--- title: "Webhook REST API" slug: "webhook-rest-api" abstract: "Understand how to use the Webhook REST API to create webhooks that forward all audit logs from SitecoreCommon Audit Log, including the base URL, authorization, and the JSON fields." --- # Webhook REST API The Webhook REST API lets you forward all audit logs from all supported Sitecore DXP applications to systems outside Sitecore. For example, to a security information and event management (SIEM) system, where you can analyze the recorded audit logs. You can start forwarding all audit logs by [creating and enabling](https://doc.sitecore.com/portal/en/developers/sitecore-cloud-portal/sitecore-common-audit-log/webhook-rest-api/create-a-webhook.html "Create a webhook") a webhook. After creating at least one webhook, you can call the other API endpoints to, for example, [update](https://doc.sitecore.com/portal/en/developers/sitecore-cloud-portal/sitecore-common-audit-log/webhook-rest-api/update-a-webhook.html "Update a webhook") or [disable](https://doc.sitecore.com/portal/en/developers/sitecore-cloud-portal/sitecore-common-audit-log/webhook-rest-api/disable-a-webhook.html "Disable a webhook") the webhook. ## Base URL In general, your Webhook REST API base URL depends on the [region of your Sitecore instance](https://doc.sitecore.com/portal/en/developers/sitecore-cloud-portal/sitecore-common-audit-log/webhook-rest-api/webhook-rest-api.html#UUID-f7f4b3d3-d86a-364c-1dd1-9a179d658100_N1708525788739 "Your Sitecore region"). The only exception is [logged activities in the Sitecore Cloud Portal](https://doc.sitecore.com/portal/en/developers/sitecore-cloud-portal/sitecore-common-audit-log/logged-activities/logged-activities-in-the-sitecore-cloud-portal.html "Logged activities in the Sitecore Cloud Portal"), which always use the `EUW` region (`https://mesh-management-api-euw.sitecorecloud.io`). | Sitecore region | Webhook REST API base URL | | --- | --- | | **AUE** | `https://mesh-management-api-aue.sitecorecloud.io` | | **EUW** | `https://mesh-management-api-euw.sitecorecloud.io` | | **JPE** | `https://mesh-management-api-jpe.sitecorecloud.io` | | **USE** | `https://mesh-management-api-use.sitecorecloud.io` | | **USW** | `https://mesh-management-api-usw.sitecorecloud.io` | ### Your Sitecore region You can find your Sitecore region by logging in to any of your Sitecore DXP apps supported by the Common Audit Log: - In Sitecore CDP, on the menu bar, click ![cdp_gear_icon.png](https://doc.sitecore.com/api/markdown-image/portal/en/developers/sitecore-cloud-portal/images/cdp_gear_icon.png) > **Company information** > **Environment**: - **AP region** means that your Sitecore region is **AUE**. - **EU region** means that your Sitecore region is **EUW**. - **US region** means that your Sitecore region is **USE**. - In Sitecore Connect, on the menu bar, in the last part of your tenant name: - **Australia (East)** means that your Sitecore region is **AUE**. - **Europe (West)** means that your Sitecore region is **EUW**. - **Japan (East)** means that your Sitecore region is **JPE**. - **US East** means that your Sitecore region is **USE**. - **US West** means that your Sitecore region is **USW**. - In Sitecore Personalize, on the menu bar, click ![cdp_gear_icon.png](https://doc.sitecore.com/api/markdown-image/portal/en/developers/sitecore-cloud-portal/images/cdp_gear_icon.png) > **Company information** > **Environment**: - **AP region** means that your Sitecore region is **AUE**. - **EU region** means that your Sitecore region is **EUW**. - **US region** means that your Sitecore region is **USE**. ## Authentication The Webhook REST API uses bearer authentication. Bearer authentication involves sending a bearer token with every request. Only users with an *Organization Admin* or *Organization Owner* role can access bearer tokens. To access your bearer token, log in to the Sitecore Cloud Portal, and in the the top-right corner of the menu bar, click your profile ![profile.PNG](https://doc.sitecore.com/api/markdown-image/portal/en/developers/sitecore-cloud-portal/images/profile.PNG) > **API tokens**. The bearer token is in the **Bearer token** field. > [!important] > Bearer tokens expire in 15 minutes. If your requests unexpectedly return a response with status `401 Unauthorized`, refresh the **API tokens** page to access your new bearer token. ## Webhook data model When making requests to the Webhook REST API, you work with the following webhook attributes: | Attribute | Type | Description | Example(s) | | --- | --- | --- | --- | | `space` | string | The environment you are using the webhook in. This is a value of your choice. | | | `sourceSystem.$type` | string | The Sitecore digital experience platform (DXP) app to forward logs from.

