Model Reference
Last updated
Use the language selector to view the public names and types exposed by each SDK.
Accounts
Accounts are snapshot-backed records representing users inside a connected product.
Account
| Property | Property | Type | Type | Required | Description |
|---|---|---|---|---|---|
Generic | generic | GenericAccountDetails | GenericAccountDetails | Exactly one | Provider-neutral account details |
GenericAccountDetails
| Property | Property | Type | Type | Required | Description |
|---|---|---|---|---|---|
Id | id | string | str | Yes | Stable source account identifier |
Name | name | string | str | No | Display name |
Email | email | string | str | No | Primary email |
Username | username | string | str | No | Source username |
Active | active | bool | bool | No | Whether the account is active |
Roles | roles | RepeatedField<string> | list[str] | No | Roles assigned in the source |
Details | details | AccountDetails | AccountDetails | No | Vendor metadata |
Type | type | string | str | No | Source-defined account type |
AccountDetails
| Property | Property | Type | Type | Required | Description |
|---|---|---|---|---|---|
Microsoft | microsoft | MicrosoftAccountDetails | MicrosoftAccountDetails | Exactly one | Microsoft-specific metadata when vendor details are present |
MicrosoftAccountDetails.Teams | MicrosoftAccountDetails.teams | TeamsMetadata | TeamsMetadata | No | Microsoft Teams metadata |
TeamsMetadata.HasTeams | TeamsMetadata.has_teams | bool | bool | Yes | Whether the account has Teams |
Plans and Licenses
Plans and licenses are snapshot-backed. A license associates a source account with a source plan.
Plan
| Property | Property | Type | Type | Required | Description |
|---|---|---|---|---|---|
Generic | generic | GenericPlanDetails | GenericPlanDetails | Exactly one | Provider-neutral plan details |
GenericPlanDetails
| Property | Property | Type | Type | Required | Description |
|---|---|---|---|---|---|
Id | id | string | str | Yes | Stable source plan identifier |
ExternalPlanName | external_plan_name | string | str | Yes | Source plan name |
ExternalProductName | external_product_name | string | str | No | Product name when the source contains multiple products |
Attributes | attributes | MapField<string, string> | dict[str, str] | No | Source-specific metadata |
Details | details | PlanDetails | PlanDetails | Yes | Subscription details |
PlanDetails
| Property | Property | Type | Type | Required | Description |
|---|---|---|---|---|---|
Model | model | SubscriptionModel | SubscriptionModel | Yes | Subscription model |
SeatBased | seat_based | SeatBasedSubscriptionModel | SeatBasedSubscriptionModel | Conditional | Required when Model is seat-based |
SeatBased.PaidSeats | seat_based.paid_seats | int | int | No | Purchased seats |
SeatBased.ConsumedSeats | seat_based.consumed_seats | int | int | No | Assigned or consumed seats |
License
| Property | Property | Type | Type | Required | Description |
|---|---|---|---|---|---|
Generic | generic | GenericLicenseDetails | GenericLicenseDetails | Exactly one | Provider-neutral license details |
GenericLicenseDetails
| Property | Property | Type | Type | Required | Description |
|---|---|---|---|---|---|
SourceId | source_id | string | str | Yes | Stable license or assignment identifier |
SourceAccountId | source_account_id | string | str | Yes | Referenced account identifier |
SourcePlanId | source_plan_id | string | str | Yes | Referenced plan identifier |
Billable | billable | bool | bool | Yes | Whether the assignment consumes a paid entitlement |
ExternalProductId | external_product_id | string | str | No | Source product identifier |
SubscriptionModel
| C# | Python | Description |
|---|---|---|
Unspecified | SUBSCRIPTION_MODEL_UNSPECIFIED | No subscription model selected |
SeatBased | SUBSCRIPTION_MODEL_SEAT_BASED | Seat-based subscription |
Usage
Usage records are event-based. Their absence from a later batch does not remove earlier events.
