incident-io 0.0.0.pre.alpha → 0.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 86f00d7548e819bd98c397ff6db9798b0ee80086dabe4a3af634d8cd278c118d
-  data.tar.gz: 8996f92e6d8e2ce09ca347a3df59064c62084dd8b743ab7ee130b3f9045fe501
+  metadata.gz: fa30c17c73c50cc2bd87c4cf9fcb6c5dec77cb0e3188cfd36405984e54456df8
+  data.tar.gz: 5028662568201ba75c201bd463a188d44920a82e49ce0316d26a0df0a90b271c
 SHA512:
-  metadata.gz: fa98abedeeb4077d46188093e71350edfdebf423611b336b1caec9f6bf9e71c50b9455daad6510cc5fe8a9b2bf3be63111594ba87db71648237a3d8d71115aeb
-  data.tar.gz: 0fe2d9527323947af742c9cd2f7a186b77008e6283e30b19070f48e46c6398db6b2f28b8311d2c18e944e8460ec195fc7b9e3abd4dc29b2ee929f35a9fe360c4
+  metadata.gz: 61f1c864ee3d101a27790df1cde665a5fb1365bd9665515a197f46f1c0f75f8f4d01a23d3fff167740c67d7d13170cfe68b53b53e287740524c2814cb024a191
+  data.tar.gz: 68838a1cfeac0373eb8c23e65173e752047fe0fb7647a9d639e274669cec8175fc4291ffa00be69068b2e93e3bbd04f64ee61ae8768ba942d50ee48cfe4b7857

data/CHANGELOG.md

@@ -0,0 +1,23 @@
+# Changelog
+
+## 0.1.0 (2026-09-27)
+
+
+### Features
+
+* add core HTTP client ([4ebfb9c](https://github.com/sgerrand/incident-io-rb/commit/4ebfb9c806f6f6fb3ad4fd263d5fde09305f9ade))
+* add generated models and resources ([a740157](https://github.com/sgerrand/incident-io-rb/commit/a740157a6b85fd4df2239661a41b5d4cf1ce7ea3))
+* add Rack middleware for incident.io webhooks ([a33d97d](https://github.com/sgerrand/incident-io-rb/commit/a33d97d07b85048b198949d8aca316e9fe6396cb))
+* **core:** support generated resources in Resource and Page ([774b914](https://github.com/sgerrand/incident-io-rb/commit/774b914a74d93cbe72594345eff95c3a273d82a4))
+* **generator:** generate models and resources from the OpenAPI spec ([f83b515](https://github.com/sgerrand/incident-io-rb/commit/f83b5159f6594e4b5ef3a7f2504a369d89d4e8bc))
+* **generator:** generate webhook event and audit log maps ([d11e7c9](https://github.com/sgerrand/incident-io-rb/commit/d11e7c990d4081f4ca47f1e3746a886312fc2332))
+* **generator:** write a manifest of generated operations ([ddb8925](https://github.com/sgerrand/incident-io-rb/commit/ddb892587d315b3d56803e33686cc977cd6bb06f))
+* send nil as null for optional body arguments ([e71549d](https://github.com/sgerrand/incident-io-rb/commit/e71549d2dfafbddb812e7cf289e981942579e99b))
+* send nil fields of models as null ([051ecde](https://github.com/sgerrand/incident-io-rb/commit/051ecde4d965f850d6d4d511e00759365c75b363))
+* ship RBS type signatures ([f7e272f](https://github.com/sgerrand/incident-io-rb/commit/f7e272faa498b4ed9a84e5afb61f03f478ae31d3))
+* verify and parse webhooks and audit log entries ([068cd0c](https://github.com/sgerrand/incident-io-rb/commit/068cd0c69e4d34911c6a8471e85ae165297af364))
+
+
+### Bug Fixes
+
+* **sig:** accept raw: in model constructors ([a9891e8](https://github.com/sgerrand/incident-io-rb/commit/a9891e85804dbec77a454df35c3def854dcce8c3))

data/LICENSE

@@ -0,0 +1,24 @@
+BSD 2-Clause License
+
+Copyright (c) 2024-2026, Sasha Gerrand
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

data/README.md

@@ -1,3 +1,218 @@
 # incident-io
 
+[![Coverage Status](https://coveralls.io/repos/github/sgerrand/incident-io-rb/badge.svg?branch=main)](https://coveralls.io/github/sgerrand/incident-io-rb?branch=main)
+
 A Ruby client for the incident.io API.
+
+Needs Ruby 3.3 or newer.
