Authentication admin audit event
Webhook
This webhook captures administrative changes to user accounts recorded by Keycloak, the Layer1 authentication provider. It is sent when an administrator resets a user's password, updates a user (for example, enables or disables the account, or changes the name or email), or changes a user's roles or group memberships through the Keycloak administration console. Permission changes made in the tenant portal are reported through the layer1:audit:api webhook instead. These events are infrequent in normal operation.