{
  "$note": "Per-column descriptions and possible values. Keyed by output column name. Sources: Microsoft 365 Management Activity API common schema, Office 365 Management API Schema, Copilot in Microsoft 365 audit schema. Values lists are illustrative — workload-dependent fields keep evolving; consult Microsoft Learn for the authoritative current list.",
  "$value_notation": {
    "open_string": "Free-form string with no fixed value space.",
    "open_enum": "Microsoft adds new values over time — the list shown is the common/known set, not exhaustive.",
    "guid": "Tenant- or object-scoped GUID; no fixed value space.",
    "timestamp": "ISO 8601 datetime.",
    "ipv4_or_ipv6": "Standard IP address representation."
  },

  "RecordId":                { "description": "Globally unique identifier for this audit record. Same record can appear in retries; RecordId is your dedupe key.", "values": "GUID (open)." },
  "CreationDate":            { "description": "Timestamp the activity was logged by the service. Same as AuditData.CreationTime but at the envelope level. Timezone is UTC.", "values": "ISO 8601 timestamp." },
  "RecordType":              { "description": "Workload/event family. Drives which subset of AuditData fields will be populated. Numeric in the M365 Management API; PAX preserves the text label here when the audit query returns it.", "values": "Numeric or text. Common codes for PAX use: 4=SharePoint, 6=SharePointFileOperation, 8=AzureActiveDirectory, 14=SharePointSharingOperation, 15=AzureActiveDirectoryStsLogon, 20=PowerBIAudit, 25=MicrosoftTeams, 30=MicrosoftFlow, 32=MicrosoftStream, 50=MicrosoftForms, 52=ApplicationAudit, 73=ExchangeItemGroup (mailbox), 261=CopilotInteraction, 282=AIAppInteraction. Full list: see Microsoft.Office365.Management.Activity AuditLogRecordType on Microsoft Learn." },
  "RecordTypeNum":           { "description": "Integer cast of RecordType. Empty when RecordType arrived as a text label that doesn't parse.", "values": "Integer ≥ 0." },

