--- title: "admin.audit_log.created" method: POST path: "admin.audit_log.created" tags: ["Webhooks"] --- # admin.audit_log.created `POST admin.audit_log.created` (webhook) A customer admin performed an auditable action. **Subscription filters** - `action` — one of: `ACKNOWLEDGED_AI_GOVERNANCE_SENSOR_TERMS`, `ACKNOWLEDGED_SMS_VOICE_PHISHING_TERMS`, `ACTIONED_EMAIL_SECURITY_EVENT`, `ACTIVATED_AI_GOVERNANCE_POLICY`, `ADDED_ADMIN`, `ADDED_ADMIN_AUTHENTICATION_METHOD`, `ADDED_AI_GOVERNANCE_TRACKING_EXCLUSION`, `ADDED_EMPLOYEE_AUTHENTICATION_METHOD`, `ADDED_EMPLOYEE_TO_TRAINING_CAMPAIGN`, `ADDED_INDIVIDUAL_EMPLOYEE`, `ADMIN_LOGGED_IN`, `ADMIN_RESET_PASSWORD`, `ASSIGNED_INBOX_DOMAIN_OWNER`, `ATTESTED_EMAIL_IP_WHITELIST`, `BATCH_GENERATE_EXECUTIVE_REPORTS`, `BULK_DELETED_COMPANY_LIBRARY_ASSETS`, `BULK_DELETED_EXCLUSION_RULES`, `BULK_DELETED_SENDER_RULES`, `BULK_UPDATED_EMPLOYEES_PHISHING_FAILURE_STATUSES`, `CHANGED_ADMIN_ROLE`, `CLONED_PHISHING_SIMULATION_CAMPAIGN`, `CLONED_TRAINING_CAMPAIGN`, `CONNECTED_ENRICHMENT_DATA_SOURCE`, `CONNECTED_INTEGRATION`, `CONNECTED_PRIMARY_IDENTITY_SOURCE`, `CREATED_AI_GOVERNANCE_POLICY`, `CREATED_API_KEY`, `CREATED_CALL_GUARD_INTEGRATION`, `CREATED_EMAIL_DOMAIN_CONFIGURATION`, `CREATED_EXECUTIVE_REPORT`, `CREATED_FEATURE_ANNOUNCEMENT`, `CREATED_GROUP`, `CREATED_INTEGRATION_LINK`, `CREATED_INTEGRATION_OAUTH_CREDENTIALS`, `CREATED_MCP_OAUTH_CLIENT`, `CREATED_MODULE`, `CREATED_PERSONA`, `CREATED_PHISHING_DOMAIN`, `CREATED_PHISHING_SIMULATION_CAMPAIGN`, `CREATED_PRONUNCIATION_OVERRIDE`, `CREATED_RISK_SIGNAL`, `CREATED_SCENARIO`, `CREATED_SENDER_RULE`, `CREATED_TRAINING_CAMPAIGN`, `CREATED_WEBHOOK_ENDPOINT`, `DEACTIVATED_EMPLOYEE`, `DELETED_ADMIN`, `DELETED_AI_GOVERNANCE_POLICY`, `DELETED_API_KEY`, `DELETED_CLASSIFIER_THRESHOLD`, `DELETED_CUSTOM_ATTRIBUTE_SCHEMA`, `DELETED_EMAIL_DOMAIN_CONFIGURATION`, `DELETED_EXECUTIVE_REPORT`, `DELETED_FEATURE_ANNOUNCEMENT`, `DELETED_MODULE_TRANSLATIONS`, `DELETED_PERSONA`, `DELETED_PERSONA_WITH_DEPENDENT_CONTENT`, `DELETED_PHISHING_SIMULATION_CAMPAIGN`, `DELETED_PRONUNCIATION_OVERRIDE`, `DELETED_RISK_SIGNAL`, `DELETED_SCENARIO`, `DELETED_SENDER_RULE`, `DELETED_TRAINING_CAMPAIGN`, `DELETED_WEBHOOK_ENDPOINT`, `DISABLED_WEBHOOK_ENDPOINT`, `DISCONNECTED_ENRICHMENT_DATA_SOURCE`, `DISCONNECTED_INTEGRATION`, `DISCONNECTED_PRIMARY_IDENTITY_SOURCE`, `DOWNLOADED