Send events to each customer’s security tools
Each customer can configure a destination and choose the security events their team needs. Wildo applies that organization’s delivery settings around a shared event contract, so customers can use their own monitoring and review workflows.
Example — Send customers the events their teams use
One customer receives warning-level authorization events in structured JSON. Another selects a text format and a broader set of categories for a different collector.
For engineers
Enable the relevant runtime capability and customer entitlement, then connect the application’s authorized administration flow to AuthOrganizationConfigurationService.saveSiemExportConfig. It accepts the administrator’s execution context, AuthScopeType.ORGANIZATION, the organization ID and a configuration patch. The selected payload below uses the actual schema’s fields; its URL and credential are illustrative placeholders.
{
"enabled": true,
"webhookUrl": "https://security.customer.example/events",
"authMethod": "bearer_token",
"authCredential": "<collector credential>",
"eventFormat": "json_structured",
"eventFilter": {
"categories": ["authorization"],
"severityMinimum": "warning"
}
}
The resource’s authCredential is write-only secret material: the standard interface returns a mask and preserves the existing value when that mask is submitted unchanged. To replace the collector credential, submit its new value through that authorized configuration flow and coordinate the change with the receiver.
The configuration service reads the scoped row, then invokes its internal update operation (or creates the row if absent). This is the service integration contract for an application settings screen, not a standalone public update endpoint on the configuration resource.
Understand what reaches the collector
The central audit writer resolves authenticated or explicitly verified tenant destinations. The dispatcher loads that organization’s configuration, checks enabled, applies category/severity/event-type filters and queues the selected envelope. Configuration-change hooks invalidate its cache so subsequent dispatch uses current settings.
Supported authentication choices are bearer token, a named API-key header, HMAC signing and none. The chosen wire format also determines the content type. Delivery attempts and recoverable failures have their own lifecycle.
Confirm setup with a real in-scope security action and a receipt at the customer collector. The tenant stream is distinct from the application’s complete primary history; an event without an authorized tenant destination does not get routed merely because its payload names an organization.