Event Log

An event log entry is generated by Control Plane, or by a platform component acting on your behalf (a Managed Kubernetes autoscaler reporting a failed scaling activity, for example); you do not create them directly. Most resource kinds expose a /-eventlog subresource that lists the events recorded against that one resource, newest first.

Example

cpln serviceaccount eventlog my-sa --org my-org -o json

{
  "kind": "list",
  "itemKind": "event",
  "items": [
    {
      "kind": "event",
      "id": "b1f6b6b0-6e3a-4b8a-8b3a-3a2b6b6b6b6b",
      "status": "serviceAccountUsed",
      "created": "2026-08-26T16:28:02.412Z",
      "lastEventTime": "2026-08-26T16:51:47.001Z",
      "eventCount": 3,
      "pinned": false,
      "context": {
        "component": "data-service",
        "fingerprint": "Xk9fQ2vR7mLpT0aZcY4bN1hW8eE1756224000",
        "keyName": "ci-key"
      }
    }
  ],
  "links": [
    { "rel": "self", "href": "/org/my-org/serviceaccount/my-sa/-eventlog" },
    { "rel": "target", "href": "/org/my-org/serviceaccount/my-sa" }
  ]
}

Fields

Field	Type	Description
`id`	string	Unique identifier for the event log entry.
`kind`	string	Always `event`.
`status`	string	Free-form status message, up to 400 characters.
`created`	date	When the event was first recorded.
`lastEventTime`	date	When the most recent duplicate of this event was folded in. `null` until a duplicate occurs.
`eventCount`	number	How many times this event has recurred within the deduplication window. Starts at `1` and increments on each duplicate.
`pinned`	boolean	When `true`, this event is exempt from deduplication; see Deduplication.
`context`	object	Free-form details about the event. See Context.

Context

Field	Type	Description
`category`	string	Free-form grouping for the event, such as `Deploy`.
`component`	string	The Control Plane component that recorded the event: `actuator`, `dns-updater`, `scheduler`, `iam-broker`, `metadata-proxy`, `data-service`, `mk8s`, or `other`.
`cloudProvider`	string	The cloud provider the event relates to, when applicable.
`cluster`	string	The location the event originated in, or absent for a globally scoped event.
`principalLink`	string	Reference to the principal that caused the event, when applicable.
`fingerprint`	string	Deduplication key chosen by the recording component, up to 64 characters. See Deduplication.

context also accepts additional fields specific to the component that recorded the event.

Deduplication

An event with a context.fingerprint is deduplicated against events already recorded for the same resource: at most one entry per fingerprint is recorded within a 24-hour window. A repeat within that window does not create a new entry; instead it increments the existing entry’s eventCount and updates its lastEventTime. The recording component chooses the fingerprint, and many components include a time bucket in it (for example, one hour), so a recurring condition can produce a new entry more often than once a day. Setting pinned: true exempts an event from this deduplication, so every occurrence is recorded as its own entry. Events with no fingerprint are never deduplicated.

Permissions

Viewing a resource’s event log requires view on that resource. There is no separate eventlog permission, and event log entries are not something you create directly — see the permission model for the permissions on the resource itself.

Supported Resources

The following kinds expose /-eventlog: agent, audit context, cloud account, domain, group, GVC, identity, IP set, Managed Kubernetes cluster, org, policy, secret, service account, user, volume set, and workload.

CLI

cpln workload eventlog my-app --gvc my-gvc --org my-org

This is unrelated to tailing container output, which is the separate cpln logs command with LogQL syntax. --max (default 50) caps how many entries are returned; a value less than 1 returns all entries. eventlog is documented on the CLI reference page for each supporting kind: agent, audit context, cloud account, domain, group, GVC, identity, IP set, mk8s cluster, org, policy, secret, service account, user, volume set, and workload.

API

Operation	Path
Event log for an org-scoped resource	`GET /org/my-org/agent/my-agent/-eventlog`
Event log for a GVC-scoped resource	`GET /org/my-org/gvc/my-gvc/workload/my-app/-eventlog`
Event log for the org itself	`GET /org/my-org/-eventlog`

The response is a standard paginated list, sorted newest first, with a target link back to the resource the events belong to.

Getting Started

Quickstart

Concepts

Core

Reference

Example

Fields

Context

Deduplication

Permissions

Supported Resources

CLI

API

​Example

​Fields

​Context

​Deduplication

​Permissions

​Supported Resources

​CLI

​API

Example

Fields

Context

Deduplication

Permissions

Supported Resources

CLI

API