IAM

This is an englisch preview of the IAM module.

IAM

Sections

• Authentication — 14 endpoints
• Tenants — 7 endpoints
• Roles — 9 endpoints
• Users — 14 endpoints
• User Groups — 11 endpoints
• Device Pairing — 2 endpoints

Events

Published on the tenant's event stream and delivered over the websocket to every subscriber holding read on the resource the message names. resourceIdentifier is the resource the action changed; the payload is the shape below.

Event	Description
IAM_ROLE_CREATE	A role was created, with the access rules it grants its holders.
IAM_ROLE_DELETE	A role was removed; every user paired to it was unpaired first and lost the access it granted.
IAM_ROLE_PAIR_USER	One or more accounts were paired to a role and hold its access from that moment.
IAM_ROLE_REPLACE	A role was overwritten as a whole — anything not repeated in the write is gone.
IAM_ROLE_UNPAIR_USER	One or more accounts were unpaired from a role and lost the access it granted.
IAM_ROLE_UPDATE	Fields of a role were written; a present access replaced the whole rule set.
IAM_SIGNING_KEY_REGISTER	The public half of a JWT signing key was recorded at boot, so every instance can verify against it and the JWKS endpoint can publish it. Rotation adds an entry rather than replacing one, which keeps older tokens verifiable.
IAM_TENANT_CREATE	A tenant was created, with the rootAccess ceiling every rule inside it is held to and the reference to its password pepper.
IAM_TENANT_DELETE	A tenant entry was removed and the origins it had registered for browser requests were released.
IAM_TENANT_REPLACE	A tenant was overwritten as a whole; fields left out fell back to their defaults, apart from passwordSecret and createdBy, which were carried over.
IAM_TENANT_UPDATE	Fields of a tenant were written; a changed allowedOrigins re-registered which origins may reach the tenant from a browser.
IAM_USER_CHANGE_EMAIL	An account was pointed at a new address, which starts out unverified.
IAM_USER_CONSUME_CLAIM_CODE	A tenant claim code was removed and no longer admits a registration.
IAM_USER_CONSUME_EMAIL_VERIFICATION	A verification code was used up and cannot be presented a second time.
IAM_USER_CONSUME_INVITE	An invitation was redeemed: the account it named now exists and the code stopped working.
IAM_USER_CONSUME_PASSWORD_RESET	A password-reset token was used up and cannot be presented a second time.
IAM_USER_CREATE	An account was created by redeeming an invite or a claim code. invitedBy names what admitted it, where anything did — a broadcast tenant claim code leaves it unset.
IAM_USER_CREATE_CLAIM_CODE	A tenant claim code was minted; only its hash is stored, and it may carry a role every signup with it joins.
IAM_USER_CREATE_EMAIL_VERIFICATION	A verification code was issued for an address. The plaintext goes into the mail and nowhere else — only its hash is stored.
IAM_USER_CREATE_PASSWORD_RESET	A password-reset token was issued. The plaintext travels in the mailed link and nowhere else — only its hash is stored.
IAM_USER_CREATE_PENDING	An invitation was minted, carrying the access, roles and groups the account receives when the code is redeemed.
IAM_USER_DELETE	An account was removed, its email address released for a new signup and its role pairings dropped.
IAM_USER_ENROLL_TOTP	A TOTP secret was stored as the account's second factor, with its set of backup codes. The same event carries the shortened set after a backup code has been spent.
IAM_USER_ENROLL_WEBAUTHN_CREDENTIAL	A WebAuthn credential was registered on an account, which may hold several of them.
IAM_USER_REMOVE_TOTP	An account's TOTP secret and its backup codes were dropped.
IAM_USER_REMOVE_WEBAUTHN_CREDENTIAL	One WebAuthn credential was removed; the factor itself goes with its last credential.
IAM_USER_REVOKE_INVITE	An outstanding invitation was withdrawn without an account being created — kept apart from redemption, which ends in the same deletion.
IAM_USER_SEND_INVITE	An invitation mail was triggered; it carries the plaintext code and the signup link, and stays inside the instance that raised it.
IAM_USER_SET_PASSWORD	An account's password hash was replaced — by a change, by a reset, or by a rehash under a rotated pepper. The hash, salt and pepper version are kept off the event bus.
IAM_USER_SET_PASSWORD_INDICATION	A password change worth telling the account holder about was made. A rehash under a rotated pepper deliberately does not raise this — the password itself did not change.
IAM_USER_UPDATE	An account's own access rules or its enforce2FA flag were written.
IAM_USER_UPDATE_WEBAUTHN_SIGN_COUNT	A WebAuthn credential's signature counter was updated after a successful assertion.
IAM_USER_VERIFY_EMAIL	An account's address was confirmed by the code from the verification mail.
IAM_USERGROUP_CREATE	A user group was created; it starts out with neither roles nor members.
IAM_USERGROUP_DELETE	A group was removed after its roles and its members were unlinked, so everyone in it lost what it granted.
IAM_USERGROUP_PAIR_ROLE	One or more roles were put into a group and reached everyone already in it.
IAM_USERGROUP_PAIR_USER	One or more accounts joined a group and hold every role it carries.
IAM_USERGROUP_UNPAIR_ROLE	One or more roles were taken out of a group; its members lost them unless they hold them by another path.
IAM_USERGROUP_UNPAIR_USER	One or more accounts left a group and lost the roles it carried.
IAM_USERGROUP_UPDATE	A group's name or description was written; its roles and members were untouched.

