Skip to content
Home Developer API Webhooks and Audit API
Webhooks and Audit API

Wire SendSafely events into the rest of your stack.

Structured, real-time events for integrations, auditing and automation. Capture, monitor, and act on every SendSafely event. 

PACKAGE_EVENT USER_EVENT ADMIN_EVENT
See event surfaces REST API reference
Three event surfaces

Pick the surface that matches your workflow.

SendSafely exposes events three ways — a pull-based Audit Log API for activity in your portal, an inbound webhook on Dropzone uploads, and outbound Action webhooks that route finalized files to AV, DLP, and archive systems. 

Pull · portal activity
Audit Log API

Programmatic access to important metadata related to file uploads and downloads, admin tasks and user events.  ISO 8601 UTC timestamps, IP address, authenticated user, and JSON logDetails. 90-day retention via REST, indefinite via S3 export.

Enterprise plan REST API reference
Push · per upload
Dropzone notifications

Configure a webhook URL in your Dropzone Profile under "Use a Webhook for notifications" — SendSafely posts to it on every Dropzone upload instead of email.

Configurable in portal Dropzone overview
Push · finalized package
Action workflows

External Actions fire outbound webhooks when a package is finalized or a file lands in a Workspace — routing to CrowdStrike, OPSWAT, Sophos, Google Cloud DLP, Tines, or a private S3 bucket. Decryptable via API credentials.

Enterprise plan Actions overview
Audit Log API

Core audit events security teams rely on

The Audit Log API captures portal events into three top-level event types. Each record carries an eventId, ISO 8601 UTC timestamp, eventType, action, ipAddress, authenticatedUser, and a JSON logDetails payload describing the action.

PACKAGE_EVENT
File uploads and downloads

All Dropzone and Send package finalization and downloads, as well as file upload and download activities on a Workspace. 

  • Package finalized
  • File Download
  • Workspace File Upload
  • Workspace File Download
USER_EVENT
User level activity

User registration, authentication, and updates users have made to their own profile.

  • User registration
  • User sign-in
  • Two-factor verification
  • API Keys
ADMIN_EVENT
Provisioning & Key Management

Admin-side changes to portal — user provisioning, authentication settings and master key management

  • User provisioned or deprovisioned
  • Admin role management
  • Authentication settings
  • Master key management
Audit Log event — documented fields JSON
eventIdstring Stable, unique identifier for this event record.
timestampiso 8601 UTC timestamp marking when the event was recorded.
eventTypeenum One of PACKAGE_EVENT, USER_EVENT, ADMIN_EVENT.
actionstring The specific action recorded within the event category.
ipAddressstring Source IP address attributed to the action.
authenticatedUserstring Identifier for the user authenticated at the time of the event.
logDetailsjson Structured action-specific payload — package IDs, file metadata, policy diffs, and other contextual fields.
Consume the Audit Log

Integrate with your SIEM for unified monitoring and alerting

The Audit Log API is part of the SendSafely REST API, with 90 day retention and an S3 export path for long-term archival. Perform targeted searches of log data as part of ad-hoc incident investigation, or ingest the audit feed into existing SIEM platform. 

90 days via REST, indefinite via S3

Audit Log records remain queryable through the REST API for 90 days. For indefinite retention — or compliance-driven WORM archival — pair the API with the S3 Export feature on the Enterprise plan.

SIEM-ready event shape

Records ship as structured JSON — ISO 8601 UTC timestamps, stable eventId, IP, and authenticated user fields — ready to forward into Splunk, Sumo Logic, or any SIEM that accepts JSON event streams.

Plan availability

Dropzone webhook notifications are configurable in the Dropzone Profile on plans that include Dropzone. The Audit Log API — and the outbound Action webhooks — require the Enterprise plan. REST API access overall is available on Teams plan and above.

See Pricing Developer API overview SDKs and tooling Obtain API credentials

Pipe encrypted file activity where it belongs.

Talk to our team about wiring the Audit Log API into your SIEM, archive, or AI workflow — or browse the REST and SDK reference to start building today.

Developer API home Request Demo