection, deployment, pipeline run, and schedule operations.

The following tables list the audit events that Prophecy logs, organized by entity type.

Prophecy uses GraphQL for control plane API operations. Request and response parameters may vary depending on where you call the query.

Fabric

Query	Description	Request Parameters
`fabricDetailQuery`	Get Fabric Details	`["id"]`
`addFabric`	Add a Fabric	`["name", "ownerUid"]`
`updateOwnedBy`	Update Team owing the Fabric	`["id","targetUid"]`
`userFabricQuery`	Get all Fabrics for User	`["uid"]`

Project

Query	Description	Request Parameters
`addProject`	Add a project	`["name","forkMode","language", "ownerUid", "mainBranchModificationAllowed"]`
`getDetails`	Get Details of a Project	`["projectId"]`
`project`	List all projects for User	`["uid"]`
`teamProjectAvailable`	Available Projects for that Team	`["uid", "language"]`
`addProjectDependency`	Add a dependency Project to Current	`["projectId", "DependencyProjectUid"]`
`updateProjectDependency`	Update dependency Project to a new released version	`["projectId", "DependencyProjectUid", "ReleaseTag"]`
`removeProjectDependency`	Removed an added dependency	`["projectId", "DependencyProjectUid"]`
`projectDependenciesQuery`	List all project Dependencies	`["projectId"]`
`projectReleaseStatus`	Gives Status of last Release for given project	`["projectID", "statuses"]`
`projectSyncFromGit`	Status of Git sync of project	`["uid"]`
`releaseProject`	Release a Project	`["branch", "message","version","projectID", "CommitHash"]`
`gitFooter`	Details for Git for commit/branchNAme etc	`["projectID"]`
`addSubscriberToProject`	Add Subscriber to a Project	`["uid", "teamId"]`
`projectBranches`	List of available branches for this project	`["projectId"]`
`cloneProject`	Created clone of current project	`["uid", "name", "teamUid", "copyMainBranchReleaseTags"]`

Pipeline

Query	Description	Request Parameters
`addPipeline`	Add a new Pipeline	`["name", "branch", "ownerId", "doCheckout"]`
`tableQueryPipeline`	Lists all pipelines for project	`["projectId", "sortOrder", "sortColumn"]`
`tableQueryPipeline`	Lists all pipelines for User	`["uid", "sortOrder", "sortColumn"]`
`pipelineDetailsQuery`	Get Details of Pipeline	`["Uid"]`
`clonePipeline`	Cloned a Pipeline	`["branch", "sourcePipelineId", "targetPipelineName", "ownerUid", "doCheckout"]`
`addSubgraph`	When Subgraph is added to a Pipeline	`["mode", "name", "language", "ownerUID"]`
`addUDFBulk`	UDFs added to a Project	`["udfs.name","udfs.description", "projectUID"]`
`removeUDFBulk`	UDFs removed form a project	`["uids"]`
`getSubgraph`	Get Subgraph by given Id	`["uid"]`

Job

Query	Description	Request Parameters
`addJob`	Add a Job	`["name", "branch","fabricUID", "scheduler", "doCheckout", "projectUID"]`
`updateJobConfiguration`	Job configurations are updated	`["emails", "jobUID", "enabled", "onStart", "fabricId", "onFailure", "onSuccess", "clusterMode", "scheduleCron"]`
`latestJobReleaseByJobIdAndFabricID`	Get Jobs Release by Fabric Id	`["jobUID", "fabricUID"]`
`jobReleaseByProjectRelease`	Gets Jobs Released by Project ID	`["projectReleaseUID"]`
`jobQuery`	Get a Job by given Id	`["uid"]`
`addJobRelease`	Adds a Job released mapping to project Release	`["jobUID", "fabricUID", "scheduler", "schedulerJobUID", "projectReleaseUID"]`
`tableQueryJob`	list query for Jobs	`["uid", "sortOrder", "sortColumn"]`

Dataset

Query	Description	Request Parameters
`queryDataset`	When Datasets are queried from any page	`["uid", "optionalProjectUID"]`
`addDataset`	Added a new Dataset	`["mode", "name", "ownerUID", "fabricUID", "datasetType"]`
`addMultipleDatasets`	Add Multiple Datasets	`["names", "ownerUID", "tableNameList", "schemaNameList", "descriptionsList", "schemaAspectList", "databaseNamesList"]`

