Events and evidence

Use this page to read the two records OpenLatch keeps as evidence: the audit trail of every change and action in your organization, and the execution events the client sends for each agent action.

Audit trail export

Export the audit trail from the Audit Trail page, as CSV or JSON; see Review the audit trail. Each exported event carries these fields, in this order.

Field	Meaning
timestamp	When the event occurred
actor_name	The name of the person who acted, empty for an event the system wrote
actor_email	That person’s email address
source	Where the action came from: console, api, system or auth_sidecar
action	What was done, such as policy.updated
target_type	The kind of object acted on
target_label	The name of that object
status	The outcome: success, failure or denied
changes	The fields that changed, as JSON
site	The OpenLatch site that recorded the event

The export itself is recorded in the audit trail. The hash chain that links each event to the one before it is not part of the export: check it under Settings › Audit Trail.

Execution events

The console’s live events page reads every hook event the client sends with these fields.

Field	Meaning
event_id	The event’s evt_ identifier, assigned by the client; the platform stores an event once per identifier and drops a repeat
time	When the agent fired the hook, as the agent reported it
ingested_at	When the platform received and stored the event
type	The hook event, under the agent’s own name for it
platform	The agent product that fired the hook, such as claude-code or codex-cli
host_id	The host the agent runs on, a hst_ identifier
agent_id	The agent that sent the event, an agt_ identifier
session_id	The session the event belongs to, a ses_ identifier
agentversion	The agent’s version
clientversion	The client’s version
os	The machine’s operating system
arch	The machine’s processor architecture
localipv4	The machine’s local IPv4 address
localipv6	The machine’s local IPv6 address
publicipv4	The machine’s public IPv4 address
publicipv6	The machine’s public IPv6 address
tool_name	The tool the agent invoked, on a tool event, under one name shared by every agent
tool_input	The tool’s input, as the arguments of that shared tool
tool_response	The tool’s response, on the event after the tool ran
olverdict	The verdict recorded for the event
olverdictshadow	The verdict a policy in Monitor mode would have produced
olpolicyruleid	The policy rule that decided the action, or would have in Monitor mode
olpolicybundlerev	The revision of the policy bundle the decision was made against
olpolicyoffline	True when the client decided from its cached bundle because its last bundle update failed
raw_event	The event as OpenLatch stores it, in the event model described below

The stored event

Open an event on the live events page and its Raw event section shows the event as OpenLatch stores it. Every event is stored in one event model, the same for every agent. The events already stored in your organization in the earlier format were converted to this model, and a client that sends that format now has its events refused. The audit trail records the conversion as Event History Conversion Started and Event History Converted, with the number of events converted and the number that could not be. Each event that could not be converted is in the audit trail as Unconvertible Events Exported, one per event, and its changes hold the original event and the reason it could not be converted, so the CSV and JSON exports carry it whole.

Field	Meaning
dataschema	The event model the event follows, https://openlatch.ai/schemas/events/v3. It is an identifier, not a page to open
type	The hook event, such as a tool call before or after it runs
id	The event’s evt_ identifier
source	The agent product that sent the event
subject	The session, as a ses_ identifier
hostid	The host, as a hst_ identifier
agentid	The agent, as an agt_ identifier
data	The action itself, in the fields below for an agent action

Field in data	Meaning
harness_name	The agent product, such as claude-code or codex-cli
action_type	The kind of action, such as a tool call or an MCP call
tool_name	The shared tool name, the same for every agent: a shell command is bash whichever agent ran it
payload_llm_tool	The tool call’s arguments and, once it has run, its result
payload_llm_mcp	An MCP call’s server, tool, arguments and result
payload_raw	The agent’s own payload, as the client sent it, kept for audit

Because tool names are shared, the console shows one label per tool for every agent: a shell command shows as Bash and a file edit as Edit, whichever agent made it.

Inside data, the agent’s own identifiers keep their names: session_id there is the session identifier the agent itself gave, never a ses_ identifier. An event stored before the current identifiers keeps its earlier ones in its raw event, and the console shows it under the current ones. Identifiers describes each identifier.

Refused events

The platform answers each batch of events from a client event by event. An event that fails its checks is refused on its own, with a reason, and the other events of the batch are stored.

Reason	What happened	What to do
missing_required	A field the event model requires is absent	Update the client on that machine
schema_invalid	The event does not match the event model	Update the client on that machine
unknown_dataschema	The event names an event model the platform does not accept	Update the client on that machine to a published release
client_too_old	The event comes from a client older than the current identifiers	Reinstall the client on that machine; see Install the client
server_error	The platform could not store the event	Nothing: the client sends the batch again, and an event already stored is never stored twice

Not shipped

The SIEM export channel is not shipped. Neither record is sent to a SIEM; export the audit trail from the console instead.