Sign in
enterprise-admin

Update an existing audit log stream configuration

Updates an existing audit log stream configuration for an enterprise.

Microsoft Agent365 streams are configured through Microsoft Entra authorization. For those streams, this endpoint can only pause or resume the stream. Authorization-managed fields cannot be updated; delete and recreate the stream to change its Entra tenant or authorization.

When using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See "Encrypting secrets for the REST API."

put/enterprises/{enterprise}/audit-log/streams/{stream_id}

Path parameters

enterprisestring required

The slug version of the enterprise name.

stream_idinteger required

The ID of the audit log stream configuration.

Request body

enabledboolean required

This setting pauses or resumes a stream.

stream_type'Azure Blob Storage' | 'Azure Event Hubs' | 'Amazon S3' | 'Splunk' | 'HTTPS Event Collector' | 'Google Cloud Storage' | 'Datadog' | 'Microsoft Agent365' required

The audit log streaming provider. The name is case sensitive.

Response

Successful update

idinteger required
stream_typestring required
stream_detailsstring required
enabledboolean required
created_atstring date-time required
updated_atstring date-time required
paused_atstring date-time nullable

Changes