Security export (SIEM)

The security export sends the audit log of your organisation to your SIEM or to any tool that can read JSON over HTTPS, such as Microsoft Sentinel, Splunk, Elastic or QRadar with a JSON collector. It covers sign-ins and refused sign-ins, changes to accounts and roles, settings, keys, tokens and directory changes, with who did it, when and from where. It never carries the content of your events or messages. Secrets, tokens, phone numbers, names and free texts are always removed from the details. Only a company_admin of your organisation can set it up, in Settings > Security export (SIEM) of the dashboard. There are two ways, and you can use both.

Pull: your SIEM collects

Create a token in the dashboard. It starts with wsec_ and is shown only once: wede keeps only a hash of it. You can have up to 5 active tokens, and revoking one stops it at once.

curl "https://api.wede.pt/v1/security-events?after=0&limit=500" \
  -H "Authorization: Bearer <wsec_token>"

{
  "events": [ { "id": "...", "seq": 1042, "action": "auth.sso_login", "...": "..." } ],
  "next_after": "1042",
  "has_more": false
}

Start with after=0 and send the next_after of each answer in the next request. limit goes up to 1000 (500 by default). Events appear 10 seconds after they happen, always in order and never twice, so a cursor never skips an event.

Push: wede sends to your address

Add an https address in the dashboard, up to 3. If your receiver needs a header, for example Authorization with its own token, add it: the value is stored encrypted and never shown again. You also get a signing secret, shown only once. Every minute wede sends the new events in POST requests of up to 500 events:

{ "destination_id": "...", "events": [ ... ] }

A new address receives what happens from the moment it is added.
Without a 2xx answer, wede tries again after 1, 2, 4 and up to 60 minutes, then sends everything that was waiting, in order, without gaps.
Send test event sends one signed event with "test": true. Pause and Resume stop and restart sending without losing events.

Verify the signature

Each request carries X-Wede-Signature: t=<unix seconds>,v1=<hex>, where v1 is an HMAC-SHA256, with your signing secret, of <t>.<raw body>. It is the same scheme as webhook signatures. Compute it over the body exactly as received, compare in constant time and refuse requests whose t is more than 5 minutes away from your clock. Each request also carries a unique X-Wede-Delivery id.

Event format

{
  "id": "6f0c...",
  "seq": 1042,
  "time": "2026-10-14T21:53:28.217Z",
  "tenant_id": "513e...",
  "action": "auth.sso_login",
  "category": "auth",
  "outcome": "success",
  "actor": { "type": "user", "id": "9b1d...", "role": "operational_supervisor", "via": null, "email": "ana@bank.com" },
  "target": { "type": "user", "id": "9b1d..." },
  "ip": "203.0.113.10",
  "user_agent": "Mozilla/5.0 ...",
  "details": { "jit": false, "rbac_level": "operational_supervisor", "protocol": "saml" }
}

Field	Meaning
`id`	Stable id of the event. If the same id arrives twice, keep one
`seq`	Position in the record of your organisation, always increasing
`action`, `category`	What happened, for example `auth.sso_login`, `scim.user_suspended`, `user.updated`
`outcome`	`success` or `failure`
`actor.type`	`user`, `wede_staff`, `directory` (your SCIM directory) or `system`
`actor.email`	Only for people of your organisation, and only while Include the email of the person who did it is on
`target`	The type and id of what was changed
`details`	The data of the action, without secrets, contacts or content

Actions by wede staff always show only their role and id, never their email.

Audit of the export itself

Creating or revoking tokens, adding, changing, testing or removing an address and a failing address are recorded in the audit log as tenant.security_export_*, so the export itself is under the same record it sends.

Security Overview

Identity and access

Compliance

Pull: your SIEM collects

Push: wede sends to your address

Verify the signature

Event format

Audit of the export itself

​Pull: your SIEM collects

​Push: wede sends to your address

​Verify the signature

​Event format

​Audit of the export itself

Pull: your SIEM collects

Push: wede sends to your address

Verify the signature

Event format

Audit of the export itself