Skip to main content

Webhook

Send audit logs to any HTTP endpoint for custom processing.

Prerequisites​

  1. An HTTP(S) endpoint that accepts POST requests with JSON payloads.
  2. Network connectivity from your deployment to the webhook URL.

Configuration fields​

FieldRequiredDescription
URLYesThe full webhook URL (e.g., https://api.example.com/logs).
Anonymous ModeNoToggle to send only statistical data (see Anonymous Mode).

How it works​

Each audit log is sent as a POST request with the following JSON structure:

{
  "timestamp": "2024-01-15T10:30:00.000Z",
  "type": "audit_log",
  "data": { ... }
}

The Content-Type header is set to application/json. The request timeout is 5 seconds.

See Log schemas for the fields in data for each event type.

Tips​

  • Implement idempotency on your receiver to handle potential retries.
  • Add authentication on your endpoint (e.g., verify a shared secret in headers).
  • Use this for custom pipelines, SIEM integrations, or forwarding to collectors not natively supported.

Troubleshooting​

  • Confirm your endpoint returns a 2xx status code.
  • Requests time out after 5 seconds.

If no logs appear at all, confirm the provider credentials and URL are correct and that outbound egress is allowed. See Log Settings for shared guidance.

  • Log Settings: retention, content options, and Anonymous Mode
  • Logs: view and search the logs themselves
On this page