Event Reference

This page documents every Level 1 event that appears in the REFRACT Audit timeline and the severity it carries.

Full Governed Document Timeline

The following is the complete audit log for a vendor contract that passed through every REFRACT Platform product: REFRACT PDF generation, REFRACT Workflow approval, REFRACT eSign counter-signature (sequential, 2 signers), REFRACT Delivery, and REFRACT Audit archival. This represents the maximum event set for a fully governed document.

Document:  Vendor Contract VC-2026-0601 (Acme Corp)
Products:  REFRACT PDF → REFRACT Workflow → REFRACT eSign (sequential, 2 signers) → REFRACT Delivery → REFRACT Audit

── 11 Level 1 events, across three separate logs ──────────────────────────────

 #   Timestamp (UTC)        Severity      Product        Event Title
─────────────────────────────────────────────────────────────────────────────────
 1   2026-06-01 08:00:01    information   REFRACT PDF       Document Generated
 2   2026-06-01 08:00:02    compliance    REFRACT Audit     Integrity Verified
 3   2026-06-01 08:02:14    governance    REFRACT Workflow  Submitted for Review
 4   2026-06-01 09:45:00    governance    REFRACT Workflow  Sent for Approval
 5   2026-06-01 10:20:11    governance    REFRACT Workflow  Workflow Approved
 6   2026-06-01 10:22:30    compliance    REFRACT Workflow  Document Sealed
 7   2026-06-01 10:23:05    information   REFRACT eSign     Sent for Signature    (sequential, 2 slots)
 8   2026-06-01 11:05:10    compliance    REFRACT eSign     Document Signed       (slot 0: vendor@acme.com)
 9   2026-06-01 11:29:33    compliance    REFRACT eSign     Document Signed       (slot 1: director@contoso.com)
10   2026-06-01 11:30:00    information   REFRACT Delivery  Document Delivered    (1 recipient)
11   2026-06-01 11:30:01    compliance    REFRACT Audit     Archived to Write-Once Storage

Events 1-2 and any render-level events (like Document Delivered's session
creation) are written to the general, unchained render audit log. Events 3-6
are written to the workflow HMAC chain (workflow/{tenantId}/{correlationId}.jsonl).
Events 7-9 are written to the eSign HMAC chain (esign/{tenantId}/{correlationId}.jsonl).

── Timeline view coverage ──────────────────────────────────────────────────────

 Executive view   (information + compliance)  →  Events 1, 2, 6, 8, 9, 10, 11
 Compliance view  (compliance + security)     →  Events 2, 6, 8, 9, 11
 Security view    (security + failure)        →  none in this example
 Full view        (all severities)            →  Events 1 - 11

Render Events

Events emitted by REFRACT PDF during document generation.

generated - Initial PDF render completed. Extended details include engine version, template path, payload path, output file size, and render duration in milliseconds.

failed - PDF generation or upload failed. Extended details include the error message and the failing pipeline stage.

REFRACT Audit Events

Events emitted directly by REFRACT Audit - integrity checks, archival, verification operations, and access control.

integrity-validated - SHA-256 hash computed and stored at generation time. This event is the baseline for all future verification. Always emitted immediately after generated.

accessibility-checked - Section 508 accessibility trace generated and stored. Only emitted when the section508 feature flag is enabled on the template.

archived - Document marked as archived. Appends an audit entry; the document enters a read-only compliance state.

verified - On-demand SHA-256 re-verification triggered from the REFRACT Lifecycle workspace. Extended details include the verification result (PASS, FAIL, INDETERMINATE, or NOT_VERIFIABLE) and the comparing hash values. See Verify Results below for what each value means.

reproduced - Document re-rendered from the .raudit archive and output hash compared to the original. Extended details include the reproduction result (matched or mismatch) and any hash delta.

evidence-exported - Full audit JSONL event stream exported as a downloadable evidence bundle. Extended details include the export format and operator identity.

revoked - A REFRACT eSign signing session or REFRACT Delivery delivery session was revoked. Extended details include the session ID and revoking operator.

