Protobuf

// Represent an activity or event that happened in the system.
message Activity {
  // Globally unique ID (UUID) identifying an activity.
  // In HUE, this is generated when an activity record is converted from raw 
  // log to Parquet row.
  string id = 1;

  // The globally unique ID of a user operation in which the activity is a part 
  // of. A user operation is an ordered sequence of individual activities.
  // In HUE, this is roughly equivalent to "correlationId".
  string userOperationId = 2;

  // 0-based sequence number of the activity within the process identified by
  // processId. There is no equivalent field in HUE. In HUE, activities with
  // the same "correlationId" is ordered by timestamp. 
  // Same sequence number with the same processId suggests that the activities
  // happened in parallel.
  uint32 sequenceNo = 3;

  // UNIX timestamp recording the time the activity/event happened.
  uint64 timestamp = 4;

  // IANA TZ database code (e.g. "Asia/Tokyo")
  string timeZone = 5;

  // The context of the activity, mostly containing request information, e.g.
  // host, user-agent, HTTP method, URL, referer, request token, session token,
  // etc.
  Map context = 6;

  // The user that does the activity/participate in an event.
  User actor = 7;

  // The detail of the activity being done by the actor. 
  ActivityClause activity = 8;

  // The location where the activity/event happened.
  Location location = 9;

  // The ID of the multililngual template for the text that describes 
  // the activity.
  string description = 10;

  // The original user that impersonates the actor.
  User impersonator = 11;

}

// A collection of key and value pair, with additional metadata to describe 
// the data type of the value.
message Map {
  // the collection of pairs.
  repeated Pair entries = 1;

  // The pair of String key and (typed) value.
  message Pair {
    string key = 1;
    Value value = 2;
    //...
  }

  //...
}

    // the actual content of the value stored in
    message Value {
      // data type of the value's content
      enum ValueType {
        DOUBLE = 0;
        FLOAT = 1;
        INT32 = 2;
        INT64 = 3;
        UINT32 = 4;
        UINT64 = 5;
        SINT32 = 6;
        SINT64 = 7;
        FIXED32 = 8;
        FIXED64 = 9;
        SFIXED32 = 10;
        SFIXED64 = 11;
        BOOL = 12;
        STRING = 13;
        MULTILINGUAL_TEXT = 14;
        BYTES = 15;
        MAP = 16;
        Nil = 17; // used when the the content needs to be explicitly set as empty.
        LIST = 18;
        TIMESTAMP = 19; // unix timestamp (down to second)
      }

      // Data type mostly equivalent to Protobuf's built-in types,
      // with some additional type meaningful only for audit system.
      ValueType type = 1;
      oneof content {
        double doubleValue = 2;
        float floatValue = 3;
        int32 int32Value = 4;
        int64 int64Value = 5;
        uint32 uint32Value = 6;
        uint64 uint64Value = 7;
        sint32 sint32Value = 8;
        sint64 sint64Value = 9;
        fixed32 fixed32Value = 10;
        fixed64 fixed64Value = 11;
        sfixed32 sfixed32Value = 12;
        sfixed64 sfixed64Value = 13;
        bool boolValue = 14;
        string stringValue = 15;
        // Multilingual text ID. The value stored should be used as 
        // a reference to get the actual text in a specific language
        // used when viewing the data.
        string multilingualTextValue = 16;
        bytes bytesValue = 17;
        Map mapValue = 18;
        ValueList listValue = 19;
        // unix timestamp (down to second)
        uint64 timestampValue = 20;
      }
    }

    message ValueList {
      repeated Value value = 1;
    }

// Represent a user that does an activity, participate in an event, or be
// a target in an activity.
// Examples:
// When the user does an activity: _Alice_ submit an application.
// When a user becomes a target of an activity: 
message User {
  string id = 1;
  string name = 2;
  UserType type = 3;

  enum UserType {
    USER = 0; // Standard user of the system.
    CLIENT = 1; // Access using client ID/API key.
  }
  // Data source (DB, schema, table) that the ID is refering to. 
  string ref = 4;
}

// Represent a location where an activity/event happened, or a location
// that is a target of an activity. This can represent a service, 
// a subsystem, a page, an organizational unit, etc.
// Examples:
// Where an activity happened: Login is authenticated in the _auth_ system.
// When becoming a target of an activity: Alice disabled the access to the 
// _accounting_system_. 
message Location {
  // The ID of a location.
  string id = 1;
  // Optional ID of the multilingual description of the location with ID as 
  // specified, or the name as is (not to be resolved to multilingual value).
  oneof name {
    string value = 2;
    bool nil = 3;
  }
  // Data source (DB, schema, table) that the ID is refering to. 
  string ref = 4;
}

message ActivityClause {

  ActivityCategory category = 1;
  ActivityVerb verb = 2;
  ActivityVocabulary object = 3;
  ActivityVocabulary specifier = 4;
  ActivityVocabulary preposition = 5;
  
  // ......

}

message ActivityClause {

  // ......  

  // The actual data content of the activity. Depending on the type of activity,
  // the data might be stored in on of the following structures.
  oneof extension {
    DataActivity data = 7;
    WebActivity web = 8;
    // authentication and account category uses AccountActivity extension
    AccountActivity account = 9;
    AuthorityActivity authorization = 10;
    ApprovalActivity approval = 11;
    ReportActivity report = 12;
  }
  
}

message ActivityClause {

  // ......  

  repeated SubActivityClause aliases = 13;

  // Represents an alias of the ActivityClause
  message SubActivityClause {
    ActivityCategory category = 1;
    ActivityVerb verb = 2;
    ActivityVocabulary object = 3;
    ActivityVocabulary specifier = 4;
    ActivityVocabulary preposition = 5;
  }
  
}