Skip to main content
All WorkOS integration capabilities

​
About

Send your WorkOS identity events into Sazabi: AuthKit sign-ins and failed attempts, SSO connection changes, directory sync updates, and user, session, and organization changes. Add a webhook endpoint in WorkOS that points at Sazabi, and WorkOS sends each event as it happens. There is no agent or poller to run.

​
What Sazabi stores

Each WorkOS event becomes one log record:
  • Message — the event type, for example authentication.sso_succeeded or dsync.user.created.
  • Timestamp — the event’s created_at.
  • Severity — warning for failed authentication attempts (authentication.*_failed), authentication.radar_risk_detected, and connection.deactivated; other events carry no severity.
  • Attributes — workos.event, workos.event_id, workos.object, workos.organization_id, workos.user_id, workos.email, workos.connection_id, workos.connection_type, workos.directory_id, workos.ip_address, workos.user_agent, and workos.error_code / workos.error_message when the event has them. The full event payload is kept as the record’s raw body.

​
Prerequisites

  • A WorkOS account with access to Webhooks in the WorkOS dashboard.
  • Your Sazabi intake URL (shown above).

​
Set up in the dashboard

1

​
Open the webhooks page

In the WorkOS dashboard, pick the environment whose events you want (Staging or Production), navigate to Developer > Webhooks, and click Create Webhook.
2

​
Set the endpoint URL

  • Endpoint URL: Paste your Sazabi intake URL (shown above).
The public key in the URL’s hostname authenticates each request. WorkOS also signs requests with a WorkOS-Signature header; Sazabi does not need the endpoint secret.
3

​
Choose events

Select the events to send. For identity monitoring, select every Authentication, Connection, and Directory Sync event, plus the User, Session, and Organization events you want to keep.
4

​
Save and verify

Click Create. Each WorkOS environment has its own endpoints, so repeat these steps in every environment you want in Sazabi.

​
Set up with the CLI

You can also register the WorkOS log source with the Sazabi CLI (installed and authenticated — see CLI reference). Registering the source mints the same intake URL the dashboard shows above (the public key is embedded in its hostname):
The command prints the intake URL for the new source — copy the whole URL and paste it into the WorkOS Endpoint URL field. Run sazabi log-sources get <log-source-id> at any time to reprint the endpoint, or sazabi log-sources list to see every log source in the project.

​
Verify

On the endpoint’s page in WorkOS, click Send test event, or sign in through AuthKit or SSO. Open the Intake page in the Sazabi dashboard and confirm events from the WorkOS source appear. Events typically arrive within a minute.

​
Troubleshooting

No events after creating the endpoint — Confirm the WorkOS Endpoint URL matches your Sazabi intake URL exactly, and that you created the endpoint in the same WorkOS environment that produced the events. Deliveries failing — Open the endpoint in WorkOS to see each delivery attempt and its response status. WorkOS retries failed deliveries for up to three days, so events sent while the URL was wrong arrive once it is fixed.

​
Further reading

Intake

See per-source ingestion volume and health in the Intake page.

Instrument

Learn how to send data to Sazabi.

Log sources

Browse the full log source catalog.

WorkOS webhooks

WorkOS documentation for webhook endpoints and delivery.