anchor.diff:  Logged when the <<security-api-delete-role-mapping,delete role mapping API>>
   is invoked to delete a role mapping.
   +
  +You must include the `security_config_change` event type to audit the related
  +event action.
  ++
   .Example
   [%collapsible%open]
   ====
  
positive.code:                         designated by the `origin.address` field).
  
  
  ==== Audit event attributes of the REST event type
  
  The events with `event.type` equal to `rest` have one of the following `event.action`
  attribute values: `authentication_success`, `anonymous_access_denied`, `authentication_failed`,
  
negative.code: `rule`                ::    The <<ip-filtering, IP filtering>> rule that denied
                              the request.
  
  [[security-config-change]]
  ==== Audit event attributes of the `security_config_change` event type
  
  The events with the `event.type` attribute equal to `security_config_change` have one of the following
  `event.action` attribute values: `put_user`, `change_password`, `put_role`, `put_role_mapping`,
  `change_enable_user`, `change_disable_user`, `put_privileges`, `create_apikey`, `delete_user`,
  `delete_role`, `delete_role_mapping`, `invalidate_apikeys`, or `delete_privileges`.
  
  These events also have *one* of the following extra attributes (in addition to the common
  ones), which is specific to the `event.type` attribute. The attribute's value is a nested JSON object:
  
  `put`                 ::    The object representation of the security config that
                              is being created, or the overwrite of an existing config.
  