@openauditmodel/cli 0.4.0 → 0.4.2

package/examples/valid/access-request-approval.json

@@ -0,0 +1,47 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1b5c-ab6e-7072-be5f-8d9c0b1a2f3e",
+  "time": "2026-03-16T14:07:52.118Z",
+  "event": {
+    "name": "iam.access-request.approve",
+    "category": "identity-and-access",
+    "type": "approve",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "Access request approved after review by two approvers in a separate service."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-approver-88"
+  },
+  "subject": {
+    "type": "user",
+    "id": "user-4471"
+  },
+  "resource": {
+    "type": "entitlement",
+    "id": "entitlement-finance-reporting"
+  },
+  "application": {
+    "name": "access-governance",
+    "service": "approval-service",
+    "environment": "production"
+  },
+  "approval": {
+    "status": "approved",
+    "workflowId": "wf-access-review-v3",
+    "requestId": "ar-2026-0912",
+    "requiredApprovals": 2,
+    "receivedApprovals": 2,
+    "approvedAt": "2026-03-16T14:07:51.902Z"
+  },
+  "request": {
+    "requestId": "req-c41f09",
+    "correlationId": "access-request-2026-0912",
+    "traceId": "5c6d7e8f90a1b2c3d4e5f60718293a4b",
+    "spanId": "4d5e6f7081920304",
+    "protocol": "https",
+    "method": "POST",
+    "route": "/access-requests/{accessRequestId}/approvals"
+  }
+}

package/examples/valid/document-external-share.json

@@ -0,0 +1,92 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1b70-2c18-7f3a-b46d-5e8a1c9d0b12",
+  "time": "2026-03-14T11:47:52.108Z",
+  "event": {
+    "name": "document.share.create",
+    "category": "data-access",
+    "type": "share",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "Confidential document shared with an external recipient."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-5120",
+    "tenantId": "tenant-7",
+    "roles": ["contributor"]
+  },
+  "resource": {
+    "type": "document",
+    "id": "document-90311",
+    "name": "quarterly-supplier-agreement",
+    "parentId": "workspace-14",
+    "classification": "confidential",
+    "ownerId": "user-4004",
+    "tenantId": "tenant-7"
+  },
+  "relatedResources": [
+    {
+      "type": "share-link",
+      "id": "share-6f21a9"
+    }
+  ],
+  "application": {
+    "name": "document-service",
+    "environment": "production",
+    "version": "2.11.0"
+  },
+  "organization": {
+    "tenantId": "tenant-7",
+    "workspaceId": "workspace-14"
+  },
+  "authentication": {
+    "method": "oidc",
+    "provider": "corporate-idp",
+    "mfa": true,
+    "assuranceLevel": "high",
+    "sessionId": "session-b71f"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "external-sharing",
+    "policyVersion": "12",
+    "permissions": ["document.share.create"]
+  },
+  "request": {
+    "requestId": "request-a91c4f",
+    "correlationId": "correlation-7712",
+    "traceId": "4bf92f3577b34da6a3ce929d0e0e4736",
+    "spanId": "00f067aa0ba902b7",
+    "protocol": "https",
+    "method": "POST",
+    "route": "/workspaces/{workspaceId}/documents/{documentId}/shares"
+  },
+  "reason": {
+    "code": "customer-request",
+    "text": "Supplier requested the countersigned agreement.",
+    "reference": "support-case-3391"
+  },
+  "privacy": {
+    "containsPersonalData": true,
+    "dataCategories": ["identifier", "contact"],
+    "processing": "mask",
+    "minimized": true,
+    "purpose": "access-transparency"
+  },
+  "controlCategories": ["external-data-sharing", "data-access-logging"],
+  "tags": ["external-sharing"],
+  "metadata": {
+    "recipientType": "external",
+    "recipientDomain": "example.net",
+    "recipientCount": 1,
+    "grantedPermission": "view",
+    "expiresAt": "2026-03-21T11:47:52Z",
+    "passwordProtected": true,
+    "watermarkApplied": true,
+    "downloadAllowed": false
+  },
+  "extensions": {
+    "com.example.document.retention.class": "contract-standard"
+  }
+}