Role created

A role was created, with the access rules it grants its holders.

EVENTIAM_ROLE_CREATE

Payload

Name	Description
namestring	Display name of the role min length 1 · max length 64
descriptionstringoptional	Human-readable description of the role's purpose
accessarrayoptional	Access policies assigned to members of this role Default: []
identifier	The resource this policy applies to
Alternative 1	Resource identifier pattern (CRN), may include wildcards
Alternative 2	Resource identifier pattern (CRN), may include wildcards
Alternative 3	Resource identifier pattern (CRN), may include wildcards
Alternative 4	Resource identifier pattern (CRN), may include wildcards
Alternative 5	Resource identifier pattern (CRN), may include wildcards
Alternative 6	Resource identifier pattern (CRN), may include wildcards
effectenum	Access policy effect — either allow or deny Possible values: deny, allow
actionsarray	List of actions permitted by this policy
policyobjectoptional	Additional constraints for this access policy
enforce2FAbooleanoptional	Requires the subject to have 2FA active before this access is granted
targetoptional	Where a device claimed under this rule lands: the kind of owner — user, role or group — or a CRN naming one outright. Only meaningful on a .pair rule.
Alternative 1	Where a device claimed under this rule lands: the kind of owner — user, role or group — or a CRN naming one outright. Only meaningful on a .pair rule. Possible values: user, role, group
Alternative 2	Where a device claimed under this rule lands: the kind of owner — user, role or group — or a CRN naming one outright. Only meaningful on a .pair rule.
isOwnerbooleanoptional	Marks an owner-relative rule, written as crn#tenant:<id>.user:* and rebound to the holder's own account when the access list is assembled — how a shared role says "your own account" without naming anyone.
require2FAbooleanoptional	Whether members of this role must have two-factor authentication enabled Default: false
resourceIdentifierstring	Unique Coldwave resource name (CRN) that identifies a resource
createdBystring	Resource identifier of the entity that created this resource

Role deleted

A role was removed; every user paired to it was unpaired first and lost the access it granted.

EVENTIAM_ROLE_DELETE

Payload

Name	Description

Users added to a role

One or more accounts were paired to a role and hold its access from that moment.

EVENTIAM_ROLE_PAIR_USER

Payload

Name	Description
user	The users being added to or removed from the role or user group, as one CRN or an array of them.
Alternative 1string	Unique Coldwave resource name (CRN) that identifies a resource
Alternative 2array	The users being added to or removed from the role or user group, as one CRN or an array of them.

Role replaced

A role was overwritten as a whole — anything not repeated in the write is gone.

EVENTIAM_ROLE_REPLACE

Payload

Name	Description
namestring	Display name of the role min length 1 · max length 64
descriptionstringoptional	Human-readable description of the role's purpose
accessarrayoptional	Access policies assigned to members of this role Default: []
identifier	The resource this policy applies to
Alternative 1	Resource identifier pattern (CRN), may include wildcards
Alternative 2	Resource identifier pattern (CRN), may include wildcards
Alternative 3	Resource identifier pattern (CRN), may include wildcards
Alternative 4	Resource identifier pattern (CRN), may include wildcards
Alternative 5	Resource identifier pattern (CRN), may include wildcards
Alternative 6	Resource identifier pattern (CRN), may include wildcards
effectenum	Access policy effect — either allow or deny Possible values: deny, allow
actionsarray	List of actions permitted by this policy
policyobjectoptional	Additional constraints for this access policy
enforce2FAbooleanoptional	Requires the subject to have 2FA active before this access is granted
targetoptional	Where a device claimed under this rule lands: the kind of owner — user, role or group — or a CRN naming one outright. Only meaningful on a .pair rule.
Alternative 1	Where a device claimed under this rule lands: the kind of owner — user, role or group — or a CRN naming one outright. Only meaningful on a .pair rule. Possible values: user, role, group
Alternative 2	Where a device claimed under this rule lands: the kind of owner — user, role or group — or a CRN naming one outright. Only meaningful on a .pair rule.
isOwnerbooleanoptional	Marks an owner-relative rule, written as crn#tenant:<id>.user:* and rebound to the holder's own account when the access list is assembled — how a shared role says "your own account" without naming anyone.
require2FAbooleanoptional	Whether members of this role must have two-factor authentication enabled Default: false
resourceIdentifierstring	Unique Coldwave resource name (CRN) that identifies a resource
createdBystring	Resource identifier of the entity that created this resource

