Audit Trail
The Audit Trail webhook streams account security events out of Report URI as they happen - API keys created, settings changed, team membership altered, logins. It is a separate feed from Watch alerts, with its own configuration and its own payload, and it is the one that belongs in a SIEM.
Available on Business and Enterprise plans.
Why this feed matters
Monitoring is only evidence if the monitoring itself was not quietly altered. The audit trail is the record that answers that: who changed a policy, when a key was issued, whether alerting was turned off before an incident. Keeping it somewhere outside Report URI, in a system with its own retention and its own access controls, is the point.
Enabling it
For a personal account, open Account Settings and find the Audit Trail section.
For a team, switch to the team first, then open the Teams page and find the Team Audit Trail section.
Set the webhook to the URL that should receive the events.
What arrives
An HTTP POST with a flat JSON object. The full field reference is on the Webhooks page; in summary, each event carries type (always auditTrail), account, event, a human-readable text, the actor's id and email, the originating IP and an ISO 8601 timestamp.
Two properties make it well behaved as a log feed:
typeis constant, so a collector receiving several Report URI webhooks can route on it without inspecting anything else.- Webhook delivery attempts are excluded, so the feed cannot trigger itself into a loop.
Confirming the feed is live
Setting or removing the webhook is itself an audit event (auditTrailWebhookSet / auditTrailWebhookRemoved). The first message your endpoint receives confirms delivery is working, and the last one before deactivation records that it stopped. There is no separate test button, and none is needed.
Choosing a destination
The webhook sends a URL and a JSON body, with no custom headers, so the destination has to accept an unauthenticated POST at a secret URL.
Works directly - collectors whose token forms part of the endpoint URL, automation platforms with catch-hook URLs, and any function you host yourself.
Needs a relay - Splunk HEC, Elasticsearch and most SIEM ingestion APIs authenticate with a header. Put a small function in front: it receives our POST, adds the header, and forwards the body unchanged. A Cloudflare Worker or a Lambda Function URL is enough.
Slack is also supported directly, formatted as a Slack message rather than raw JSON, if you would rather have the events in a channel than in a log platform. See Slack.
Things to watch for
- The webhook is configured in a different place from Watch alerts, and enabling one does not enable the other. They are independent feeds.
- Team and personal audit trails are configured separately. Setting one does not cover the other.
- The endpoint URL is a credential in itself for most collectors. Anyone with it can write into your logs.
Start Monitoring with Report URI
Already using us? Set the webhook in Account Settings, or on the Teams page for a team account.
New to Report URI? The Audit Trail webhook is available on Business and Enterprise plans.