Skip to main content

​
Overview

Security webhook events notify your SIEM or security tooling when identity and access management (IAM) actions occur in Gu1: member lifecycle, role changes, sign-in/out, failed logins, admin password actions, and selected security settings. Configure them like any other webhook in Settings → Webhooks and subscribe only to the security.* events you need.

​
Payload shape (all security events)

Every security webhook uses the standard envelope plus a normalized inner payload: 
{
  "event": "security.auth.login_succeeded",
  "timestamp": "2026-06-18T12:00:00.000Z",
  "organizationId": "550e8400-e29b-41d4-a716-446655440000",
  "payload": {
    "actionAt": "2026-06-18T12:00:00.000Z",
    "actor": {
      "id": "550e8400-e29b-41d4-a716-446655440001",
      "email": "admin@example.com",
      "displayName": "Jane Admin"
    },
    "affectedUser": {
      "id": "550e8400-e29b-41d4-a716-446655440002",
      "email": "user@example.com",
      "displayName": "John User"
    },
    "description": "User logged in successfully",
    "changes": {
      "permissions": {
        "added": ["entities:write"],
        "removed": [],
        "current": ["entities:read", "entities:write"]
      }
    },
    "context": {
      "ipAddress": "203.0.113.10",
      "userAgent": "Mozilla/5.0 ...",
      "scope": "sandbox",
      "roleId": "uuid",
      "roleName": "Analyst"
    }
  }
}
FieldDescription
actionAtWhen the action occurred (ISO 8601)
actorUser who performed the action (id is Gu1 DB UUID when available)
affectedUserUser impacted by the action (when applicable)
descriptionHuman-readable summary
changesMap of changed fields. Role permissions: { added, removed, current }. Other fields: { previous, current }.
contextIP, user agent, settings scope, role metadata

​
Available events

​
Members (security.member.*)

EventWhen it fires
security.member.invitedAdmin invites a new member
security.member.createdMember accepts invitation / is created in org
security.member.removedMember removed from organization
security.member.activatedMember enabled / reactivated
security.member.deactivatedMember disabled
security.member.profile_updatedAdmin updates member display name (firstName / lastName)
security.member.password_resetAdmin resets a member’s password
security.member.password_generatedAdmin generates a temporary password
security.member.team_addedMember is added to a team
security.member.team_removedMember is removed from a team
security.member.team_role_changedMember’s role within a team changes
security.member.channel_grantedMember is granted access to a child channel organization
security.member.channel_revokedMember’s access to a child channel organization is revoked
security.member.environment_grantedMember is granted access to the paired production or sandbox org
security.member.environment_revokedMember’s access to the paired production or sandbox org is revoked
context.teamType (e.g. production, sandbox) and context.teamRole apply to team events. For environment access, context.environment is "production" or "sandbox", with context.environmentOrganizationId and context.environmentOrganizationName. Channel webhooks fire on the parent organization context; context.channelOrganizationId identifies the channel.

​
Roles & RBAC (security.role.*, security.rbac.*)

EventWhen it fires
security.role.createdGranular role created
security.role.updatedRole modified (includes permission diffs when available)
security.role.deletedRole deleted
security.role.assignedRole assigned to user
security.role.revokedRole revoked from user
security.rbac.granular_toggledGranular RBAC enabled or disabled

​
Authentication (security.auth.*)

EventWhen it fires
security.auth.login_succeededSuccessful sign-in (Gu1 web app)
security.auth.logoutUser signs out
security.auth.login_failedFailed sign-in attempt (when email resolves to an org)

​
Security settings

EventWhen it fires
security.settings.updatedSandbox mode, general/risk settings, or other audited security-related org settings (context.scope identifies the area)

​
Limitations

The following are not covered by Gu1 security webhooks today:
  • End-user self-service password change in Clerk (IdP-only)
  • MFA / SSO configuration changes in Clerk
  • Machine-to-machine API key authentication (separate from user login)
  • Clerk dashboard session revocations that never touch Gu1 API
Admin-initiated password reset/generation is covered via security.member.password_*.