> ## Documentation Index > Fetch the complete documentation index at: https://mintlify.hoop.dev/docs/llms.txt > Use this file to discover all available pages before exploring further. # Event Routing > Automatically dispatch a runbook whenever a platform event fires, with full audit and approval coverage. export const EventRoutingAnimation = () => { const FONTS_URL = "https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400;500&family=Inter:wght@400;500;600;700;800&display=swap"; const C = { warmGold: "var(--warm-gold)", sand100: "var(--sand-100)" }; const ROWS = [{ event: "session.guardrail_violation", category: "Session", runbook: "quarantine-connection", duration: "198 ms" }, { event: "alert.sensitive_data_detected", category: "Alert", runbook: "revoke-ai-agent-access", duration: "241 ms" }, { event: "session.anomaly_detected", category: "Session", runbook: "page-oncall", duration: "167 ms" }]; const ROW_DELAY = 1700; const CROSS_DURATION = 550; const HOLD = 2800; function RouterIcon({active, done}) { return {done && } ; } const [rowPhases, setRowPhases] = useState(ROWS.map(() => "hidden")); const [dispatchPhases, setDispatchPhases] = useState(ROWS.map(() => "hidden")); const [allDone, setAllDone] = useState(false); const [routerActive, setRouterActive] = useState(false); const [routerGlow, setRouterGlow] = useState(false); const timeouts = useRef([]); const clearAll = useCallback(() => { timeouts.current.forEach(clearTimeout); timeouts.current = []; }, []); const later = useCallback((fn, ms) => { const id = setTimeout(fn, ms); timeouts.current.push(id); }, []); useEffect(() => { let cancelled = false; const cycle = () => { if (cancelled) return; setRowPhases(ROWS.map(() => "hidden")); setDispatchPhases(ROWS.map(() => "hidden")); setAllDone(false); setRouterActive(false); setRouterGlow(false); later(() => { if (cancelled) return; setRouterActive(true); }, 300); ROWS.forEach((_, i) => { const t0 = 600 + i * ROW_DELAY; later(() => { if (cancelled) return; setRowPhases(p => { const n = [...p]; n[i] = "approaching"; return n; }); }, t0); later(() => { if (cancelled) return; setRowPhases(p => { const n = [...p]; n[i] = "crossing"; return n; }); setRouterGlow(true); later(() => { if (!cancelled) setRouterGlow(false); }, 350); }, t0 + 500); later(() => { if (cancelled) return; setRowPhases(p => { const n = [...p]; n[i] = "through"; return n; }); setDispatchPhases(p => { const n = [...p]; n[i] = "processing"; return n; }); }, t0 + 500 + CROSS_DURATION); later(() => { if (cancelled) return; setDispatchPhases(p => { const n = [...p]; n[i] = "delivered"; return n; }); }, t0 + 500 + CROSS_DURATION + 700); }); const total = 600 + (ROWS.length - 1) * ROW_DELAY + 500 + CROSS_DURATION + 900; later(() => { if (!cancelled) setAllDone(true); }, total); later(() => { if (!cancelled) cycle(); }, total + HOLD); }; cycle(); return () => { cancelled = true; clearAll(); }; }, [later, clearAll]); return <>
Event Routing {allDone ? "3 dispatched" : routerGlow ? "Routing" : "Active"}
Platform events
{ROWS.map((row, i) => { const phase = rowPhases[i]; const show = phase === "approaching" || phase === "crossing"; return
{row.event}
{row.category}
; })}
Runbook dispatches
{ROWS.map((row, i) => { const dPhase = dispatchPhases[i]; const show = dPhase === "processing" || dPhase === "delivered"; return
{row.runbook}
{dPhase === "processing" && <>
processing } {dPhase === "delivered" && <>
{row.duration} delivered }
; })}
{["Fully audited", "Replay on failure", "Approval pipeline", "Zero manual intervention"].map(tag => {tag})}
; };
## What You'll Accomplish Event Routing connects platform events to runbooks. When a subscribed event fires, the gateway renders the event payload through the subscription's parameter mapping and dispatches the target runbook automatically. You can: * Revoke access automatically when DLP flags sensitive data in a session. * Trigger remediation the moment a guardrail rule fires. * Page on-call when the AI analyzer rates a session as high risk. * Pre-stage evidence collection when a PCI-tagged connection is opened. * Replay a failed dispatch from history without waiting for the original event to fire again. Event Routing is an experimental feature. It's **enabled by default since version 1.85.0** — on earlier versions an admin enables it per organization. *** ## How Event Routing Works