package/examples/valid/incident-case-close.json

@@ -0,0 +1,114 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1b88-9d02-7a61-9f3c-2b7e5d4a6c88",
+  "time": "2026-03-15T08:15:03Z",
+  "observedTime": "2026-03-15T08:15:04.221Z",
+  "event": {
+    "name": "incident.case.close",
+    "category": "workflow",
+    "type": "update",
+    "outcome": "success",
+    "severity": "medium",
+    "summary": "Major incident closed after the root cause analysis was approved."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-3301",
+    "roles": ["incident-manager"]
+  },
+  "resource": {
+    "type": "incident",
+    "id": "incident-2026-0418",
+    "name": "checkout-latency-degradation",
+    "classification": "internal"
+  },
+  "relatedResources": [
+    {
+      "type": "service",
+      "id": "service-checkout"
+    },
+    {
+      "type": "root-cause-analysis",
+      "id": "rca-2026-0418"
+    }
+  ],
+  "application": {
+    "name": "incident-service",
+    "environment": "production",
+    "version": "5.2.0"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "incident-closure",
+    "permissions": ["incident.case.close"]
+  },
+  "approval": {
+    "status": "approved",
+    "workflowId": "workflow-incident-closure",
+    "requestId": "approval-request-9921",
+    "requiredApprovals": 2,
+    "receivedApprovals": 2,
+    "approvers": [
+      {
+        "type": "user",
+        "id": "user-1180",
+        "roles": ["service-owner"]
+      },
+      {
+        "type": "user",
+        "id": "user-2245",
+        "roles": ["problem-manager"]
+      }
+    ],
+    "approvedAt": "2026-03-15T08:12:40Z"
+  },
+  "request": {
+    "requestId": "request-51f0c2",
+    "correlationId": "correlation-incident-2026-0418",
+    "traceId": "0af7651916cd43dd8448eb211c80319c",
+    "spanId": "b7ad6b7169203331",
+    "protocol": "https",
+    "method": "POST",
+    "route": "/incidents/{incidentId}/close"
+  },
+  "change": {
+    "type": "update",
+    "changedFields": ["status", "closedAt"],
+    "before": {
+      "status": "resolved"
+    },
+    "after": {
+      "status": "closed"
+    },
+    "ticketId": "change-7742",
+    "incidentId": "incident-2026-0418"
+  },
+  "reason": {
+    "code": "resolution-verified",
+    "text": "Corrective action verified in production for seven consecutive days.",
+    "reference": "rca-2026-0418"
+  },
+  "evidence": [
+    {
+      "type": "document",
+      "reference": "records/root-cause-analysis/rca-2026-0418",
+      "hash": "9f2a4c1d5e6b7a8c9d0e1f2a3b4c5d6e7f8091a2b3c4d5e6f708192a3b4c5d6e",
+      "contentType": "application/pdf",
+      "createdAt": "2026-03-14T17:30:00Z",
+      "retentionUntil": "2033-03-14T00:00:00Z",
+      "legalHold": false
+    },
+    {
+      "type": "approval",
+      "reference": "workflow-incident-closure/approval-request-9921"
+    }
+  ],
+  "controlCategories": ["incident-traceability", "change-approval"],
+  "metadata": {
+    "previousStatus": "resolved",
+    "newStatus": "closed",
+    "priority": "p1",
+    "impactedServiceCount": 1,
+    "timeToResolveMinutes": 214
+  }
+}

