Event Reference

This page documents every Level 1 event that appears in the VaultAudit timeline, the severity it carries, and the Level 2 sub-events that expand beneath it.

Render Events

Events emitted by VaultPDF during document generation.

generated — Initial PDF render completed. Extended details include engine version, template path, payload path, output file size, and render duration in milliseconds.

failed — PDF generation or upload failed. Extended details include the error message and the failing pipeline stage.

VaultAudit Events

Events emitted directly by VaultAudit — integrity checks, archival, verification operations, and access control.

integrity-validated — SHA-256 hash computed and stored at generation time. This event is the baseline for all future verification. Always emitted immediately after generated.

accessibility-checked — Section 508 accessibility trace generated and stored. Only emitted when the section508 feature flag is enabled on the template.

archived — Document marked as archived. Appends an immutable audit entry; the document enters a read-only compliance state.

verified — On-demand SHA-256 re-verification triggered from the VaultLifecycle workspace. Extended details include the verification result (trusted, verified, or tampered) and the comparing hash values.

reproduced — Document re-rendered from the .vpdf archive and output hash compared to the original. Extended details include the reproduction result (matched or mismatch) and any hash delta.

evidence-exported — Full audit JSONL event stream exported as a downloadable evidence bundle. Extended details include the export format and operator identity.

revoked — A VaultESign signing session or VaultDelivery delivery session was revoked. Extended details include the session ID and revoking operator.

Workflow Events

Events emitted by VaultWorkflow and classified by VaultAudit in the timeline.

workflow-initiated — VaultWorkflow session created and participant forms distributed. Extended details include the workflow title and initiator identity.

workflow-approval-requested — Completed submission forwarded to the approver queue. Extended details include the approver role.

workflow-changes-requested — Approver returned the submission with correction instructions.

workflow-resubmitted — Participant addressed change requests and resubmitted.

workflow-approved — Approver accepted the submission.

workflow-rejected — Approver rejected the submission. Shown as a failure-severity event in all timeline views.

workflow-cancelled — Workflow cancelled by the initiator or an administrator.

workflow-sealed — Final PDF sealed and stored after workflow completion. This is the compliance milestone for governed documents and is the only workflow event shown in the Compliance and Executive views.

Signing Events

Events emitted by VaultESign and classified by VaultAudit in the timeline.

sent-for-signature — VaultESign session created. Extended details include signing mode (single, sequential, or parallel) and slot count.

otp-verified — A signer completed the OTP challenge. Extended details include slot index, role, and hashed IP address. Emitted once per signer who passes OTP; shown in the Security and Full views.

document-signed — A signer completed their signature slot. Extended details include slot index, role, and completion timestamp. This is the compliance milestone for signed documents.

eSign Level 2 Trail

The document-signed event carries a complete sub-event trail capturing every step of the signing session for that slot:

Delivery Events

Events emitted by VaultDelivery and classified by VaultAudit in the timeline.

delivery-created — VaultDelivery session created. Extended details include recipient count and delivery mode (secure-email, sharepoint, or both).

Delivery Level 2 Trail

The delivery-created event carries a complete sub-event trail capturing recipient interaction with the delivery session:

Redact Events

Events emitted by VaultRedact and classified by VaultAudit in the timeline.

document-protected — Sensitive content redacted or access controls applied by VaultRedact. Extended details include the protection type and the operator identity.

Event Schema

Every Level 1 audit event in the JSONL log has the following structure:

{
  "correlationId": "d8cb1510-8290-40f8-8592-702eaa9838a6",
  "eventType": "document-signed",
  "severity": "compliance",
  "title": "Document Signed",
  "product": "VaultESign",
  "timestamp": "2026-06-12T09:14:22.451Z",
  "actorName": "Jane Smith",
  "actorEmail": "[email protected]",
  "extendedDetails": {
    "slotIndex": 0,
    "role": "vendor",
    "mode": "sequential"
  },
  "subEvents": [
    {
      "timestamp": "2026-06-12T09:05:10.000Z",
      "title": "Session Created",
      "detail": "VaultESign session initialised"
    },
    {
      "timestamp": "2026-06-12T09:05:12.000Z",
      "title": "Invitation Sent",
      "detail": "Signing invitation dispatched to slot 0"
    }
  ]
}