> ## Documentation Index > Fetch the complete documentation index at: https://tracecat-codex-docs-secrets-oauth-discoverability.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Organization audit logs > Stream organization audit events to an HTTPS webhook and shape each request for your log collector. Send organization audit events to an external log collector over HTTPS. You must be an organization administrator to configure the endpoint. Each event answers one question: which identity changed which resource, from where, and did it work. The stream covers privilege changes, credential changes, agent configuration changes, and automation changes. ## Configure audit logs Open the workspace menu, select **Organization**, then open **Audit Logs** under **Settings**. Click **Connect** and enter the HTTPS URL that accepts your audit events. Connect an organization audit webhook Set the request options your collector needs, then click **Save changes**. Changing the endpoint is itself an audited `organization_setting` update, so your existing collector records the change before the stream moves. Events can continue to reach the old endpoint for up to 30 seconds after the change while cached settings expire. ## Request options | Option | Behavior | | ---------------------- | --------------------------------------------------------------------------------------------------------------------------- | | Audit webhook URL | Receives each event as a JSON `POST` request. | | Custom headers | Adds static headers to every request. Header names are case-insensitive. | | Custom payload | Merges a JSON object into every event. Custom keys replace matching default keys. | | Payload attribute | Wraps the complete payload under the configured key. | | Verify SSL certificate | Verifies the endpoint certificate. Disable this only for a trusted endpoint that uses a private or self-signed certificate. | Tracecat encrypts the webhook URL, custom headers, and custom payload at rest. Use the payload attribute when your collector expects the event under a specific key. Splunk HTTP Event Collector is the common case: it requires each event wrapped in an `event` field. Set the payload attribute to `event`, and Tracecat wraps the whole payload: ```json theme={null} { "event": { "actor_label": "avery@example.com", "resource_type": "workflow", "action": "update", "status": "SUCCESS", "created_at": "2026-01-15T14:03:12.123456Z" } } ``` ## Logged events | Resource type | Action | Description | | --------------------------- | ----------- | ---------------------------------------------------------------- | | `agent_catalog` | `create` | A model was added to the organization's agent catalog. | | `agent_catalog` | `delete` | A model was removed from the organization's agent catalog. | | `agent_catalog` | `update` | An agent catalog entry was updated. | | `agent_custom_provider` | `create` | A custom model provider was configured. | | `agent_custom_provider` | `delete` | A custom model provider was removed. | | `agent_custom_provider` | `update` | A custom model provider was reconfigured. | | `agent_model_access` | `create` | A catalog model was enabled for an organization or workspace. | | `agent_model_access` | `delete` | A catalog model was disabled for an organization or workspace. | | `agent_preset` | `create` | An agent preset was created. | | `agent_preset` | `delete` | An agent preset was deleted. | | `agent_preset` | `update` | An agent preset was updated or restored to an earlier version. | | `agent_session` | `delete` | An agent session and its history were deleted. | | `agent_session` | `update` | An agent session's title, preset, or MCP integrations changed. | | `auth` | `sign_in` | A user signed in. | | `case` | `create` | A case was created. | | `case` | `delete` | A case was deleted. | | `case` | `update` | A case was updated. | | `case_comment` | `create` | A comment was added to a case. | | `case_comment` | `delete` | A case comment was deleted. | | `case_comment` | `update` | A case comment was edited. | | `case_trigger` | `update` | Part of a workflow's case trigger configuration changed. | | `case_trigger` | `upsert` | A workflow's case trigger configuration was created or replaced. | | `mcp_personal_access_token` | `create` | An MCP personal access token was issued. | | `mcp_personal_access_token` | `revoke` | An MCP personal access token was revoked. | | `organization` | `delete` | An organization was deleted. | | `organization_invitation` | `accept` | An