Subscriptions
A Subscription connects event routing logic to one or more Targets within Event Channels. A subscription defines which events match, and the targets define where those events are delivered.
Site Administrators in the Default Workspace can enable Apply to All Workspaces on a subscription, which makes it match events from every workspace on the site. Cross-workspace delivery requires both the subscription and every target it routes to have Apply to All Workspaces enabled. Setting it on one side alone is not enough.
On sites without Workspaces, all subscriptions are site-level. On sites with Workspaces, subscriptions are scoped to the workspace where they are created. Workspace Administrators create subscriptions within their workspace, and those subscriptions match only events from that workspace. For example, a Workspace Administrator for the Marketing workspace creates a subscription for Automation: Failure events. Only Automation failures from the Marketing workspace trigger it.
A Workspace Administrator's Subscriptions list shows only subscriptions created within their workspace. Default Workspace subscriptions set to Apply to All Workspaces do not appear in individual workspace lists, even though they deliver that workspace's events. A Workspace Administrator's list can look empty while delivery is in fact configured at the Default Workspace level. Workspace Administrators can check with their Site Administrator to confirm whether cross-workspace delivery is in place.
SSO and SIEM event types are not available for workspace-scoped subscriptions. They are available for subscriptions in the Default Workspace, including subscriptions set to Apply to All Workspaces.
Routing
Each subscription is attached to one Event Channel. Within that subscription, you select which event types to match and which targets to deliver to. Both Event Types and Event Targets are multi-select: a single subscription can match multiple event types and deliver to multiple targets simultaneously.
Event Types
Subscriptions can match a specific set of event types or all event types. When no event types are selected, the subscription matches every event that passes through the channel. When specific types are selected, only those types are delivered.
Available event types:
| Category | Event Type | Description |
|---|---|---|
| User Security | User Lockout | A user account is locked after too many failed login attempts |
| Client Logs | Client Log: Success, Failure, Partial Failure, Skipped | A Files.com CLI app uploads activity logs to your site |
| SSO | LDAP Sync: Success, Failure, Partial Failure, Skipped | An LDAP directory sync runs to provision users or update group membership |
| SSO | LDAP Login: Success, Failure, Partial Failure, Skipped | A user attempts to authenticate using LDAP credentials |
| SSO | SAML Login: Success, Failure, Partial Failure, Skipped | A user attempts to authenticate via SAML SSO |
| Pending Work | Pending Work: Success, Failure, Partial Failure, Skipped | A background file preprocessing job runs, including GPG encryption or decryption applied by a Folder Setting |
| SIEM | SIEM: Success, Failure, Partial Failure, Skipped | An event is delivered to your configured SIEM integration |
| Sync | Sync: Success, Failure, Partial Failure, Skipped | A file sync runs between your site and a remote server |
| Automation | Automation: Success, Failure, Partial Failure, Skipped, Failure Will Retry, Partial Failure Will Retry | An Automation rule runs on files or folders |
| Expectations | Expectation Evaluation: Success, Late, Missing, Invalid | An Expectation is evaluated: a monitored file arrived on time, arrived late, did not arrive, or arrived with an invalid condition |
| Expectations | Expectation Incident: Open, Acknowledged, Snoozed, Resolved | An Expectation incident changes state |
For Automation runs, the Failure Will Retry and Partial Failure Will Retry types fire when a run fails but will be retried automatically. The broad admin email alert for Automation failures only covers terminal failures after all retries are exhausted. Subscribe to these types explicitly if you want alerts for retryable failures.
For Expectation evaluations, the broad admin email alert covers Missing and Invalid only. Late evaluations are available only through an explicit subscription.
Filters
A subscription can include one or more filter rules to narrow which events are delivered beyond event type alone. Leave all filter rules blank to match all events of the selected types. When filter rules are set, only events whose fields match all rules are delivered.
Each filter rule evaluates three components: an Event Field, an Operator, and a Value. The Event Field is the part of the event to evaluate. Named fields include Severity and Username. To filter on any other part of the event payload, select Custom Field and enter a dot-notation path in the Custom Field Path field (like payload.status).
The Operator controls how the field value is compared. Equals matches when the field exactly equals the value, treating numbers and booleans as JSON values. Starts With matches text values that begin with the specified value. The Value is the string or number the field is compared against.
You can add more than one filter rule to a single subscription. All rules must match for an event to be delivered.
Targets
A subscription routes matched events to one or more targets. The same target can be used across multiple subscriptions.