Webflow Audit Logs
Collect audit logs from your Webflow workspace showing user access, content changes, and administrative events.
Webflow Audit logs allow you to view audit events from your Webflow workspace. RunReveal will poll the Webflow API to retrieve your audit logs every 60 seconds.
Setup
To setup your Webflow Audit source, you will need API credentials from your Webflow account.
Webflow API Credentials
- Log in to your Webflow account
- Navigate to Account Settings > Integrations > API Access
- Generate an API token
- In RunReveal, create a new Webflow Audit source
- Enter your credentials:
- API Token: Your Webflow API token
- Workspace ID: Your Webflow workspace identifier
Verify It’s Working
Once added, the source logs should begin flowing within a minute.
You can validate we are receiving your logs by running the following SQL query.
SELECT * FROM runreveal.logs WHERE sourceType = 'webflow-audit' LIMIT 1Schema
The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.
Table: webflow_audit_logs (47 columns)
webflow_audit_logs (47 columns)| Column | Type |
|---|---|
workspaceID | String |
sourceID | String |
sourceType | String |
sourceTTL | UInt32 |
receivedAt | DateTime |
id | String |
eventTime | DateTime |
eventName | String |
eventID | String |
srcIP | String |
srcASCountryCode | String |
srcASNumber | UInt32 |
srcASOrganization | String |
srcCity | String |
srcConnectionType | String |
srcISP | String |
srcLatitude | Float64 |
srcLongitude | Float64 |
srcUserType | String |
dstIP | String |
dstASCountryCode | String |
dstASNumber | UInt32 |
dstASOrganization | String |
dstCity | String |
| Column | Type |
|---|---|
dstConnectionType | String |
dstISP | String |
dstLatitude | Float64 |
dstLongitude | Float64 |
dstUserType | String |
actor | Map(String, String) |
tags | Map(String, String) |
resources | Array(String) |
serviceName | String |
enrichments | Array(Tuple(data Map(String, String), name String, provider String, type String, value String)) |
readOnly | Bool |
rawLog | String |
auditLogId | String |
timestamp | DateTime |
eventType | String |
eventSubType | String |
actorId | String |
actorEmail | String |
workspaceId | String |
workspaceSlug | String |
payloadIPAddress | String |
payloadLocation | String |
payloadMethod | String |