> For the complete documentation index, see [llms.txt](https://docs.harmony.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.harmony.io/settings/streaming-audit-logs-via-webhook.md).

# Streaming Audit Logs via Webhook

Harmony can forward audit log events to an external destination in real time via webhook. Each time a tracked user action occurs, Harmony sends an HTTP POST request containing a JSON payload to the URL you configure. This makes it straightforward to integrate your activity history with SIEM tools, log aggregation platforms such as Sumo Logic, and compliance systems - without any additional tooling or manual exports.

### Supported Event Types

The following categories of events are captured and forwarded to your webhook destination:

* **Authentication events** - user sign-ins and sign-outs
* **Asset actions** - create, update, delete, and assignment changes
* **Ticket and service desk actions** - status changes and mutations

As Harmony adds support for additional tracked actions, they will be included in the stream automatically.

### Configuring a Webhook Destination

To set up audit log streaming:

1. Navigate to **Settings** in your Harmony workspace.
2. Locate the **Audit Logs** section and select **Webhook**.
3. Enter the destination URL in the **Webhook URL** field. This must be a publicly reachable HTTPS endpoint that accepts HTTP POST requests.
4. Save your configuration.

Once saved, Harmony will begin forwarding new audit events to the specified URL immediately. Events that occurred before the webhook was configured are not retroactively delivered.

### Payload Format

Each event is delivered as an HTTP POST request with a `Content-Type: application/json` header. The request body contains a JSON object describing the event, including details such as the event type, the user who performed the action, a timestamp, and any relevant resource identifiers.

The exact fields in the payload vary by event type, but all payloads share a common structure so you can parse and route them consistently in your receiving system.

### Receiving and Verifying Events

Your endpoint should return a `2xx` HTTP status code to acknowledge successful receipt. If Harmony does not receive a successful response, it may retry delivery.

To ensure the events you receive originate from Harmony, we recommend:

* Restricting access to your endpoint so only known Harmony IP ranges are accepted, if your infrastructure supports it.
* Validating the structure and required fields of each incoming payload before processing it.

### Use Cases

* **SIEM integration** - forward events directly into your security information and event management platform to correlate Harmony activity with signals from other systems.
* **Log aggregation** - stream events into platforms such as Sumo Logic for long-term retention, search, and dashboarding.
* **Compliance auditing** - maintain a real-time, tamper-evident record of user actions in an external system that your compliance or legal team controls.

### Troubleshooting

**Events are not arriving at my endpoint** Confirm that the destination URL is publicly reachable and returns a `2xx` status code. Check that no firewall or authentication layer is blocking inbound requests from Harmony.

**My endpoint is receiving duplicate events** This can occur if your endpoint did not return a successful response during a previous delivery attempt, triggering a retry. Implement idempotency handling in your receiver using a unique event identifier from the payload.

**I need to change the destination URL** Return to **Settings > Audit Logs > Webhook**, update the URL, and save. The new destination takes effect for all events going forward.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.harmony.io/settings/streaming-audit-logs-via-webhook.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.