1. 1
   Navigate to Workspace Settings in the sidebar
2. 2
   Scroll to the Webhooks section
3. 3
   Click Add Destination
4. 4
   Enter your HTTPS webhook URL and an optional description
5. 5
   Add any custom headers your endpoint requires (e.g., API keys, authorization tokens)
6. 6
   Click Create Destination
7. 7
   Copy the HMAC secret — it is shown only once. Store it securely.
8. 8
   Click the Test button to send a test event and verify delivery

• CloudEvents v1.0 (default) — a generic structured envelope that works with most consumers (Knative Eventing, Argo Events, custom HTTP receivers). Documented below.
• Datadog Logs — pre-formatted for Datadog's HTTP log intake, with top-level reserved attributes (ddsource, service, hostname, status, message, ddtags, event_id, event_type) so events are searchable in Log Explorer without a remap pipeline. See the Datadog quickstart below.

[
  {
    "specversion": "1.0",
    "id": "aud_abc123",
    "source": "https://atmos-pro.com/workspaces/ws_xyz",
    "type": "pro.atmos.workspace.created",
    "time": "2025-01-15T10:30:00.000Z",
    "subject": "ws_target1",
    "datacontenttype": "application/json",
    "data": {
      "actor": { "id": "usr_actor1", "type": "user" },
      "action": { "category": "workspace", "action": "created" },
      "target": { "type": "workspace", "id": "ws_target1" },
      "description": null,
      "metadata": {}
    }
  }
]

X-Webhook-Signature: sha256=5d7861...

const crypto = require('crypto');
 
function verifySignature(body, secret, signatureHeader) {
  const expected = 'sha256=' + crypto.createHmac('sha256', secret)
    .update(body)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(signatureHeader),
    Buffer.from(expected)
  );
}
 
// In your webhook handler:
const body = req.body; // raw string, not parsed JSON
const signature = req.headers['x-webhook-signature'];
if (!verifySignature(body, process.env.WEBHOOK_SECRET, signature)) {
  return res.status(401).send('Invalid signature');
}

• Events are batched — up to 100 events are collected over a 30-second window before delivery
• Failed deliveries are retried up to 5 times with exponential backoff
• After all retries are exhausted, an alert email is sent to notify you of the failure
• Delivery status (success/failure) is visible in the webhook destinations list in workspace settings
• The X-Webhook-Id header identifies which destination received the delivery

// All permission grants in the last 24 hours
['atmos-pro-audit']
| where _time > ago(24h)
| where ['data.action.action'] == 'assigned'
| where ['data.action.category'] == 'permission'
| project _time, ['data.actor.email'], ['data.target.id']

// Failed actions by user
['atmos-pro-audit']
| where ['data.outcome'] == 'failure'
| summarize count() by ['data.actor.email']
| order by count_ desc

• Verify the destination URL is reachable and returns a 2xx status code
• Check that HTTPS is used (HTTP URLs are not allowed)
• Verify any custom headers (e.g., API keys) are correct and not expired
• Check your endpoint's firewall or IP allowlist

• Confirm the destination is enabled in workspace settings
• Check the audit log viewer to verify events are being recorded
• Send a test event to confirm connectivity

• Verify against the raw request body (the exact bytes received), not a re-serialized version
• Use timing-safe comparison (e.g., crypto.timingSafeEqual in Node.js)
• Ensure you are using the correct secret for the destination