package/examples/valid/kafka-consumer-offset-reset.json

@@ -0,0 +1,105 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1ba3-0d77-7b42-a915-3c6e8f0d1b24",
+  "time": "2026-03-17T03:41:26Z",
+  "observedTime": "2026-03-17T03:41:27.014Z",
+  "sequence": 4,
+  "event": {
+    "name": "kafka.consumer.offset-reset",
+    "category": "data-infrastructure",
+    "type": "execute",
+    "outcome": "success",
+    "severity": "critical",
+    "summary": "Consumer group offsets reset on a production topic partition during incident recovery."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-6612",
+    "roles": ["streaming-operator"]
+  },
+  "resource": {
+    "type": "consumer-group",
+    "id": "payments-settlement-consumer",
+    "parentId": "cluster-streaming-production",
+    "classification": "internal"
+  },
+  "relatedResources": [
+    {
+      "type": "topic",
+      "id": "payments.settlement.completed",
+      "parentId": "cluster-streaming-production",
+      "classification": "confidential"
+    },
+    {
+      "type": "cluster",
+      "id": "cluster-streaming-production"
+    }
+  ],
+  "application": {
+    "name": "streaming-control-service",
+    "environment": "production",
+    "version": "1.8.2",
+    "region": "region-1"
+  },
+  "authentication": {
+    "method": "oidc",
+    "provider": "corporate-idp",
+    "mfa": true
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "streaming-privileged-operation",
+    "permissions": ["consumer-group.offset.reset"]
+  },
+  "approval": {
+    "status": "approved",
+    "workflowId": "workflow-incident-change",
+    "requiredApprovals": 1,
+    "receivedApprovals": 1,
+    "approvers": [
+      {
+        "type": "user",
+        "id": "user-1180",
+        "roles": ["incident-commander"]
+      }
+    ],
+    "approvedAt": "2026-03-17T03:39:12Z"
+  },
+  "request": {
+    "requestId": "request-6f0b31",
+    "correlationId": "correlation-incident-2026-0431",
+    "traceId": "3c1a9d5e7f0b2468ac13579bdf024680",
+    "spanId": "9d5e7f0b24681357",
+    "protocol": "https",
+    "method": "POST",
+    "route": "/clusters/{clusterId}/consumer-groups/{consumerGroupId}/offsets"
+  },
+  "change": {
+    "type": "execute",
+    "changedFields": ["offset"],
+    "before": {
+      "offset": 918273645
+    },
+    "after": {
+      "offset": 918200000
+    },
+    "ticketId": "change-8123",
+    "incidentId": "incident-2026-0431"
+  },
+  "reason": {
+    "code": "incident-recovery",
+    "text": "Reprocessing required after an unprocessable message blocked the settlement consumers.",
+    "reference": "incident-2026-0431"
+  },
+  "controlCategories": ["privileged-access", "change-approval", "incident-traceability"],
+  "tags": ["production", "incident-response"],
+  "metadata": {
+    "brokerType": "kafka",
+    "partition": 7,
+    "previousOffset": 918273645,
+    "newOffset": 918200000,
+    "resetStrategy": "to-offset",
+    "estimatedReprocessedMessages": 73645
+  }
+}

package/examples/valid/minimal-event.json

@@ -0,0 +1,22 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1b5c-6d2a-7c3e-9a1b-4f5e6d7c8b9a",
+  "time": "2026-03-14T09:24:31.412Z",
+  "event": {
+    "name": "data.record.update",
+    "category": "data-modification",
+    "outcome": "success"
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-123"
+  },
+  "resource": {
+    "type": "record",
+    "id": "resource-123"
+  },
+  "application": {
+    "name": "application-service",
+    "environment": "production"
+  }
+}

package/examples/valid/nightly-reconciliation-job.json

@@ -0,0 +1,33 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1b5c-9a5d-7f61-ad4e-7c8b9a0f1e2d",
+  "time": "2026-03-14T02:00:12.004Z",
+  "event": {
+    "name": "billing.reconciliation.complete",
+    "category": "data-modification",
+    "type": "execute",
+    "outcome": "partial",
+    "severity": "medium",
+    "summary": "Nightly reconciliation completed with a subset of ledger entries deferred."
+  },
+  "actor": {
+    "type": "system",
+    "id": "reconciliation-scheduler"
+  },
+  "resource": {
+    "type": "ledger",
+    "id": "ledger-primary"
+  },
+  "application": {
+    "name": "billing-service",
+    "service": "reconciliation-job",
+    "environment": "production"
+  },
+  "request": {
+    "correlationId": "nightly-reconciliation-2026-03-14"
+  },
+  "metadata": {
+    "recordsProcessed": 4187,
+    "recordsDeferred": 12
+  }
+}