Users removed from a role

One or more accounts were unpaired from a role and lost the access it granted.

EVENTIAM_ROLE_UNPAIR_USER

Payload

Name	Description
user	The users being added to or removed from the role or user group, as one CRN or an array of them.
Alternative 1string	Unique Coldwave resource name (CRN) that identifies a resource
Alternative 2array	The users being added to or removed from the role or user group, as one CRN or an array of them.

Role updated

Fields of a role were written; a present access replaced the whole rule set.

EVENTIAM_ROLE_UPDATE

Payload

Name	Description
namestringoptional	New display name for the role min length 1 · max length 64
descriptionstringoptional	Updated description of the role's purpose
accessarrayoptional	Replacement access policies for this role — replaces the existing set
identifier	The resource this policy applies to
Alternative 1	Resource identifier pattern (CRN), may include wildcards
Alternative 2	Resource identifier pattern (CRN), may include wildcards
Alternative 3	Resource identifier pattern (CRN), may include wildcards
Alternative 4	Resource identifier pattern (CRN), may include wildcards
Alternative 5	Resource identifier pattern (CRN), may include wildcards
Alternative 6	Resource identifier pattern (CRN), may include wildcards
effectenum	Access policy effect — either allow or deny Possible values: deny, allow
actionsarray	List of actions permitted by this policy
policyobjectoptional	Additional constraints for this access policy
enforce2FAbooleanoptional	Requires the subject to have 2FA active before this access is granted
targetoptional	Where a device claimed under this rule lands: the kind of owner — user, role or group — or a CRN naming one outright. Only meaningful on a .pair rule.
Alternative 1	Where a device claimed under this rule lands: the kind of owner — user, role or group — or a CRN naming one outright. Only meaningful on a .pair rule. Possible values: user, role, group
Alternative 2	Where a device claimed under this rule lands: the kind of owner — user, role or group — or a CRN naming one outright. Only meaningful on a .pair rule.
isOwnerbooleanoptional	Marks an owner-relative rule, written as crn#tenant:<id>.user:* and rebound to the holder's own account when the access list is assembled — how a shared role says "your own account" without naming anyone.
require2FAbooleanoptional	Whether members of this role must have two-factor authentication enabled

Signing key published

The public half of a JWT signing key was recorded at boot, so every instance can verify against it and the JWKS endpoint can publish it. Rotation adds an entry rather than replacing one, which keeps older tokens verifiable.

EVENTIAM_SIGNING_KEY_REGISTER

Payload

Name	Description
kidstring	Key id of the signing key: its JWK thumbprint per RFC 7638, and what the kid header of an issued token carries. min length 1
jwkobject	The public half of the token signing key as a JWK; the private half never leaves the secrets store.
kty	Key type; always EC.
crv	Curve; always P-256, the curve of the ES256 tokens this backend issues.
xstring	Base64url of the public point's x coordinate. min length 1
ystring	Base64url of the public point's y coordinate. min length 1
createdAtstring
resourceIdentifierstring	Unique Coldwave resource name (CRN) that identifies a resource

Tenant created

A tenant was created, with the rootAccess ceiling every rule inside it is held to and the reference to its password pepper.

