> For the complete documentation index, see [llms.txt](https://docs.lithnet.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.lithnet.io/ams/v2.0/help-and-support/advanced-help-topics/audit-variables.md). # Variables available in audit notification channels Access Manager provides a comprehensive set of variables you can use in your audit notifications. See the guides on [PowerShell auditing scripts](/ams/v2.0/help-and-support/advanced-help-topics/audit-scripts.md) and [HTML and JSON audit templates](/ams/v2.0/help-and-support/advanced-help-topics/audit-templates.md) to learn how to use these variables in your audit scripts and templates. ## Global properties | Property | Format/Type | Description | | ------------- | ----------- | ----------------------------------------------- | | `DateTime` | string | The current date and time, in local server time | | `DateTimeUtc` | string | The current date and time, in UTC time | ## Request element This group of attributes represents the incoming request | Property | Format/Type | Description | | --------------------------- | --------------------------- | ------------------------------------------------------------------- | | `Request.Target` | string | The name of the target that the user requested access to | | `Request.TargetType` | `Computer` or `Role` | The type of resource the user requested access to | | `Request.Reason` | string | The reason that the user provided when requesting access | | `Request.IPAddress` | IPv4 or IPv6 address string | The IP address of requestor | | `Request.HostName` | string | The host name of the requestor, if available via reverse DNS lookup | | `Request.RequestedDuration` | TimeSpan | The requested duration of access | ## Response element This group of attributes represents the result of the access evaluation | Property | Format/Type | Description | | --------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | `Response.Target` | string | The name of the target that the access request was evaluated against | | `Response.TargetType` | `Computer` or `Role` | The type of resource that was evaluated | | `Response.IsSuccess` | `true` or `false` | Indicates if access was granted to the resource | | `Response.IsFailure` | `true` or `false` | Indicates if access was denied to the resource | | `Response.NotificationChannels` | string | A comma-separated list of audit channels IDs that apply to this access response | | `Response.MatchedRule` | string | The ID of the authorization rule that was used to make the access decision | | `Response.MatchedRuleDescription` | string | The 'description' field from the authorization rule that was used to make the access decision | | `Response.ExpireAfter` | TimeSpan | The duration of time that access was granted for | | `Response.Code` | `Success`, `NoMatchingRuleForTarget`, `NoMatchingRuleForUser`, `ExplicitlyDenied`, `UserRateLimitExceeded`, `IpRateLimitExceeded` | The result of the authorization decision. Codes other than `Success` represent an 'access denied' response. | | `Response.AccessType` | `None`, `LocalAdminPassword`, `LocalAdminPasswordHistory`, `Jit`, `Bitlocker` | The type of access that was granted | | `Response.AccessTypeDescription` | string | The friendly name of the type of access that was granted | | `Response.AccessExpiryDate` | DateTime | The date and time when the user's access will expire, expressed in local server time | | `Response.Message` | string | A user-friendly message describing the outcome of the access decision | ## User element This group of attributes represents the user who performed the access request | Property | Format/Type | Description | | ------------------------- | ----------- | -------------------------------------------------- | | `User.Username` | string | The `samAccountName` of the user requesting access | | `User.FullyQualifiedName` | string | The user's username in `domain\username` format | | `User.DisplayName` | string | The display name of the user | | `User.Sid` | string | The user's security identifier | | `User.EmailAddress` | string | The user's email address | ## Role element If the authorization request was for a role, then this property will be populated with information about the role authorization rule | Property | Format/Type | Description | | ----------------------------- | ----------- | ----------------------------------------------------------------------------------------------------- | | `Role.Name` | string | The name of the role | | `Role.Description` | string | The description of the role | | `Role.MaximumAllowedDuration` | TimeSpan | The maximum amount of time that the user can request for the role according to the authorization rule | ## Computer element If the authorization request for a computer, then this property will be populated with information about the computer | Property | Format/Type | Description | | ----------------------------- | ------------------------------------------------ | ---------------------------------------------------------------- | | `Computer.Name` | string | The short name of the computer | | `Computer.Description` | string | The description of the computer | | `Computer.FullyQualifiedName` | string | The name of the computer in `domain\computer` format | | `Computer.DnsHostName` | string | The computer's DNS host name, if known | | `Computer.DisplayName` | string | The computer's display name | | `Computer.ObjectId` | string | A unique identifier for the computer | | `Computer.Sid` | string | The computer's security identifier | | `Computer.AuthorityType` | `ActiveDirectory`, `AzureActiveDirectory`, `Ams` | The authoritative directory where this computer is located | | `Computer.AuthorityId` | string | The ID of the authority where the computer is located | | `Computer.AuthorityDeviceId` | string | The unique ID for the device, specific to the device's authority | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.lithnet.io/ams/v2.0/help-and-support/advanced-help-topics/audit-variables.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.