{"token_count": 2844}

# Applications Audit Events

This page lists audit events related to Teleport-protected applications.

## app.create

Application Created

Example:

```
{
  "code": "TAP03I",
  "ei": 0,
  "event": "app.create",
  "time": "2022-09-27T19:07:35.00Z",
  "uid": "45cabf1e-3f19-4f83-a360-01ac0a176b67",
  "aws_role_arn": "arn:aws:iam::1234567890:role/steve",
  "name": "dynamic-app",
  "user": "mike"
}

```

## app.delete

Application Deleted

Example:

```
{
  "code": "TAP05I",
  "ei": 0,
  "event": "app.delete",
  "time": "2022-09-27T19:11:35.00Z",
  "uid": "d2342a20-9697-4a5d-9658-5d473e04624a",
  "aws_role_arn": "arn:aws:iam::1234567890:role/steve",
  "name": "dynamic-app",
  "user": "mike"
}

```

## app.session.chunk

App Session Data

Example:

```
{
  "code": "T2008I",
  "ei": 0,
  "event": "app.session.chunk",
  "namespace": "default",
  "server_id": "a0518380-0d53-4188-ac8b-8ddd8103e45b",
  "session_chunk_id": "3a54f32d-210f-4338-abf5-133bfe19ccc0",
  "sid": "6593cf87-9839-4f18-abf8-c54873aaeb4e",
  "time": "2020-10-30T17:28:14.705Z",
  "uid": "8ea5be3d-07b1-4308-8e0d-2d2ec57cbb20",
  "user": "alice",
  "app_name": "test"
}

```

## app.session.dynamodb.request

App Session DynamoDB Request

Example:

```
{
  "code": "T2013I",
  "ei": 1,
  "event": "app.session.dynamodb.request",
  "app_name": "dyno1",
  "app_public_addr": "dynamodb.root.com",
  "app_uri": "https://console.aws.amazon.com/dynamodbv2/home",
  "aws_host": "dynamodb.us-west-2.amazonaws.com",
  "aws_region": "us-west-2",
  "aws_role_arn": "arn:aws:iam::123456789012:role/GavinDynamoDBRole",
  "aws_service": "dynamodb",
  "body": {
    "TableName": "test-table"
  },
  "cluster_name": "root.com",
  "method": "POST",
  "path": "/",
  "raw_query": "",
  "session_chunk_id": "3a54f32d-210f-4338-abf5-133bfe19ccc0",
  "status_code": 200,
  "target": "DynamoDB_20120810.Scan",
  "time": "2022-10-19T19:04:07.763Z",
  "uid": "f6f38f69-46e9-4110-a773-2c88278d08ca",
  "user": "alice"
}

```

## app.session.end

App Session Ended

Example:

```
{
  "app_name": "ponger",
  "app_public_addr": "ponger.root.gravitational.io",
  "app_uri": "tcp://localhost:9876",
  "cluster_name": "root",
  "code": "T2011I",
  "ei": 0,
  "event": "app.session.end",
  "namespace": "default",
  "server_id": "8e70002c-7a07-4513-a3fa-ac556a1d7534",
  "sid": "11c328b4-5a1e-4adc-b7cb-206389e5f130",
  "time": "2022-08-10T19:54:40.444Z",
  "uid": "ac8c9b6b-46a0-4b0e-8d85-2204101d5615",
  "user": "alice"
}

```

## app.session.request.denied

App Request Denied

Example:

```
{
  "addr.remote": "127.0.0.1:41106",
  "app_name": "dev-app",
  "app_public_addr": "dev-app.root.gravitational.io",
  "app_session_id": "6593cf87-9839-4f18-abf8-c54873aaeb4e",
  "app_uri": "http://localhost:8080",
  "cluster_name": "root",
  "code": "T2020E",
  "deny_kind": "teleport_request_not_allowed",
  "ei": 0,
  "event": "app.session.request.denied",
  "method": "GET",
  "namespace": "default",
  "path": "/api/things",
  "server_id": "8e70002c-7a07-4513-a3fa-ac556a1d7534",
  "server_version": "19.0.0",
  "time": "2022-08-10T19:54:41.444Z",
  "uid": "e0b0e0f4-6b1a-4b6e-9f3f-2a4f9a1d6c11",
  "user": "alice"
}

```

## app.session.start

There are multiple events with the `app.session.start` type.

