Webflow Audit Logs

Collect audit logs from your Webflow workspace showing user access, content changes, and administrative events.

Webflow Audit logs allow you to view audit events from your Webflow workspace. RunReveal will poll the Webflow API to retrieve your audit logs every 60 seconds.

Setup

To setup your Webflow Audit source, you will need API credentials from your Webflow account.

Webflow API Credentials

  1. Log in to your Webflow account
  2. Navigate to Account Settings > Integrations > API Access
  3. Generate an API token
  4. In RunReveal, create a new Webflow Audit source
  5. Enter your credentials:
    • API Token: Your Webflow API token
    • Workspace ID: Your Webflow workspace identifier

Verify It’s Working

Once added, the source logs should begin flowing within a minute.

You can validate we are receiving your logs by running the following SQL query.

SELECT * FROM runreveal.logs WHERE sourceType = 'webflow-audit' LIMIT 1

Schema

The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.

Table: webflow_audit_logs (47 columns)

ColumnType
workspaceIDString
sourceIDString
sourceTypeString
sourceTTLUInt32
receivedAtDateTime
idString
eventTimeDateTime
eventNameString
eventIDString
srcIPString
srcASCountryCodeString
srcASNumberUInt32
srcASOrganizationString
srcCityString
srcConnectionTypeString
srcISPString
srcLatitudeFloat64
srcLongitudeFloat64
srcUserTypeString
dstIPString
dstASCountryCodeString
dstASNumberUInt32
dstASOrganizationString
dstCityString
ColumnType
dstConnectionTypeString
dstISPString
dstLatitudeFloat64
dstLongitudeFloat64
dstUserTypeString
actorMap(String, String)
tagsMap(String, String)
resourcesArray(String)
serviceNameString
enrichmentsArray(Tuple(data Map(String, String), name String, provider String, type String, value String))
readOnlyBool
rawLogString
auditLogIdString
timestampDateTime
eventTypeString
eventSubTypeString
actorIdString
actorEmailString
workspaceIdString
workspaceSlugString
payloadIPAddressString
payloadLocationString
payloadMethodString