_AI_PERSONA_AUDIO_CLIP`, `DOWNLOADED_AI_PERSONA_IMAGE`, `DOWNLOADED_AI_PERSONA_VIDEO_CLIP`, `DOWNLOADED_AI_PERSONA_VOICE_SAMPLE`, `DOWNLOADED_EMAIL_ATTACHMENT`, `DOWNLOADED_SCORM_PACKAGE`, `DUPLICATED_SCENARIO`, `EDITED_ADMIN`, `EDITED_AI_GOVERNANCE_POLICY`, `EDITED_CAMPAIGN_MODULE`, `EDITED_CAMPAIGN_POSTBACKS`, `EDITED_CAMPAIGN_SCHEDULE`, `EDITED_FEATURE_ANNOUNCEMENT`, `EDITED_GROUP`, `EDITED_LATE_COMPLETIONS`, `EDITED_LEARNER_SETTINGS`, `EDITED_MANAGER_ESCALATIONS`, `EDITED_MANAGER_PHISH_FAILURE_NOTIFICATION`, `EDITED_MODULE`, `EDITED_MODULE_TRANSLATIONS`, `EDITED_NOTIFICATION_CADENCE`, `EDITED_NOTIFICATION_EXCLUSIONS_LIST`, `EDITED_NOTIFICATION_MESSAGE`, `EDITED_PERSONA`, `EDITED_PHISHING_IP_BLOCKLIST`, `EDITED_PHISHING_SIMULATION_CAMPAIGN`, `EDITED_PRONUNCIATION_OVERRIDE`, `EDITED_RISK_SIGNAL`, `EDITED_SCENARIO`, `EDITED_TRAINING_CAMPAIGN`, `EDITED_WORKSPACE_NAME`, `ENABLED_SPAM_DETECTION`, `ENDED_AI_GOVERNANCE_POLICY`, `ENDED_PHISHING_SIMULATION_CAMPAIGN`, `ENDED_TRAINING_CAMPAIGN`, `EXCLUDED_EMPLOYEE`, `EXPORTED_EMAIL_ANNOTATION_CONTENT`, `EXPORTED_TRIAGE_SECURITY_EVENTS_CSV`, `GENERATED_AI_PERSONA_AUDIO_CLIP`, `GENERATED_AI_PERSONA_VIDEO_CLIP`, `GENERATED_THREAT_LANDSCAPE_REPORT`, `HARD_DELETED_EMPLOYEE`, `IMPORTED_EXCLUSION_RULES`, `IMPORTED_INTEGRATION_SENDER_RULES`, `IMPORTED_SENDER_RULES`, `INTERNAL_ACCESS_EXTENDED`, `INTERNAL_ACCESS_REQUESTED`, `INTERNAL_SESSION_ENDED`, `LAUNCHED_VIDEO_CALL_ATTACK`, `MARKED_EMPLOYEE_COMPLETED_TRAINING_CAMPAIGN`, `MARKED_EMPLOYEE_NOT_FAILED_PHISHING_SIMULATION`, `MARKED_KNOWN_SENDER`, `MARKED_MODULE_TRANSLATIONS_UP_TO_DATE`, `MARKED_SCENARIO_TRANSLATIONS_UP_TO_DATE`, `OVERRODE_EMAIL_ANNOTATION`, `OVERRODE_EMPLOYEE_ATTRIBUTE`, `PATCHED_CAMPAIGN_FRAMES`, `PROMOTED_EMAIL_DOMAIN_CONFIGURATION`, `PUBLISHED_INDUSTRY_BENCHMARK_REPORT`, `REACTIVATED_EMPLOYEE`, `REENABLED_WEBHOOK_ENDPOINT`, `REFRESHED_DIRECTORY_INTEGRATION`, `REFRESHED_INTEGRATION`, `REGENERATED_FRAME_NARRATIONS`, `REGENERATED_THREAT_LANDSCAPE_REPORT`, `REGENERATED_WEBHOOK_ENDPOINT_SECRET`, `REGENERATE_EXECUTIVE_REPORT`, `REMOVED_ADMIN_AUTHENTICATION_METHOD`, `REMOVED_AI_GOVERNANCE_TRACKING_EXCLUSION`, `REMOVED_EMPLOYEE_AUTHENTICATION_METHOD`, `REMOVED_EMPLOYEE_FROM_TRAINING_CAMPAIGN`, `REMOVED_SCENARIO_TRANSLATIONS`, `RENAMED_COMPANY_LIBRARY_ASSET`, `REQUESTED_COMPANY_PROVISIONING`, `REQUESTED_MODULE_TRANSLATION_CANCELLATION`, `REQUESTED_MODULE_TRANSLATION_GENERATION`, `REQUESTED_MODULE_TRANSLATION_RECOVERY`, `REQUESTED_SCENARIO_TRANSLATION_GENERATION`, `RESET_EMAIL_IP_WHITELIST`, `RESOLVED_CALL_GUARD_SECURITY_EVENT`, `RESTORED_CAMPAIGN_FRAMES`, `RESTORED_NOTIFICATION_MESSAGE_DEFAULT`, `RESTORED_SCENARIO_DEFAULT`, `REVEALED_WEBHOOK_ENDPOINT_SECRETS`, `REVERTED_EMPLOYEE_ATTRIBUTE_OVERRIDE`, `REVIEWED_INTEGRATION_ONBOARDING_CHANGES`, `REVOKED_CALL_GUARD_INTEGRATION`, `REVOKED_MCP_OAUTH_CLIENT`, `SCHEDULED_PHISHING_SIMULATION_CAMPAIGN`, `SCHEDULED_TRAINING_CAMPAIGN`, `SELECTED_AI_IMAGE`, `SENT_ADHOC_PHISHING_SIMULATION_NOTIFICATION`, `SENT_ADHOC_TRAINING_NOTIFICATION`, `SENT_EMAIL_DOMAIN_TEST`, `SENT_PHISHING_CAMPAIGN_NOTIFICATION_TEST_SENDS`, `SENT_TRAINING_CAMPAIGN_NOTIFICATION_TEST_SENDS`, `SENT_WEBHOOK_TEST_EVENT`, `STARTED_AI_IMAGE_GENERATION`, `STARTED_PROVISIONING_CONTENT_WORKFLOW`, `SUBMITTED_EMAIL_ANNOTATION`, `TOGGLED_AUTOMATED_BOT_EXCLUSION_RULE`, `TOGGLED_AUTO_ACTIVATE_ALL_AVAILABLE_DOMAINS`, `TOGGLED_EMAIL_SECURITY_REMEDIATE_SIMILAR_MESSAGES`, `TOGGLED_EMAIL_SECURITY_REMEDIATION`, `TOGGLED_PHISHING_DOMAIN`, `TOGGLED_PHISHING_EMAIL_SENDER_SUBDOMAINS`, `TOGGLED_PRONUNCIATION_OVERRIDE`, `UNKNOWN`, `UNPUBLISHED_INDUSTRY_BENCHMARK_REPORT`, `UNSCHEDULED_PHISHING_SIMULATION_CAMPAIGN`, `UNSCHEDULED_TRAINING_CAMPAIGN`, `UPDATED_AI_GOVERNANCE_PROMPT_RETENTION`, `UPDATED_API_KEY_PERMISSIONS`, `UPDATED_API_KEY_STATUS`, `UPDATED_CALL_GUARD_PHONE_ROUTING`, `UPDATED_COMPANY_ATTRIBUTE`, `UPDATED_COMPANY_CONTEXT_ADDENDUM`, `UPDATED_COMPANY_PRODUCT_STATUS`, `UPDATED_CUSTOM_ATTRIBUTE_SCHEMA`, `UPDATED_DIRECTORY_INTEGRATION_SYNC_TYPE`, `UPDATED_EMAIL_BANNER_SETTINGS`, `UPDATED_EMAIL_SECURITY_REMEDIATION_RULES`, `UPDATED_EMAIL_WHITELISTING_VENDORS`, `UPDATED_EMAIL_WHITELISTING_VENDOR_STATUS`, `UPDATED_INTEGRATION_CREDENTIALS`, `UPDATED_INTEGRATION_DISPLAY_NAME`, `UPDATED_INTEGRATION_SYNC_TYPE`, `UPDATED_LANGUAGE_SOURCES`, `UPDATED_LMS_INTEGRATION`, `UPDATED_NOTIFICATION_SENDER_SETTINGS`, `UPDATED_PHISHING_DELIVERY_METHOD`, `UPDATED_PHISHING_DOMAIN_STATUS`, `UPDATED_PHISH_FORWARDING_RULES`, `UPDATED_SCENARIO_VOICE_PHISHING_REVEAL`, `UPDATED_TRIAGE_SETTINGS`, `UPDATED_USER_ATTRIBUTE_SOURCE_PRIORITIES`, `UPDATED_WEBHOOK_ENDPOINT`, `UPLOADED_AI_PERSONA_AUDIO`, `UPLOADED_AI_PERSONA_IMAGE`, `UPLOADED_COMPANY_LIBRARY_ASSET`, `UPLOADED_EMPLOYEE_LIST_CSV`, `UPSERTED_CLASSIFIER_THRESHOLD`, `VERIFIED_EMAIL_DOMAIN_CONFIGURATION`, `VIEWED_CALL_GUARD_LIVE_TRANSCRIPTS`, `VIEWED_EMAIL_CONTENT`, `VIEWED_GOVERNANCE_AGENT_INSTRUCTION`, `VIEWED_GOVERNANCE_PROMPT`, `VIEWED_GOVERNANCE_PROMPT_AGENT_ACTIONS`, `VIEWED_GOVERNANCE_SENSITIVE_CONTENT`, `VIEWED_MISSING_IDENTIFIER_USERS` - `category` — one of: `AI_GOVERNANCE`, `API`, `CALL_GUARD`, `EMAIL_SECURITY`, `LLM_SECURITY`, `SAT_PROGRAM`, `USERS`, `WORKSPACE` - `subcategory` — one of: `ADMINS`, `AI_PERSONAS`, `API_KEYS`, `ASSET_LIBRARY`, `AUTHENTICATION`, `CALL_GUARD_SECURITY_EVENTS`, `COMPANY_CONTEXT`, `COMPANY_SETTINGS`, `DETECTION_THRESHOLDS`, `EMAIL_ANNOTATIONS`, `EMAIL_SECURITY_EVENTS`, `EMPLOYEES`, `EXCLUSION_RULES`, `EXECUTIVE_RISK`, `GOVERNANCE_POLICIES`, `GOVERNANCE_PROMPTS`, `GOVERNANCE_SETTINGS`, `GROUPS`, `INTEGRATIONS`, `PHISHING_SIMULATION`, `PRONUNCIATIONS`, `REMEDIATION_SETTINGS`, `SENDER_RULES`, `THREAT_LANDSCAPE`, `TRAINING`, `WEBHOOKS` - `success` — `true` or `false` ## Payload - WebhookEnvelopeAdminAuditLogCreatedPayload: The CloudEvents envelope wrapping every webhook event - `data` WebhookEnvelopeDataAdminAuditLogCreatedPayload: The data member of the CloudEvents envelope: the event payload plus the subscription's custom data - `customdata` unknown - `payload` AdminAuditLogCreatedPayload: A customer admin performed an auditable action. - `action` 'UNKNOWN' | 'CREATED_TRAINING_CAMPAIGN' | 'SCHEDULED_TRAINING_CAMPAIGN' | 'UNSCHEDULED_TRAINING_CAMPAIGN' | 'EDITED_TRAINING_CAMPAIGN' | 'EDITED_NOTIFICATION_CADENCE' | 'EDITED_LEARNER_SETTINGS' | 'EDITED_LATE_COMPLETIONS' | 'EDITED_CAMPAIGN_SCHEDULE' | 'EDITED_CAMPAIGN_MODULE' | 'EDITED_CAMPAIGN_POSTBACKS' | 'SENT_TRAINING_CAMPAIGN_NOTIFICATION_TEST_SENDS' | 'SENT_ADHOC_TRAINING_NOTIFICATION' | 'CLONED_TRAINING_CAMPAIGN' | 'ENDED_TRAINING_CAMPAIGN' | 'DELETED_TRAINING_CAMPAIGN' | 'ADDED_EMPLOYEE_TO_TRAINING_CAMPAIGN' | 'REMOVED_EMPLOYEE_FROM_TRAINING_CAMPAIGN' | 'MARKED_EMPLOYEE_COMPLETED_TRAINING_CAMPAIGN' | 'CREATED_PHISHING_SIMULATION_CAMPAIGN' | 'CLONED_PHISHING_SIMULATION_CAMPAIGN' | 'EDITED_PHISHING_SIMULATION_CAMPAIGN' | 'SCHEDULED_PHISHING_SIMULATION_CAMPAIGN' | 'UNSCHEDULED_PHISHING_SIMULATION_CAMPAIGN' | 'ENDED_PHISHING_SIMULATION_CAMPAIGN' | 'DELETED_PHISHING_SIMULATION_CAMPAIGN' | 'BULK_UPDATED_EMPLOYEES_PHISHING_FAILURE_STATUSES' | 