n8n Webhook Setup Guide

Sign in to your n8n instance as the owner or an admin.

• Only owners and admins can manage log streaming destinations. API keys created by members cannot include the destination scopes.
• Log streaming is an Enterprise feature. If Settings > Log streaming shows Available on the Enterprise plan, the instance is not licensed for it.

Select Settings > n8n API, then select Create API key.

• Under Scopes, select Custom and keep every scope the connector already uses.
• Expand Event Bus Destination and add eventBusDestination:create and eventBusDestination:delete. StackOne uses them to create the destination and to remove it when events are turned off.
• Select Save, then copy the key. It is shown only once.
• Paste the key into the API Key field for the n8n account in StackOne Hub, then reconnect the account.

Once events are enabled, open Settings > Log streaming in n8n.

• A Webhook destination named StackOne is listed under Log destinations.
• Do not edit or delete this destination in n8n. StackOne manages it and removes it when events are turned off.

Workflow execution events, sent for every production and manual execution.

• Workflow execution started (n8n.workflow.started) — Fired when a workflow execution starts
• Workflow execution succeeded (n8n.workflow.success) — Fired when a workflow execution finishes successfully
• Workflow execution failed (n8n.workflow.failed) — Fired when a workflow execution fails
• Workflow execution cancelled (n8n.workflow.cancelled) — Fired when a workflow execution is cancelled

Events for each node within a workflow execution. These are high-volume events.

• Node execution started (n8n.node.started) — Fired when a node starts running inside a workflow execution
• Node execution finished (n8n.node.finished) — Fired when a node finishes running inside a workflow execution

Audit events for changes to workflows.

• Workflow executed (n8n.audit.workflow.executed) — Fired when a user runs a workflow
• Workflow created (n8n.audit.workflow.created) — Fired when a workflow is created
• Workflow deleted (n8n.audit.workflow.deleted) — Fired when a workflow is deleted
• Workflow updated (n8n.audit.workflow.updated) — Fired when a workflow is saved with changes
• Workflow waiting (n8n.audit.workflow.waiting) — Fired when a workflow execution pauses and waits (for example on a Wait node)
• Workflow resumed (n8n.audit.workflow.resumed) — Fired when a waiting workflow execution resumes
• Workflow archived (n8n.audit.workflow.archived) — Fired when a workflow is archived
• Workflow unarchived (n8n.audit.workflow.unarchived) — Fired when an archived workflow is restored
• Workflow activated (n8n.audit.workflow.activated) — Fired when a workflow is published (activated)
• Workflow deactivated (n8n.audit.workflow.deactivated) — Fired when a workflow is unpublished (deactivated)
• Workflow version updated (n8n.audit.workflow.version.updated) — Fired when a saved workflow version is updated

Audit events for workflow reviews.

• Workflow reviews enabled (n8n.audit.workflow-reviews.enabled) — Fired when workflow reviews are turned on
• Workflow reviews disabled (n8n.audit.workflow-reviews.disabled) — Fired when workflow reviews are turned off
• Workflow review requested (n8n.audit.workflow-review.requested) — Fired when a review is requested for a workflow
• Workflow review version updated (n8n.audit.workflow-review.version-updated) — Fired when the workflow version under review is updated
• Workflow review approved (n8n.audit.workflow-review.approved) — Fired when a workflow review is approved
• Workflow review changes requested (n8n.audit.workflow-review.changes-requested) — Fired when a reviewer requests changes to a workflow
• Workflow review closed (n8n.audit.workflow-review.closed) — Fired when a workflow review is closed

Audit events for user accounts, sign-in, credentials, API keys and two-factor authentication.

• User signed in (n8n.audit.user.login.success) — Fired when a user signs in
• User sign-in failed (n8n.audit.user.login.failed) — Fired when a sign-in attempt fails
• User signed up (n8n.audit.user.signedup) — Fired when a user completes sign-up
• User updated (n8n.audit.user.updated) — Fired when a user profile is updated
• User deleted (n8n.audit.user.deleted) — Fired when a user is deleted
• User invited (n8n.audit.user.invited) — Fired when a user is invited to the instance
• User invitation accepted (n8n.audit.user.invitation.accepted) — Fired when an invited user accepts the invitation
• User re-invited (n8n.audit.user.reinvited) — Fired when an invitation is sent again
• User email failed (n8n.audit.user.email.failed) — Fired when n8n fails to send an email to a user
• Password reset requested (n8n.audit.user.reset.requested) — Fired when a user requests a password reset
• Password reset (n8n.audit.user.reset) — Fired when a user resets their password
• Credential created (n8n.audit.user.credentials.created) — Fired when a user creates a credential
• Credential shared (n8n.audit.user.credentials.shared) — Fired when a user shares a credential
• Credential updated (n8n.audit.user.credentials.updated) — Fired when a user updates a credential
• Credential deleted (n8n.audit.user.credentials.deleted) — Fired when a user deletes a credential
• Credential connection removed by user (n8n.audit.user.credentials.userDisconnected) — Fired when a user removes their own connection from an end-user credential
• API key created (n8n.audit.user.api.created) — Fired when a user creates an API key
• API key deleted (n8n.audit.user.api.deleted) — Fired when a user deletes an API key
• API key rotated (n8n.audit.user.api.rotated) — Fired when a user rotates an API key
• Two-factor authentication enabled (n8n.audit.user.mfa.enabled) — Fired when a user turns on two-factor authentication
• Two-factor authentication disabled (n8n.audit.user.mfa.disabled) — Fired when a user turns off two-factor authentication
• Executions deleted (n8n.audit.user.execution.deleted) — Fired when a user deletes executions

Audit events for instance settings, community and n8n packages, variables, external secrets, token exchange, role mapping, policies, MCP and cluster health.

