Analytics events

This file is generated. Run make events to regenerate it, and commit the result.
CI fails when it is out of date. Edit the event declarations in each service, not this file.

Every product analytics event Arcade emits, and what each of its properties carries. This is the bill of materials for a self-hosted deployment: it states, property by property, what leaves a customer's cluster.

A hashed value is a deployment-keyed HMAC, so it groups a customer's own events together without being reversible to the original and without matching the same value from another deployment.

Arcade Cloud emits every property verbatim; dispositions apply only where the event crosses out of a customer's network.

Coverage: 55 declared events, 418 properties (300 allow, 78 hash, 40 deny).

These are not part of any one event. Middleware attaches each bundle to every event emitted while serving the surface it describes, so they reach the wire alongside whatever the event itself declares.

Is attached to every event emitted while serving an authenticated HTTP API request.

Attached by engine — declared in apps/engine/internal/usage/events/ambient.go.

Is attached to every event emitted while serving an MCP gateway request, so gateway-scoped reporting works without each call site having to know which gateway it is inside.

Attached by engine — declared in apps/engine/internal/usage/events/ambient.go.

Is attached to every event emitted while serving a stateless MCP request, carrying the protocol version the client declared in its headers.

Attached by engine — declared in apps/engine/internal/usage/events/ambient.go.

A person signed up. $set is a PostHog convention, not an ordinary property: its contents are written to the person record rather than the event.

Emitted by coordinator — declared in apps/coordinator/arcade/app/usage/events/_events.py.

Reports every authenticated request to the Engine's HTTP API. It is the platform's highest-volume event by an order of magnitude. The client properties come from the SDK's own headers and describe the integration, not the person using it, so they are disclosed. The caller's IP address identifies a customer's own network and is not.

Emitted by engine — declared in apps/engine/internal/usage/events/api.go.

An API key was minted. api_key_type is set on the project-key path and arcade_client on the account path, so each is absent from the other's events.

Emitted by coordinator — declared in apps/coordinator/arcade/app/usage/events/_events.py.

Reports an agent telling us, in prose, what it could not do. Every free-text field is the agent's or the end user's own words about their work, so none of it leaves a self-hosted cluster; the tool and client identifiers around it are what make the report countable.

Emitted by engine — declared in apps/engine/internal/usage/events/tool_recommendation.go.

A customer opened a checkout session. Paired with Subscription updated, this is what makes the upgrade funnel measurable.

Emitted by coordinator — declared in apps/coordinator/arcade/app/usage/events/_events.py.

Reports a deployment pointing user verification at its own endpoint. operation distinguishes first configuration from a change or a removal.

Emitted by engine — declared in apps/engine/internal/usage/events/admin.go.

Reports a failure to confirm a user mid-flow. error is relayed from the Coordinator verbatim and can embed request detail, so it stays inside the cluster.

Emitted by engine — declared in apps/engine/internal/usage/events/auth.go.

Reports a provider flow test that did not complete.

Emitted by engine — declared in apps/engine/internal/usage/events/auth.go.

Reports an administrator beginning a provider flow test.

Emitted by engine — declared in apps/engine/internal/usage/events/auth.go.

Reports a provider flow test that completed.

Emitted by engine — declared in apps/engine/internal/usage/events/auth.go.

Reports a new MCP gateway being configured.

Emitted by engine — declared in apps/engine/internal/usage/events/gateway.go.

Reports a gateway being removed.

Emitted by engine — declared in apps/engine/internal/usage/events/gateway.go.

Reports a change to an existing gateway. The previous_* properties appear only when that field actually changed, so the per-gateway timeline can distinguish a first assignment from a reassignment or an unbind without carrying a duplicate property on every update.

Emitted by engine — declared in apps/engine/internal/usage/events/gateway.go.

Reports a hook that could not run. error is the raw error from customer-supplied extension code, so it stays inside the cluster.

Emitted by engine — declared in apps/engine/internal/usage/events/hooks.go.

