Register Log Sink

POST/api/v1/system/dispatch

Request

curl -X POST "<BASE_URL>/api/v1/system/dispatch" \
  -H "Authorization: Bearer <ACCESS_TOKEN>" \
  -H "X-CQRS-Action: REGISTER_LOG_SINK" \
  -H "Content-Type: application/json" \
  -d '{
    "endpoint_url": "https://example.com",
    "event_classes": [
      "ENGINE_DECISION"
    ],
    "kind": "SPLUNK_HEC",
    "name": "string",
    "registered_by": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
    "secret_key_name": "string",
    "tenant_id": "7c9e6679-7425-40de-944b-e07fc1f90ae7"
  }'

Authorization

Minimum role: Tenant administratorThe caller must hold this role or a higher one.
Multi-factor sign-in: Required. The access token must come from a session that completed multi-factor sign-in.
Action: REGISTER_LOG_SINK

Headers

AuthorizationstringRequired
Access token of the signed-in user, as a Bearer token. It identifies the user, their role and the workspace.
X-CQRS-ActionstringRequired
Names the command to run. Must be REGISTER_LOG_SINK for this endpoint.
Content-TypestringRequired
Always application/json.
X-Idempotency-KeystringOptional
A key you choose that is unique to this attempt. A command repeated with the same key is not applied a second time.
X-Correlation-IdstringOptional
Your own identifier for the request. Returned in the x-correlation-id response header; generated when you leave it out.

Request body

endpoint_urluriRequired
No description yet.
event_classesarray of enumRequired
Allowlist of what this sink receives. Rejected when empty rather than defaulted to everything: see LogEventClass.
Allowed values
- ENGINE_DECISION
- ENGINE_REFUSAL
- AUDIT_EVENT
- AUTH_ATTEMPT
- CONNECTOR_ACTIVITY
ENGINE_DECISION
Every gate outcome from decision_audit. The security-relevant bulk: auth decisions, policy denials, idempotency replays, refusals.
ENGINE_REFUSAL
Refusals only — the outcome = 'ERR' subset. The common choice: same signal, a fraction of the volume.
AUDIT_EVENT
system_audit_events — permission changes, data modification, contract signature, erasure.
AUTH_ATTEMPT
sso_login_attempts — authentication outcomes.
CONNECTOR_ACTIVITY
connector_operation_logs — third-party integration activity.
kindenumRequired
Wire protocol of a customer's log sink.
Allowed values
- SPLUNK_HEC
- HTTPS_JSON
- DATADOG
SPLUNK_HEC
Splunk HTTP Event Collector. Authorization: Splunk <token>, newline-delimited {"event": …} objects.
HTTPS_JSON
Any HTTPS endpoint accepting a JSON array of ECS documents with a bearer token. The escape hatch that works with Elastic, Sumo, Cribl and anything self-hosted without needing a variant each.
DATADOG
Datadog Logs intake. DD-API-KEY header, JSON array.
namestringRequired
No description yet.
minimum length 1
registered_byuuidRequired
No description yet.
secret_key_namestringRequired
Key into tenant_secrets. The credential itself never travels on a command — it would land in the command payload digest, the event envelope and any trace replay of this dispatch.
minimum length 1
tenant_iduuidRequired
No description yet.

Response

Status 202. The command was applied. The body is the record as it stands after the command: a JSON object whose fields depend on the record.

Errors

Every error carries an HTTP status. Where it also carries a code, branch on the code, not on the message.

400X-CQRS-Action is missing or names a command this route does not accept. Send REGISTER_LOG_SINK.
400DOMAIN_ROUTINGThe body is not a valid command. Check the required fields and their types.
401The access token is missing, expired or not valid.
401L1_AUTHThe caller's role is below tenantadmin, the session has not completed multi-factor sign-in, or the caller has no access to this record.
403L1_POLICYA business rule refused the command. The message names the rule.
409L1_IDEMPOTENCYA command with this idempotency key was already applied.
409CONFLICTThe command would duplicate a record that must be unique.
500L3_COMMITThe command was valid but could not be saved.