'MARKED_EMPLOYEE_NOT_FAILED_PHISHING_SIMULATION' | 'SENT_ADHOC_PHISHING_SIMULATION_NOTIFICATION' | 'SENT_PHISHING_CAMPAIGN_NOTIFICATION_TEST_SENDS' | 'LAUNCHED_VIDEO_CALL_ATTACK' | 'EDITED_WORKSPACE_NAME' | 'UPDATED_COMPANY_PRODUCT_STATUS' | 'UPDATED_LANGUAGE_SOURCES' | 'EDITED_MANAGER_ESCALATIONS' | 'EDITED_MANAGER_PHISH_FAILURE_NOTIFICATION' | 'EDITED_NOTIFICATION_EXCLUSIONS_LIST' | 'EDITED_NOTIFICATION_MESSAGE' | 'RESTORED_NOTIFICATION_MESSAGE_DEFAULT' | 'EDITED_PHISHING_IP_BLOCKLIST' | 'ACKNOWLEDGED_SMS_VOICE_PHISHING_TERMS' | 'ATTESTED_EMAIL_IP_WHITELIST' | 'RESET_EMAIL_IP_WHITELIST' | 'TOGGLED_AUTO_ACTIVATE_ALL_AVAILABLE_DOMAINS' | 'TOGGLED_PHISHING_EMAIL_SENDER_SUBDOMAINS' | 'TOGGLED_AUTOMATED_BOT_EXCLUSION_RULE' | 'TOGGLED_PHISHING_DOMAIN' | 'CREATED_PHISHING_DOMAIN' | 'UPDATED_PHISHING_DOMAIN_STATUS' | 'UPDATED_PHISHING_DELIVERY_METHOD' | 'UPDATED_COMPANY_ATTRIBUTE' | 'UPDATED_TRIAGE_SETTINGS' | 'UPDATED_EMAIL_BANNER_SETTINGS' | 'UPDATED_PHISH_FORWARDING_RULES' | 'ADDED_ADMIN_AUTHENTICATION_METHOD' | 'REMOVED_ADMIN_AUTHENTICATION_METHOD' | 'ADDED_EMPLOYEE_AUTHENTICATION_METHOD' | 'REMOVED_EMPLOYEE_AUTHENTICATION_METHOD' | 'CREATED_GROUP' | 'EDITED_GROUP' | 'EXCLUDED_EMPLOYEE' | 'DEACTIVATED_EMPLOYEE' | 'REACTIVATED_EMPLOYEE' | 'ADDED_INDIVIDUAL_EMPLOYEE' | 'UPLOADED_EMPLOYEE_LIST_CSV' | 'OVERRODE_EMPLOYEE_ATTRIBUTE' | 'REVERTED_EMPLOYEE_ATTRIBUTE_OVERRIDE' | 'HARD_DELETED_EMPLOYEE' | 'CONNECTED_PRIMARY_IDENTITY_SOURCE' | 'DISCONNECTED_PRIMARY_IDENTITY_SOURCE' | 'CONNECTED_ENRICHMENT_DATA_SOURCE' | 'DISCONNECTED_ENRICHMENT_DATA_SOURCE' | 'CONNECTED_INTEGRATION' | 'DISCONNECTED_INTEGRATION' | 'UPDATED_INTEGRATION_SYNC_TYPE' | 'REFRESHED_INTEGRATION' | 'UPDATED_DIRECTORY_INTEGRATION_SYNC_TYPE' | 'VIEWED_MISSING_IDENTIFIER_USERS' | 'REFRESHED_DIRECTORY_INTEGRATION' | 'CREATED_INTEGRATION_OAUTH_CREDENTIALS' | 'CREATED_INTEGRATION_LINK' | 'UPDATED_INTEGRATION_DISPLAY_NAME' | 'UPDATED_INTEGRATION_CREDENTIALS' | 'IMPORTED_INTEGRATION_SENDER_RULES' | 'UPDATED_LMS_INTEGRATION' | 'UPDATED_EMAIL_WHITELISTING_VENDORS' | 'UPDATED_EMAIL_WHITELISTING_VENDOR_STATUS' | 'REVIEWED_INTEGRATION_ONBOARDING_CHANGES' | 'ADDED_ADMIN' | 'DELETED_ADMIN' | 'CHANGED_ADMIN_ROLE' | 'EDITED_ADMIN' | 'UPDATED_USER_ATTRIBUTE_SOURCE_PRIORITIES' | 'UPDATED_CUSTOM_ATTRIBUTE_SCHEMA' | 'DELETED_CUSTOM_ATTRIBUTE_SCHEMA' | 