Jira Cloud admin: Missing audit log entry when creating a new webhook

[pszwajkowski]

Summary

When a Jira admin creates a new webhook that can send all Jira issue events to an external endpoint, this action does not appear in any audit trail I can find - neither in the Jira Cloud audit log nor in the organization-level (Atlassian) audit log.

Expected result
An audit entry recording webhook creation (including creator, time, target URL redacted or partially masked, scope/events enabled).

Actual result
No audit entry found in either Jira’s audit log or the Atlassian organization audit log.

Why this matters
Webhooks can exfiltrate issue data to external systems. For compliance, security reviews, and incident response, we need a definitive audit trail for webhook lifecycle events (create/update/enable/disable/delete), ideally with:

• Actor and timestamp

• Webhook name/ID

• Event scope (e.g., issue events)

• Status changes (enabled/disabled)

• Target URL (masked if necessary)

[Bill Sheboy]

Hi @pszwajkowski -- Welcome to the Atlassian Community!

Short answer: I do not believe that is possible at this time.

There are several open suggestions to improve audit logging related to site webhooks, including this one which is more than a decade old: 

https://jira.atlassian.com/browse/JRACLOUD-41463

I also checked the ecosystem backlog and did not find any related items to add events to support this type of logging.

There was an Atlassian announcement early in 2025 for a Guard Premium / Enterprise feature for 3rd party webhook logging, and I did not notice anything about logging webhook creation:

https://community.atlassian.com/forums/Enterprise-articles/App-activity-logs-are-coming-to-Atlassian-Audit-Logs/ba-p/2954758

Perhaps work with your Product Admin to contact Atlassian and learn if Guard could help with this type of logging.

Kind regards,
Bill