  "Operation":               { "description": "Workload-specific verb for what happened. Varies wildly by workload — the value space is open and Microsoft adds new operations every month.", "values": "Open enum. Examples by workload — SharePoint/OneDrive: FileAccessed, FileDownloaded, FileUploaded, FileModified, FileDeleted, FilePreviewed, FileRenamed, FileSyncDownloadedFull, FileCopied, FileMoved, FolderCreated, SharingSet, SharingInvitationCreated, AnonymousLinkCreated, AnonymousLinkUsed, CompanyLinkCreated. Exchange: Send, Create, Update, MoveToDeletedItems, SoftDelete, HardDelete, MailboxLogin. Teams: MessageSent, MessageRead, MeetingDetail, ChatRetrieved, MemberAdded, MemberRemoved. AAD: UserLoggedIn, UserLoginFailed, Add user., Update user., Consent to application. Copilot: CopilotInteraction. AI App: AIAppInteraction." },
  "UserId":                  { "description": "Identity that performed the activity. Usually the user's UPN. App-driven actions surface as the app's service principal name; system events surface as a synthetic name.", "values": "UPN (user@tenant.com), GUID, 'System Account', 'app@sharepoint', 'SHAREPOINT\\system', service principal name." },
  "@odata.type":             { "description": "Strong schema type of the AuditData payload. Tells you which derived schema (SharePoint, Exchange, Copilot, etc.) the rest of AuditData conforms to.", "values": "Open enum. Common: #Microsoft.Office.Audit.Schema.AuditRecord, #Microsoft.Office365.Audit.SharePointAuditRecord, #Microsoft.Office365.Audit.SharePointFileOperation, #Microsoft.Office365.Audit.AzureActiveDirectoryStsLogonRecord, #Microsoft.Office365.Audit.MicrosoftTeamsAuditRecord, #Microsoft.Office365.Audit.CopilotInteraction." },
  "CreationTime":            { "description": "Authoritative event timestamp from inside AuditData. Always UTC. PAX normalizes the format via format_date_purview().", "values": "ISO 8601 timestamp." },
  "Id":                      { "description": "AuditData-level unique identifier. Usually matches RecordId. Use this when joining to downstream stores that store AuditData separately.", "values": "GUID." },
  "OrganizationId":          { "description": "Tenant identifier (Microsoft Entra tenant GUID) the event belongs to. Stable per tenant.", "values": "GUID." },
  "ResultStatus":            { "description": "Coarse outcome of the operation as reported by the workload. Note Exchange historically used 'True'/'False' instead of Succeeded/Failed for the same idea.", "values": "Succeeded, Failed, PartiallySucceeded, True, False." },
  "ResultStatus_Audit":      { "description": "Alias of ResultStatus emitted under a second name so downstream Power BI / Splunk queries can disambiguate from any workload-specific ResultStatus that uses different domain values.", "values": "Same as ResultStatus." },
  "UserKey":                 { "description": "Unique persistent key for the actor. For users this is typically the Microsoft Entra ObjectId; for guests/B2B it can be a different namespace.", "values": "GUID, UPN, or 'NT AUTHORITY\\\\SYSTEM' for service-driven events." },
  "UserType":                { "description": "Classification of the acting principal.", "values": "0=Regular (interactive user), 1=Reserved, 2=Admin, 3=DcAdmin (datacenter admin), 4=System, 5=Application, 6=ServicePrincipal, 7=CustomPolicy, 8=SystemPolicy." },
  "Version":                 { "description": "Schema version of the AuditData payload. New workloads occasionally bump this when fields change shape.", "values": "Integer. Currently almost always 1." },
  "Workload":                { "description": "High-level service the event came from. This is the primary fan-out dimension for dashboards.", "values": "Open enum. Common: Exchange, SharePoint, OneDrive, AzureActiveDirectory, MicrosoftTeams, MicrosoftForms, MicrosoftStream, PowerApps, PowerAutomate (MicrosoftFlow), PowerBI, SecurityComplianceCenter, ThreatIntelligence, DataInsightsRestApiAudit, Copilot, 'Copilot for Microsoft 365', MicrosoftFabric, Loop, OneNote, Yammer, Planner, MicrosoftProject." },
  "ClientIP":                { "description": "IP address of the client that initiated the activity, as observed by the workload. Can be IPv4 or IPv6. May be empty for service-driven events.", "values": "IPv4 or IPv6." },
  "ObjectId":                { "description": "Identifier of the object acted on. Semantics depend on Workload: SharePoint = full URL; Exchange = mailbox/item id; AAD = target principal GUID; Copilot = conversation/turn id.", "values": "Open — URL, GUID, mailbox path, etc." },
  "AzureActiveDirectoryEventType": { "description": "Sub-type for AAD records.", "values": "0=AccountLogon, 1=AzureApplicationAuditEvent." },
  "ActorContextId":          { "description": "Tenant context the actor authenticated against. Differs from OrganizationId for guest/cross-tenant access.", "values": "GUID." },
  "ActorIpAddress":          { "description": "AAD-specific IP of the actor. Use this as the canonical IP for AAD events; use ClientIP for everything else.", "values": "IPv4 or IPv6." },
  "InterSystemsId":          { "description": "Correlation id used by Microsoft to thread an event across services (e.g., Exchange ↔ SharePoint ↔ Teams legs of one user action).", "values": "GUID." },
  "IntraSystemId":           { "description": "Per-service correlation id, scoped to one workload. Use together with InterSystemsId for end-to-end tracing.", "values": "GUID." },
  "SupportTicketId":         { "description": "Populated when the action was performed by Microsoft support staff under an open support ticket.", "values": "Open string (ticket id) or empty." },
  "TargetContextId":         { "description": "Tenant context of the object being acted on. Differs from ActorContextId for cross-tenant/B2B operations.", "values": "GUID." },
  "ApplicationId":           { "description": "Microsoft Entra AppId of the calling application. For first-party clients this is a well-known Microsoft AppId; for ISV apps it's the tenant-registered AppId.", "values": "GUID. Well-known examples: Office 365 SharePoint Online = 00000003-0000-0ff1-ce00-000000000000; Microsoft Teams = 1fec8e78-bce4-4aaf-ab1b-5451cc387264; Microsoft Office = d3590ed6-52b3-4102-aeff-aad2292ab01c; Copilot = fb78d390-0c51-40cd-8e17-fdbfab77341b (and several other Copilot app ids)." },
  "ErrorNumber":             { "description": "Workload-defined numeric error code when ResultStatus is Failed.", "values": "Integer; workload-specific." },

  "DeviceProperties.OS":          { "description": "Operating system the user was on when the action occurred. Pivoted out of the AuditData.DeviceProperties name/value array (other names dropped).", "values": "Windows, MacOS, iOS, Android, Linux, ChromeOS, Unknown." },
  "DeviceProperties.BrowserType": { "description": "Browser used for the action, when the workload was reached via a browser. Empty for thick-client apps.", "values": "Edge, Chrome, Firefox, Safari, IE, Opera, EdgeMobile, ChromeMobile, SafariMobile, Unknown." },