EVENTIAM_TENANT_CREATE

Payload

Name	Description
enforce2FAbooleanoptional	Whether all users in this tenant are required to enrol in two-factor authentication Default: true
rootAccessarray	Access policies that apply at the root scope of this tenant
identifier	The resource this policy applies to
Alternative 1	Resource identifier pattern (CRN), may include wildcards
Alternative 2	Resource identifier pattern (CRN), may include wildcards
Alternative 3	Resource identifier pattern (CRN), may include wildcards
Alternative 4	Resource identifier pattern (CRN), may include wildcards
Alternative 5	Resource identifier pattern (CRN), may include wildcards
Alternative 6	Resource identifier pattern (CRN), may include wildcards
effectenum	Access policy effect — either allow or deny Possible values: deny, allow
actionsarray	List of actions permitted by this policy
policyobjectoptional	Additional constraints for this access policy
enforce2FAbooleanoptional	Requires the subject to have 2FA active before this access is granted
targetoptional	Where a device claimed under this rule lands: the kind of owner — user, role or group — or a CRN naming one outright. Only meaningful on a .pair rule.
Alternative 1	Where a device claimed under this rule lands: the kind of owner — user, role or group — or a CRN naming one outright. Only meaningful on a .pair rule. Possible values: user, role, group
Alternative 2	Where a device claimed under this rule lands: the kind of owner — user, role or group — or a CRN naming one outright. Only meaningful on a .pair rule.
isOwnerbooleanoptional	Marks an owner-relative rule, written as crn#tenant:<id>.user:* and rebound to the holder's own account when the access list is assembled — how a shared role says "your own account" without naming anyone.
namestring	Short alphanumeric tenant identifier (slug) Pattern: ^\w{4,16}$
allowedOriginsarrayoptional	List of origins permitted to make cross-origin requests to this tenant Default: []
resourceIdentifierstring	Unique Coldwave resource name (CRN) that identifies a resource
passwordSecretoptional	Custom secret used to pepper password hashes for this tenant
createdBystring	Resource identifier of the entity that created this resource

Tenant deleted

A tenant entry was removed and the origins it had registered for browser requests were released.

EVENTIAM_TENANT_DELETE

Payload

Name	Description

Tenant replaced

A tenant was overwritten as a whole; fields left out fell back to their defaults, apart from passwordSecret and createdBy, which were carried over.

EVENTIAM_TENANT_REPLACE

Payload

Name	Description
enforce2FAbooleanoptional	Whether all users in this tenant are required to enrol in two-factor authentication Default: true
rootAccessarray	Access policies that apply at the root scope of this tenant
identifier	The resource this policy applies to
Alternative 1	Resource identifier pattern (CRN), may include wildcards
Alternative 2	Resource identifier pattern (CRN), may include wildcards
Alternative 3	Resource identifier pattern (CRN), may include wildcards
Alternative 4	Resource identifier pattern (CRN), may include wildcards
Alternative 5	Resource identifier pattern (CRN), may include wildcards
Alternative 6	Resource identifier pattern (CRN), may include wildcards
effectenum	Access policy effect — either allow or deny Possible values: deny, allow
actionsarray	List of actions permitted by this policy
policyobjectoptional	Additional constraints for this access policy
enforce2FAbooleanoptional	Requires the subject to have 2FA active before this access is granted
targetoptional	Where a device claimed under this rule lands: the kind of owner — user, role or group — or a CRN naming one outright. Only meaningful on a .pair rule.
Alternative 1	Where a device claimed under this rule lands: the kind of owner — user, role or group — or a CRN naming one outright. Only meaningful on a .pair rule. Possible values: user, role, group
Alternative 2	Where a device claimed under this rule lands: the kind of owner — user, role or group — or a CRN naming one outright. Only meaningful on a .pair rule.
isOwnerbooleanoptional	Marks an owner-relative rule, written as crn#tenant:<id>.user:* and rebound to the holder's own account when the access list is assembled — how a shared role says "your own account" without naming anyone.
namestring	Short alphanumeric tenant identifier (slug) Pattern: ^\w{4,16}$
allowedOriginsarrayoptional	List of origins permitted to make cross-origin requests to this tenant Default: []
resourceIdentifierstring	Unique Coldwave resource name (CRN) that identifies a resource
passwordSecretoptional	Custom secret used to pepper password hashes for this tenant
createdBystring	Resource identifier of the entity that created this resource

Tenant updated

Fields of a tenant were written; a changed allowedOrigins re-registered which origins may reach the tenant from a browser.