package/examples/valid/order-api-publish.json

@@ -0,0 +1,34 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1b5c-7e3b-7d4f-8b2c-5a6f7e8d9c0b",
+  "time": "2026-03-14T09:24:31.412Z",
+  "event": {
+    "name": "order.submission.accept",
+    "category": "data-modification",
+    "type": "create",
+    "outcome": "success",
+    "summary": "Order accepted over the public API and queued for fulfilment."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-4471"
+  },
+  "resource": {
+    "type": "order",
+    "id": "order-2026-004418"
+  },
+  "application": {
+    "name": "order-api",
+    "service": "order-api",
+    "environment": "production"
+  },
+  "request": {
+    "requestId": "req-8f2c41",
+    "correlationId": "order-process-9d41c7a2",
+    "traceId": "4bf92f3577b34da6a3ce929d0e0e4736",
+    "spanId": "1a2b3c4d5e6f7081",
+    "protocol": "https",
+    "method": "POST",
+    "route": "/orders"
+  }
+}

package/examples/valid/order-consumer-new-trace.json

@@ -0,0 +1,36 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1b5c-8f4c-7e50-9c3d-6b7a8f9e0d1c",
+  "time": "2026-03-14T09:24:33.907Z",
+  "event": {
+    "name": "order.fulfilment.start",
+    "category": "data-modification",
+    "type": "execute",
+    "outcome": "success",
+    "summary": "Fulfilment worker began processing an order consumed from the queue."
+  },
+  "actor": {
+    "type": "service",
+    "id": "fulfilment-worker"
+  },
+  "resource": {
+    "type": "order",
+    "id": "order-2026-004418"
+  },
+  "application": {
+    "name": "fulfilment-worker",
+    "service": "fulfilment-worker",
+    "environment": "production"
+  },
+  "request": {
+    "correlationId": "order-process-9d41c7a2",
+    "traceId": "9f8e7d6c5b4a39281706f5e4d3c2b1a0",
+    "spanId": "3c4d5e6f708192a3",
+    "protocol": "amqp"
+  },
+  "extensions": {
+    "org.openauditmodel.correlation": {
+      "causes": [{ "type": "audit-event", "id": "018f1b5c-7e3b-7d4f-8b2c-5a6f7e8d9c0b" }]
+    }
+  }
+}

package/examples/valid/privileged-configuration-change.json

@@ -0,0 +1,109 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1b95-4411-7c09-8d7a-6f1e2c3b4a50",
+  "time": "2026-03-16T22:04:09.882Z",
+  "sequence": 10428,
+  "event": {
+    "name": "configuration.setting.update",
+    "category": "configuration",
+    "type": "update",
+    "outcome": "success",
+    "severity": "critical",
+    "summary": "Session lifetime reduced on the production authentication configuration."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "admin-0091",
+    "roles": ["platform-administrator"]
+  },
+  "resource": {
+    "type": "configuration",
+    "id": "configuration-authentication-session",
+    "name": "authentication-session-policy",
+    "parentId": "cluster-production-1",
+    "classification": "restricted"
+  },
+  "application": {
+    "name": "platform-control-service",
+    "environment": "production",
+    "version": "9.0.3",
+    "instance": "instance-7c1a",
+    "region": "region-1",
+    "zone": "zone-a"
+  },
+  "authentication": {
+    "method": "mfa",
+    "provider": "corporate-idp",
+    "mfa": true,
+    "assuranceLevel": "high",
+    "authenticatedAt": "2026-03-16T21:58:31Z"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "privileged-configuration-change",
+    "policyVersion": "23",
+    "reason": "Actor holds the platform administrator role within an approved change window.",
+    "permissions": ["configuration.setting.update"]
+  },
+  "approval": {
+    "status": "approved",
+    "workflowId": "workflow-emergency-change",
+    "requestId": "approval-request-6120",
+    "requiredApprovals": 2,
+    "receivedApprovals": 2,
+    "approvers": [
+      {
+        "type": "user",
+        "id": "user-1180",
+        "roles": ["change-manager"]
+      },
+      {
+        "type": "user",
+        "id": "user-7702",
+        "roles": ["security-officer"]
+      }
+    ],
+    "approvedAt": "2026-03-16T22:01:55Z"
+  },
+  "request": {
+    "requestId": "request-cc10ab",
+    "traceId": "8a3c60f7d188f8fa79d48a391a778fa6",
+    "spanId": "5f3d2b1a0c9e8d7f",
+    "protocol": "https",
+    "method": "PATCH",
+    "route": "/clusters/{clusterId}/configurations/{configurationId}"
+  },
+  "change": {
+    "type": "update",
+    "changedFields": ["sessionLifetimeMinutes", "requireReauthenticationForPrivilegedActions"],
+    "before": {
+      "sessionLifetimeMinutes": 720,
+      "requireReauthenticationForPrivilegedActions": false
+    },
+    "after": {
+      "sessionLifetimeMinutes": 60,
+      "requireReauthenticationForPrivilegedActions": true
+    },
+    "ticketId": "change-9910",
+    "deploymentId": "deployment-2026-03-16-3"
+  },
+  "reason": {
+    "code": "security-hardening",
+    "text": "Session lifetime reduced following a security review finding.",
+    "reference": "change-9910"
+  },
+  "integrity": {
+    "canonicalization": "RFC8785",
+    "hashAlgorithm": "SHA-256",
+    "hash": "7438093aa44b48f0b692e6d77de03fbf8bc823ac5442ce294bea5b9bfa06c77e",
+    "previousHash": "5c9a1f3e7b204d68a1c5e9f0b3d7a2c48e6f0b9d1a3c5e7f9b0d2a4c6e8f0b13",
+    "chainId": "chain-platform-control-service-instance-7c1a"
+  },
+  "controlCategories": ["privileged-access", "configuration-integrity", "change-approval"],
+  "tags": ["production", "emergency-change"],
+  "metadata": {
+    "changeWindow": "emergency",
+    "reviewReference": "security-review-2026-02"
+  }
+}

