Data event structure

This document describes the key fields of a data event and provides an example.

Key fields

Parameter	Description
acsRegion	The Alibaba Cloud region.
additionalEventData	Additional information about the event.
apiVersion	When eventType is set to ApiCall, the event represents an API call. In this case, this field specifies the API version.
eventCategory	The event category. Valid value: `Data` (data event).
eventId	The event ID.
eventName	The event name. The value of this field depends on `eventType`: If eventType is ApiCall, this field is the API name. If eventType is not ApiCall, this field indicates the meaning of the event.
eventRW	The read/write type of the event. Valid values: `Write`: Represents a write operation. `Read`: Represents a read operation.
eventSource	The source of the event.
eventTime	The UTC time when the event occurred.
eventType	The event type. Valid values: ApiCall: an API call event. ConsoleOperation: Management events on some consoles or purchase pages. AliyunServiceEvent: These are data events performed by the Alibaba Cloud platform on your resources.
eventVersion	The version of the event format. The current version is 1.
errorCode	The error code for a failed API request.
errorMessage	The error message for a failed API request.
requestId	The request ID.
requestParameters	The input parameters of the API request.
responseElements	The data returned in the API response.
referencedResources	A list of resources affected by the event.
serviceName	The name of the Alibaba Cloud service that generated the event.
sourceIpAddress	The source IP address from which the request was made. Possible values: Typically, this is the client's IP address, which can be an IPv4 or IPv6 address. If the request is initiated by an Alibaba Cloud service, this field is set to a service identifier, such as `ecs.aliyuncs.com`. If the source IP address belongs to a VPC CIDR block or an Alibaba Cloud internal CIDR block and the system cannot determine whether it comes from your VPC, the value is recorded as `Internal`.
vpcId	If the source IP address is identified as part of a VPC, this field contains the source VPC ID.
userAgent	The user agent of the requesting client.
userIdentity	Information about the requester. For more information, see Fields in userIdentity.

Table 1. Fields in userIdentity

Parameter	Description
type	Valid values: root-account: An Alibaba Cloud account. ram-user: A RAM user. assumed-role: RAM role. system: Alibaba Cloud services. cloudsso-user: A CloudSSO user. saml-user: Federated identity (SAML-based). alibaba-cloud-account: The authorized identity for cross-account authorization. oidc-user: a federated identity that is based on an OIDC identity.
principalId	The ID of the current requester, which must be used with the type parameter to uniquely identify the requester. If type is root-account, the Alibaba Cloud account ID is recorded. If the value of type is ram-user, the RAM user ID is recorded. If type is set to assumed-role, record `RoleID:RoleSessionName`. If type is cloudsso-user, the CloudSSO user ID is recorded. If type is alibaba-cloud-account If the cross-account caller is an Alibaba Cloud account, this is the account ID. If the cross-account caller is a RAM user, this is the user's ID. When a role is assumed for cross-account operations, `RoleID:RoleSessionName` is logged. If the type parameter is set to saml-user, oidc-user, or system, the principalId parameter is not recorded.
accountId	The ID of the Alibaba Cloud account that owns the requester's identity.
accessKeyId	The AccessKey ID of the requester's identity. Populated for requests made with an SDK. Omitted for console logons. For requests made with a temporary security token, this field contains the temporary AccessKey ID.
userName	The name of the requester. This field is optional and may be omitted in some events. If type is set to ram-user, the RAM username is recorded. If type is assumed-role, `RoleName:RoleSessionName` is recorded. If type is root-account, userName is root. If type is set to cloudsso-user, it records the username of the CloudSSO user. If type is saml-user, the username of the federated identity (based on SAML identity) is recorded. If type is alibaba-cloud-account or system, userName is not recorded. If type is oidc-user, the username of the OIDC-based federated identity is recorded.
sessionContext	Contains session details for requests made with a temporary security token or for console logons. This object includes the following fields: `creationDate`: The creation time. `mfaAuthenticated`: Indicates whether the user used multi-factor authentication to log in to the console.

Example

{
  "acsRegion": "cn-hangzhou",
  "apiVersion": "2019-05-17",
  "eventCategory": "Data",
  "eventId": "6A2B71A11B343F3735FA****",
  "eventName": "PutObject",
  "eventRW": "Write",
  "eventSource": "actiontrail-auto-test-cn-hangzhou.oss-cn-hangzhou.aliyuncs.com",
  "eventTime": "2026-06-12T02:40:33Z",
  "eventType": "ApiCall",
  "eventVersion": "1",
  "recipientAccountId": "159498693826****",
  "referencedResources": {
    "ACS::OSS::Bucket": [
      "test-bucket"
    ],
    "ACS::OSS::Object": [
      "test-do-not-delete.txt"
    ]
  },
  "requestId": "6A2B71A11B343F3735FA****",
  "serviceName": "Oss",
  "sourceIpAddress": "121.41.*.*",
  "userAgent": "aliyun-sdk-java/3.18.1(Linux/4.19.91-c8dfc93.al7.x86_64/amd64;1.8.0_292)",
  "userIdentity": {
    "accessKeyId": "LTAI5tEoA8B4uha8zPNX****",
    "accountId": "159498693826****",
    "principalId": "25680425206822****",
    "type": "ram-user"
  }
}