Webhooks
Subscribe to EntryPoint configuration-audit events at Organization or Context scope. The only event EntryPoint exposes today is entrypoint.configuration.audit.
EntryPoint can deliver configuration-audit events as webhooks to an HTTPS endpoint you control. Subscriptions can live at Organization scope or EntryPoint Context scope.
Available events
Section titled “Available events”Today EntryPoint exposes one event type via webhooks:
entrypoint.configuration.audit— emitted whenever someone changes the configuration of an EntryPoint Context (enabling an auth method, editing an Attribute Profile, adding a Group, rotating a secret, etc.).
RADIUS authentication outcomes and accounting records are not delivered via webhooks today. Per-attempt outcomes are recorded in the EntryPoint authentication log, which is queried in the portal rather than streamed, and they’re also reflected in per-Context counters and the Groups’ Connected Devices lists. There’s no push feed for them. If your use case needs auth-event streaming, talk to your Netgraph contact.
Where to set up a subscription
Section titled “Where to set up a subscription”Open the EntryPoint Context and go to Webhooks in the left navigation.
Click Create Webhook. The form asks for a Webhook Type and a Webhook Name.
Webhook Type has two options:
- Instant Event Delivery (recommended) — each event is POST’d to the receiver as it happens.
- Batch Delivery — events are buffered and delivered as a batch.
Pick a name that identifies the receiver (e.g. Splunk, Ops
Slack, SIEM) and create. The subsequent Webhook detail view lets
you configure the endpoint URL, HTTP headers (for auth against your
receiver), and which events to subscribe to — today that’s only
entrypoint.configuration.audit.
Organization vs Context scope
Section titled “Organization vs Context scope”The same webhook infrastructure is available at Organization scope (under Webhooks in the Organization’s left navigation) and Context scope (here). Pick based on reach:
- Context scope — receive events only from this EntryPoint Context. One subscription per Context; clean separation for multi- Context deployments.
- Organization scope — receive events from every Service Context in the Organization, not just EntryPoint. The enabled events list at Organization scope lets you pick which event types from which Service you want.
See Organization webhooks for the cross-Service view.
Payload shape
Section titled “Payload shape”A entrypoint.configuration.audit delivery carries:
- The event ID and timestamp.
- The Context ID and name.
- The actor (admin user / system).
- A description of what changed, with before/after values where applicable.
- Any additional metadata the admin UI recorded on the audit entry.
Exact field names evolve — use the Webhook detail view’s delivery history to inspect real payloads once deliveries start arriving.
Common use cases
Section titled “Common use cases”- Change management — stream config audits into your ticketing system or SIEM so every RADIUS policy change is logged alongside other infrastructure changes.
- Out-of-band alerts — notify a Slack channel when a sensitive knob (trusted CA list, IP allow-list, identity store config) changes outside a change window.