Usage
| Property | Property | Type | Type | Required | Description |
|---|---|---|---|---|---|
Generic | generic | GenericUsageDetails | GenericUsageDetails | Exactly one | Provider-neutral usage details |
GenericUsageDetails
| Property | Property | Type | Type | Required | Description |
|---|---|---|---|---|---|
Id | id | string | str | Yes | Stable usage-event identifier |
SourceActorId | source_actor_id | string | str | Yes | Account or employee responsible for the activity |
ExternalProductName | external_product_name | string | str | No | Product in which activity occurred |
SourcePlanId | source_plan_id | string | str | No | Related plan identifier |
LastActivity | last_activity | Timestamp | datetime | Timestamp | Yes | Most recent activity time |
ExternallyDiscoveredUsage
| Property | Property | Type | Type | Required | Description |
|---|---|---|---|---|---|
Generic | generic | GenericExternallyDiscoveredUsageDetails | GenericExternallyDiscoveredUsageDetails | Exactly one | Provider-neutral discovered-usage details |
GenericExternallyDiscoveredUsageDetails
| Property | Property | Type | Type | Required | Description |
|---|---|---|---|---|---|
SourceActorId | source_actor_id | string | str | Yes | Stable actor identifier |
ActorEmail | actor_email | string | str | No | Actor email when known |
ExternalProductName | external_product_name | string | str | No | Discovered product |
Source | source | string | str | No | Discovery source |
LastActivity | last_activity | Timestamp | datetime | Timestamp | Conditional | Provide this or the complete activity range |
LastActivityFrom | last_activity_from | Timestamp | datetime | Timestamp | Conditional | Range start; requires the range end |
LastActivityTo | last_activity_to | Timestamp | datetime | Timestamp | Conditional | Range end; requires the range start |
Employees
Employees are snapshot-backed. Select the details model that matches the source data.
Employee
| Property | Property | Type | Type | Required | Description |
|---|---|---|---|---|---|
Generic | generic | GenericEmployeeDetails | GenericEmployeeDetails | Exactly one | Provider-neutral or normalized employee |
Microsoft | microsoft | MicrosoftEmployeeDetails | MicrosoftEmployeeDetails | Exactly one | Microsoft Graph user |
Google | google | GoogleEmployeeDetails | GoogleEmployeeDetails | Exactly one | Google Directory user |
Okta | okta | OktaEmployeeDetails | OktaEmployeeDetails | Exactly one | Okta user |
BambooHr | bamboo_hr | BambooHrEmployeeDetails | BambooHrEmployeeDetails | Exactly one | BambooHR employee |
GenericEmployeeDetails
| Property | Property | Type | Type | Required | Description |
|---|---|---|---|---|---|
Id | id | string | str | Yes | Stable source employee identifier |
FullName | full_name | string | str | Yes | Display name |
FirstName | first_name | string | str | No | Given name |
LastName | last_name | string | str | No | Family name |
Email | email | string | str | No | Primary email |
EmailAliases | email_aliases | RepeatedField<string> | list[str] | No | Alternate emails |
Active | active | bool | bool | No | Whether the employee is active |
Deleted | deleted | bool | bool | No | Whether the employee was deleted |
DeletionTime | deletion_time | Timestamp | datetime | Timestamp | No | Source deletion time |
CreationTime | creation_time | Timestamp | datetime | Timestamp | No | Source creation time |
AvatarUrl | avatar_url | string | str | No | Profile image URL |
OrgUnit | org_unit | string | str | No | Organizational unit |
DepartmentPath | department_path | RepeatedField<string> | list[str] | No | Department hierarchy |
JobTitle | job_title | string | str | No | Job title |
Country | country | string | str | No | Country |
Division | division | string | str | No | Division |
CostCenter | cost_center | string | str | No | Cost center |