+
+## Usage
+
+```ruby
+require "incident_io"
+
+client = IncidentIo::Client.new(api_key: ENV["INCIDENT_IO_API_KEY"])
+
+incident = client.incidents.create(name: "Database is down", visibility: "public")
+incident.id          # => "01H..."
+incident.created_at  # => a Time
+
+# Lists fetch pages as you go.
+client.incidents.list(status_category: { one_of: ["live"] }).each do |incident|
+  puts incident.name
+end
+```
+
+Each resource has one method per API endpoint. Required fields are required
+keyword arguments. Results are read-only model objects. To read a field that
+this gem does not know about yet, use `model[:field_name]`.
+
+Optional fields you leave out are not sent. Passing `nil` sends `null`, for
+example to clear a field. This works the same for method arguments and for
+fields of models you build and pass in:
+
+```ruby
+client.schedules.update(id, schedule: {name: "On-call"})  # leaves other fields out
+client.incidents.create(visibility: "public", summary: nil)  # sends "summary": null
+
+edit = IncidentIo::Models::IncidentEditPayloadV2.new(summary: nil)
+client.incidents.edit(id, incident: edit, notify_incident_channel: false)  # sends "summary": null
+```
+
+### API versions
+
+Some parts of the incident.io API have more than one version. `client.<name>`
+always uses the newest one. To use an older version, name it:
+
+```ruby
+client.catalog.list_types     # v3
+client.v2.catalog.list_types  # v2 (deprecated)
+```
+
+Calling a deprecated endpoint prints a warning when Ruby's deprecation
+warnings are on (`ruby -W:deprecated`).
+
+### Any endpoint
+
+`client.request` calls any endpoint and returns the parsed JSON:
+
+```ruby
+client.request(:get, "/v2/incidents/01ABC")
+client.paginate("/v2/incidents", items_key: "incidents").first(10)
+```
+
+### Webhooks
+
+`IncidentIo::Webhook.construct_event` checks a webhook's signature and turns
+it into an event. Pass the raw request body, the request headers and your
+endpoint's signing secret (it starts with `whsec_`):
+
+```ruby
+# In a Rails controller
+event = IncidentIo::Webhook.construct_event(
+  request.raw_post, request.headers, secret: ENV["INCIDENT_IO_WEBHOOK_SECRET"]
+)
+
+case event.type
+when "public_incident.incident_created_v2"
+  puts event.data.name
+when "private_incident.incident_created_v2"
+  # Private events only include an ID, so fetch the details.
+  incident = client.incidents.show(event.data.id)
+end
+```
+
+It raises `IncidentIo::Webhook::SignatureError` if the signature is wrong or
+the webhook is more than 5 minutes old. `event.id` stays the same when
+incident.io retries a webhook, so you can use it to skip duplicates.
+
+#### With Rack middleware
+
+`IncidentIo::Webhook::Middleware` checks webhooks sent to
+`/incident_io/webhooks` (change it with `path:`) and replies `400` to any that
+fail the check. Other requests pass through untouched.
+
+Give it a block to handle webhooks there. It replies `204` once the block
+returns. If the block raises an error, incident.io retries the webhook later.
+
+```ruby
+# config.ru
+use IncidentIo::Webhook::Middleware, secret: ENV["INCIDENT_IO_WEBHOOK_SECRET"] do |event|
+  IncidentWebhookJob.perform_later(event.raw) if event.type.start_with?("public_incident.")
+end
+```
+
+Without a block, it adds the event to the request and passes it on, so your
+app can handle it, e.g. in Rails:
+
+```ruby
+# config/application.rb
+config.middleware.use IncidentIo::Webhook::Middleware, secret: ENV["INCIDENT_IO_WEBHOOK_SECRET"]
+
+# config/routes.rb
+post "/incident_io/webhooks", to: "incident_io_webhooks#create"
+
+# app/controllers/incident_io_webhooks_controller.rb
+class IncidentIoWebhooksController < ActionController::API
+  def create
+    event = request.env[IncidentIo::Webhook::Middleware::ENV_KEY]
+    IncidentWebhookJob.perform_later(event.raw)
+    head :no_content
+  end
+end
+```
+
+#### In a Rails controller, without middleware
+
+```ruby
+class IncidentIoWebhooksController < ActionController::API
+  def create
+    event = IncidentIo::Webhook.construct_event(
+      request.raw_post, request.headers, secret: ENV["INCIDENT_IO_WEBHOOK_SECRET"]
+    )
+    IncidentWebhookJob.perform_later(event.raw)
+    head :no_content
+  rescue IncidentIo::Webhook::SignatureError
+    head :bad_request
+  end
+end
+```
+
+### Audit logs
+
+incident.io sends audit logs to a log stream (e.g. Datadog, Splunk or S3),
+not through the API. `IncidentIo::AuditLog.parse` turns an entry into a
+model:
+
+```ruby
+entry = IncidentIo::AuditLog.parse(line)
+entry.action      # => "alert_route.created"
+entry.actor.name
+```
+
+### Types
+
+The gem ships [RBS](https://github.com/ruby/rbs) signatures in `sig/`, so
+type checkers such as [Steep](https://github.com/soutaro/steep) know every
+resource method, argument and model field.
