Event Mappings
The Audit Log Event Mappings API lets you configure which Fastly audit log events trigger notifications to your integrations. An event mapping links one or more event types to one or more notification integrations, scoped to your account, specific CDN services, Compute services, or Next-Gen WAF workspaces. Use the event-types and scope-types discovery endpoints to retrieve the full list of supported event and scope types before creating mappings. All endpoints require the superuser role.
Data model
Properties for creating or replacing a notification event mapping.
description | string | An optional description of the mapping. | |
event_types | array | The audit event types that trigger a notification. Each event type must be valid for the given scope_type. Use the event-types endpoint to retrieve the supported values. Required. | |
integration_ids | array | The IDs of the integrations that should receive notifications. Must reference integrations for the account linked to the supplied token. Required. | |
name | string | A descriptive name for the mapping. Required. | |
scope_ids | array | The specific service or workspace IDs to scope this mapping to. Omit or provide an empty array to apply the mapping to all resources of the given scope type. Must be empty or omitted when scope_type is account. | |
scope_type | string | The category of Fastly resource a mapping applies to.
account: applies account-wide, regardless of any specific service or workspace. - vcl: applies to specific CDN (VCL) services identified by service ID. - wasm: applies to specific Compute (Wasm) services identified by service ID. - ngwaf: applies to specific Next-Gen WAF workspaces identified by workspace ID.
Some event types are compatible with more than one scope type. For example, ngwaf.list.create can be mapped at either account scope (fires for any matching event across the account) or ngwaf scope (fires only for specified workspaces). Use the event-types endpoint to see which scope types each event supports. Required. | |
limit | integer | The maximum number of results returned per page. | |
next_cursor | string | Cursor value to retrieve the next page of results. Pass this as the cursor parameter in your next request using the same filter and sort values. Omitted when the results are the last page. | |
previous_cursor | string | Cursor value to retrieve the previous page of results. Omitted when the results are the first page. | |
sort | string | The sort order applied to the results. | |
total | integer | Total number of event mappings matching the filters. | |
created_at | string | Timestamp when the mapping was created. Read-only. | |
customer_id | string | The ID of the customer this mapping belongs to. Read-only. | |
id | string | Unique identifier for the mapping. Read-only. | |
mapping_status | string | Indicates whether the mapping is permitted to send notifications. This field is set server-side and cannot be set directly. A mapping is active when it has at least one integration ID. It becomes inactive automatically when all of its integration IDs are removed — for example, when an integration is deleted. An inactive mapping does not send notifications. | |
updated_at | string | Timestamp when the mapping was last updated. Read-only. | |
meta | object | Metadata about the filter results. | |
display_name | string | A human-readable name for the event type. | |
event_type | string | The event type identifier. Use this value in the event_types field when creating a mapping. | |
scope_types | array | The scope types this event type is compatible with. |
