Webhook REST API
The Webhook REST API lets you forward all audit logs from all supported Sitecore DXP applications to systems outside Sitecore. For example, to a security information and event management (SIEM) system, where you can analyze the recorded audit logs.
You can start forwarding all audit logs by creating and enabling a webhook. After creating at least one webhook, you can call the other API endpoints to, for example, update or disable the webhook.
Base URL
In general, your Webhook REST API base URL depends on the region of your Sitecore instance.
The only exception is logged activities in the Sitecore Cloud Portal, which always use the EUW region (https://mesh-management-api-euw.sitecorecloud.io).
| Sitecore region | Webhook REST API base URL |
|---|---|
| AUE | https://mesh-management-api-aue.sitecorecloud.io |
| EUW | https://mesh-management-api-euw.sitecorecloud.io |
| JPE | https://mesh-management-api-jpe.sitecorecloud.io |
| USE | https://mesh-management-api-use.sitecorecloud.io |
| USW | https://mesh-management-api-usw.sitecorecloud.io |
Your Sitecore region
You can find your Sitecore region by logging in to any of your Sitecore DXP apps supported by the Common Audit Log:
- In Sitecore CDP, on the menu bar, click
> Company information > Environment:
- AP region means that your Sitecore region is AUE.
- EU region means that your Sitecore region is EUW.
- US region means that your Sitecore region is USE.
- In Sitecore Connect, on the menu bar, in the last part of your tenant name:
- Australia (East) means that your Sitecore region is AUE.
- Europe (West) means that your Sitecore region is EUW.
- Japan (East) means that your Sitecore region is JPE.
- US East means that your Sitecore region is USE.
- US West means that your Sitecore region is USW.
- In Sitecore Personalize, on the menu bar, click > Company information > Environment:
- AP region means that your Sitecore region is AUE.
- EU region means that your Sitecore region is EUW.
- US region means that your Sitecore region is USE.
Authentication
The Webhook REST API uses bearer authentication.
Bearer authentication involves sending a bearer token with every request. Only users with an Organization Admin or Organization Owner role can access bearer tokens. To access your bearer token, log in to the Sitecore Cloud Portal, and in the the top-right corner of the menu bar, click your profile 
> API tokens. The bearer token is in the Bearer token field.
Bearer tokens expire in 15 minutes. If your requests unexpectedly return a response with status 401 Unauthorized, refresh the API tokens page to access your new bearer token.
Webhook data model
When making requests to the Webhook REST API, you work with the following webhook attributes:
| Attribute | Type | Description | Example(s) |
|---|---|---|---|
space | string | The environment you are using the webhook in. This is a value of your choice. |
|
sourceSystem.$type | string | The Sitecore digital experience platform (DXP) app to forward logs from. You must set this value to "AnySource", which means that logs from all apps will be forwarded. | "AnySource" |
destinationSystem.$type | string | The type of the system that logs will be forwarded to. You must set this value to "Webhook". | "Webhook" |
destinationSystem.secret | string | A secret you define, automatically passed in the X-Secret request header. To authenticate incoming webhook calls, your target application must verify this secret. | "mys3cr3tstr1ingforauth1!x" |
destinationSystem.targetUrl | string | The webhook target URL. This is the URL that logs will be forwarded to. | "https://www.exampletarget.url/example-endpoint" |
logLevel | string | Record only when a webhook message fails to be sent to an external system, or also when the message is successfully sent. | Must be one of:
|
eventName | string | The internal event name of when a webhook is created. You must set this value to "sitecore.backbone.messages.audit.created". | "sitecore.backbone.messages.audit.created" |
enabled | boolean | Determines whether the webhook is enabled or disabled at creation time. When enabled, logs will immediately start being forwarded to the webhook target URL. To change this after creating the webhook, see Disable a webhook and Enable a webhook. | true or false |
When receiving responses from the Webhook REST API, the following webhook attributes are returned:
| Attribute | Type | Description | Example(s) |
|---|---|---|---|
id | string | The webhook ID. | "7050346545d5447da57b64be6416ac78" |
organizationId | string | The ID of your organization. | "org_ZiiCnzhCeHDpWJAU" |
sourceSystem.$type | string | The Sitecore digital experience platform (DXP) app to forward logs from. | "AnySource" |
destinationSystem.$type | string | The type of the system that logs will be forwarded to. | "Webhook" |
destinationSystem.secret | string | A secret you define, automatically passed in the X-Secret request header. To authenticate incoming webhook calls, your target application must verify this secret. | "mys3cr3tstr1ingforauth1!x" |
destinationSystem.targetUrl | string | The webhook target URL. This is the URL that logs will be forwarded to. | "https://www.exampletarget.url/example-endpoint" |
logLevel | string | Record only when a webhook message fails to be sent to an external system, or also when the message is successfully sent. | Must be one of:
|
space | string | The environment you are using the webhook in. This is a value of your choice. |
|
createdBy | string | The email address of the Sitecore Cloud Portal user that created the webhook. | "[email protected]" |
createdDate | string (ISO 8601) | The UTC date and time when the webhook was created. | "2026-01-08 08:12" |
updatedBy | string | The unique identifier of the user that last updated the webhook. | "[email protected]" |
updatedDate | string (ISO 8601) | The UTC date and time when the webhook was last updated. | "2026-01-16 11:44" |
eventName and name | string | The internal event name of when a webhook is created. | "sitecore.backbone.messages.audit.created" |
enabled | boolean | Determines whether the webhook is enabled or disabled at creation time. When enabled, logs will immediately start being forwarded to the webhook target URL. | true or false |
Response codes
The Webhook REST API uses standard HTTP responses to let you know the result of your requests:
| HTTP response | Description |
|---|---|
200 OK | Webhook successfully retrieved. |
201 Created | Webhook successfully created. |
401 Unauthorized | You're not authorized to access the resource. Make sure to use a valid bearer token. |
404 Not Found | Webhook not found. |