+
+### Errors
+
+Failed requests raise a subclass of `IncidentIo::APIError`, for example
+`NotFoundError`, `UnprocessableEntityError` or `RateLimitError`. Each error has
+`status`, `type`, `request_id` and `errors` (the field-level details).
+
+Network problems raise `IncidentIo::APIConnectionError` or
+`IncidentIo::APITimeoutError`.
+
+### Retries
+
+The client retries up to 2 times (change this with `max_retries:`):
+
+- rate limits (429), waiting as long as the API asks, up to 60 seconds
+- server errors and network errors, but only for GET, PUT and DELETE, or for
+  a POST sent with `idempotent: true`
+
+## Development
+
+```sh
+bundle install
+bundle exec rake            # run the specs
+COVERAGE=1 bundle exec rake # run the specs and write coverage/index.html
+bundle exec rake standard   # lint code and YARD tags (standard:fix to fix)
+bundle exec rake typecheck  # type-check with Steep
+bundle exec rake spec:rbs   # run the specs, checking calls against sig/
+bundle exec rake yardstick  # check the YARD docs with Yardstick
+```
+
+The models and resources in `lib/incident_io/models` and
+`lib/incident_io/resources`, and their signatures in `sig/incident_io`, are
+generated from the incident.io OpenAPI spec.
+Do not edit them by hand. To update them:
+
+```sh
+bundle exec rake openapi:fetch  # download the latest spec
+bundle exec rake generate       # rebuild the generated code
+```
+
+The spec is not stored in git, so run `openapi:fetch` before `generate`.
+It is saved to `openapi/openapi.json`, which git ignores.
+
+To rename a generated method, add it to `generator/overrides.yml`.
+`bundle exec rake generate:check` fails if the generated code does not match
+your local copy of the spec.
+
+## Releasing
+
+Releases are automated. Use [Conventional Commits](https://www.conventionalcommits.org/)
+(`feat:`, `fix:` and so on) so the version and changelog can be worked out.
+
+1. Each push to `main` updates an open release pull request. It bumps the
+   version and adds the new changes to `CHANGELOG.md`.
+2. Merging that pull request tags the version and creates a GitHub Release.
+3. The release starts the Publish workflow, which pushes the gem to
+   RubyGems.org using trusted publishing. No API key is stored in GitHub.
+
+## License
+
+BSD 2-Clause. See [LICENSE](LICENSE).

data/lib/incident-io.rb

@@ -0,0 +1,4 @@
+# frozen_string_literal: true
+
+# Lets `Bundler.require` and `require "incident-io"` load the gem.
+require_relative "incident_io"

data/lib/incident_io/audit_log.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module IncidentIo
+  # Parses incident.io audit log entries, e.g. from a SIEM log stream or an
+  # S3 export. Audit logs are not sent as webhooks or through the API.
+  #
+  #   entry = IncidentIo::AuditLog.parse(line)
+  #   entry.action       # => "alert_route.created"
+  #   entry.actor.name
+  module AuditLog
+    module_function
+
+    # Turns an audit log entry into its model
+    #
+    # Entry types this gem doesn't know yet come back as the parsed Hash.
+    #
+    # @param entry [String, Hash] the entry as JSON or already parsed
+    # @return [Object, Hash] the model for the entry's action and version
+    def parse(entry)
+      data = entry.is_a?(String) ? JSON.parse(entry) : entry
+      model = ENTRIES[[data["action"], data["version"]]]
+      model ? Models.const_get(model).from_api(data) : data
+    end
+  end
+end

data/lib/incident_io/audit_log_entries.rb

@@ -0,0 +1,231 @@
+# frozen_string_literal: true
+
+# This file is generated by `rake generate` from openapi/openapi.json.
+# Do not edit it by hand.
+
+module IncidentIo
+  module AuditLog
+    # Audit log entry types, keyed by action and version, and their models.