UserType | user_type | string | str | No | Source-defined employee type |
ManagerId | manager_id | string | str | No | Source manager identifier |
HasMailbox | has_mailbox | bool | bool | No | Whether the employee has a mailbox |
Attributes | attributes | MapField<string, string> | dict[str, str] | No | Source-specific metadata |
MicrosoftEmployeeDetails
| Property | Property | Type | Type | Required | Description |
|---|---|---|---|---|---|
Id | id | string | str | Yes | Microsoft user identifier |
DisplayName | display_name | string | str | Yes | Display name |
UserPrincipalName | user_principal_name | string | str | Yes | User principal name |
GivenName | given_name | string | str | No | Given name |
Surname | surname | string | str | No | Family name |
Mail | mail | string | str | No | Primary email |
Department | department | string | str | No | Department |
AccountEnabled | account_enabled | bool | bool | No | Whether the account is enabled |
CreatedDateTime | created_date_time | Timestamp | datetime | Timestamp | No | Creation time |
DeletedDateTime | deleted_date_time | Timestamp | datetime | Timestamp | No | Deletion time |
JobTitle | job_title | string | str | No | Job title |
UserType | user_type | string | str | No | Microsoft user type |
Country | country | string | str | No | Country |
EmployeeOrgData | employee_org_data | MicrosoftEmployeeOrgData | MicrosoftEmployeeOrgData | No | Division and cost-center data |
ManagerId | manager_id | string | str | No | Microsoft manager identifier |
MicrosoftEmployeeOrgData exposes optional Division / division and CostCenter / cost_center strings.
GoogleEmployeeDetails
| Property | Property | Type | Type | Required | Description |
|---|---|---|---|---|---|
Id | id | string | str | Yes | Google user identifier |
Name | name | GoogleEmployeeName | GoogleEmployeeName | Yes | Full, given, and family names; all three are required |
PrimaryEmail | primary_email | string | str | Yes | Primary email |
Aliases | aliases | RepeatedField<string> | list[str] | No | Alternate emails |
ThumbnailPhotoUrl | thumbnail_photo_url | string | str | No | Profile image URL |
OrgUnitPath | org_unit_path | string | str | No | Organizational-unit path |
CreationTime | creation_time | Timestamp | datetime | Timestamp | No | Creation time |
Suspended | suspended | bool | bool | No | Whether the user is suspended |
Archived | archived | bool | bool | No | Whether the user is archived |
DeletionTime | deletion_time | Timestamp | datetime | Timestamp | No | Deletion time |
IsMailboxSetup | is_mailbox_setup | bool | bool | No | Whether the mailbox is set up |
Organizations | organizations | RepeatedField<GoogleEmployeeOrganization> | list[GoogleEmployeeOrganization] | No | Organization entries |
Addresses | addresses | RepeatedField<GoogleEmployeeAddress> | list[GoogleEmployeeAddress] | No | Address entries |
Relations | relations | RepeatedField<GoogleEmployeeRelation> | list[GoogleEmployeeRelation] | No | Employee relations |
Organization entries expose optional cost center, description, title, primary, and type fields. Address entries expose optional country, primary, and type fields. Relation entries expose optional type and value fields.
OktaEmployeeDetails
| Property | Property | Type | Type | Required | Description |
|---|---|---|---|---|---|
Id | id | string | str | Yes | Okta user identifier |
Status | status | string | str | Yes | Okta lifecycle status |
Created | created | Timestamp | datetime | Timestamp | Yes | Creation time |
Profile | profile | OktaEmployeeProfile | OktaEmployeeProfile | Yes | User profile |
OktaEmployeeProfile requires Email / email, FirstName / first_name, and LastName / last_name. Department, manager ID, manager, country code, division, cost center, user type, and title are optional strings.