Reports a hook that ran, whether it allowed or denied. A denial is a successful execution — hook_result is what separates them.

Emitted by engine — declared in apps/engine/internal/usage/events/hooks.go.

Reports an agent asking which applications are available.

Emitted by engine — declared in apps/engine/internal/usage/events/mcp.go.

Reports a tool call that stopped to ask the caller for authorization. The tool did not run, so this is not a successful call.

Emitted by engine — declared in apps/engine/internal/usage/events/mcp.go.

Reports an agent telling us it could not find a tool for what it was trying to do.

Emitted by engine — declared in apps/engine/internal/usage/events/mcp.go.

Reports authorization links being handed to an agent.

Emitted by engine — declared in apps/engine/internal/usage/events/mcp.go.

Reports an agent reading authorization status without being offered anything to complete.

Emitted by engine — declared in apps/engine/internal/usage/events/mcp.go.

Reports an end user filing a capability request through a gateway's Private Registry.

Emitted by engine — declared in apps/engine/internal/usage/events/mcp.go.

Reports an end user supporting another user's capability request through a gateway's Private Registry.

Emitted by engine — declared in apps/engine/internal/usage/events/mcp.go.

Reports an end user reading either the gateway's suggestion list or their own source-scoped submissions.

Emitted by engine — declared in apps/engine/internal/usage/events/mcp.go.

Reports a client listing what a gateway offers, which is the step before it calls anything.

Emitted by engine — declared in apps/engine/internal/usage/events/mcp.go.

Reports an agent completing the MCP handshake against a gateway. client_requested_protocol_version is what the client asked for, which can differ from the protocol_version that was negotiated.

Emitted by engine — declared in apps/engine/internal/usage/events/mcp.go.

Reports a tool invoked through an MCP gateway returning without a transport-level failure.

Emitted by engine — declared in apps/engine/internal/usage/events/mcp.go.

Reports an agent asking which tools suit a task.

Emitted by engine — declared in apps/engine/internal/usage/events/mcp.go.

Reports an agent running a tool through the recommendation builtin rather than calling it by name.

Emitted by engine — declared in apps/engine/internal/usage/events/mcp.go.

A client registered against Arcade's OAuth server. Dynamic Client Registration is unauthenticated, so this is a system event with no user context. The client's self-declared name and URI come from an unauthenticated request, so neither is disclosed.

Emitted by coordinator — declared in apps/coordinator/arcade/app/usage/events/_events.py.

Reports an auth provider being configured. provider_id is the well-known provider's name, or "custom" for one Arcade does not ship.

Emitted by engine — declared in apps/engine/internal/usage/events/admin.go.

Arcade Auth issued a token. Emitted only where a local account record exists, which is the static Arcade Auth flow. amr is the authentication methods reference from the identity provider: a bounded set of method names, not user data.

Emitted by coordinator — declared in apps/coordinator/arcade/app/usage/events/_events.py.

An organization's profile changed. Everything but the identifier is what a customer chose to call themselves, so only the identifier is disclosed.

Emitted by coordinator — declared in apps/coordinator/arcade/app/usage/events/_events.py.

A project was created. Emitted both on explicit creation and for the default project that comes with a new organization.

Emitted by coordinator — declared in apps/coordinator/arcade/app/usage/events/_events.py.

A project was removed.

Emitted by coordinator — declared in apps/coordinator/arcade/app/usage/events/_events.py.

A project's profile changed.

Emitted by coordinator — declared in apps/coordinator/arcade/app/usage/events/_events.py.

Reports a secret being written. It deliberately carries no properties: that a deployment manages secrets is the signal, and every attribute of one would describe the secret.

Emitted by engine — declared in apps/engine/internal/usage/events/admin.go.

Reports a tool server being registered. credential_mode is the joined set of credential sources an MCP server carries, which caps the property at eight values rather than the unbounded space a per-source list would produce. It is absent for HTTP servers, which always authenticate with a shared secret.

Emitted by engine — declared in apps/engine/internal/usage/events/admin.go.