EVENTIAM_TENANT_UPDATE

Payload

Name	Description
namestringoptional	New short identifier for the tenant Pattern: ^\w{4,16}$
passwordSecretoptional	Custom secret used to pepper password hashes for this tenant
rootAccessarrayoptional	Access policies that apply at the root scope of this tenant
identifier	The resource this policy applies to
Alternative 1	Resource identifier pattern (CRN), may include wildcards
Alternative 2	Resource identifier pattern (CRN), may include wildcards
Alternative 3	Resource identifier pattern (CRN), may include wildcards
Alternative 4	Resource identifier pattern (CRN), may include wildcards
Alternative 5	Resource identifier pattern (CRN), may include wildcards
Alternative 6	Resource identifier pattern (CRN), may include wildcards
effectenum	Access policy effect — either allow or deny Possible values: deny, allow
actionsarray	List of actions permitted by this policy
policyobjectoptional	Additional constraints for this access policy
enforce2FAbooleanoptional	Requires the subject to have 2FA active before this access is granted
targetoptional	Where a device claimed under this rule lands: the kind of owner — user, role or group — or a CRN naming one outright. Only meaningful on a .pair rule.
Alternative 1	Where a device claimed under this rule lands: the kind of owner — user, role or group — or a CRN naming one outright. Only meaningful on a .pair rule. Possible values: user, role, group
Alternative 2	Where a device claimed under this rule lands: the kind of owner — user, role or group — or a CRN naming one outright. Only meaningful on a .pair rule.
isOwnerbooleanoptional	Marks an owner-relative rule, written as crn#tenant:<id>.user:* and rebound to the holder's own account when the access list is assembled — how a shared role says "your own account" without naming anyone.
enforce2FAbooleanoptional	Whether all users in this tenant are required to enrol in two-factor authentication
allowedOriginsarrayoptional	List of origins permitted to make cross-origin requests to this tenant

Email address changed

An account was pointed at a new address, which starts out unverified.

EVENTIAM_USER_CHANGE_EMAIL

Payload

Name	Description
emailstring	The account's email address; within one tenant at most one account may hold it.

Claim code removed

A tenant claim code was removed and no longer admits a registration.

EVENTIAM_USER_CONSUME_CLAIM_CODE

Payload

Name	Description

Verification code spent

A verification code was used up and cannot be presented a second time.

EVENTIAM_USER_CONSUME_EMAIL_VERIFICATION

Payload

Name	Description

Invite redeemed

An invitation was redeemed: the account it named now exists and the code stopped working.

EVENTIAM_USER_CONSUME_INVITE

Payload

Name	Description

Reset token spent

A password-reset token was used up and cannot be presented a second time.

EVENTIAM_USER_CONSUME_PASSWORD_RESET

Payload

Name	Description

User created

An account was created by redeeming an invite or a claim code. invitedBy names what admitted it, where anything did — a broadcast tenant claim code leaves it unset.

EVENTIAM_USER_CREATE

Payload

Name	Description
enforce2FAbooleanoptional	Whether two-factor authentication is required Default: false
emailstring	The account's email address; within one tenant at most one account may hold it.
emailVerifiedbooleanoptional	Whether this email address has been verified Default: false
accessarray	A resource access policy entry
identifier	The resource this policy applies to
Alternative 1	Resource identifier pattern (CRN), may include wildcards
Alternative 2	Resource identifier pattern (CRN), may include wildcards
Alternative 3	Resource identifier pattern (CRN), may include wildcards
Alternative 4	Resource identifier pattern (CRN), may include wildcards
Alternative 5	Resource identifier pattern (CRN), may include wildcards
Alternative 6	Resource identifier pattern (CRN), may include wildcards
effectenum	Access policy effect — either allow or deny Possible values: deny, allow
actionsarray	List of actions permitted by this policy
policyobjectoptional	Additional constraints for this access policy
enforce2FAbooleanoptional	Requires the subject to have 2FA active before this access is granted
targetoptional	Narrows a pair grant to where a claimed device may land: a kind — user, role or group — or one owner's CRN outright.
Alternative 1	Narrows a pair grant to where a claimed device may land: a kind — user, role or group — or one owner's CRN outright. Possible values: user, role, group
Alternative 2	Narrows a pair grant to where a claimed device may land: a kind — user, role or group — or one owner's CRN outright.
isOwnerbooleanoptional	Marks an owner-relative rule on a shared role: the crn#tenant:*.user:* head is rebound to the holder's own CRN before the rule is evaluated, so every member reaches only their own resources.
resourceIdentifierstring	Unique Coldwave resource name (CRN) that identifies a resource
saltstringoptional	Random value used to salt the password hash
hashstringoptional	Bcrypt password hash
pepperVersionstringoptional	Which pepper the stored password hash was derived with; absent means the hash is unpeppered. Stripped from every response — it appears here only because the stored entity carries it.
twoFactorAutharrayoptional	Two-factor authentication data for this user Default: []
createdBystring	Unique Coldwave resource name (CRN) that identifies a resource
invitedBystringoptional	What admitted the account — the user who sent the invitation, or the device whose claim code was redeemed. Absent when the invitation was addressed to nobody, as with a broadcast tenant claim code or an account created outright.

