---
description: Stream every Report URI account security event to a SIEM or log platform with the Audit Trail webhook.
---

# Audit Trail

The Audit Trail webhook streams account security events out of Report URI as they happen - API keys created, settings changed, team membership altered, logins. It is a separate feed from Watch alerts, with its own configuration and its own payload, and it is the one that belongs in a SIEM.

Available on Business and Enterprise plans.

## Why this feed matters

Monitoring is only evidence if the monitoring itself was not quietly altered. The audit trail is the record that answers that: who changed a policy, when a key was issued, whether alerting was turned off before an incident. Keeping it somewhere outside Report URI, in a system with its own retention and its own access controls, is the point.

## Enabling it

For a **personal account**, open **Account Settings** and find the Audit Trail section.

For a **team**, switch to the team first, then open the **Teams** page and find the Team Audit Trail section.

Set the webhook to the URL that should receive the events.

## What arrives

An HTTP POST with a flat JSON object. The full field reference is on the [Webhooks](/integrations/webhooks/#payload) page; in summary, each event carries `type` (always `auditTrail`), `account`, `event`, a human-readable `text`, the actor's id and email, the originating IP and an ISO 8601 `timestamp`.

Two properties make it well behaved as a log feed:

- **`type` is constant**, so a collector receiving several Report URI webhooks can route on it without inspecting anything else.
- **Webhook delivery attempts are excluded**, so the feed cannot trigger itself into a loop.

## Confirming the feed is live

Setting or removing the webhook is itself an audit event (`auditTrailWebhookSet` / `auditTrailWebhookRemoved`). The first message your endpoint receives confirms delivery is working, and the last one before deactivation records that it stopped. There is no separate test button, and none is needed.

## Choosing a destination

The webhook sends a URL and a JSON body, with no custom headers, so the destination has to accept an unauthenticated POST at a secret URL.

**Works directly** - collectors whose token forms part of the endpoint URL, automation platforms with catch-hook URLs, and any function you host yourself.

**Needs a relay** - Splunk HEC, Elasticsearch and most SIEM ingestion APIs authenticate with a header. Put a small function in front: it receives our POST, adds the header, and forwards the body unchanged. A Cloudflare Worker or a Lambda Function URL is enough.

**Slack** is also supported directly, formatted as a Slack message rather than raw JSON, if you would rather have the events in a channel than in a log platform. See [Slack](/notifications/slack/).

## Things to watch for

- The webhook is configured in a different place from Watch alerts, and enabling one does not enable the other. They are independent feeds.
- Team and personal audit trails are configured separately. Setting one does not cover the other.
- The endpoint URL is a credential in itself for most collectors. Anyone with it can write into your logs.

## Start Monitoring with Report URI

**Already using us?** Set the webhook in Account Settings, or on the Teams page for a team account.

**New to Report URI?** The Audit Trail webhook is available on Business and Enterprise plans.

[Start your free trial](https://report-uri.com/register/?plan=starter2025)