BambooHrEmployeeDetails
| Property | Property | Type | Type | Required | Description |
|---|---|---|---|---|---|
Id | id | string | str | Yes | BambooHR employee identifier |
FirstName | first_name | string | str | Yes | Given name |
LastName | last_name | string | str | Yes | Family name |
WorkEmail | work_email | string | str | No | Work email |
Department | department | string | str | No | Department |
JobTitle | job_title | string | str | No | Job title |
Division | division | string | str | No | Division |
Country | country | string | str | No | Country |
Status | status | string | str | No | Employment status |
HireDate | hire_date | Timestamp | datetime | Timestamp | No | Hire date |
EmploymentStatus | employment_status | string | str | No | Source employment status |
SupervisorId | supervisor_id | string | str | No | Supervisor identifier |
SupervisorEmail | supervisor_email | string | str | No | Supervisor email |
PhotoUrl | photo_url | string | str | No | Profile image URL |
MetaUserStatus | meta_user_status | string | str | No | BambooHR meta-user status |
CostCenter | cost_center | string | str | No | Cost center |
EmployeeType | employee_type | string | str | No | Employee type |
Groups and Devices
Groups, memberships, and devices are snapshot-backed records.
Group
| Property | Property | Type | Type | Required | Description |
|---|---|---|---|---|---|
Generic | generic | GenericGroupDetails | GenericGroupDetails | Exactly one | Provider-neutral group details |
GenericGroupDetails
| Property | Property | Type | Type | Required | Description |
|---|---|---|---|---|---|
Id | id | string | str | Yes | Stable source group identifier |
Name | name | string | str | Yes | Group name |
Description | description | string | str | No | Group description |
DeletionTime | deletion_time | Timestamp | datetime | Timestamp | No | Source deletion time |
CreationTime | creation_time | Timestamp | datetime | Timestamp | No | Source creation time |
EmailAliases | email_aliases | RepeatedField<string> | list[str] | No | Group email aliases |
Attributes | attributes | MapField<string, string> | dict[str, str] | No | Source-specific metadata |
GroupMember
| Property | Property | Type | Type | Required | Description |
|---|---|---|---|---|---|
Generic | generic | GenericGroupMemberDetails | GenericGroupMemberDetails | Exactly one | Provider-neutral membership details |
GenericGroupMemberDetails
| Property | Property | Type | Type | Required | Description |
|---|---|---|---|---|---|
GroupId | group_id | string | str | Yes | Referenced group identifier |
MemberId | member_id | string | str | Yes | Referenced user or group identifier |
Type | type | GroupMemberType | GroupMemberType | Yes | Whether the member is a user or group |
DeletionTime | deletion_time | Timestamp | datetime | Timestamp | No | Membership deletion time |
CreationTime | creation_time | Timestamp | datetime | Timestamp | No | Membership creation time |
Role | role | string | str | No | Source membership role |
Attributes | attributes | MapField<string, string> | dict[str, str] | Conditional | Must include a stable sourceId entry |
Device
| Property | Property | Type | Type | Required | Description |
|---|---|---|---|---|---|
Generic | generic | GenericDeviceDetails | GenericDeviceDetails | Exactly one | Provider-neutral device details |
GenericDeviceDetails
| Property | Property | Type | Type | Required | Description |
|---|---|---|---|---|---|
Id | id | string | str | Yes | Stable source device identifier |
Name | name | string | str | Yes | Device name |
SerialNumber | serial_number | string | str | Yes | Device serial number |
Owner | owner | DeviceOwner | DeviceOwner | No | Device owner |
Uuid | uuid | string | str | No | Device UUID |
DeviceOwner
| Property | Property | Type | Type | Required | Description |
|---|---|---|---|---|---|
Id | id | string | str | Yes | Referenced owner identifier |
Email | email | string | str | No | Owner email |
GroupMemberType
| C# | Python | Description |
|---|---|---|
Unspecified | GROUP_MEMBER_TYPE_UNSPECIFIED | No member type selected |
User | GROUP_MEMBER_TYPE_USER | User member |
Group | GROUP_MEMBER_TYPE_GROUP | Nested group member |
Audit Logs
Audit logs are event-based. Select the details model that matches the source event.