+    ENTRIES = {
+      ["activity_log.scrubbed", 1] => :AuditLogsActivityLogScrubbedV1,
+      ["alert.scrubbed", 1] => :AuditLogsAlertScrubbedV1,
+      ["alert_chat_message_template.created", 1] => :AuditLogsAlertChatMessageTemplateCreatedV1,
+      ["alert_chat_message_template.deleted", 1] => :AuditLogsAlertChatMessageTemplateDeletedV1,
+      ["alert_chat_message_template.updated", 1] => :AuditLogsAlertChatMessageTemplateUpdatedV1,
+      ["alert_priority.created", 1] => :AuditLogsAlertPriorityCreatedV1,
+      ["alert_priority.deleted", 1] => :AuditLogsAlertPriorityDeletedV1,
+      ["alert_priority.set_as_default", 1] => :AuditLogsAlertPrioritySetAsDefaultV1,
+      ["alert_priority.updated", 1] => :AuditLogsAlertPriorityUpdatedV1,
+      ["alert_route.created", 1] => :AuditLogsAlertRouteCreatedV1,
+      ["alert_route.deleted", 1] => :AuditLogsAlertRouteDeletedV1,
+      ["alert_route.updated", 1] => :AuditLogsAlertRouteUpdatedV1,
+      ["alert_schema.updated", 1] => :AuditLogsAlertSchemaUpdatedV1,
+      ["alert_source_config.created", 1] => :AuditLogsAlertSourceConfigCreatedV1,
+      ["alert_source_config.deleted", 1] => :AuditLogsAlertSourceConfigDeletedV1,
+      ["alert_source_config.updated", 1] => :AuditLogsAlertSourceConfigUpdatedV1,
+      ["announcement_post_template.created", 1] => :AuditLogsAnnouncementPostTemplateCreatedV1,
+      ["announcement_post_template.created", 2] => :AuditLogsAnnouncementPostTemplateCreatedV2,
+      ["announcement_post_template.deleted", 1] => :AuditLogsAnnouncementPostTemplateDeletedV1,
+      ["announcement_post_template.set_as_default", 1] => :AuditLogsAnnouncementPostTemplateSetAsDefaultV1,
+      ["announcement_post_template.updated", 1] => :AuditLogsAnnouncementPostTemplateUpdatedV1,
+      ["announcement_post_template.updated", 2] => :AuditLogsAnnouncementPostTemplateUpdatedV2,
+      ["announcement_rule.created", 1] => :AuditLogsAnnouncementRuleCreatedV1,
+      ["announcement_rule.created", 2] => :AuditLogsAnnouncementRuleCreatedV2,
+      ["announcement_rule.deleted", 1] => :AuditLogsAnnouncementRuleDeletedV1,
+      ["announcement_rule.updated", 1] => :AuditLogsAnnouncementRuleUpdatedV1,
+      ["announcement_rule.updated", 2] => :AuditLogsAnnouncementRuleUpdatedV2,
+      ["api_key.created", 1] => :AuditLogsAPIKeyCreatedV1,
+      ["api_key.deleted", 1] => :AuditLogsAPIKeyDeletedV1,
+      ["api_key.rotated", 1] => :AuditLogsAPIKeyRotatedV1,
+      ["api_key.updated", 1] => :AuditLogsAPIKeyUpdatedV1,
+      ["catalog_entry_attribute.updated", 1] => :AuditLogsCatalogEntryAttributeUpdatedV1,
+      ["catalog_entry_attribute.updated", 2] => :AuditLogsCatalogEntryAttributeUpdatedV2,
+      ["catalog_type.created", 1] => :AuditLogsCatalogTypeCreatedV1,
+      ["catalog_type.deleted", 1] => :AuditLogsCatalogTypeDeletedV1,
+      ["catalog_type.updated", 1] => :AuditLogsCatalogTypeUpdatedV1,
+      ["connector_config.created", 1] => :AuditLogsConnectorConfigCreatedV1,
+      ["connector_config.token_generated", 1] => :AuditLogsConnectorConfigTokenGeneratedV1,
+      ["connector_config.updated", 1] => :AuditLogsConnectorConfigUpdatedV1,
+      ["custom_field.created", 1] => :AuditLogsCustomFieldCreatedV1,
+      ["custom_field.deleted", 1] => :AuditLogsCustomFieldDeletedV1,
+      ["custom_field.updated", 1] => :AuditLogsCustomFieldUpdatedV1,
+      ["debrief_invite_rule.created", 1] => :AuditLogsDebriefInviteRuleCreatedV1,
+      ["debrief_invite_rule.deleted", 1] => :AuditLogsDebriefInviteRuleDeletedV1,
+      ["debrief_invite_rule.updated", 1] => :AuditLogsDebriefInviteRuleUpdatedV1,