organization invitation was accepted. | | `organization_invitation` | `create` | An organization invitation was sent. | | `organization_invitation` | `revoke` | An organization invitation was revoked. | | `organization_member` | `create` | A user was added to the organization. | | `organization_member` | `delete` | A user was removed from the organization. | | `organization_member` | `update` | An organization member's details changed. | | `organization_secret` | `create` | An organization secret was created. | | `organization_secret` | `delete` | An organization secret was deleted. | | `organization_secret` | `update` | An organization secret was updated. | | `organization_session` | `delete` | A member's active login session was revoked. | | `organization_setting` | `create` | An organization setting was created. | | `organization_setting` | `delete` | An organization setting was deleted. | | `organization_setting` | `update` | An organization setting changed, including this audit sink. | | `rbac_assignment` | `create` | A role was assigned to a group. | | `rbac_assignment` | `delete` | A group's role assignment was removed. | | `rbac_assignment` | `update` | A group's role assignment changed. | | `rbac_group` | `create` | A group was created. | | `rbac_group` | `delete` | A group was deleted. | | `rbac_group` | `update` | A group was updated. | | `rbac_group_member` | `create` | A user was added to a group. | | `rbac_group_member` | `delete` | A user was removed from a group. | | `rbac_role` | `create` | A custom role was created. | | `rbac_role` | `delete` | A custom role was deleted. | | `rbac_role` | `update` | A role's scopes changed. | | `rbac_scope` | `create` | A custom permission scope was created. | | `rbac_scope` | `delete` | A custom permission scope was deleted. | | `rbac_user_assignment` | `create` | A role was assigned directly to a user. | | `rbac_user_assignment` | `delete` | A user's role assignment was removed. | | `rbac_user_assignment` | `update` | A user's role assignment changed. | | `schedule` | `create` | A workflow schedule was created. | | `schedule` | `delete` | A workflow schedule was deleted. | | `schedule` | `update` | A workflow schedule was updated. | | `secret` | `create` | A workspace secret was created. | | `secret` | `delete` | A workspace secret was deleted. | | `secret` | `update` | A workspace secret was updated. | | `service_account` | `create` | A service account was created. | | `service_account` | `update` | A service account was renamed, re-scoped, disabled, or enabled. | | `service_account_api_key` | `create` | An API key was issued for a service account. | | `service_account_api_key` | `revoke` | A service account API key was revoked. | | `table` | `create` | A lookup table was created. | | `table` | `delete` | A lookup table was deleted. | | `table` | `update` | A lookup table was updated. | | `table_column` | `create` | A column was added to a lookup table. | | `table_column` | `delete` | A column was removed from a lookup table. | | `table_column` | `update` | A lookup table column was updated. | | `tag` | `create` | A workflow tag was created. | | `tag` | `delete` | A workflow tag was deleted. | | `tag` | `update` | A workflow tag was updated. | | `webhook` | `create` | A workflow webhook trigger was created. | | `webhook` | `update` | A workflow webhook trigger was updated. | | `webhook_api_key` | `create` | The first API key was issued for a webhook. | | `webhook_api_key` | `delete` | A webhook API key was deleted. | | `webhook_api_key` | `revoke` | A webhook API key was revoked and kept on record. | | `webhook_api_key` | `rotate` | An existing webhook API key was replaced. | | `workflow` | `create` | A workflow was created. | | `workflow` | `delete` | A workflow was deleted. | | `workflow` | `publish` | A workflow definition was published. | | `workflow` | `update` | A workflow was updated. | | `workflow_execution` | `cancel` | A workflow execution was cancelled and allowed to clean up. | | `workflow_execution` | `create` | A workflow execution was started. | | `workflow_execution` | `reset` | A workflow execution was replayed from an earlier event. | | `workflow_execution` | `terminate` | A workflow execution was stopped immediately. | | `workspace` | `create` | A workspace was created. | | `workspace` | `delete` | A workspace was deleted. | | `workspace` | `update` | A workspace was updated. | | `workspace_invitation` | `accept` | A workspace invitation was