The CF events api lists an "actor_type" field for events, which can be one of:
What is an example of an audit event's actor type being each of the above? Where is the documentation, at a higher level than a summary of the REST endpoints, and in more detail than this, for someone trying to consume this api?
actor_type represents what initiated the event. Similarly, actee_type is the resource that is being acted upon.
user: Most events (e.g. starting/stopping/deleting an app) will have actor_type "user", since the event was triggered by a user action.
service_broker: Some audit events are triggered by service brokers. Examples are registering a service offering or a service plan.
system: System is used when there is not a clear actor. There is currently a bug filed to investigate usage of this actor_type: https://www.pivotaltracker.com/story/show/132099009
v3-process: This was recently changed to be "process" in cf v245. This actor_type (along with the actor_type "app") is only used when the process/app crashes. There is also a bug around this actor_type: https://www.pivotaltracker.com/story/show/132098945
I could not find any documentation for audit events other than the API docs. How are you trying to consume the events API?