Webhook

Send audit logs to any HTTP endpoint for custom processing.

Prerequisites

1. An HTTP(S) endpoint that accepts POST requests with JSON payloads.
2. Network connectivity from your deployment to the webhook URL.

Configuration fields

Field	Required	Description
URL	Yes	The full webhook URL (e.g., https://api.example.com/logs).
Anonymous Mode	No	Toggle to send only statistical data (see Anonymous Mode).

How it works

Each audit log is sent as a POST request with the following JSON structure:

{
  "timestamp": "2024-01-15T10:30:00.000Z",
  "type": "audit_log",
  "data": { ... }
}

The Content-Type header is set to application/json. The request timeout is 5 seconds.

Tips

• Implement idempotency on your receiver to handle potential retries.
• Add authentication on your endpoint (e.g., verify a shared secret in headers).
• Use this for custom pipelines, SIEM integrations, or forwarding to collectors not natively supported.

Troubleshooting

• Confirm your endpoint returns a 2xx status code.
• Requests time out after 5 seconds.

If no logs appear at all, confirm the provider credentials and URL are correct and that outbound egress is allowed. See Log Settings for shared guidance.

Related

• Log Settings: retention, content options, and Anonymous Mode
• Logs: view and search the logs themselves