Skip to main content

Data model

Everything in Vela is scoped to an App. An app is the boundary between your services — one app per microservice, per environment, or per product area. You decide.

Accounts

An account represents your organization. It can own multiple apps and has a plan (Free, Pro, Team) that controls event limits and app quotas. You authenticate with one or more client secrets for management operations.

Apps

An app is an isolated workspace. Everything — schemas, events, rules — belongs to an app. Common patterns:
  • One app per microservice (payments, auth, fulfillment)
  • One app per environment (order-service-prod, order-service-staging)
  • One app per product (web-app, mobile-app)

Schemas

A schema defines the expected shape of an event payload. Every event sent to Vela is validated against the schema for its event name. Events without a matching schema are rejected with 400.

Why schemas matter

Without schemas, bad data silently enters your system. A schema enforces:
  • Required fields — the event is rejected if they are missing
  • Field types — string, number, boolean, date, enum, object
  • Validation rules — min/max length, regex patterns, enum values
  • Metadata fields — optional contextual data like environment or trace ID

Example schema

Field types

Use the CLI to manage schemas as JSON files in your repository. Schema changes become PR-reviewable, just like database migrations.

Events

Events are the core data unit. An event represents something that happened in your system.

Event fields

Event levels

Event lifecycle


Notification Rules

A rule watches for events of a specific type and fires when conditions match. Evaluation is real-time — rules trigger as soon as an event is ingested.

Rule fields

Conditions

A rule with no conditions fires for every matching event. Conditions filter by payload fields:

Actions

Each action points to a destination. A single rule can have multiple actions — alert Slack and email at the same time.

Destinations

Destinations are delivery targets configured in the dashboard. Create them once, then reference by ID in rules. Destination credentials are encrypted at rest with AES-256-GCM.

Authentication

The separation is intentional. Your API key travels with every ingest call — if it leaks, an attacker can only send events, not read or modify your data. See the credentials guide.