1 — Filesystem event (upload, download, delete, rename, mkdir, rmdir, copy, ssh_cmd, and their pre-* / first-* variants) | .Name, .Event, .Status, .VirtualPath, .FsPath, .ObjectName, .ObjectType, .Protocol, .IP, .Timestamp, .UID, .Role, .Email, .Errors, .Initiator.User | .VirtualTargetPath / .FsTargetPath (rename/copy only); .FileSize / .Elapsed (only on post-upload/download, zero for pre-*); .Metadata (cloud backends only). | .IDPFields, .Initiator.Admin, .Object, .RetentionChecks, .EventReports, .ShareExpirationChecks. |
2 — Provider event (add / update / delete on user, group, share, folder, admin, …) | .Event, .ObjectName, .ObjectType, .Object, .Object.JSON, .Timestamp, .UID, .Initiator (one of .User / .Admin populated). | .Name = affected username for user events; .Object.User / .Object.Admin / .Object.Group / .Object.Share depending on .ObjectType. | .VirtualPath, .FsPath, .FileSize, .Elapsed, .Protocol, .IP, .IDPFields, .Errors. |
| 3 — Schedule (cron) | .Timestamp, .UID. Chained data from earlier actions in the same rule: .RetentionChecks, .EventReports, .ShareExpirationChecks. | Chained Share Expiration can populate .ShareExpirationResult when split-mode is on. | .Name, .VirtualPath, .FsPath, .Event, .Status, .FileSize, .Protocol, .IP, .Role, .Email, .IDPFields, .Object. Everything that would require a subject user or file path is blank. |
| 4 — IP blocked | .IP, .Protocol, .Event, .Timestamp, .UID, .Errors. | — | .Name, .VirtualPath, .FsPath, .FileSize, .Object, .Initiator, .IDPFields. |
| 5 — Certificate renewal (ACME) | .Event (acme_ok / acme_error), .Timestamp, .UID, .Errors. | — | Everything else. |
| 6 — On demand | .Name (when the POST body lists users), .Timestamp, .UID. | Whatever earlier chained actions populate. | Depends on how the rule is invoked — default: same blanks as schedule. |
| 7 — IDP login | .Name, .ExtName, .Role, .Email, .Protocol (= OIDC), .IP, .Timestamp, .UID, .IDPFields. | Anything in .IDPFields must match a claim listed in the OIDC binding's custom_fields; the role claim comes via .Role (populated from role_field), not via .IDPFields. | .VirtualPath, .FsPath, .FileSize, .Event (typed as IDP event, not filesystem), .Object, .Errors. |