Every event, accounted for.
Compliance is a consequence of knowing what happened. WeldForge records every authentication, every admin action, every provider change, and every lifecycle event in an append-only audit log, and fans the same stream out over HMAC-signed webhooks for your SIEM, GRC platform, or custom workflows.
The audit log
Every entry is a row with a timestamp, event type, outcome, actor, target, IP address, user agent and structured metadata. The log is append-only and scoped per tenant, so cross-tenant queries aren't possible even accidentally. Every write runs in its own transaction — a failure to audit can never roll back the business action.
Events recorded today (incomplete list)
Authentication
auth.login.success/failed/mfa_requiredauth.register,auth.logout.rp_initiatedauth.email.verification_sent/verifiedauth.password_reset.requested/completed
MFA
mfa.factor.enroll/activate/removemfa.challenge.success/failedmfa.self_reset/admin_resetmfa.policy.upsert,mfa.stepup_required
Administration
tenant.create/update/deleteadmin.role.assigned,user.deleteservice_account.create/rotate/deletesaml_provider.upsert,oidc_client.dynamic_register
PKI & integrations
pki.ca.create,pki.cert.issue/revoke/expiringfederation.rules.update,group_role.mapping.*ldap_provider.upsert,crm.provisionedtwilio_provider.upsert,webhook.subscription.*
Webhook fan-out
Every audit event is automatically published to matching webhook subscriptions. You don't wire events into webhooks one service at a time — the subscription is the contract.
HMAC-SHA256
The body of every delivery is signed with the subscription's secret. The X-WeldForge-Signature header carries a timestamp and signature so replays are trivially detectable.
Event-type globs
Subscribe to user.*, or auth.login.*, or just pki.cert.expiring. Missing filters means "every event, everywhere".
Retry + dead letter
Failed deliveries back off at 30s → 2m → 10m → 1h → 6h. After max_attempts they move to a dead-letter state so your team can replay them later.
Tenant-scoped
A subscription only receives events from its own tenant. No amount of mis-configuration can make tenant A see tenant B's traffic.
Operational visibility
/actuator/prometheus
Every Micrometer metric — JVM, HTTP, authentication counters, circuit breaker state, custom SSO metrics — exported in Prometheus format. Scrape once, grep later.
Liveness & readiness probes
Standard Kubernetes probes at /actuator/health/liveness and /actuator/health/readiness. Tied to DB connectivity on the readiness side so a DB outage drains traffic cleanly.
Circuit breakers
Five named breakers (webhook, twilio, smtp, upstream-idp, crm) whose state is visible on /actuator/circuitbreakers and scraped into Prometheus.
Consistent error shape
Every error response returns {error, message, timestamp, path}. No stack traces leak, no vendor-specific exception types surface — a global handler ensures clients always get something they can parse.