AuditLog
| Property | Property | Type | Type | Required | Description |
|---|---|---|---|---|---|
Generic | generic | GenericAuditLogDetails | GenericAuditLogDetails | Exactly one | Provider-neutral audit event |
MicrosoftSignIn | microsoft_sign_in | MicrosoftSignInAuditLogDetails | MicrosoftSignInAuditLogDetails | Exactly one | Microsoft Graph sign-in event |
MicrosoftSecurity | microsoft_security | MicrosoftSecurityAuditLogDetails | MicrosoftSecurityAuditLogDetails | Exactly one | Microsoft Graph security audit event |
GenericAuditLogDetails
| Property | Property | Type | Type | Required | Description |
|---|---|---|---|---|---|
Date | date | Timestamp | datetime | Timestamp | Yes | Event time |
AuditLogSource | audit_log_source | string | str | Yes | Source audit-log stream |
Actor | actor | AuditLogActor | AuditLogActor | Yes | Actor identity |
ApplicationName | application_name | string | str | Yes | Application name |
Source | source | string | str | Yes | Event source |
ActivityName | activity_name | string | str | Yes | Activity name |
EventProvider | event_provider | string | str | Yes | Provider that emitted the event |
Scopes | scopes | string | str | No | Event scopes |
AuditLogActor requires Email / email. Its Id / id field is optional.
MicrosoftSignInAuditLogDetails
| Property | Property | Type | Type | Required | Description |
|---|---|---|---|---|---|
CreatedDateTime | created_date_time | Timestamp | datetime | Timestamp | Yes | Sign-in time |
UserId | user_id | string | str | Yes | Microsoft user identifier |
AppDisplayName | app_display_name | string | str | Yes | Application display name |
UserPrincipalName | user_principal_name | string | str | No | User principal name |
ClientAppUsed | client_app_used | string | str | No | Client used for sign-in |
AppId | app_id | string | str | No | Application identifier |
ResourceDisplayName | resource_display_name | string | str | No | Resource display name |
ResourceId | resource_id | string | str | No | Resource identifier |
IsInteractive | is_interactive | bool | bool | No | Whether the sign-in was interactive |
Status | status | MicrosoftSignInStatus | MicrosoftSignInStatus | No | Error code and failure details |
Omit the complete sign-in record when the source does not provide AppDisplayName / app_display_name. Status error code, failure reason, and additional details are all optional.
MicrosoftSecurityAuditLogDetails
| Property | Property | Type | Type | Required | Description |
|---|---|---|---|---|---|
ActorId | actor_id | string | str | Yes | Entra ID user object ID resolved from the user principal name |
CreatedDateTime | created_date_time | Timestamp | datetime | Timestamp | No | Event time |
UserPrincipalName | user_principal_name | string | str | No | User principal name |
Service | service | string | str | No | Microsoft service |
Operation | operation | string | str | No | Audit operation |
AuditLogRecordType | audit_log_record_type | string | str | No | Microsoft record type |
AI Usage and Cost
AI usage and cost records are event-based. The models preserve provider response fields without normalization.