• Community package installed (n8n.audit.package.installed) — Fired when a community node package is installed
• Community package updated (n8n.audit.package.updated) — Fired when a community node package is updated
• Community package uninstalled (n8n.audit.package.deleted) — Fired when a community node package is uninstalled
• n8n package imported (n8n.audit.n8n-package.import.success) — Fired when an n8n package import completes
• n8n package exported (n8n.audit.n8n-package.export.success) — Fired when an n8n package export completes
• n8n package export failed (n8n.audit.n8n-package.export.failed) — Fired when an n8n package export fails
• n8n package import failed (n8n.audit.n8n-package.import.failed) — Fired when an n8n package import fails
• Variable created (n8n.audit.variable.created) — Fired when a variable is created
• Variable updated (n8n.audit.variable.updated) — Fired when a variable is updated
• Variable deleted (n8n.audit.variable.deleted) — Fired when a variable is deleted
• External secrets provider settings saved (n8n.audit.external-secrets.provider.settings.saved) — Fired when external secrets provider settings are saved
• External secrets provider reloaded (n8n.audit.external-secrets.provider.reloaded) — Fired when an external secrets provider is reloaded
• External secrets connection created (n8n.audit.external-secrets.connection.created) — Fired when an external secrets connection is created
• External secrets connection updated (n8n.audit.external-secrets.connection.updated) — Fired when an external secrets connection is updated
• External secrets connection deleted (n8n.audit.external-secrets.connection.deleted) — Fired when an external secrets connection is deleted
• External secrets connection tested (n8n.audit.external-secrets.connection.tested) — Fired when an external secrets connection is tested
• External secrets connection reloaded (n8n.audit.external-secrets.connection.reloaded) — Fired when an external secrets connection is reloaded
• Personal-project publishing restricted (n8n.audit.personal-publishing-restricted.enabled) — Fired when publishing from personal projects is restricted
• Personal-project publishing restriction lifted (n8n.audit.personal-publishing-restricted.disabled) — Fired when the personal-project publishing restriction is lifted
• Personal-project sharing restricted (n8n.audit.personal-sharing-restricted.enabled) — Fired when sharing from personal projects is restricted
• Personal-project sharing restriction lifted (n8n.audit.personal-sharing-restricted.disabled) — Fired when the personal-project sharing restriction is lifted
• Two-factor authentication enforced (n8n.audit.2fa-enforcement.enabled) — Fired when two-factor authentication is made mandatory
• Two-factor authentication enforcement removed (n8n.audit.2fa-enforcement.disabled) — Fired when mandatory two-factor authentication is turned off
• Redaction enforcement updated (n8n.audit.redaction-enforcement.updated) — Fired when the instance execution-data redaction setting changes
• Execution data revealed (n8n.audit.execution.data.revealed) — Fired when a user reveals redacted execution data
• Execution data reveal failed (n8n.audit.execution.data.reveal_failure) — Fired when an attempt to reveal redacted execution data fails
• Token exchange succeeded (n8n.audit.token-exchange.succeeded) — Fired when a token exchange succeeds
• Token exchange failed (n8n.audit.token-exchange.failed) — Fired when a token exchange fails
• Embedded sign-in through token exchange (n8n.audit.token-exchange.embed-login) — Fired when a user signs in to embedded n8n through token exchange
• Embedded sign-in through token exchange failed (n8n.audit.token-exchange.embed-login-failed) — Fired when an embedded sign-in through token exchange fails
• Identity linked through token exchange (n8n.audit.token-exchange.identity-linked) — Fired when an external identity is linked to an n8n user
• Identity re-linked through token exchange (n8n.audit.token-exchange.identity-rebound) — Fired when an external identity is linked again to a different n8n user
• User provisioned through token exchange (n8n.audit.token-exchange.user-provisioned) — Fired when token exchange creates a new n8n user
• Role updated through token exchange (n8n.audit.token-exchange.role-updated) — Fired when token exchange changes a user role
• Role mapping roles resolved (n8n.audit.role-mapping.roles-resolved) — Fired when role mapping rules resolve the roles for a user
• Role mapping rule created (n8n.audit.role-mapping.rule.created) — Fired when a role mapping rule is created
• Role mapping rule updated (n8n.audit.role-mapping.rule.updated) — Fired when a role mapping rule is updated
• Role mapping rule deleted (n8n.audit.role-mapping.rule.deleted) — Fired when a role mapping rule is deleted
• Role mapping rules deleted in bulk (n8n.audit.role-mapping.rules.bulk-deleted) — Fired when several role mapping rules are deleted at once
• Cluster version mismatch detected (n8n.audit.cluster.version-mismatch.detected) — Fired when instances in a cluster run different n8n versions
• Cluster version mismatch resolved (n8n.audit.cluster.version-mismatch.resolved) — Fired when a cluster version mismatch is resolved
• Cluster host ID clash detected (n8n.audit.cluster.hostid-clash.detected) — Fired when two cluster instances report the same host ID
• Cluster host ID clash resolved (n8n.audit.cluster.hostid-clash.resolved) — Fired when a cluster host ID clash is resolved
• Cluster split-brain detected (n8n.audit.cluster.split-brain.detected) — Fired when the cluster detects more than one leader
• Cluster split-brain resolved (n8n.audit.cluster.split-brain.resolved) — Fired when a cluster split-brain condition is resolved
• Cluster instance joined (n8n.audit.cluster.instance-joined) — Fired when an instance joins the cluster
• Cluster instance left (n8n.audit.cluster.instance-left) — Fired when an instance leaves the cluster
• OAuth callback binding rejected (n8n.audit.oauth.callback.binding.rejected) — Fired when an OAuth callback is rejected because it does not match the session that started it
• Credential authorisation rejected (n8n.audit.credentials.authorize.rejected) — Fired when a credential authorisation request is rejected
• Node type policy scope updated (n8n.audit.node-type-policy.scope.updated) — Fired when the scope of a node type policy changes
• Node type policy document created (n8n.audit.node-type-policy.document.created) — Fired when a node type policy document is created
• Node type policy document updated (n8n.audit.node-type-policy.document.updated) — Fired when a node type policy document is updated
• Node type policy document deleted (n8n.audit.node-type-policy.document.deleted) — Fired when a node type policy document is deleted
• Node type policy attachments updated (n8n.audit.node-type-policy.attachments.updated) — Fired when node type policy attachments change
• Action blocked by policy (n8n.audit.policy.decision.blocked) — Fired when a policy blocks an action
• Trusted source created (n8n.audit.trusted-source.created) — Fired when a trusted source is added
• Trusted source updated (n8n.audit.trusted-source.updated) — Fired when a trusted source is updated
• Trusted source deleted (n8n.audit.trusted-source.deleted) — Fired when a trusted source is removed
• MCP OAuth completed (n8n.audit.mcp.oauth.completed) — Fired when an MCP client completes OAuth authorisation
• MCP tool called (n8n.audit.mcp.tool.called) — Fired when an MCP client calls a tool
• MCP access updated (n8n.audit.mcp.access.updated) — Fired when MCP access settings change