You must set this value to `"AnySource"`, which means that logs from all apps will be forwarded. | `"AnySource"` | | `destinationSystem.$type` | string | The type of the system that logs will be forwarded to.

You must set this value to `"Webhook"`. | `"Webhook"` | | `destinationSystem.secret` | string | A secret you define, automatically passed in the `X-Secret` request header. To authenticate incoming webhook calls, your target application must verify this secret. | `"mys3cr3tstr1ingforauth1!x"` | | `destinationSystem.targetUrl` | string | The webhook target URL. This is the URL that logs will be forwarded to. | `"https://www.exampletarget.url/example-endpoint"` | | `logLevel` | string | Record only when a webhook message fails to be sent to an external system, or also when the message is successfully sent. | Must be one of:

| | `eventName` | string | The internal event name of when a webhook is created.

You must set this value to `"sitecore.backbone.messages.audit.created"`. | `"sitecore.backbone.messages.audit.created"` | | `enabled` | boolean | Determines whether the webhook is enabled or disabled at creation time.

When enabled, logs will immediately start being forwarded to the webhook target URL.

To change this after creating the webhook, see [Disable a webhook](https://doc.sitecore.com/portal/en/developers/sitecore-cloud-portal/sitecore-common-audit-log/webhook-rest-api/disable-a-webhook.html) and [Enable a webhook](https://doc.sitecore.com/portal/en/developers/sitecore-cloud-portal/sitecore-common-audit-log/webhook-rest-api/enable-a-webhook.html). | `true` or `false` | When receiving responses from the Webhook REST API, the following webhook attributes are returned: | Attribute | Type | Description | Example(s) | | --- | --- | --- | --- | | `id` | string | The webhook ID. | `"7050346545d5447da57b64be6416ac78"` | | `organizationId` | string | The ID of your organization. | `"org_ZiiCnzhCeHDpWJAU"` | | `sourceSystem.$type` | string | The Sitecore digital experience platform (DXP) app to forward logs from. | `"AnySource"` | | `destinationSystem.$type` | string | The type of the system that logs will be forwarded to. | `"Webhook"` | | `destinationSystem.secret` | string | A secret you define, automatically passed in the `X-Secret` request header. To authenticate incoming webhook calls, your target application must verify this secret. | `"mys3cr3tstr1ingforauth1!x"` | | `destinationSystem.targetUrl` | string | The webhook target URL. This is the URL that logs will be forwarded to. | `"https://www.exampletarget.url/example-endpoint"` | | `logLevel` | string | Record only when a webhook message fails to be sent to an external system, or also when the message is successfully sent. | Must be one of:

| | `space` | string | The environment you are using the webhook in. This is a value of your choice. | | | `createdBy` | string | The email address of the Sitecore Cloud Portal user that created the webhook. | `"jane.doe@myretailsite.com"` | | `createdDate` | string ([ISO 8601](https://en.wikipedia.org/wiki/ISO_8601)) | The UTC date and time when the webhook was created. | `"2026-01-08 `08:06`:12"` | | `updatedBy` | string | The unique identifier of the user that last updated the webhook. | `"john.doe@myretailsite.com"` | | `updatedDate` | string ([ISO 8601](https://en.wikipedia.org/wiki/ISO_8601)) | The UTC date and time when the webhook was last updated. | `"2026-01-16 `11:03`:44"` | | `eventName` and `name` | string | The internal event name of when a webhook is created. | `"sitecore.backbone.messages.audit.created"` | | `enabled` | boolean | Determines whether the webhook is enabled or disabled at creation time.

When enabled, logs will immediately start being forwarded to the webhook target URL. | `true` or `false` | ## Response codes The Webhook REST API uses standard HTTP responses to let you know the result of your requests: | HTTP response | Description | | --- | --- | | `200 OK` | Webhook successfully retrieved. | | `201 Created` | Webhook successfully created. | | `401 Unauthorized` | You're not authorized to access the resource. Make sure to use a [valid bearer token](https://doc.sitecore.com/portal/en/developers/sitecore-cloud-portal/sitecore-common-audit-log/webhook-rest-api/webhook-rest-api.html#UUID-f7f4b3d3-d86a-364c-1dd1-9a179d658100_section-idm1903409955372724). | | `404 Not Found` | Webhook not found. |