+      ["email_otp_login_setting.updated", 1] => :AuditLogsEmailOtpLoginSettingUpdatedV1,
+      ["escalation.scrubbed", 1] => :AuditLogsEscalationScrubbedV1,
+      ["escalation_path.created", 1] => :AuditLogsEscalationPathCreatedV1,
+      ["escalation_path.deleted", 1] => :AuditLogsEscalationPathDeletedV1,
+      ["escalation_path.updated", 1] => :AuditLogsEscalationPathUpdatedV1,
+      ["escalation_path_template.created", 1] => :AuditLogsEscalationPathTemplateCreatedV1,
+      ["escalation_path_template.deleted", 1] => :AuditLogsEscalationPathTemplateDeletedV1,
+      ["escalation_path_template.updated", 1] => :AuditLogsEscalationPathTemplateUpdatedV1,
+      ["extension_connector.called", 1] => :AuditLogsExtensionConnectorCalledV1,
+      ["extension_connector.called", 2] => :AuditLogsExtensionConnectorCalledV2,
+      ["extension_connector.called", 3] => :AuditLogsExtensionConnectorCalledV3,
+      ["follow_up_category.created", 1] => :AuditLogsFollowUpCategoryCreatedV1,
+      ["follow_up_category.deleted", 1] => :AuditLogsFollowUpCategoryDeletedV1,
+      ["follow_up_category.updated", 1] => :AuditLogsFollowUpCategoryUpdatedV1,
+      ["follow_up_priority.created", 1] => :AuditLogsFollowUpPriorityCreatedV1,
+      ["follow_up_priority.deleted", 1] => :AuditLogsFollowUpPriorityDeletedV1,
+      ["follow_up_priority.updated", 1] => :AuditLogsFollowUpPriorityUpdatedV1,
+      ["holiday_user_feed.created", 1] => :AuditLogsHolidayUserFeedCreatedV1,
+      ["holiday_user_feed.deleted", 1] => :AuditLogsHolidayUserFeedDeletedV1,
+      ["holiday_user_feed.updated", 1] => :AuditLogsHolidayUserFeedUpdatedV1,
+      ["hris_time_off_policy.updated", 1] => :AuditLogsHrisTimeOffPolicyUpdatedV1,
+      ["incident_call_setting.updated", 1] => :AuditLogsIncidentCallSettingUpdatedV1,
+      ["incident_call_transcription_session.deleted", 1] => :AuditLogsIncidentCallTranscriptionSessionDeletedV1,
+      ["incident_duration_metric.created", 1] => :AuditLogsIncidentDurationMetricCreatedV1,
+      ["incident_duration_metric.deleted", 1] => :AuditLogsIncidentDurationMetricDeletedV1,
+      ["incident_duration_metric.updated", 1] => :AuditLogsIncidentDurationMetricUpdatedV1,
+      ["incident_role.created", 1] => :AuditLogsIncidentRoleCreatedV1,
+      ["incident_role.deleted", 1] => :AuditLogsIncidentRoleDeletedV1,
+      ["incident_role.updated", 1] => :AuditLogsIncidentRoleUpdatedV1,
+      ["incident_status.created", 1] => :AuditLogsIncidentStatusCreatedV1,
+      ["incident_status.deleted", 1] => :AuditLogsIncidentStatusDeletedV1,
+      ["incident_status.updated", 1] => :AuditLogsIncidentStatusUpdatedV1,
+      ["incident_template.created", 1] => :AuditLogsIncidentTemplateCreatedV1,
+      ["incident_template.deleted", 1] => :AuditLogsIncidentTemplateDeletedV1,
+      ["incident_template.set_as_default", 1] => :AuditLogsIncidentTemplateSetAsDefaultV1,
+      ["incident_template.updated", 1] => :AuditLogsIncidentTemplateUpdatedV1,
+      ["incident_timestamp.created", 1] => :AuditLogsIncidentTimestampCreatedV1,
+      ["incident_timestamp.deleted", 1] => :AuditLogsIncidentTimestampDeletedV1,
+      ["incident_timestamp.updated", 1] => :AuditLogsIncidentTimestampUpdatedV1,
+      ["incident_timestamp_set_by_rule.created", 1] => :AuditLogsIncidentTimestampSetByRuleCreatedV1,
+      ["incident_timestamp_set_by_rule.deleted", 1] => :AuditLogsIncidentTimestampSetByRuleDeletedV1,
+      ["incident_timestamp_set_by_rule.updated", 1] => :AuditLogsIncidentTimestampSetByRuleUpdatedV1,