Team

Query	Description	Request Parameters
`addTeam`	Added a new Team	`["name", "adminUid"]`
`getUserTeam`	Get Teams for a User	`["uid"]`
`addteamAdmin`	Add a user as Admin	`["teamUid", "userUid", "invitationAccepted"]`
`user`	List All teams for Users with Members	`["uid"]`

User

Query	Description	Request Parameters
`getUser`	Get User	`["email"]`
`tableQueryUser`	List query for the User	`["uid", "sortOrder", "sortColumn"]`
`userAllFabricInfoAspect`	Get User Details	`["uid"]`
`setPassword`	user Sets a new Password	`["uid", "newPassword"]`

Git

Query	Description	Request Parameters
`deleteBranch`	Deleted a Branch	`["projectId", "branchName"]`
`checkout`	Checkout a new branch	`["projectId" , "branchName"]`
`prCreationRedirectUrl`	Pr Creation button clicked	`["to", "from", "projectId"]`
`createPR`	Pr Creation button clicked	`["to", "from", "toFork", "fromFork":, "projectId"]`
`cleanCommit`	Committed any changes	`["message", "projectId"]`
`commit`	Commit button clicked	`["branch", "message", "projectId"]`
`pullOrigin`	pull origin branch	`["branch", "projectId"]`
`checkGitConnection`	Test Git connection	`["externalUriArg", "pushAccessCheck", "userGitCredsUID"]`
`linkSavedCredsToExternalGit`	Linked Saved Creds to a project	`["projectUID", "userGitCredsUID"]`
`unlinkExternalGit`	Unlink the saved creds	`["projectUID"]`
`branchDivergence`	When user compares two branches for commit screen	`["projectId", "branchName", "baseBranchName"]`
`branchInfo`	Gives details of a particular working branch	`["projectId", "branchName", "remoteType"]`
`setPrCreationTemplate`	When user Sets PR creation template	`["projectId", "customPrTemplate", "prCreationEnabled"]`
`getPrCreationTemplate`	Gets PR creation template	`["projectId"]`
`deleteUserGitCreds`	When user deleted saved Git creds	`["uid"]`
`linkExternalGit`	Link saved Git creds	`["projectUID", "externalRepoUri", "userGitCredsUID"]`
`mergeMaster`	Merge to master branch	`["prNumber", "projectId", "entityConflicts", "projectConflicts", "resolvedConflicts"]`

Transpiler

Query	Description	Request Parameters
`transpilerImport`	Transpiler Import started	`["uid"]`
`addTranspilerImport`	Importing files to Prophecy Transpiler	`["name", "status", "storagePath", "transpilerType"]`

Generic

Query	Description	Request Parameters
`removeEntity`	When any entity is removed	`["uid", "entityKind"]`
`updateEntity`	When any entity is updated	`["uid", "entityKind", "entityFieldName", "entityFieldValue"]`

Execution plane events

Prophecy audit logs also capture actions performed directly on the execution plane (the orchestrator service running in your environment), not just control plane GraphQL calls. These events are recorded locally on the execution plane first, then forwarded to the control plane in batches (every 30 minutes by default). As a result, there’s a short delay between an execution action occurring and its event appearing in the central audit log.

Execution plane events are identified by a fixed event type and category rather than a GraphQL query name.

Authentication and identity

Event type	Category	Description
`login_federated`	`auth`	A user signed in through a federated identity provider (OAuth, OIDC, or SAML)
`login_ldap`	`auth`	A user signed in through LDAP
`login_builtin`	`auth`	A user signed in with a Prophecy-native username and password
`login_token`	`auth`	A user signed in with a bearer token (reserved for future use)
`logout`	`auth`	A user ended their own session
`user_impersonate`	`identity`	A privileged user (for example, a Support role) requested a token to act as another user

Fabric

Event type	Category	Description
`fabric_create`	`data_flow`	A fabric was created
`fabric_config_update`	`data_flow`	A fabric’s configuration was updated
`fabric_delete`	`data_flow`	A fabric was deleted

Connections and secrets

Event type	Category	Description
`connection_create`	`data_flow`	A connection was created
`connection_update`	`data_flow`	A connection was updated
`connection_delete`	`data_flow`	A connection was deleted
`fabric_secret_create`	`secrets`	A secret was added to a fabric
`fabric_secret_update`	`secrets`	A fabric secret was updated
`fabric_secret_delete`	`secrets`	A fabric secret was deleted

