| AssuranceLevelChangePayload | Assurance Level Change (CAEP 1.0 Section 3.4): the subject's authentication strength changed since the initial login, in either direction - a user stepping up with a second factor at one provider is a signal every other provider holding the session may act on. When EventTimestamp is included it is the moment of the change. |
| AssuranceLevelChangePayload.ChangeDirections | The values the "change_direction" member may carry (CAEP 1.0 Section 3.4.1). |
| AssuranceLevelChangePayload.Namespaces | The level namespaces Section 3.4.1 names. The set is open: any other value is an alias for a custom namespace the two parties agreed on, which is why Namespace is a string rather than a closed enumeration. |
| CaepClaimNames | The wire names of the CAEP event claims (CAEP 1.0 Sections 2, 3): one registry, because the common claims cross every event type and per-model copies of one name drift apart. |
| CaepEventPayload | The claims every CAEP event may carry (CAEP 1.0 Section 2): when it happened, who set it in motion, and why - the latter twice, because the administrator's log line and the sentence an end user should read are different texts in different languages. |
| CaepEventPayload.InitiatingEntities | The values the "initiating_entity" claim may carry (CAEP 1.0 Section 2). |
| CaepEventTypes | The event type URIs CAEP 1.0 defines (its Section 3), and the one registration call that teaches a receiver's event registry the whole dictionary. |
| CaepInteropProfilePolicy | What the CAEP Interoperability Profile 1.0 demands of a TRANSMITTER's payload, on top of what CAEP 1.0 permits: each of its three use cases requires reason_admin to carry a non-empty object. |
| CredentialChangePayload | Credential Change (CAEP 1.0 Section 3.3): a credential was created, changed, revoked or deleted - a password reset, a certificate enrollment or revocation, a second-factor or passwordless credential enrolled or removed. When EventTimestamp is included it is the moment of the change. |
| CredentialChangePayload.ChangeTypes | The values the "change_type" member may carry (CAEP 1.0 Section 3.3.1) - this set is closed, unlike the credential types. |
| CredentialChangePayload.CredentialTypes | The credential kinds Section 3.3.1 names. The set is open by the specification's own words: any other credential type mutually supported by the transmitter and the receiver is equally legal, which is why CredentialType is a string rather than a closed enumeration. |
| DeviceComplianceChangePayload | Device Compliance Change (CAEP 1.0 Section 3.5): the compliance status of the device identified by the subject changed. When EventTimestamp is included it is the moment of the change. |
| DeviceComplianceChangePayload.ComplianceStatuses | The values both status members carry (CAEP 1.0 Section 3.5.1). |
| RiskLevelChangePayload | Risk Level Change (CAEP 1.0 Section 3.8): the transmitter's assessed risk level for the subject changed at the moment EventTimestamp names - a password found in a breach, unapproved software on a device, or any other signal the transmitter abstracts into a level. |
| RiskLevelChangePayload.Principals | The principal kinds Section 3.8.1 names, matching the complex-subject member names of the Shared Signals Framework. The set is open to any other entity the framework's subject model can express. |
| RiskLevelChangePayload.RiskLevels | The values both level members carry (CAEP 1.0 Section 3.8.1) - a closed set. |
| SessionEstablishedPayload | Session Established (CAEP 1.0 Section 3.6): the transmitter established a new session for the subject - how a service closes the loop with the identity provider after federation, how an identity provider detects unintended logins, how a receiver inventories sessions. The EventTimestamp is the moment the session was established. |
| SessionPresentedPayload | Session Presented (CAEP 1.0 Section 3.7): the transmitter observed the subject's session to be present at the moment EventTimestamp names - the signal receivers build activity anomaly detection and live-session inventories on. |
| SessionRevokedPayload | Session Revoked (CAEP 1.0 Section 3.1): the session identified by the subject has been revoked. The event carries no claims of its own - the subject names the session, directly or through the properties of a complex subject, in which case the revocation applies to any session matching the combined claims; when EventTimestamp is included it is the moment of revocation. |
| TokenClaimsChangePayload | Token Claims Change (CAEP 1.0 Section 3.2): a claim in the token identified by the subject - a JWT through the jwt_id subject format, a SAML assertion through saml_assertion_id - has changed. When EventTimestamp is included it is the moment the claim values changed. |