+      ["incident_type.created", 1] => :AuditLogsIncidentTypeCreatedV1,
+      ["incident_type.created", 2] => :AuditLogsIncidentTypeCreatedV2,
+      ["incident_type.deleted", 1] => :AuditLogsIncidentTypeDeletedV1,
+      ["incident_type.updated", 1] => :AuditLogsIncidentTypeUpdatedV1,
+      ["incident_type.updated", 2] => :AuditLogsIncidentTypeUpdatedV2,
+      ["integration.installed", 1] => :AuditLogsIntegrationInstalledV1,
+      ["integration.uninstalled", 1] => :AuditLogsIntegrationUninstalledV1,
+      ["internal_status_page.created", 1] => :AuditLogsInternalStatusPageCreatedV1,
+      ["internal_status_page.deleted", 1] => :AuditLogsInternalStatusPageDeletedV1,
+      ["internal_status_page.updated", 1] => :AuditLogsInternalStatusPageUpdatedV1,
+      ["ip_allowlist.updated", 1] => :AuditLogsIPAllowlistUpdatedV1,
+      ["maintenance_window.created", 1] => :AuditLogsMaintenanceWindowCreatedV1,
+      ["maintenance_window.deleted", 1] => :AuditLogsMaintenanceWindowDeletedV1,
+      ["maintenance_window.updated", 1] => :AuditLogsMaintenanceWindowUpdatedV1,
+      ["microsoft_entra_tenant.linked", 1] => :AuditLogsMicrosoftEntraTenantLinkedV1,
+      ["mobile_intune_enabled_setting.updated", 1] => :AuditLogsMobileIntuneEnabledSettingUpdatedV1,
+      ["nudge.created", 1] => :AuditLogsNudgeCreatedV1,
+      ["nudge.deleted", 1] => :AuditLogsNudgeDeletedV1,
+      ["nudge.updated", 1] => :AuditLogsNudgeUpdatedV1,
+      ["on_call_notification_method.created", 1] => :AuditLogsOnCallNotificationMethodCreatedV1,
+      ["on_call_notification_method.created", 2] => :AuditLogsOnCallNotificationMethodCreatedV2,
+      ["on_call_notification_method.destroyed", 1] => :AuditLogsOnCallNotificationMethodDestroyedV1,
+      ["on_call_notification_method.destroyed", 2] => :AuditLogsOnCallNotificationMethodDestroyedV2,
+      ["on_call_notification_pause.created", 1] => :AuditLogsOnCallNotificationPauseCreatedV1,
+      ["on_call_notification_pause.deleted", 1] => :AuditLogsOnCallNotificationPauseDeletedV1,
+      ["on_call_notification_pause.updated", 1] => :AuditLogsOnCallNotificationPauseUpdatedV1,
+      ["on_call_upsell.requested", 1] => :AuditLogsOnCallUpsellRequestedV1,
+      ["organisation_settings.updated", 1] => :AuditLogsOrganisationSettingsUpdatedV1,
+      ["policy.created", 1] => :AuditLogsPolicyCreatedV1,
+      ["policy.created", 2] => :AuditLogsPolicyCreatedV2,
+      ["policy.deleted", 1] => :AuditLogsPolicyDeletedV1,
+      ["policy.updated", 1] => :AuditLogsPolicyUpdatedV1,
+      ["policy.updated", 2] => :AuditLogsPolicyUpdatedV2,
+      ["policy_report_schedule.created", 1] => :AuditLogsPolicyReportScheduleCreatedV1,
+      ["policy_report_schedule.deleted", 1] => :AuditLogsPolicyReportScheduleDeletedV1,
+      ["policy_report_schedule.updated", 1] => :AuditLogsPolicyReportScheduleUpdatedV1,
+      ["post_incident_task.created", 1] => :AuditLogsPostIncidentTaskCreatedV1,
+      ["post_incident_task.deleted", 1] => :AuditLogsPostIncidentTaskDeletedV1,
+      ["post_incident_task.updated", 1] => :AuditLogsPostIncidentTaskUpdatedV1,
+      ["postmortem_section.created", 1] => :AuditLogsPostmortemSectionCreatedV1,
+      ["postmortem_section.created", 2] => :AuditLogsPostmortemSectionCreatedV2,
+      ["postmortem_section.deleted", 1] => :AuditLogsPostmortemSectionDeletedV1,
+      ["postmortem_section.deleted", 2] => :AuditLogsPostmortemSectionDeletedV2,
+      ["postmortem_section.updated", 1] => :AuditLogsPostmortemSectionUpdatedV1,
+      ["postmortem_section.updated", 2] => :AuditLogsPostmortemSectionUpdatedV2,