Deployment and pipeline runs

Event type	Category	Description
`project_deploy`	`compute`	A project was deployed to a fabric
`pipeline_run_interactive`	`compute`	A pipeline was run interactively, for example from the Prophecy IDE
`pipeline_run_scheduled`	`compute`	A pipeline run was triggered by a schedule
`pipeline_run_sync_api`	`compute`	A pipeline was run synchronously through the REST API

Schedules

Event type	Category	Description
`schedule_create`	`compute`	A schedule was created
`schedule_update`	`compute`	A schedule was updated
`schedule_delete`	`compute`	A schedule was deleted

Sync data to S3

If your Prophecy deployment is hosted on AWS, you can sync your Prophecy audit logs to your own Amazon S3 bucket. Follow these steps to configure your S3 bucket and grant Prophecy the required access.

1. Create the S3 bucket

Open the Amazon S3 console and choose Create bucket.
Enter a Bucket name, following the format prophecy-customer-audit-events-foo. Replace foo with an identifier for your organization.
Choose a Region. Prophecy syncs to whichever region your bucket is created in — there’s no region you need to avoid or request special handling for.
Complete the remaining setup options as needed, then create the bucket.
Set Object Ownership to ACLs disabled (recommended). You can apply this setting during bucket creation or by editing bucket permissions after creation.
If your bucket uses a customer-managed KMS key, grant the Prophecy role kms:Encrypt, kms:GenerateDataKey*, and kms:DescribeKey in your key policy. Without this, the sync will create successfully but fail when Prophecy tries to write objects.

2. Configure bucket permissions for Prophecy

In the Amazon S3 console, open your bucket and choose the Permissions tab.
Under Bucket policy, select Edit.
Paste the following policy JSON, replacing the placeholders as described below.

{
  "Version": "2008-10-17",
  "Statement": [
    {
      "Sid": "DataSyncCreateS3LocationAndTaskAccess",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::##############:role/AWSDataSyncS3BucketAccessCustomerAuditEventsRole"
      },
      "Action": [
        "s3:GetBucketLocation",
        "s3:ListBucket",
        "s3:ListBucketMultipartUploads",
        "s3:AbortMultipartUpload",
        "s3:GetObject",
        "s3:ListMultipartUploadParts",
        "s3:PutObject",
        "s3:GetObjectTagging",
        "s3:PutObjectTagging",
        "s3:DeleteObject"
      ],
      "Resource": [
        "arn:aws:s3:::prophecy-customer-audit-events-foo",
        "arn:aws:s3:::prophecy-customer-audit-events-foo/*"
      ]
    },
    {
      "Sid": "DataSyncCreateS3Location",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::##############:user/s3access"
      },
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::prophecy-customer-audit-events-foo"
    }
  ]
}

To use this example JSON:

Replace all instances of prophecy-customer-audit-events-foo with your bucket ARN.
The two statements grant access for different purposes: the first lets Prophecy’s sync role read your bucket’s location and read/write objects at transfer time. The second — the DataSyncCreateS3Location statement — grants Prophecy’s s3access IAM user the s3:ListBucket permission it needs to register your bucket as a sync destination in the first place. Both are required.
After applying the policy, contact Prophecy and provide:
- Your bucket ARN.
- The AWS region.

Prophecy will complete the configuration and enable syncing for your environment.

Platform

Setup

Management

Help and resources

Storage location

Audit event reference

Fabric

Project

Pipeline

Job

Dataset

Team

User

Git

Transpiler

Generic

Execution plane events

Authentication and identity

Fabric

Connections and secrets

Deployment and pipeline runs

Schedules

Sync data to S3

1. Create the S3 bucket

2. Configure bucket permissions for Prophecy

​Storage location

​Audit event reference

​Fabric

​Project

​Pipeline

​Job

​Dataset

​Team

​User

​Git

​Transpiler

​Generic

​Execution plane events

​Authentication and identity

​Fabric

​Connections and secrets

​Deployment and pipeline runs

​Schedules

​Sync data to S3

​1. Create the S3 bucket

​2. Configure bucket permissions for Prophecy

Storage location

Audit event reference

Fabric

Project

Pipeline

Job

Dataset

Team

User

Git

Transpiler

Generic

Execution plane events

Authentication and identity

Fabric

Connections and secrets

Deployment and pipeline runs

Schedules

Sync data to S3

1. Create the S3 bucket

2. Configure bucket permissions for Prophecy