Claim code minted

A tenant claim code was minted; only its hash is stored, and it may carry a role every signup with it joins.

EVENTIAM_USER_CREATE_CLAIM_CODE

Payload

Name	Description
resourceIdentifierstring	Unique Coldwave resource name (CRN) that identifies a resource
tenantRistring	Unique Coldwave resource name (CRN) that identifies a resource
roleRistringoptional	CRN of the role a redeemed claim code joins. Absent on a code that grants no role.
expiresAtnumber	When the code, token or invitation stops being redeemable, UTC epoch milliseconds. Past it the entry counts as absent rather than as expired: the pending list withholds it, and revoking or resending it answers 404.
createdBystring	Unique Coldwave resource name (CRN) that identifies a resource

Verification code issued

A verification code was issued for an address. The plaintext goes into the mail and nowhere else — only its hash is stored.

EVENTIAM_USER_CREATE_EMAIL_VERIFICATION

Payload

Name	Description
resourceIdentifierstring	Unique Coldwave resource name (CRN) that identifies a resource
userRistring	Unique Coldwave resource name (CRN) that identifies a resource
emailstring
expiresAtnumber	When the code, token or invitation stops being redeemable, UTC epoch milliseconds. Past it the entry counts as absent rather than as expired: the pending list withholds it, and revoking or resending it answers 404.
localestringoptional
codestring	A verification code entry

Reset token issued

A password-reset token was issued. The plaintext travels in the mailed link and nowhere else — only its hash is stored.

EVENTIAM_USER_CREATE_PASSWORD_RESET

Payload

Name	Description
resourceIdentifierstring	Unique Coldwave resource name (CRN) that identifies a resource
userRistring	Unique Coldwave resource name (CRN) that identifies a resource
emailstring
expiresAtnumber	When the code, token or invitation stops being redeemable, UTC epoch milliseconds. Past it the entry counts as absent rather than as expired: the pending list withholds it, and revoking or resending it answers 404.
localestringoptional
resetLinkstring	The password-reset link, token included. It goes to the mail template only — neither cache nor database keeps it, so it cannot be read back.
tenantNamestring	The tenant's name, for the tenant_name parameter of the invitation and reset mails; it falls back to the tenant id when the tenant record cannot be read.

Invite created

An invitation was minted, carrying the access, roles and groups the account receives when the code is redeemed.

EVENTIAM_USER_CREATE_PENDING

Payload

Name	Description
resourceIdentifierstring	Unique Coldwave resource name (CRN) that identifies a resource
tenantRistring	Unique Coldwave resource name (CRN) that identifies a resource
futureUserRistring	Unique Coldwave resource name (CRN) that identifies a resource
emailstring
accessarrayoptional	A resource access policy entry Default: []
identifier	The resource this policy applies to
Alternative 1	Resource identifier pattern (CRN), may include wildcards
Alternative 2	Resource identifier pattern (CRN), may include wildcards
Alternative 3	Resource identifier pattern (CRN), may include wildcards
Alternative 4	Resource identifier pattern (CRN), may include wildcards
Alternative 5	Resource identifier pattern (CRN), may include wildcards
Alternative 6	Resource identifier pattern (CRN), may include wildcards
effectenum	Access policy effect — either allow or deny Possible values: deny, allow
actionsarray	List of actions permitted by this policy
policyobjectoptional	Additional constraints for this access policy
enforce2FAbooleanoptional	Requires the subject to have 2FA active before this access is granted
targetoptional	Narrows a pair grant to where a claimed device may land: a kind — user, role or group — or one owner's CRN outright.
Alternative 1	Narrows a pair grant to where a claimed device may land: a kind — user, role or group — or one owner's CRN outright. Possible values: user, role, group
Alternative 2	Narrows a pair grant to where a claimed device may land: a kind — user, role or group — or one owner's CRN outright.
isOwnerbooleanoptional	Marks an owner-relative rule on a shared role: the crn#tenant:*.user:* head is rebound to the holder's own CRN before the rule is evaluated, so every member reaches only their own resources.
roleRisarraystringoptional	CRNs of the roles the account joins when the invitation is redeemed. Default: []
usergroupRisarraystringoptional	CRNs of the user groups the account joins when the invitation is redeemed. A group is a bundle of roles and is granted whole — which is what lets an admin hand out a bundle they could not have assembled role by role. Default: []
emailVerifiedbooleanoptional	Whether this email address has been verified Default: false
expiresAtnumber	When the code, token or invitation stops being redeemable, UTC epoch milliseconds. Past it the entry counts as absent rather than as expired: the pending list withholds it, and revoking or resending it answers 404.
createdBystring	Unique Coldwave resource name (CRN) that identifies a resource

User deleted

An account was removed, its email address released for a new signup and its role pairings dropped.

