> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Platform audit logs
> Stream platform administrator actions to an HTTPS webhook and separate them from organization audit events.
Enterprise Edition
Platform audit logs record what platform administrators do above the organization boundary.
They cover changes that no organization audit stream can see, such as a new organization, a promoted superuser, or a rewritten platform setting.
You must be a platform superuser to configure the endpoint. These events go to their own sink, separate from every organization webhook, and organization administrators cannot read, change, or receive them.
## Configure audit logs
Open **Admin**, then select **Audit Logs** under **Platform**.
Click **Connect** and enter the HTTPS URL that accepts your audit events.
Set the request options your collector needs, then click **Save changes**.
Events can continue to reach the old endpoint for up to 30 seconds after an endpoint change while cached settings expire.
## Request options
| Option | Behavior |
| ---------------------- | --------------------------------------------------------------------------------------------------------------------------- |
| Audit webhook URL | Receives each event as a JSON `POST` request. |
| Custom headers | Adds static headers to every request. Header names are case-insensitive. |
| Custom payload | Merges a JSON object into every event. Custom keys replace matching default keys. |
| Payload attribute | Wraps the complete payload under the configured key. |
| Verify SSL certificate | Verifies the endpoint certificate. Disable this only for a trusted endpoint that uses a private or self-signed certificate. |
Tracecat encrypts the webhook URL, custom headers, and custom payload at rest.
Use the payload attribute when your collector expects the event under a specific key. Splunk HTTP Event Collector is the common case: it requires each event wrapped in an `event` field.
Set the payload attribute to `event`, and Tracecat wraps the whole payload:
```json theme={null}
{
"event": {
"actor_label": "avery@example.com",
"resource_type": "workflow",
"action": "update",
"status": "SUCCESS",
"created_at": "2026-01-15T14:03:12.123456Z"
}
}
```
## Logged events
| Resource type | Action | Description |
| ------------------------------ | --------- | -------------------------------------------------------------------------- |
| `auth` | `sign_in` | A user signed in. |
| `organization` | `create` | An organization was provisioned. |
| `organization` | `delete` | An organization was deleted. |
| `organization` | `update` | An organization was reconfigured. |
| `organization_domain` | `create` | A domain was assigned to an organization. |
| `organization_domain` | `delete` | A domain was removed from an organization. |
| `organization_domain` | `update` | An organization domain was updated. |
| `organization_invitation` | `create` | An organization invitation was sent from platform administration. |
| `organization_invitation` | `revoke` | An organization invitation was revoked from platform administration. |
| `organization_tier` | `update` | An organization's tier assignment or per-organization overrides changed. |
| `platform_registry` | `sync` | Every platform registry repository was synchronized. |
| `platform_registry_repository` | `sync` | One platform registry repository was synchronized. |
| `platform_registry_version` | `delete` | A non-current platform registry version was deleted. |
| `platform_registry_version` | `promote` | A platform registry version became the current version for its repository. |
| `platform_setting` | `update` | A platform-wide setting changed, including this audit sink. |
| `tier` | `create` | A tier definition was created. |
| `tier` | `delete` | A tier definition was deleted. |
| `tier` | `update` | A tier definition changed, altering limits for every organization on it. |
| `user` | `create` | A platform user account was created. |
| `user` | `delete` | A platform user account was deleted. |
| `user` | `demote` | Superuser access was withdrawn from a user. |
| `user` | `promote` | A user was granted superuser access. |
An organization-scoped sign-in emits `auth` `sign_in` to this sink and to that organization's sink.
A superuser login that carries no organization context reaches this sink only.
## Event payload
A platform event uses the same schema as an organization event, with platform-scope identifiers left null.
```json theme={null}
{
"organization_id": null,
"workspace_id": null,
"actor_type": "USER",
"actor_id": "00000000-0000-4000-8000-000000000003",
"actor_label": "admin@example.com",
"ip_address": "192.0.2.10",
"user_agent": "Mozilla/5.0",
"resource_type": "platform_setting",
"resource_id": null,
"action": "update",
"status": "SUCCESS",
"data": null,
"created_at": "2026-01-15T14:03:12.123456Z"
}
```
For platform settings updates, `data` is `null`, so the event tells you who made the change and whether it succeeded, but not which setting changed.
| Field | Description |
| ----------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `organization_id` | Organization scope. `null` on platform events, except the platform copy of an organization-scoped `auth` `sign_in`, which carries the organization's ID. |
| `workspace_id` | Workspace that owns the affected resource, when applicable. |
| `actor_type` | `USER` or `SERVICE_ACCOUNT`. |
| `actor_id` | Stable ID of the user or service account that performed the action. |
| `actor_label` | User email or service-account name, when available. |
| `ip_address` | Source IP address, when available. |
| `user_agent` | Bounded client user-agent string, when available. |
| `resource_type` | Type of resource affected by the action. |
| `resource_id` | Stable ID of the affected resource, when available. |
| `action` | Operation performed on the resource. |
| `status` | `ATTEMPT`, `SUCCESS`, or `FAILURE`. |
| `data` | Privacy-bounded operational metadata, when available. |
| `created_at` | UTC event timestamp. |
Platform events normally carry `null` `organization_id` and `workspace_id` because Tracecat emits them with a platform role.
Organization-scoped sign-in is the exception: its `auth` `sign_in` event reaches both sinks, and the platform copy carries the organization's ID.
Do not filter strictly on null scope to separate platform administration from tenant activity — that drops those sign-in events.
Tag each stream with a custom payload instead when both reach the same index.
## Delivery behavior
Tracecat posts each event as a JSON `POST` request and does not block the audited action on the result.
* Delivery runs in the background, so a failing or slow collector does not prevent the audited change from completing.
* Each request times out after 10 seconds.
* Tracecat makes up to three delivery attempts per event — the initial request plus two retries with exponential backoff — on `429`, `500`, `502`, `503`, `504`, and transport errors. Other `4xx` responses are terminal.
* A retry after a lost response can deliver a duplicate. Events carry no event ID and a retried event is byte-identical, so deduplicate on the full event body if you need exact counts.
* Under sustained backpressure Tracecat sheds events rather than buffering without bound.
Delivery is best-effort, so do not treat the stream as a guaranteed-complete ledger.
## Related pages
* See [Organization audit logs](/audit-logs/organization) to stream user and service-account activity inside an organization.
* See [Architecture](/security/architecture) for the boundaries that platform audit events record.
* See [Self-hosted security](/self-hosting/security) for deployment hardening guidance.