Security event types
Reference for POST /api/ingest/security-events, schema version 1.0. An event with an unknown type is rejected individually, not the whole batch.
Event types
| Type | Meaning |
|---|---|
gateway.request | A request through the AI Gateway |
policy.evaluation | A policy was evaluated |
policy.denied | A policy blocked an action |
tool.invocation | An agent called a tool |
tool.unauthorized | An agent called a tool it may not |
mcp.connection | A connection to an MCP server |
llm.call | A call to a model |
egress.connection | An outbound network connection |
agent.activity | Activity by a known agent |
agent.unregistered_activity | Activity by an agent with no registration |
identity.owner_mismatch | The observed identity does not match the agent's owner |
auth.cross_tenant_attempt | An attempt to cross a tenant boundary |
guardrail.hit | A guardrail matched |
session.started, session.ended | A session boundary |
system.heartbeat | A source is alive |
data.exposure | Sensitive data was seen in a request |
prompt.signal | A prompt matched a risk signal |
Severity
info, low, medium, high, critical. Findings, incidents and shadow candidates use the four levels from low up.
Source kinds
A token is bound to one source kind when you create it: mcp_gateway, api_gateway, otel, imported, infrastructure, sensor or test_fixture. The kinds gateway and lineage are used by Bairav's own built-in sync and cannot be chosen for a token.
Event fields
| Field | Required | Notes |
|---|---|---|
event_uid | Yes | Your unique ID, at most 200 characters. Idempotent per source. |
occurred_at | Yes | ISO-8601 time |
event_type | Yes | One of the types above |
severity | One of the levels above | |
observed_identity | Who or what produced it, at most 300 characters, for example host:BTG-LAP-04/proc:python | |
agent_version | At most 100 characters | |
trace_id, span_id, correlation_id | At most 128, 64 and 128 characters | |
decision | The outcome, if any | |
summary | A short human-readable line | |
fields | An object of normalised fields, each masked, at most 8 KB per event |
Normalised fields
All optional: host, port, endpoint, provider, model, tool, mcp_server, sdk, framework, user_agent, status, latency_ms, tokens_in, tokens_out, policy_id, rule, device, process, user, protocol, bytes_out, session_id, and attributes (an object of at most 20 keys).
Prompts, responses, chain-of-thought and tool arguments are never stored unless the tenant's data policy allows redacted content.
Who sees what
Without the view_sensitive_telemetry permission a reader sees only a safe subset of fields (provider, model, status, latency_ms, tokens_in, tokens_out) and identities appear as [restricted].