# Stream the audit log to a webhook or bucket

`POST /v1/audit-sinks`

**In this build:** Real. Webhook sinks deliver for real. An s3 sink is recorded and its batches counted, but no bucket is written: that needs object-store credentials.

**Scope:** `account.admin`

**CLI:** `harebox audit sink new`

## Request: `CreateAuditSinkRequest`

| Field | Type | Notes |
|---|---|---|
| `kind` (required) | `string` | One of: `webhook`, `s3` |
| `url` (required) | `string` | An HTTPS URL, or s3://bucket/prefix. |

## Response: 201

`AuditSink`

| Field | Type | Notes |
|---|---|---|
| `id` (required) | `string` |  |
| `kind` (required) | `string` | One of: `webhook`, `s3` |
| `url` (required) | `string` |  |
| `secret` | `string` | Shown once. Batches carry HareBox-Signature, made with it as webhooks are. |
| `cursor` | `integer` |  |
| `delivered` | `integer` |  |
| `last_at` | `string or null` |  |
| `last_error` | `string or null` |  |
| `created_at` | `string` |  |

Errors follow [one format](../errors.html).