AiUsage and AiCost
| Property | Property | Type | Type | Required | Description |
|---|---|---|---|---|---|
AiUsage.Provider | AiUsage.provider | AiProvider | AiProvider | Yes | Usage provider |
AiUsage.AnthropicChatUsage | AiUsage.anthropic_chat_usage | AnthropicChatUsage | AnthropicChatUsage | Exactly one | Anthropic Messages API usage |
AiUsage.AnthropicClaudeCode | AiUsage.anthropic_claude_code | AnthropicClaudeCodeUsage | AnthropicClaudeCodeUsage | Exactly one | Anthropic Claude Code usage |
AiCost.Provider | AiCost.provider | AiProvider | AiProvider | Yes | Cost provider |
AiCost.AnthropicCost | AiCost.anthropic_cost | AnthropicCost | AnthropicCost | Exactly one | Anthropic cost report item |
AnthropicChatUsage
| Property | Property | Type | Type | Required | Description |
|---|---|---|---|---|---|
StartingAt | starting_at | Timestamp | datetime | Timestamp | Yes | Bucket start, inclusive |
EndingAt | ending_at | Timestamp | datetime | Timestamp | Yes | Bucket end, exclusive |
UncachedInputTokens | uncached_input_tokens | long | int | Yes | Uncached input tokens |
CacheReadInputTokens | cache_read_input_tokens | long | int | Yes | Cache-read input tokens |
OutputTokens | output_tokens | long | int | Yes | Output tokens |
CacheCreation | cache_creation | AnthropicCacheCreation | AnthropicCacheCreation | Yes | One-hour and five-minute cache-creation token counts |
ServerToolUse | server_tool_use | AnthropicServerToolUse | AnthropicServerToolUse | Yes | Server tool-use counts |
AccountId | account_id | string | str | No | Anthropic account identifier |
ApiKeyId | api_key_id | string | str | No | API key identifier |
ServiceAccountId | service_account_id | string | str | No | Service-account identifier |
WorkspaceId | workspace_id | string | str | No | Anthropic workspace identifier |
Model | model | string | str | No | Model |
ServiceTier | service_tier | string | str | No | Service tier |
ContextWindow | context_window | string | str | No | Context-window group |
InferenceGeo | inference_geo | string | str | No | Inference geography |
AnthropicCacheCreation requires the one-hour and five-minute token counts. AnthropicServerToolUse requires the web-search request count.
AnthropicCost
| Property | Property | Type | Type | Required | Description |
|---|---|---|---|---|---|
StartingAt | starting_at | Timestamp | datetime | Timestamp | Yes | Bucket start, inclusive |
EndingAt | ending_at | Timestamp | datetime | Timestamp | Yes | Bucket end, exclusive |
Amount | amount | string | str | Yes | Lowest currency units as reported by Anthropic |
Currency | currency | string | str | Yes | Currency code |
WorkspaceId | workspace_id | string | str | No | Anthropic workspace identifier |
Description | description | string | str | No | Cost description |
CostType | cost_type | string | str | No | Cost category |
TokenType | token_type | string | str | No | Token category |
Model | model | string | str | No | Model |
ServiceTier | service_tier | string | str | No | Service tier |
ContextWindow | context_window | string | str | No | Context-window group |
InferenceGeo | inference_geo | string | str | No | Inference geography |
AnthropicClaudeCodeUsage
| Property | Property | Type | Type | Required | Description |
|---|---|---|---|---|---|
Date | date | Timestamp | datetime | Timestamp | Yes | UTC usage day |
Actor | actor | AnthropicClaudeCodeActor | AnthropicClaudeCodeActor | Yes | User or API actor |
CoreMetrics | core_metrics | AnthropicClaudeCodeCoreMetrics | AnthropicClaudeCodeCoreMetrics | Yes | Session, code-line, commit, and pull-request metrics |
ToolActions | tool_actions | AnthropicClaudeCodeToolActions | AnthropicClaudeCodeToolActions | Yes | Accepted and rejected tool actions |
OrganizationId | organization_id | string | str | No | Anthropic organization identifier |
CustomerType | customer_type | string | str | No | API or subscription customer type |
SubscriptionType | subscription_type | string | str | No | Subscription type |
TerminalType | terminal_type | string | str | No | Terminal or editor |
ModelBreakdowns | model_breakdowns | RepeatedField<AnthropicClaudeCodeModelBreakdown> | list[AnthropicClaudeCodeModelBreakdown] | No | Per-model tokens and estimated cost |
The nested Claude Code metrics use required numeric counters. The actor type is required; actor email and API-key name are optional. Each model breakdown requires its model, token counts, and estimated currency and amount.
AiProvider
| C# | Python | Description |
|---|---|---|
Unspecified | AI_PROVIDER_UNSPECIFIED | No provider selected |
Anthropic | AI_PROVIDER_ANTHROPIC | Anthropic provider data |
Generic | AI_PROVIDER_GENERIC | Provider-neutral data |