EVENTIAM_USER_DELETE

Payload

Name	Description

TOTP factor stored

A TOTP secret was stored as the account's second factor, with its set of backup codes. The same event carries the shortened set after a backup code has been spent.

EVENTIAM_USER_ENROLL_TOTP

Payload

Name	Description
type	Discriminator of the variant that follows — which answer a device gave, which second factor was enrolled, how a stored series is to be read. Read it before the fields beside it.
secretstring	The TOTP secret, encrypted with the tenant's pepper. Stripped from every response — enrolment hands out an otpauth:// URI instead, and the secret itself is never served.
backupCodesarraystring	The one-time backup codes, stored as hashes. Stripped from every response — the plaintext codes are returned once, when enrolment is confirmed, and cannot be listed again.
enrolledAtnumber	When the second factor was enrolled, UTC epoch seconds — seconds here, unlike the milliseconds every other timestamp in the API uses.

WebAuthn credential enrolled

A WebAuthn credential was registered on an account, which may hold several of them.

EVENTIAM_USER_ENROLL_WEBAUTHN_CREDENTIAL

Payload

Name	Description
credentialIdstring	Id of the WebAuthn credential: base64url of the authenticator's raw credential id. It is what a removal names and what an assertion is matched against.
publicKeystring	The public key a signature is checked against: a device's Ed25519 key as 32 bytes of hex, or a WebAuthn authenticator's key as base64url.
signCountnumber	The authenticator's signature counter as of its last assertion. A later assertion has to report a higher one or the credential counts as cloned; authenticators that always report 0 are exempt.
transportsarraystringoptional	How the authenticator can be reached, as the browser reported it at registration — values such as usb, nfc, ble or internal. It is handed back to the browser so it can prompt for the right one.
createdAtnumber

TOTP factor removed

An account's TOTP secret and its backup codes were dropped.

EVENTIAM_USER_REMOVE_TOTP

Payload

Name	Description

WebAuthn credential removed

One WebAuthn credential was removed; the factor itself goes with its last credential.

EVENTIAM_USER_REMOVE_WEBAUTHN_CREDENTIAL

Payload

Name	Description
credentialIdstring	Id of the WebAuthn credential: base64url of the authenticator's raw credential id. It is what a removal names and what an assertion is matched against.

Invite revoked

An outstanding invitation was withdrawn without an account being created — kept apart from redemption, which ends in the same deletion.

EVENTIAM_USER_REVOKE_INVITE

Payload

Name	Description

Invitation mailed

An invitation mail was triggered; it carries the plaintext code and the signup link, and stays inside the instance that raised it.

EVENTIAM_USER_SEND_INVITE

Payload

Name	Description
emailstring
codestring	A verification code entry
inviteLinkstring	The invitation link, code included. It goes to the mail template only and is kept nowhere, so a lost invitation is replaced by minting a new code rather than resending this one.
tenantNamestring	The tenant's name, for the tenant_name parameter of the invitation and reset mails; it falls back to the tenant id when the tenant record cannot be read.
localestring

Password hash written

An account's password hash was replaced — by a change, by a reset, or by a rehash under a rotated pepper. The hash, salt and pepper version are kept off the event bus.

EVENTIAM_USER_SET_PASSWORD

Payload

Name	Description
saltstringoptional	Random value used to salt the password hash
hashstringoptional	Bcrypt password hash
pepperVersionstringoptional	Which pepper the stored password hash was derived with; absent means the hash is unpeppered. Stripped from every response — it appears here only because the stored entity carries it.
resourceIdentifierstring	Unique Coldwave resource name (CRN) that identifies a resource

Password change notified

A password change worth telling the account holder about was made. A rehash under a rotated pepper deliberately does not raise this — the password itself did not change.

EVENTIAM_USER_SET_PASSWORD_INDICATION

Payload

Name	Description
emailstring
localestring

User updated

An account's own access rules or its enforce2FA flag were written.