+      ["postmortem_template.created", 1] => :AuditLogsPostmortemTemplateCreatedV1,
+      ["postmortem_template.created", 2] => :AuditLogsPostmortemTemplateCreatedV2,
+      ["postmortem_template.deleted", 1] => :AuditLogsPostmortemTemplateDeletedV1,
+      ["postmortem_template.deleted", 2] => :AuditLogsPostmortemTemplateDeletedV2,
+      ["postmortem_template.updated", 1] => :AuditLogsPostmortemTemplateUpdatedV1,
+      ["postmortem_template.updated", 2] => :AuditLogsPostmortemTemplateUpdatedV2,
+      ["private_alert.access_attempted", 1] => :AuditLogsPrivateAlertAccessAttemptedV1,
+      ["private_escalation.access_attempted", 1] => :AuditLogsPrivateEscalationAccessAttemptedV1,
+      ["private_incident.access_attempted", 1] => :AuditLogsPrivateIncidentAccessAttemptedV1,
+      ["private_incident.access_attempted", 2] => :AuditLogsPrivateIncidentAccessAttemptedV2,
+      ["private_incident.access_requested", 1] => :AuditLogsPrivateIncidentAccessRequestedV1,
+      ["private_incident.accessed_via_bot", 1] => :AuditLogsPrivateIncidentAccessedViaBotV1,
+      ["private_incident_membership.granted", 1] => :AuditLogsPrivateIncidentMembershipGrantedV1,
+      ["private_incident_membership.revoked", 1] => :AuditLogsPrivateIncidentMembershipRevokedV1,
+      ["private_incident_membership.upgraded_to_direct", 1] => :AuditLogsPrivateIncidentMembershipUpgradedToDirectV1,
+      ["private_incident_team_membership.granted", 1] => :AuditLogsPrivateIncidentTeamMembershipGrantedV1,
+      ["private_incident_team_membership.revoked", 1] => :AuditLogsPrivateIncidentTeamMembershipRevokedV1,
+      ["private_insights.exported", 1] => :AuditLogsPrivateInsightsExportedV1,
+      ["private_insights.measure_queried", 1] => :AuditLogsPrivateInsightsMeasureQueriedV1,
+      ["private_insights.underlying_data_queried", 1] => :AuditLogsPrivateInsightsUnderlyingDataQueriedV1,
+      ["qr_code_mobile_login_setting.updated", 1] => :AuditLogsQrCodeMobileLoginSettingUpdatedV1,
+      ["rbac_role.created", 1] => :AuditLogsRbacRoleCreatedV1,
+      ["rbac_role.deleted", 1] => :AuditLogsRbacRoleDeletedV1,
+      ["rbac_role.updated", 1] => :AuditLogsRbacRoleUpdatedV1,
+      ["schedule.created", 1] => :AuditLogsScheduleCreatedV1,
+      ["schedule.deleted", 1] => :AuditLogsScheduleDeletedV1,
+      ["schedule.updated", 1] => :AuditLogsScheduleUpdatedV1,
+      ["schedule_override.created", 1] => :AuditLogsScheduleOverrideCreatedV1,
+      ["schedule_override.created", 2] => :AuditLogsScheduleOverrideCreatedV2,
+      ["schedule_override.deleted", 1] => :AuditLogsScheduleOverrideDeletedV1,
+      ["schedule_override.deleted", 2] => :AuditLogsScheduleOverrideDeletedV2,
+      ["schedule_override.updated", 1] => :AuditLogsScheduleOverrideUpdatedV1,
+      ["schedule_override.updated", 2] => :AuditLogsScheduleOverrideUpdatedV2,
+      ["schedule_sync_rule.created", 1] => :AuditLogsScheduleSyncRuleCreatedV1,
+      ["schedule_sync_rule.deleted", 1] => :AuditLogsScheduleSyncRuleDeletedV1,
+      ["schedule_sync_rule.updated", 1] => :AuditLogsScheduleSyncRuleUpdatedV1,
+      ["schedule_sync_target.created", 1] => :AuditLogsScheduleSyncTargetCreatedV1,
+      ["schedule_sync_target.deleted", 1] => :AuditLogsScheduleSyncTargetDeletedV1,
+      ["schedule_sync_target.updated", 1] => :AuditLogsScheduleSyncTargetUpdatedV1,
+      ["scim_group.role_mappings_updated", 1] => :AuditLogsScimGroupRoleMappingsUpdatedV1,
+      ["scim_group.seat_mappings_updated", 1] => :AuditLogsScimGroupSeatMappingsUpdatedV1,
