> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wede.pt/llms.txt
> Use this file to discover all available pages before exploring further.

# Security export (SIEM)

> Send the security record of your organisation to your SIEM, by pull or by signed push

The security export sends the audit log of your organisation to your SIEM or to any tool that can read JSON over HTTPS, such as Microsoft Sentinel, Splunk, Elastic or QRadar with a JSON collector. It covers sign-ins and refused sign-ins, changes to accounts and roles, settings, keys, tokens and directory changes, with who did it, when and from where.

It never carries the content of your events or messages. Secrets, tokens, phone numbers, names and free texts are always removed from the details.

Only a `company_admin` of your organisation can set it up, in **Settings > Security export (SIEM)** of the dashboard. There are two ways, and you can use both.

***

## Pull: your SIEM collects

Create a token in the dashboard. It starts with `wsec_` and is shown only once: wede keeps only a hash of it. You can have up to 5 active tokens, and revoking one stops it at once.

```bash theme={null}
curl "https://api.wede.pt/v1/security-events?after=0&limit=500" \
  -H "Authorization: Bearer <wsec_token>"
```

```json theme={null}
{
  "events": [ { "id": "...", "seq": 1042, "action": "auth.sso_login", "...": "..." } ],
  "next_after": "1042",
  "has_more": false
}
```

Start with `after=0` and send the `next_after` of each answer in the next request. `limit` goes up to 1000 (500 by default). Events appear 10 seconds after they happen, always in order and never twice, so a cursor never skips an event.

***

## Push: wede sends to your address

Add an `https` address in the dashboard, up to 3. If your receiver needs a header, for example `Authorization` with its own token, add it: the value is stored encrypted and never shown again. You also get a signing secret, shown only once.

Every minute wede sends the new events in `POST` requests of up to 500 events:

```json theme={null}
{ "destination_id": "...", "events": [ ... ] }
```

* A new address receives what happens from the moment it is added.
* Without a `2xx` answer, wede tries again after 1, 2, 4 and up to 60 minutes, then sends everything that was waiting, in order, without gaps.
* **Send test event** sends one signed event with `"test": true`. **Pause** and **Resume** stop and restart sending without losing events.

### Verify the signature

Each request carries `X-Wede-Signature: t=<unix seconds>,v1=<hex>`, where `v1` is an HMAC-SHA256, with your signing secret, of `<t>.<raw body>`. It is the same scheme as [webhook signatures](/concepts/security.md#webhook-signatures). Compute it over the body exactly as received, compare in constant time and refuse requests whose `t` is more than 5 minutes away from your clock. Each request also carries a unique `X-Wede-Delivery` id.

***

## Event format

```json theme={null}
{
  "id": "6f0c...",
  "seq": 1042,
  "time": "2026-10-14T21:53:28.217Z",
  "tenant_id": "513e...",
  "action": "auth.sso_login",
  "category": "auth",
  "outcome": "success",
  "actor": { "type": "user", "id": "9b1d...", "role": "operational_supervisor", "via": null, "email": "ana@bank.com" },
  "target": { "type": "user", "id": "9b1d..." },
  "ip": "203.0.113.10",
  "user_agent": "Mozilla/5.0 ...",
  "details": { "jit": false, "rbac_level": "operational_supervisor", "protocol": "saml" }
}
```

| Field | Meaning |
| - | - |
| `id` | Stable id of the event. If the same id arrives twice, keep one |
| `seq` | Position in the record of your organisation, always increasing |
| `action`, `category` | What happened, for example `auth.sso_login`, `scim.user_suspended`, `user.updated` |
| `outcome` | `success` or `failure` |
| `actor.type` | `user`, `wede_staff`, `directory` (your SCIM directory) or `system` |
| `actor.email` | Only for people of your organisation, and only while **Include the email of the person who did it** is on |
| `target` | The type and id of what was changed |
| `details` | The data of the action, without secrets, contacts or content |

Actions by wede staff always show only their role and id, never their email.

***

## Audit of the export itself

Creating or revoking tokens, adding, changing, testing or removing an address and a failing address are recorded in the audit log as `tenant.security_export_*`, so the export itself is under the same record it sends.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.