Reports a worker deployment, sized by how many toolkits it carries.

Emitted by engine — declared in apps/engine/internal/usage/events/admin.go.

A customer's subscription changed.

Emitted by coordinator — declared in apps/coordinator/arcade/app/usage/events/_events.py.

Reports an execution that never produced a tool response — the call to the worker itself failed. arcade_error is the raw Go error, which routinely embeds upstream URLs and request bodies, so it stays inside the cluster.

Emitted by engine — declared in apps/engine/internal/usage/events/tool_execution.go.

Reports a tool the Engine ran to completion. The tool itself may still have returned an error, described by the execution_error_* properties; is_execution_success is what separates the two cases. execution_error and execution_error_dev_message relay text from the upstream provider verbatim, which in practice includes customer document IDs, URLs and request bodies, so neither leaves a self-hosted cluster. The bounded execution_error_kind is what makes a failure legible without them.

Emitted by engine — declared in apps/engine/internal/usage/events/tool_execution.go.

Reports an agent listing the applications available to it, and how many of them it is already connected to.

Emitted by engine — declared in apps/engine/internal/usage/events/tool_recommendation.go.

Reports a free-text search over the tool catalog.

Emitted by engine — declared in apps/engine/internal/usage/events/tool_recommendation.go.

Reports a task-driven tool selection. It opens the discovery-to-execution funnel: query_id is echoed back by the tr_use_tool event that follows, which is what links the two.

Emitted by engine — declared in apps/engine/internal/usage/events/tool_recommendation.go.

Reports a gateway tool execution alongside the recommendation that led to it. result_type distinguishes a tool that ran from one that stopped on an authorization challenge: a challenge returns successfully at the transport level but the tool never ran, so counting it as a success would inflate every execution rate with pending OAuth flows. toolkit and canonical_name are absent when the tool name does not parse, in which case tool_name holds the raw string rather than the event being dropped.

Emitted by engine — declared in apps/engine/internal/usage/events/tool_recommendation.go.

Reports a poll of a user's authorization status. It is by far the highest-volume auth event, since callers poll it while a flow is pending.

Emitted by engine — declared in apps/engine/internal/usage/events/auth.go.

Reports a user's identity being confirmed mid-flow, which is the step that binds an authorization to a specific end user.

Emitted by engine — declared in apps/engine/internal/usage/events/auth.go.

Reports an authorization flow that ended without a connection. failure_reason is a bounded set of causes, not a message from the provider.

Emitted by engine — declared in apps/engine/internal/usage/events/auth.go.

Reports a connection being deleted, which is the only event that marks a user withdrawing access to an integration.

Emitted by engine — declared in apps/engine/internal/usage/events/auth.go.

Reports the beginning of an authorization flow for a user.

Emitted by engine — declared in apps/engine/internal/usage/events/auth.go.

Reports an authorization flow that completed and produced a usable connection. flow_id is absent on the resume path, where a flow interrupted by a restart is picked back up and waited_duration_s reports how long that took instead.

Emitted by engine — declared in apps/engine/internal/usage/events/auth.go.

Someone was invited to a project. The role is the only dimension: who was invited is on the event's identity, not its properties.

Emitted by coordinator — declared in apps/coordinator/arcade/app/usage/events/_events.py.

A federated identity source was configured.

Emitted by coordinator — declared in apps/coordinator/arcade/app/usage/events/_events.py.

A federated identity source was removed.

Emitted by coordinator — declared in apps/coordinator/arcade/app/usage/events/_events.py.

A federated identity source changed.

Emitted by coordinator — declared in apps/coordinator/arcade/app/usage/events/_events.py.

• PostHog SDK autocapture ($pageview, $autocapture, $web_vitals, $ai_*, $identify) is generated inside the SDK, so it has no declaration to read.
• Marketing-site events are emitted from a separate repository and never run in a customer deployment.
• Events from services not yet migrated to declarations. The count above is what is declared, not everything Arcade sends today.