Platform audit logs

Enterprise Edition Platform audit logs record what platform administrators do above the organization boundary. They cover changes that no organization audit stream can see, such as a new organization, a promoted superuser, or a rewritten platform setting. You must be a platform superuser to configure the endpoint. These events go to their own sink, separate from every organization webhook, and organization administrators cannot read, change, or receive them.

Configure audit logs

Open platform administration

Open Admin, then select Audit Logs under Platform.

Connect the endpoint

Click Connect and enter the HTTPS URL that accepts your audit events.

Configure the request

Set the request options your collector needs, then click Save changes.

Events can continue to reach the old endpoint for up to 30 seconds after an endpoint change while cached settings expire.

Request options

Option	Behavior
Audit webhook URL	Receives each event as a JSON `POST` request.
Custom headers	Adds static headers to every request. Header names are case-insensitive.
Custom payload	Merges a JSON object into every event. Custom keys replace matching default keys.
Payload attribute	Wraps the complete payload under the configured key.
Verify SSL certificate	Verifies the endpoint certificate. Disable this only for a trusted endpoint that uses a private or self-signed certificate.

Tracecat encrypts the webhook URL, custom headers, and custom payload at rest. Use the payload attribute when your collector expects the event under a specific key. Splunk HTTP Event Collector is the common case: it requires each event wrapped in an event field. Set the payload attribute to event, and Tracecat wraps the whole payload:

{
  "event": {
    "actor_label": "avery@example.com",
    "resource_type": "workflow",
    "action": "update",
    "status": "SUCCESS",
    "created_at": "2026-01-15T14:03:12.123456Z"
  }
}

Logged events

Resource type	Action	Description
`auth`	`sign_in`	A user signed in.
`organization`	`create`	An organization was provisioned.
`organization`	`delete`	An organization was deleted.
`organization`	`update`	An organization was reconfigured.
`organization_domain`	`create`	A domain was assigned to an organization.
`organization_domain`	`delete`	A domain was removed from an organization.
`organization_domain`	`update`	An organization domain was updated.
`organization_invitation`	`create`	An organization invitation was sent from platform administration.
`organization_invitation`	`revoke`	An organization invitation was revoked from platform administration.
`organization_tier`	`update`	An organization’s tier assignment or per-organization overrides changed.
`platform_registry`	`sync`	Every platform registry repository was synchronized.
`platform_registry_repository`	`sync`	One platform registry repository was synchronized.
`platform_registry_version`	`delete`	A non-current platform registry version was deleted.
`platform_registry_version`	`promote`	A platform registry version became the current version for its repository.
`platform_setting`	`update`	A platform-wide setting changed, including this audit sink.
`tier`	`create`	A tier definition was created.
`tier`	`delete`	A tier definition was deleted.
`tier`	`update`	A tier definition changed, altering limits for every organization on it.
`user`	`create`	A platform user account was created.
`user`	`delete`	A platform user account was deleted.
`user`	`demote`	Superuser access was withdrawn from a user.
`user`	`promote`	A user was granted superuser access.

An organization-scoped sign-in emits auth sign_in to this sink and to that organization’s sink. A superuser login that carries no organization context reaches this sink only.

Event payload

A platform event uses the same schema as an organization event, with platform-scope identifiers left null.

{
  "organization_id": null,
  "workspace_id": null,
  "actor_type": "USER",
  "actor_id": "00000000-0000-4000-8000-000000000003",
  "actor_label": "admin@example.com",
  "ip_address": "192.0.2.10",
  "user_agent": "Mozilla/5.0",
  "resource_type": "platform_setting",
  "resource_id": null,
  "action": "update",
  "status": "SUCCESS",
  "data": null,
  "created_at": "2026-01-15T14:03:12.123456Z"
}

For platform settings updates, data is null, so the event tells you who made the change and whether it succeeded, but not which setting changed.

Field	Description
`organization_id`	Organization scope. `null` on platform events, except the platform copy of an organization-scoped `auth` `sign_in`, which carries the organization’s ID.
`workspace_id`	Workspace that owns the affected resource, when applicable.
`actor_type`	`USER` or `SERVICE_ACCOUNT`.
`actor_id`	Stable ID of the user or service account that performed the action.
`actor_label`	User email or service-account name, when available.
`ip_address`	Source IP address, when available.
`user_agent`	Bounded client user-agent string, when available.
`resource_type`	Type of resource affected by the action.
`resource_id`	Stable ID of the affected resource, when available.
`action`	Operation performed on the resource.
`status`	`ATTEMPT`, `SUCCESS`, or `FAILURE`.
`data`	Privacy-bounded operational metadata, when available.
`created_at`	UTC event timestamp.

Platform events normally carry null organization_id and workspace_id because Tracecat emits them with a platform role. Organization-scoped sign-in is the exception: its auth sign_in event reaches both sinks, and the platform copy carries the organization’s ID. Do not filter strictly on null scope to separate platform administration from tenant activity — that drops those sign-in events. Tag each stream with a custom payload instead when both reach the same index.

Delivery behavior

Tracecat posts each event as a JSON POST request and does not block the audited action on the result.

Delivery runs in the background, so a failing or slow collector does not prevent the audited change from completing.
Each request times out after 10 seconds.
Tracecat makes up to three delivery attempts per event — the initial request plus two retries with exponential backoff — on 429, 500, 502, 503, 504, and transport errors. Other 4xx responses are terminal.
A retry after a lost response can deliver a duplicate. Events carry no event ID and a retried event is byte-identical, so deduplicate on the full event body if you need exact counts.
Under sustained backpressure Tracecat sheds events rather than buffering without bound.

Delivery is best-effort, so do not treat the stream as a guaranteed-complete ledger.

See Organization audit logs to stream user and service-account activity inside an organization.
See Architecture for the boundaries that platform audit events record.
See Self-hosted security for deployment hardening guidance.

Overview

Building automations

Building agents

Building custom actions

Self-hosting

Authentication

Security

Configure audit logs

Request options

Logged events

Event payload

Delivery behavior

​Configure audit logs

​Request options

​Logged events

​Event payload

​Delivery behavior

​Related pages

Configure audit logs

Request options

Logged events

Event payload

Delivery behavior

Related pages