A typed event is emitted at an audit-relevant moment: a session opens or closes, a review is approved or denied, the DLP analyzer flags entities, a guardrail trips, the AI analyzer rates a session, or a PCI-tagged connection is opened. The gateway looks up subscriptions for that event type in the org. Only subscriptions with status `active` produce dispatches. Each runbook parameter is filled from an event payload field using a JSONPath reference (e.g. `$.session_id`, `$.user`). Same-name fields are pre-matched when you create the subscription. The dispatcher launches the runbook against the subscription's resource role using the rendered parameters. A dispatch row lands in the subscription's history with a status and duration. Failed dispatches can be replayed from the UI. ### Event Catalog | Event | Category | Fires when | | ------------------------------- | -------- | ---------------------------------------------------------------- | | `session.started` | Session | A session opens, before any input or output flows | | `session.closed` | Session | A session is finalized with `exit_code` and `duration_ms` | | `session.guardrail_violation` | Session | At session close, once per guardrail rule that tripped | | `session.pci_scope_entered` | Session | At session open against a connection tagged `pci` or `pci-scope` | | `session.anomaly_detected` | Session | At session close when the AI analyzer rates risk as `high` | | `access.jit_approved` | Access | A review transitions to APPROVED via API, Slack, or MCP | | `access.jit_denied` | Access | A review transitions to REJECTED via API, Slack, or MCP | | `alert.sensitive_data_detected` | Alert | At session close when DLP flagged one or more entities | | `alert.data_masked` | Alert | At session close when the redactor replaced one or more values | *** ## Subscription and Dispatch Statuses ### Subscription Status | Status | Dispatches created | | -------- | ------------------ | | `active` | Yes | | `paused` | No | A subscription can be paused to stop dispatching and resumed to re-enable it. ### Dispatch Status | Status | Meaning | | ------------ | ----------------------------------------------- | | `pending` | Queued, not yet picked up | | `processing` | The dispatcher is running the runbook | | `delivered` | Runbook completed successfully | | `failed` | Runbook failed; `last_error` carries the reason | Failed dispatches can be **manually** replayed — replay is never automatic. A replay reuses the stored event payload, so no new event needs to fire. *** ## Common Recipes ### Recipe 1: Revoke AI Agent Access on PII Detection **Event:** `alert.sensitive_data_detected` **Runbook:** `revoke-ai-agent-access.md` **Parameter mapping:** | Runbook parameter | Event field | | ----------------- | -------------- | | `agent_user` | `$.user` | | `connection_name` | `$.connection` | Fires whether or not a redaction was applied. Use `alert.data_masked` instead if you only want to react when values were actually replaced. *** ### Recipe 2: Quarantine a Connection on Guardrail Violation **Event:** `session.guardrail_violation` **Runbook:** `quarantine-connection.md` **Parameter mapping:** | Runbook parameter | Event field | | ----------------- | -------------- | | `connection` | `$.connection` | | `triggered_rule` | `$.rule` | A session that trips multiple rules emits one event per rule, producing one dispatch per rule. Add a `query_excerpt` mapping to pass context to the runbook. *** ### Recipe 3: Page On-Call for High-Risk Sessions **Event:** `session.anomaly_detected` **Runbook:** `page-oncall.md` **Parameter mapping:** | Runbook parameter | Event field | | ----------------- | -------------- | | `session_id` | `$.session_id` | | `risk_summary` | `$.reason` | Does not fire for `low` or `medium` ratings, or when AI analysis is disabled for the org. *** Ready to set it up? The [Event Routing configuration guide](/setup/configuration/event-routing-configuration) covers enabling the feature, creating and managing subscriptions, auditing dispatch history, and troubleshooting. ## Next Steps Configure the repositories and runbook files that Event Routing dispatches. Define rules so a violation can trigger an automated runbook response. Turn on DLP so sensitive-data alerts can drive automatic remediation. Set up approvals so JIT decisions can kick off follow-up runbooks.