Workflow Events

Events emitted by REFRACT Workflow and classified by REFRACT Audit in the timeline.

workflow-initiated - REFRACT Workflow session created and participant forms distributed. Extended details include the workflow title and initiator identity.

workflow-approval-requested - Completed submission forwarded to the approver queue. Extended details include the approver role.

workflow-changes-requested - Approver returned the submission with correction instructions.

workflow-resubmitted - Participant addressed change requests and resubmitted.

workflow-approved - Approver accepted the submission.

workflow-rejected - Approver rejected the submission. Shown as a failure-severity event in all timeline views.

workflow-cancelled - Workflow cancelled by the initiator or an administrator.

workflow-sealed - Final PDF sealed and stored after workflow completion. This is the compliance milestone for governed documents and is the only workflow event shown in the Compliance and Executive views.

Verify Results

GET the verify-integrity route for a document to get one of these results, or an HTTP 404 if no audit record exists for the correlation ID at all. The route requires the Lifecycle.Reader role and returns 403 with code ROLE_MISSING without it:

Signing Events

Events emitted by REFRACT eSign and classified by REFRACT Audit in the timeline.

sent-for-signature - REFRACT eSign session created. Extended details include signing mode (single, sequential, or parallel) and slot count.

document-signed - A signer completed their signature slot. The chained entry's data includes the slot index, role, completion timestamp, and the OTP verification facts recorded for that signer (verification time and IP address, in plaintext - not hashed).

Signing sub-events. Some signer activity is recorded on the eSign chain as Level 2 sub-entries, visible in the Full view: SIGN_OTP_LOCKED (Signer Locked Out of Codes), SIGN_OTP_LOCK_CLEARED (Signing Code Lock Cleared), SIGN_DEVICE_TRANSFER_CREATED (Device Transfer Link Created), SIGN_DEVICE_TRANSFER_REDEEMED (Signing Moved to Another Device), and SIGN_ATTEMPT_REFUSED (Signing Attempt Refused), each security, and SIGN_INVITE_RESENT (Signing Invitation Re-sent, information). A code lock is recorded when it happens; a successful code verification is still not its own event. See OTP Verification and Cross-Device Signing.

Delivery Events

Events emitted by REFRACT Delivery and classified by REFRACT Audit in the timeline.

delivery-created - REFRACT Delivery session created.

delivery-accessed - The recipient accessed the document. Carries the delivery ID and the session's running view count.

Revoking a delivery session does not write an audit event. There is no separate "download" event - access and download are the same recorded event.

Data Redaction Events

Events emitted by REFRACT PDF's data redaction feature and classified by REFRACT Audit in the timeline.

Redaction does not currently write its own event to the eSign/Workflow HMAC chains. Instead, the redaction policy and its outcome (policyId, mode, applied rules, redacted/masked field paths) are embedded in the .raudit archive's manifest when the archive is built, and the SharePoint REFRACT_Activity list records an Action value of redact for the record.

Event Schema

The eSign and Workflow HMAC chains write each event as one JSON line with the following shape:

{
  "event": "document-signed",
  "data": {
    "slotIndex": 0,
    "role": "vendor",
    "signedAt": "2026-06-12T09:14:22.451Z"
  },
  "timestamp": "2026-06-12T09:14:22.451Z",
  "_chain": {
    "seq": 9,
    "prevHash": "3f2a9c...",
    "hmac": "8b1e07...",
    "chain": "esign",
    "kid": "k1",
    "algorithm": "HS256"
  }
}

If the signing key or Table Storage is temporarily unavailable, the event is still written, but with _chain: null - it is logged as a gap rather than blocking the write.

The general, unchained render audit log (PDFGenerated and similar events) uses a simpler shape with no _chain field at all - see Audit Logs configuration for its AuditEvent schema.