accepted. | | `workspace_invitation` | `create` | A workspace invitation was sent. | | `workspace_invitation` | `revoke` | A workspace invitation was revoked. | | `workspace_variable` | `create` | A workspace variable was created. | | `workspace_variable` | `delete` | A workspace variable was deleted. | | `workspace_variable` | `update` | A workspace variable was updated. | An organization-scoped sign-in emits `auth` `sign_in` to this sink and to the platform sink. A superuser login that carries no organization context reaches the platform sink only. ## Event payload An audit event contains the actor, affected resource, action, result, and scope. ```json theme={null} { "organization_id": "00000000-0000-4000-8000-000000000001", "workspace_id": "00000000-0000-4000-8000-000000000002", "actor_type": "USER", "actor_id": "00000000-0000-4000-8000-000000000003", "actor_label": "avery@example.com", "ip_address": "192.0.2.10", "user_agent": "Mozilla/5.0", "resource_type": "workflow", "resource_id": "00000000-0000-4000-8000-000000000004", "action": "update", "status": "SUCCESS", "data": { "changed_fields": ["title"] }, "created_at": "2026-01-15T14:03:12.123456Z" } ``` | Field | Description | | ----------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | | `organization_id` | Organization scope. `null` on platform events, except the platform copy of an organization-scoped `auth` `sign_in`, which carries the organization's ID. | | `workspace_id` | Workspace that owns the affected resource, when applicable. | | `actor_type` | `USER` or `SERVICE_ACCOUNT`. | | `actor_id` | Stable ID of the user or service account that performed the action. | | `actor_label` | User email or service-account name, when available. | | `ip_address` | Source IP address, when available. | | `user_agent` | Bounded client user-agent string, when available. | | `resource_type` | Type of resource affected by the action. | | `resource_id` | Stable ID of the affected resource, when available. | | `action` | Operation performed on the resource. | | `status` | `ATTEMPT`, `SUCCESS`, or `FAILURE`. | | `data` | Privacy-bounded operational metadata, when available. | | `created_at` | UTC event timestamp. | ### Attribution `actor_type` distinguishes a human from automation. `USER` events carry the account's email in `actor_label`, and `SERVICE_ACCOUNT` events carry the service account's name. Treat `actor_id` as the stable join key; `actor_label` is a display value that changes when a user's email changes. ### Scope `organization_id` identifies the tenant and `workspace_id` identifies the workspace that owns the affected resource. Organization-level resources such as `organization_member` and `rbac_role` have no workspace, so `workspace_id` is `null`. If you index platform and organization events together, filter on `organization_id` being non-null to isolate tenant activity. ### Status lifecycle Most audited changes emit an `ATTEMPT` event followed by `SUCCESS` or `FAILURE`. An `ATTEMPT` with no matching terminal event does not always mean the request failed — the terminal event may have been shed or lost in delivery. ## Delivery behavior Tracecat posts each event as a JSON `POST` request and does not block the audited action on the result. * Delivery runs in the background, so a failing or slow collector does not prevent the audited change from completing. * Each request times out after 10 seconds. * Tracecat makes up to three delivery attempts per event — the initial request plus two retries with exponential backoff — on `429`, `500`, `502`, `503`, `504`, and transport errors. Other `4xx` responses are terminal. * A retry after a lost response can deliver a duplicate. Events carry no event ID and a retried event is byte-identical, so deduplicate on the full event body if you need exact counts. * Under sustained backpressure Tracecat sheds events rather than buffering without bound. Delivery is best-effort, so do not treat the stream as a guaranteed-complete ledger. ## Related pages * See [Platform audit logs](/audit-logs/platform) to capture administration above the organization boundary. * See [Organization agent logs](/audit-logs/agents) to export telemetry for agent runs. * See [MCP access logs](/audit-logs/mcp-access) to review external MCP clients acting as your users. * See [Architecture](/security/architecture) for the platform, agent, approval, and telemetry boundaries around audit events. * See [Security](/self-hosting/security) for deployment hardening guidance.