'CREATED_RISK_SIGNAL' | 'EDITED_RISK_SIGNAL' | 'DELETED_RISK_SIGNAL' | 'CREATED_PERSONA' | 'EDITED_PERSONA' | 'DELETED_PERSONA' | 'DELETED_PERSONA_WITH_DEPENDENT_CONTENT' | 'STARTED_PROVISIONING_CONTENT_WORKFLOW' | 'REQUESTED_COMPANY_PROVISIONING' | 'UPLOADED_AI_PERSONA_IMAGE' | 'UPLOADED_AI_PERSONA_AUDIO' | 'GENERATED_AI_PERSONA_AUDIO_CLIP' | 'GENERATED_AI_PERSONA_VIDEO_CLIP' | 'DOWNLOADED_AI_PERSONA_AUDIO_CLIP' | 'DOWNLOADED_AI_PERSONA_VIDEO_CLIP' | 'DOWNLOADED_AI_PERSONA_IMAGE' | 'DOWNLOADED_AI_PERSONA_VOICE_SAMPLE' | 'ADMIN_LOGGED_IN' | 'ADMIN_RESET_PASSWORD' | 'CREATED_EXECUTIVE_REPORT' | 'REGENERATE_EXECUTIVE_REPORT' | 'DELETED_EXECUTIVE_REPORT' | 'BATCH_GENERATE_EXECUTIVE_REPORTS' | 'CREATED_MODULE' | 'EDITED_MODULE' | 'STARTED_AI_IMAGE_GENERATION' | 'SELECTED_AI_IMAGE' | 'EDITED_MODULE_TRANSLATIONS' | 'DELETED_MODULE_TRANSLATIONS' | 'MARKED_MODULE_TRANSLATIONS_UP_TO_DATE' | 'REQUESTED_MODULE_TRANSLATION_GENERATION' | 'REQUESTED_MODULE_TRANSLATION_CANCELLATION' | 'REQUESTED_MODULE_TRANSLATION_RECOVERY' | 'PATCHED_CAMPAIGN_FRAMES' | 'RESTORED_CAMPAIGN_FRAMES' | 'CREATED_SCENARIO' | 'DUPLICATED_SCENARIO' | 'EDITED_SCENARIO' | 'DELETED_SCENARIO' | 'UPDATED_SCENARIO_VOICE_PHISHING_REVEAL' | 'REQUESTED_SCENARIO_TRANSLATION_GENERATION' | 'MARKED_SCENARIO_TRANSLATIONS_UP_TO_DATE' | 'REMOVED_SCENARIO_TRANSLATIONS' | 'RESTORED_SCENARIO_DEFAULT' | 'DOWNLOADED_SCORM_PACKAGE' | 'UPLOADED_COMPANY_LIBRARY_ASSET' | 'RENAMED_COMPANY_LIBRARY_ASSET' | 'BULK_DELETED_COMPANY_LIBRARY_ASSETS' | 'PUBLISHED_INDUSTRY_BENCHMARK_REPORT' | 'UNPUBLISHED_INDUSTRY_BENCHMARK_REPORT' | 'CREATED_EMAIL_DOMAIN_CONFIGURATION' | 'VERIFIED_EMAIL_DOMAIN_CONFIGURATION' | 'PROMOTED_EMAIL_DOMAIN_CONFIGURATION' | 'DELETED_EMAIL_DOMAIN_CONFIGURATION' | 'SENT_EMAIL_DOMAIN_TEST' | 'UPDATED_NOTIFICATION_SENDER_SETTINGS' | 'CREATED_API_KEY' | 'UPDATED_API_KEY_PERMISSIONS' | 'DELETED_API_KEY' | 'UPDATED_API_KEY_STATUS' | 'CREATED_MCP_OAUTH_CLIENT' | 'REVOKED_MCP_OAUTH_CLIENT' | 'CREATED_WEBHOOK_ENDPOINT' | 'UPDATED_WEBHOOK_ENDPOINT' | 'DELETED_WEBHOOK_ENDPOINT' | 'REENABLED_WEBHOOK_ENDPOINT' | 'DISABLED_WEBHOOK_ENDPOINT' | 'REVEALED_WEBHOOK_ENDPOINT_SECRETS' | 'REGENERATED_WEBHOOK_ENDPOINT_SECRET' | 'SENT_WEBHOOK_TEST_EVENT' | 'RESOLVED_CALL_GUARD_SECURITY_EVENT' | 'VIEWED_CALL_GUARD_LIVE_TRANSCRIPTS' | 'CREATED_CALL_GUARD_INTEGRATION' | 