The query field (for reasons unknown to me) is currently typed as a base64 field. I think this should have been a regular string or a choice between a string and a base64 field. I don't see any reason for defaulting to base64 for a standard such as FHIR that is text based (mostly HTTP).

Also, the examples of AuditEvent are not creating enough guidance on how the field is supposed to be used. It is unclear from the conversation on https://chat.fhir.org/#narrow/stream/179166-implementers/topic/AuditEvent/near/397093754 and on how the field is properly used. I get that the FHIR Core is very wide and open (and IHE is tasked with best practice in some areas) but I feel the Core spec could add more details to the current state about intended use in the description in the field.

See also https://chat.fhir.org/#narrow/stream/179166-implementers/topic/AuditEvent/near/194978287