  "AppHost":                 { "description": "Surface where Copilot was invoked. Primary fan-out dimension for Copilot dashboards — answers 'where is Copilot being used'.", "values": "Word, Excel, PowerPoint, Outlook, OneNote, Loop, Teams, M365Chat (formerly BizChat), Bing/Copilot.microsoft.com, M365App, Office, SharePoint, Whiteboard, Stream, Designer, Visio, Forms, Planner, DevUI, Studio, Edge, Copilot Studio, Custom Agent. Open enum — Microsoft adds surfaces regularly." },
  "ThreadId":                { "description": "Identifier of the Copilot conversation thread. Stable across multiple turns within one chat thread.", "values": "GUID." },
  "AgentVersion":            { "description": "Version of the Copilot agent/skill that handled the turn. Use for cohort analysis when Microsoft rolls out new agent builds.", "values": "Free-form version string (e.g., '2024.04.01' or a hash). Empty when not reported." },
  "ConversationId":          { "description": "Identifier of the broader conversation (may span multiple threads). PAX accepts either 'ConversationId' or the older 'ConversationID' spelling, plus 'SessionId' as a final fallback.", "values": "GUID." },
  "TurnNumber":              { "description": "1-based index of this turn within the conversation. Useful to filter to first-turn-only or to compute turns-per-conversation.", "values": "Integer ≥ 1." },
  "RetryCount":              { "description": "Number of times the turn was retried before producing the final outcome captured by this record. Non-zero values often correlate with content-safety or model-availability issues.", "values": "Integer ≥ 0." },
  "ClientVersion":           { "description": "Build/version string of the client app that produced the turn. Falls back to a generic CED.Version or CED.Build when ClientVersion is missing.", "values": "Free-form version string." },
  "ClientPlatform":          { "description": "Client OS family for the Copilot turn. Falls back to CED.Platform or CED.OS when not reported under ClientPlatform.", "values": "Windows, Mac, iOS, Android, Web, Linux, Unknown." },
  "OutcomeStatus":           { "description": "Final outcome of the Copilot turn. PAX normalizes Boolean outcomes (true/false) to 'Success'/'Failure' so downstream filters are stable across schema variants.", "values": "Success, Failure (Boolean true/false are coerced)." },
  "DurationMs":              { "description": "End-to-end latency of the turn in milliseconds. Falls back through ElapsedMs / ProcessingTimeMs / LatencyMs depending on which schema variant the surface emits.", "values": "Integer ≥ 0." },

  "ModelName":               { "description": "Model that produced the Copilot response for this turn.", "values": "Open enum. Common: gpt-4, gpt-4-turbo, gpt-4o, gpt-4o-mini, gpt-35-turbo, o1, o1-mini, o3, o3-mini, phi-3, claude-3-5-sonnet, claude-3-7-sonnet, claude-opus-4. Microsoft swaps the default model frequently." },
  "ModelVendor":             { "description": "Provider of the model used for this turn. Multi-vendor support landed with the Foundry-backed Copilot stack.", "values": "OpenAI, Microsoft, Anthropic, Mistral, Meta, DeepSeek." },
  "ModelDeployment":         { "description": "Tenant- or service-scoped deployment id of the model endpoint. Use to disambiguate when the same logical model is hosted in multiple regions or capacities.", "values": "Open string (deployment id)." },

  "TokensInput":             { "description": "Input (prompt) tokens consumed for this turn. Sum across all messages handed to the model, including grounding context. Use for cost attribution.", "values": "Integer ≥ 0." },
  "TokensOutput":            { "description": "Output (completion) tokens produced by the model for this turn.", "values": "Integer ≥ 0." },
  "TokensTotal":             { "description": "Total tokens (input + output). Some schemas report this directly; otherwise PAX sums TokensInput + TokensOutput.", "values": "Integer ≥ 0." },

  "Messages[i].Role":        { "description": "Role of the i-th message in the turn's message list.", "values": "User, Assistant, System, Tool, Function." },
  "Messages[i].MessageType": { "description": "Phase/kind of the i-th message.", "values": "Prompt, Response, ToolCall, ToolResponse, SystemPrompt, Grounding." },
  "Contexts[i].Type":        { "description": "Kind of grounding context the i-th item represents. Use to answer 'what surfaces is Copilot pulling data from'.", "values": "File, Email, ChatMessage, Channel, Site, Page, Person, Meeting, Calendar, Loop, Whiteboard, BingResult, Plugin, SharedLink, Image, Audio, Video, GraphConnector." },
  "AccessedResources[i].Type": { "description": "Kind of resource the model actually read during the turn (post-grounding). May be a subset of Contexts when the model ignored some context items.", "values": "Same value space as Contexts[i].Type." },
  "AccessedResources[i].SensitivityLabel": { "description": "MIP sensitivity label GUID applied to the accessed resource. Tenant-scoped.", "values": "GUID (tenant-specific)." },
  "AISystemPlugin[i].Type":  { "description": "Kind of plugin/extension that participated in the turn.", "values": "MessageExtension, ConnectorPlugin, GraphConnector, Skill, DeclarativeAgent, CustomAgent, OpenAPI." },
  "ModelTransparencyDetails[i].Provider": { "description": "Provider/vendor for the i-th model transparency entry. When more than one model touched the turn (e.g., routing + answer), each entry is its own row index.", "values": "OpenAI, Microsoft, Anthropic, Mistral, Meta, DeepSeek." },
  "SensitivityLabels[i].Id": { "description": "MIP label id present on data the turn touched. Tenant-scoped GUID. PAX exposes the raw GUID; join to your MIP label registry to resolve display name.", "values": "GUID (tenant-specific)." }
}