EVENTIAM_USER_UPDATE

Payload

Name	Description
accessarrayoptional	A resource access policy entry
identifier	The resource this policy applies to
Alternative 1	Resource identifier pattern (CRN), may include wildcards
Alternative 2	Resource identifier pattern (CRN), may include wildcards
Alternative 3	Resource identifier pattern (CRN), may include wildcards
Alternative 4	Resource identifier pattern (CRN), may include wildcards
Alternative 5	Resource identifier pattern (CRN), may include wildcards
Alternative 6	Resource identifier pattern (CRN), may include wildcards
effectenum	Access policy effect — either allow or deny Possible values: deny, allow
actionsarray	List of actions permitted by this policy
policyobjectoptional	Additional constraints for this access policy
enforce2FAbooleanoptional	Requires the subject to have 2FA active before this access is granted
targetoptional	Narrows a pair grant to where a claimed device may land: a kind — user, role or group — or one owner's CRN outright.
Alternative 1	Narrows a pair grant to where a claimed device may land: a kind — user, role or group — or one owner's CRN outright. Possible values: user, role, group
Alternative 2	Narrows a pair grant to where a claimed device may land: a kind — user, role or group — or one owner's CRN outright.
isOwnerbooleanoptional	Marks an owner-relative rule on a shared role: the crn#tenant:*.user:* head is rebound to the holder's own CRN before the rule is evaluated, so every member reaches only their own resources.
enforce2FAbooleanoptional	Whether two-factor authentication is required

Signature counter advanced

A WebAuthn credential's signature counter was updated after a successful assertion.

EVENTIAM_USER_UPDATE_WEBAUTHN_SIGN_COUNT

Payload

Name	Description
credentialIdstring	Id of the WebAuthn credential: base64url of the authenticator's raw credential id. It is what a removal names and what an assertion is matched against.
signCountnumber	The authenticator's signature counter as of its last assertion. A later assertion has to report a higher one or the credential counts as cloned; authenticators that always report 0 are exempt.

Email address verified

An account's address was confirmed by the code from the verification mail.

EVENTIAM_USER_VERIFY_EMAIL

Payload

Name	Description

User group created

A user group was created; it starts out with neither roles nor members.

EVENTIAM_USERGROUP_CREATE

Payload

Name	Description
namestring	1 to 64 characters; two groups in a tenant may carry the same name, nothing enforces uniqueness. min length 1 · max length 64
descriptionstringoptional	What the group is for; absent when none was given.
resourceIdentifierstring	Unique Coldwave resource name (CRN) that identifies a resource
createdBystring	Resource identifier of the entity that created this resource

User group deleted

A group was removed after its roles and its members were unlinked, so everyone in it lost what it granted.

EVENTIAM_USERGROUP_DELETE

Payload

Name	Description

Roles added to a group

One or more roles were put into a group and reached everyone already in it.

EVENTIAM_USERGROUP_PAIR_ROLE

Payload

Name	Description
role	The roles being added to or removed from the user group, as one CRN or an array of them.
Alternative 1string	Unique Coldwave resource name (CRN) that identifies a resource
Alternative 2array	The roles being added to or removed from the user group, as one CRN or an array of them.

Members added to a group

One or more accounts joined a group and hold every role it carries.

EVENTIAM_USERGROUP_PAIR_USER

Payload

Name	Description
user	The users being added to or removed from the role or user group, as one CRN or an array of them.
Alternative 1string	Unique Coldwave resource name (CRN) that identifies a resource
Alternative 2array	The users being added to or removed from the role or user group, as one CRN or an array of them.

Roles removed from a group

One or more roles were taken out of a group; its members lost them unless they hold them by another path.

EVENTIAM_USERGROUP_UNPAIR_ROLE

Payload

Name	Description
role	The roles being added to or removed from the user group, as one CRN or an array of them.
Alternative 1string	Unique Coldwave resource name (CRN) that identifies a resource
Alternative 2array	The roles being added to or removed from the user group, as one CRN or an array of them.

Members removed from a group

One or more accounts left a group and lost the roles it carried.

EVENTIAM_USERGROUP_UNPAIR_USER

Payload

Name	Description
user	The users being added to or removed from the role or user group, as one CRN or an array of them.
Alternative 1string	Unique Coldwave resource name (CRN) that identifies a resource
Alternative 2array	The users being added to or removed from the role or user group, as one CRN or an array of them.

User group updated

A group's name or description was written; its roles and members were untouched.

EVENTIAM_USERGROUP_UPDATE

Payload

Name	Description
namestringoptional	1 to 64 characters; left out, the stored name stays. min length 1 · max length 64
descriptionstringoptional	Replaces the stored text; left out it stays as it is, and an empty string is the only way to blank it.