+      ["secret.created", 1] => :AuditLogsSecretCreatedV1,
+      ["secret.deleted", 1] => :AuditLogsSecretDeletedV1,
+      ["secret.reference_added", 1] => :AuditLogsSecretReferenceAddedV1,
+      ["secret.reference_removed", 1] => :AuditLogsSecretReferenceRemovedV1,
+      ["secret.rotated", 1] => :AuditLogsSecretRotatedV1,
+      ["secret.updated", 1] => :AuditLogsSecretUpdatedV1,
+      ["severity.created", 1] => :AuditLogsSeverityCreatedV1,
+      ["severity.deleted", 1] => :AuditLogsSeverityDeletedV1,
+      ["severity.updated", 1] => :AuditLogsSeverityUpdatedV1,
+      ["status_page.created", 1] => :AuditLogsStatusPageCreatedV1,
+      ["status_page.deleted", 1] => :AuditLogsStatusPageDeletedV1,
+      ["status_page.updated", 1] => :AuditLogsStatusPageUpdatedV1,
+      ["status_page_sub_page.created", 1] => :AuditLogsStatusPageSubPageCreatedV1,
+      ["status_page_sub_page.deleted", 1] => :AuditLogsStatusPageSubPageDeletedV1,
+      ["status_page_sub_page.updated", 1] => :AuditLogsStatusPageSubPageUpdatedV1,
+      ["status_page_template.created", 1] => :AuditLogsStatusPageTemplateCreatedV1,
+      ["status_page_template.deleted", 1] => :AuditLogsStatusPageTemplateDeletedV1,
+      ["status_page_template.updated", 1] => :AuditLogsStatusPageTemplateUpdatedV1,
+      ["team_role.created", 1] => :AuditLogsTeamRoleCreatedV1,
+      ["team_role.deleted", 1] => :AuditLogsTeamRoleDeletedV1,
+      ["team_role.updated", 1] => :AuditLogsTeamRoleUpdatedV1,
+      ["team_settings.updated", 1] => :AuditLogsTeamSettingsUpdatedV1,
+      ["telemetry_data_source.access_mode_changed", 1] => :AuditLogsTelemetryDataSourceAccessModeChangedV1,
+      ["telemetry_data_source.access_policy_changed", 1] => :AuditLogsTelemetryDataSourceAccessPolicyChangedV1,
+      ["telemetry_data_source.installed", 1] => :AuditLogsTelemetryDataSourceInstalledV1,
+      ["telemetry_data_source.queried", 1] => :AuditLogsTelemetryDataSourceQueriedV1,
+      ["telemetry_data_source.queried", 2] => :AuditLogsTelemetryDataSourceQueriedV2,
+      ["telemetry_data_source.requested", 1] => :AuditLogsTelemetryDataSourceRequestedV1,
+      ["telemetry_data_source.tool_access_changed", 1] => :AuditLogsTelemetryDataSourceToolAccessChangedV1,
+      ["telemetry_data_source.tool_overrides_changed", 1] => :AuditLogsTelemetryDataSourceToolOverridesChangedV1,
+      ["telemetry_data_source.uninstalled", 1] => :AuditLogsTelemetryDataSourceUninstalledV1,
+      ["telemetry_data_source.write_access_granted", 1] => :AuditLogsTelemetryDataSourceWriteAccessGrantedV1,
+      ["telemetry_data_source.write_access_revoked", 1] => :AuditLogsTelemetryDataSourceWriteAccessRevokedV1,
+      ["timeline_item.deleted", 1] => :AuditLogsTimelineItemDeletedV1,
+      ["twilio_connection.created", 1] => :AuditLogsTwilioConnectionCreatedV1,
+      ["twilio_connection.deleted", 1] => :AuditLogsTwilioConnectionDeletedV1,
+      ["twilio_connection.updated", 1] => :AuditLogsTwilioConnectionUpdatedV1,
+      ["user.created", 1] => :AuditLogsUserCreatedV1,
+      ["user.deactivated", 1] => :AuditLogsUserDeactivatedV1,
+      ["user.logged_in", 1] => :AuditLogsUserLoggedInV1,
+      ["user.reinstated", 1] => :AuditLogsUserReinstatedV1,
+      ["user.role_memberships_updated", 1] => :AuditLogsUserRoleMembershipsUpdatedV1,
+      ["user.updated", 1] => :AuditLogsUserUpdatedV1,
+      ["workflow.created", 1] => :AuditLogsWorkflowCreatedV1,
+      ["workflow.deleted", 1] => :AuditLogsWorkflowDeletedV1,
+      ["workflow.updated", 1] => :AuditLogsWorkflowUpdatedV1
+    }.freeze
+  end
+end