package/examples/valid/service-account-data-export.json

@@ -0,0 +1,83 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1bb1-6e35-7d18-9c40-8a2f4b6d0e91",
+  "time": "2026-03-18T06:12:44.501Z",
+  "event": {
+    "name": "data.export.create",
+    "category": "data-access",
+    "type": "read",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "Scheduled export generated for a report previously requested by the subject."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-account-reporting-worker",
+    "attributes": {
+      "workloadType": "batch"
+    }
+  },
+  "subject": {
+    "type": "user",
+    "id": "user-8842",
+    "tenantId": "tenant-19"
+  },
+  "delegation": {
+    "type": "on-behalf-of",
+    "reason": "Deferred execution of an export requested by the subject.",
+    "reference": "export-request-4471"
+  },
+  "resource": {
+    "type": "report",
+    "id": "export-4471",
+    "name": "customer-activity-monthly",
+    "classification": "confidential",
+    "ownerId": "user-8842",
+    "tenantId": "tenant-19"
+  },
+  "application": {
+    "name": "reporting-service",
+    "environment": "production",
+    "version": "4.6.0",
+    "component": "export-worker"
+  },
+  "organization": {
+    "tenantId": "tenant-19"
+  },
+  "authentication": {
+    "method": "service-account",
+    "provider": "workload-identity",
+    "mfa": false
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "report-export",
+    "permissions": ["report.export"]
+  },
+  "request": {
+    "requestId": "request-e41b70",
+    "correlationId": "export-request-4471",
+    "traceId": "d4f1a08c2b6e39571ace0246813579bd",
+    "spanId": "2b6e39571ace0246"
+  },
+  "reason": {
+    "code": "customer-request",
+    "text": "Monthly activity report requested through the self-service portal.",
+    "reference": "export-request-4471"
+  },
+  "privacy": {
+    "containsPersonalData": true,
+    "dataCategories": ["identifier", "contact", "behavioral"],
+    "processing": "reference",
+    "minimized": true,
+    "retentionClass": "standard",
+    "purpose": "operational-audit"
+  },
+  "controlCategories": ["data-access-logging", "external-data-sharing"],
+  "metadata": {
+    "exportFormat": "csv",
+    "recordCount": 12480,
+    "deliveryChannel": "secure-download",
+    "expiresAt": "2026-03-25T06:12:44Z"
+  }
+}