'REVOKED_CALL_GUARD_INTEGRATION' | 'UPDATED_CALL_GUARD_PHONE_ROUTING' | 'SUBMITTED_EMAIL_ANNOTATION' | 'OVERRODE_EMAIL_ANNOTATION' | 'EXPORTED_EMAIL_ANNOTATION_CONTENT' | 'MARKED_KNOWN_SENDER' | 'VIEWED_EMAIL_CONTENT' | 'DOWNLOADED_EMAIL_ATTACHMENT' | 'UPSERTED_CLASSIFIER_THRESHOLD' | 'DELETED_CLASSIFIER_THRESHOLD' | 'UPDATED_COMPANY_CONTEXT_ADDENDUM' | 'CREATED_SENDER_RULE' | 'DELETED_SENDER_RULE' | 'BULK_DELETED_SENDER_RULES' | 'IMPORTED_SENDER_RULES' | 'BULK_DELETED_EXCLUSION_RULES' | 'IMPORTED_EXCLUSION_RULES' | 'TOGGLED_EMAIL_SECURITY_REMEDIATE_SIMILAR_MESSAGES' | 'TOGGLED_EMAIL_SECURITY_REMEDIATION' | 'UPDATED_EMAIL_SECURITY_REMEDIATION_RULES' | 'ACTIONED_EMAIL_SECURITY_EVENT' | 'EXPORTED_TRIAGE_SECURITY_EVENTS_CSV' | 'ENABLED_SPAM_DETECTION' | 'INTERNAL_ACCESS_REQUESTED' | 'INTERNAL_ACCESS_EXTENDED' | 'INTERNAL_SESSION_ENDED' | 'VIEWED_GOVERNANCE_PROMPT' | 'VIEWED_GOVERNANCE_PROMPT_AGENT_ACTIONS' | 'VIEWED_GOVERNANCE_AGENT_INSTRUCTION' | 'VIEWED_GOVERNANCE_SENSITIVE_CONTENT' | 'UPDATED_AI_GOVERNANCE_PROMPT_RETENTION' | 'ADDED_AI_GOVERNANCE_TRACKING_EXCLUSION' | 'REMOVED_AI_GOVERNANCE_TRACKING_EXCLUSION' | 'ACKNOWLEDGED_AI_GOVERNANCE_SENSOR_TERMS' | 'CREATED_AI_GOVERNANCE_POLICY' | 'EDITED_AI_GOVERNANCE_POLICY' | 'ACTIVATED_AI_GOVERNANCE_POLICY' | 'ENDED_AI_GOVERNANCE_POLICY' | 'DELETED_AI_GOVERNANCE_POLICY' | 'CREATED_FEATURE_ANNOUNCEMENT' | 'EDITED_FEATURE_ANNOUNCEMENT' | 'DELETED_FEATURE_ANNOUNCEMENT' | 'CREATED_PRONUNCIATION_OVERRIDE' | 'EDITED_PRONUNCIATION_OVERRIDE' | 'DELETED_PRONUNCIATION_OVERRIDE' | 'TOGGLED_PRONUNCIATION_OVERRIDE' | 'REGENERATED_FRAME_NARRATIONS' | 'ASSIGNED_INBOX_DOMAIN_OWNER' | 'GENERATED_THREAT_LANDSCAPE_REPORT' | 'REGENERATED_THREAT_LANDSCAPE_REPORT': The action that occurred. - `actor` AuditActor: The administrator who performed the action. - `email` string: Email address of the admin. - `id` string: Unique Adaptive identifier for the admin. - `name` string: Human-readable name of the admin, when set. - `role` string: Role of the admin at the time of the action. - `type` 'ADMIN': Who performed the action. Always ADMIN: audit log webhooks are sent only for actions an administrator performed. - `category` 'SAT_PROGRAM' | 'WORKSPACE' | 'USERS' | 'LLM_SECURITY' | 'API' | 'EMAIL_SECURITY' | 'AI_GOVERNANCE' | 'CALL_GUARD': Top-level product area for the action. - `client_info` ClientInfo: Client context captured from the originating interaction, such as the originating IP address and the parsed user agent. - `browser` string: Browser parsed from the interaction's user agent. - `browser_version` string: Browser version parsed from the interaction's user agent. - `device` string: Device type parsed from the interaction's user agent. - `ip` string: IP address the interaction originated from. - `os` string: Operating system parsed from the interaction's user agent. - `os_version` string: Operating system version parsed from the interaction's user agent. - `entities` AuditEntity[]: Entities affected by the action. - `id` string: The entity identifier. - `name` string: Human-readable entity name when available; otherwise null. - `type` string: The kind of entity. - `id` string: Unique identifier for the audit log entry. - `message` string: Human-readable description of the action. - `subcategory` 'GROUPS' | 'TRAINING' | 'PHISHING_SIMULATION' | 'COMPANY_SETTINGS' | 'AUTHENTICATION' | 'EMPLOYEES' | 'INTEGRATIONS' | 'ADMINS' | 'AI_PERSONAS' | 'EXECUTIVE_RISK' | 'API_KEYS' | 'WEBHOOKS' | 'EMAIL_ANNOTATIONS' | 'SENDER_RULES' | 'DETECTION_THRESHOLDS' | 'COMPANY_CONTEXT' | 'EXCLUSION_RULES' | 'REMEDIATION_SETTINGS' | 'GOVERNANCE_PROMPTS' | 'GOVERNANCE_SETTINGS' | 'GOVERNANCE_POLICIES' | 'PRONUNCIATIONS' | 'CALL_GUARD_SECURITY_EVENTS' | 'ASSET_LIBRARY' | 'THREAT_LANDSCAPE' | 'EMAIL_SECURITY_EVENTS': Feature area for the action. - `success` boolean: Whether the admin action completed successfully. - `datacontenttype` string: media type of `data` - `id` string: unique id for event - `source` string: the event source; always `/adaptive` - `specversion` string: CloudEvents spec version - `subject` string: reserved for the event's primary entity id; currently never set, so always omitted - `time` string, date-time: when the event occurred - `type` 'admin.audit_log.created': the event type ## Acknowledgement `2XX` Return any 2xx status to acknowledge the delivery. Timeouts, 408, 429, and 5xx responses other than 501 are retried; any other status is a permanent failure. --- [API](https://skmtc.dev/adaptivesecurity/apis/adaptive-api.md) - [All operations](https://skmtc.dev/adaptivesecurity/apis/adaptive-api/llms.txt) - [OpenAPI document](https://skmtc.dev/adaptivesecurity/apis/adaptive-api/revisions/c367e8f673f3?raw)