### T2007I

App Session Started

Example:

```
{
  "addr.remote": "50.34.48.113:56902",
  "code": "T2007I",
  "ei": 0,
  "event": "app.session.start",
  "namespace": "default",
  "public_addr": "dumper.test.domain.com",
  "server_id": "a0518380-0d53-4188-ac8b-8ddd8103e45b",
  "sid": "6593cf87-9839-4f18-abf8-c54873aaeb4e",
  "time": "2020-10-30T17:28:14.381Z",
  "uid": "80400ed9-644e-4a6e-ab99-b264b34d0f55",
  "user": "kimlisa",
  "app_name": "test"
}

```

### T2007E

App Session Start Failed

Example:

```
{
  "code": "T2007E",
  "event": "app.session.start",
  "time": "2020-06-05T16:24:05Z",
  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
}

```

## app.session.target.dial.denied

App Target Dial Denied

Example:

```
{
  "app_name": "internal-app",
  "app_public_addr": "internal-app.root.gravitational.io",
  "app_uri": "http://metadata.internal",
  "blocked_ip": "169.254.169.254",
  "blocked_prefix": "169.254.0.0/16",
  "cluster_name": "root",
  "code": "T2019E",
  "ei": 0,
  "event": "app.session.target.dial.denied",
  "namespace": "default",
  "policy": "denied_hosts",
  "resolved_ips": [
    "169.254.169.254"
  ],
  "server_id": "8e70002c-7a07-4513-a3fa-ac556a1d7534",
  "sid": "11c328b4-5a1e-4adc-b7cb-206389e5f130",
  "target_host": "metadata.internal",
  "target_port": "80",
  "time": "2022-08-10T19:54:41.444Z",
  "uid": "bc1fbf7e-b739-4ea3-8bb9-cf1e79c8acb5",
  "user": "alice"
}

```

## app.update

Application Updated

Example:

```
{
  "code": "TAP04I",
  "ei": 0,
  "event": "app.update",
  "time": "2022-09-27T19:09:35.00Z",
  "uid": "9909a8d6-b45f-455c-953d-ba1a62340810",
  "aws_role_arn": "arn:aws:iam::1234567890:role/steve",
  "name": "dynamic-app",
  "user": "mike"
}

```

## git.command

There are multiple events with the `git.command` type.

### TGIT001E

Git Command Failed

Example:

```
{
  "code": "TGIT001E",
  "event": "git.command",
  "time": "2024-12-07T11:11:11.111Z",
  "uid": "7699b806-e717-4821-85a5-d2f41acbe373",
  "user": "Linus.Torvalds",
  "service": "git-upload-pack",
  "exitError": "some-error",
  "path": "my-org/my-repo"
}

```

### TGIT001I

Git Command

Example:

```
{
  "code": "TGIT001I",
  "event": "git.command",
  "time": "2024-12-07T11:11:11.112Z",
  "uid": "7699b806-e717-4821-85a5-d2f41acbe373",
  "user": "Linus.Torvalds",
  "service": "git-upload-pack",
  "path": "my-org/my-repo"
}

```

## http.request

App HTTP Request

Example:

```
{
  "code": "T2015I",
  "event": "http.request",
  "time": "2020-06-05T16:24:05Z",
  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
}

```

## http.request.body\_chunk

App HTTP Request Body

Example:

```
{
  "code": "T2016I",
  "event": "http.request.body_chunk",
  "time": "2020-06-05T16:24:05Z",
  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
}

```

## http.response

App HTTP Response

Example:

```
{
  "code": "T2017I",
  "event": "http.response",
  "time": "2020-06-05T16:24:05Z",
  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
}

```

## http.response.body\_chunk

App HTTP Response Body

Example:

```
{
  "code": "T2018I",
  "event": "http.response.body_chunk",
  "time": "2020-06-05T16:24:05Z",
  "uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
}

```

## vnet.config.create

VNet config created

Example:

```
{
  "addr.remote": "127.0.0.1:62460",
  "cluster_name": "teleport.dev",
  "code": "TVNET001I",
  "ei": 0,
  "event": "vnet.config.create",
  "success": true,
  "time": "2025-03-04T15:49:21.869Z",
  "uid": "e1973df2-4bee-4a67-9925-575c1d38cc80",
  "user": "08fcd522-edcb-492d-8752-90494a28b70e.teleport.dev",
  "user_cluster_name": "teleport.dev",
  "user_kind": 3,
  "user_roles": [
    "Admin"
  ]
}

```

## vnet.config.delete

VNet config deleted

Example:

```
{
  "addr.remote": "127.0.0.1:62460",
  "cluster_name": "teleport.dev",
  "code": "TVNET003I",
  "ei": 0,
  "event": "vnet.config.delete",
  "success": true,
  "time": "2025-03-04T15:49:21.869Z",
  "uid": "e1973df2-4bee-4a67-9925-575c1d38cc80",
  "user": "08fcd522-edcb-492d-8752-90494a28b70e.teleport.dev",
  "user_cluster_name": "teleport.dev",
  "user_kind": 3,
  "user_roles": [
    "Admin"
  ]
}

```

## vnet.config.update

VNet config updated

Example:

```
{
  "addr.remote": "127.0.0.1:62460",
  "cluster_name": "teleport.dev",
  "code": "TVNET002I",
  "ei": 0,
  "event": "vnet.config.update",
  "success": true,
  "time": "2025-03-04T15:49:21.869Z",
  "uid": "e1973df2-4bee-4a67-9925-575c1d38cc80",
  "user": "08fcd522-edcb-492d-8752-90494a28b70e.teleport.dev",
  "user_cluster_name": "teleport.dev",
  "user_kind": 3,
  "user_roles": [
    "Admin"
  ]
}

```