terraform-provider-stackgen

sg_audit_events (Data Source)

⚠️ Experimental — Reads exactly one cursor-paginated page of Guild audit events, in native or OCSF format. To consume subsequent pages, run another query externally with cursor = next_cursor until has_more is false; Terraform does not loop through pages. There is no offset input. OCSF requires RFC 3339 from and to within 31 days. items are sensitive JSON strings because even slim native or OCSF event shapes can reveal private data; sensitive values are still stored in Terraform state, so secure your state backend. include_payload and include_raw are false by default. Respects provider workspace_id for workspace scoping.

Example Usage

# Reads exactly one native audit page (limit 1-100; OCSF supports 1-1000).
# For OCSF, set format = "ocsf" and both RFC3339 from/to within 31 days.
# Supply the previous page's next_cursor in a *subsequent* query/run;
# Terraform does not follow pages automatically and has no offset input.
# WARNING: items are sensitive JSON strings still stored in Terraform state.
# Even with include_payload/include_raw omitted (false), protect state access.
data "sg_audit_events" "page" {
  format = "native"
  limit  = 50
  cursor = var.audit_cursor
}

variable "audit_cursor" {
  description = "Opaque next_cursor from a previous audit page; null for the first page."
  type        = string
  default     = null
}

output "audit_has_more" {
  value = data.sg_audit_events.page.has_more
}

output "audit_next_cursor" {
  value     = data.sg_audit_events.page.next_cursor
  sensitive = true
}

Schema

Optional

• actor_id (String) Filter by the human actor UUID.
• actor_login (String) Case-insensitive partial actor login or display-name filter.
• agent_name (String) Filter audit events by agent name.
• cursor (String) Opaque next_cursor returned by a preceding page. Leave unset to fetch the first page; supply it in a subsequent query to continue.
• event_type (String) Filter by event category (for example tool_call or policy_evaluation).
• format (String) Item format: native (default) or ocsf (OCSF API Activity class 6003).
• from (String) Inclusive lower timestamp bound (RFC 3339). Required with to for OCSF export.
• include_payload (Boolean) Include full native event payloads (default false); these may contain credentials and remain in Terraform state.
• include_raw (Boolean) Include OCSF raw_data and full payload under unmapped (default false); these may contain credentials and remain in Terraform state.
• integration_name (String) Filter by exact integration name.
• limit (Number) Page size (default 50); 1–100 for native or 1–1000 for OCSF. No offset pagination is supported.
• session_id (String) Filter to events in this agent session; excludes events outside a session.
• to (String) Upper timestamp bound (RFC 3339). Required with from for OCSF export; window must be at most 31 days.
• tool_name (String) Filter by exact tool name.
• trace_id (String) Filter execution-correlated events by AG-UI or Langfuse trace ID.

Read-Only

• has_more (Boolean) Whether Guild reports another page. This data source never fetches it automatically.
• items (List of String, Sensitive) Sensitive JSON strings for the single returned page. Each string preserves an arbitrary native or OCSF object; content may contain secrets and is stored in Terraform state.
• next_cursor (String) Opaque token for the next page; null when Guild does not supply one. Pass it as cursor in a separate query.