> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# WorkOS

> Add a webhook endpoint in the WorkOS dashboard pointed at your Sazabi intake URL to forward authentication, SSO connection, directory sync, user, session, and organization events.

[All WorkOS integration capabilities](https://docs.sazabi.com/catalogs/integrations/workos)

## About

Send your WorkOS identity events into Sazabi: AuthKit sign-ins and failed attempts, SSO connection changes, directory sync updates, and user, session, and organization changes. Add a webhook endpoint in WorkOS that points at Sazabi, and WorkOS sends each event as it happens. There is no agent or poller to run.

### What Sazabi stores

Each WorkOS event becomes one log record:

* **Message** — the event type, for example `authentication.sso_succeeded` or `dsync.user.created`.
* **Timestamp** — the event's `created_at`.
* **Severity** — warning for failed authentication attempts (`authentication.*_failed`), `authentication.radar_risk_detected`, and `connection.deactivated`; other events carry no severity.
* **Attributes** — `workos.event`, `workos.event_id`, `workos.object`, `workos.organization_id`, `workos.user_id`, `workos.email`, `workos.connection_id`, `workos.connection_type`, `workos.directory_id`, `workos.ip_address`, `workos.user_agent`, and `workos.error_code` / `workos.error_message` when the event has them. The full event payload is kept as the record's raw body.

## Prerequisites

* A WorkOS account with access to **Webhooks** in the WorkOS dashboard.
* Your Sazabi intake URL (shown above).

## Set up in the dashboard

**Step 1**

### Open the webhooks page

In the [WorkOS dashboard](https://dashboard.workos.com/webhooks), pick the environment whose events you want (Staging or Production), navigate to **Developer > Webhooks**, and click **Create Webhook**.

**Step 2**

### Set the endpoint URL

* **Endpoint URL**: Paste your Sazabi intake URL (shown above).

The public key in the URL's hostname authenticates each request. WorkOS also signs requests with a `WorkOS-Signature` header; Sazabi does not need the endpoint secret.

**Step 3**

### Choose events

Select the events to send. For identity monitoring, select every **Authentication**, **Connection**, and **Directory Sync** event, plus the **User**, **Session**, and **Organization** events you want to keep.

**Step 4**

### Save and verify

Click **Create**. Each WorkOS environment has its own endpoints, so repeat these steps in every environment you want in Sazabi.

## Set up with the CLI

You can also register the WorkOS log source with the [Sazabi CLI](https://docs.sazabi.com/reference/cli.md) (installed and authenticated — see [CLI reference](https://docs.sazabi.com/reference/cli/log-sources.md)).

Registering the source mints the same intake URL the dashboard shows above (the public key is embedded in its hostname):

```bash theme={"system"}
sazabi log-sources create workos --mode manual
```

The command prints the intake URL for the new source — copy the whole URL and paste it into the WorkOS **Endpoint URL** field. Run `sazabi log-sources get <log-source-id>` at any time to reprint the endpoint, or `sazabi log-sources list` to see every log source in the project.

## Verify

On the endpoint's page in WorkOS, click **Send test event**, or sign in through AuthKit or SSO. Open the [Intake page](https://docs.sazabi.com/guides/instrument/intake.md) in the Sazabi dashboard and confirm events from the **WorkOS** source appear. Events typically arrive within a minute.

## Troubleshooting

**No events after creating the endpoint** — Confirm the WorkOS **Endpoint URL** matches your Sazabi intake URL exactly, and that you created the endpoint in the same WorkOS environment that produced the events.

**Deliveries failing** — Open the endpoint in WorkOS to see each delivery attempt and its response status. WorkOS retries failed deliveries for up to three days, so events sent while the URL was wrong arrive once it is fixed.

## Further reading

> [card] [Intake](https://docs.sazabi.com/guides/instrument/intake.md)
>
> See per-source ingestion volume and health in the Intake page.

> [card] [Instrument](https://docs.sazabi.com/guides/instrument.md)
>
> Learn how to send data to Sazabi.

> [card] [Log sources](https://docs.sazabi.com/catalogs/log-sources.md)
>
> Browse the full log source catalog.

> [card] [WorkOS webhooks](https://workos.com/docs/events/data-syncing/webhooks)
>
> WorkOS documentation for webhook endpoints and delivery.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.