---
title: "Update Audit Settings"
method: PATCH
path: "/admin/settings/audit"
tags: ["admin", "admin:settings"]
---

# Update Audit Settings

`PATCH /admin/settings/audit`

## Request

- Base URL: `https://platform.tracecat.com/api`
- URL: `https://platform.tracecat.com/api/admin/settings/audit`
- Auth: API key in cookie `fastapiusersauth`

Update platform audit settings.

## Request body

- PlatformAuditSettingsUpdate: Update platform audit settings.
  - `audit_webhook_url` string, nullable: Webhook URL that receives streamed audit events. When unset, audit events are skipped.
  - `audit_webhook_custom_headers` object, nullable: Custom headers to include in audit webhook requests. Header names are case-insensitive.
  - `audit_webhook_custom_payload` object, nullable: Custom JSON fields merged into streamed audit event payloads. Canonical audit event fields take precedence; conflicting custom keys are ignored.
  - `audit_webhook_payload_attribute` string, nullable: Optional wrapper key for audit payloads. When set to a value like 'event', payload is sent as {'event': <audit_payload>}.
  - `audit_webhook_verify_ssl` boolean: Whether TLS certificates are verified for webhook requests. Disable only for trusted on-prem/self-signed endpoints.

## Response `200`

Successful Response

- PlatformAuditSettingsRead: Platform audit settings response.
  - `audit_webhook_url` string, nullable, required
  - `audit_webhook_custom_headers` object, nullable
  - `audit_webhook_custom_payload` object, nullable
  - `audit_webhook_payload_attribute` string, nullable
  - `audit_webhook_verify_ssl` boolean
  - `decryption_failed_keys` string[]: Encrypted setting keys that could not be decrypted with the current encryption key and must be reconfigured.

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/tracecat/apis/tracecat-api.md) - [All operations](https://skmtc.dev/tracecat/apis/tracecat-api/llms.txt) - [OpenAPI document](https://skmtc.dev/tracecat/apis/tracecat-api/revisions/2efdda25045f?raw)