Events from AI nodes (language models, agents, memory, embeddings, retrievers and vector stores).

• AI memory messages read (n8n.ai.memory.get.messages) — Fired when an AI memory node reads messages
• AI memory message added (n8n.ai.memory.added.message) — Fired when an AI memory node stores a message
• AI output parsed (n8n.ai.output.parser.parsed) — Fired when an AI output parser parses a model response
• AI retriever documents fetched (n8n.ai.retriever.get.relevant.documents) — Fired when an AI retriever fetches relevant documents
• AI document embedded (n8n.ai.embeddings.embedded.document) — Fired when an embeddings node embeds a document
• AI query embedded (n8n.ai.embeddings.embedded.query) — Fired when an embeddings node embeds a query
• AI document processed (n8n.ai.document.processed) — Fired when an AI document loader processes a document
• AI text split (n8n.ai.text.splitter.split) — Fired when an AI text splitter splits text
• AI tool called (n8n.ai.tool.called) — Fired when an AI agent calls a tool
• AI vector store searched (n8n.ai.vector.store.searched) — Fired when a vector store is searched
• AI language model response generated (n8n.ai.llm.generated) — Fired when a language model node generates a response
• AI language model error (n8n.ai.llm.error) — Fired when a language model node returns an error
• AI vector store populated (n8n.ai.vector.store.populated) — Fired when documents are inserted into a vector store
• AI vector store updated (n8n.ai.vector.store.updated) — Fired when documents in a vector store are updated

Runtime events for queue-mode workers, task runners, the execution queue and instance usage reporting.

• Worker started (n8n.worker.started) — Fired when a queue-mode worker starts
• Worker stopped (n8n.worker.stopped) — Fired when a queue-mode worker stops
• Instance usage report sent (n8n.instanceReporting.success) — Fired when the instance sends its usage report
• Instance usage report failed (n8n.instanceReporting.failed) — Fired when the instance fails to send its usage report
• Task runner task requested (n8n.runner.task.requested) — Fired when a task is sent to a task runner
• Task runner response received (n8n.runner.response.received) — Fired when a task runner returns a result
• Queue job added (n8n.queue.job.enqueued) — Fired when an execution job is added to the queue
• Queue job picked up (n8n.queue.job.dequeued) — Fired when a worker picks up an execution job
• Queue job completed (n8n.queue.job.completed) — Fired when a queued execution job completes
• Queue job failed (n8n.queue.job.failed) — Fired when a queued execution job fails
• Queue job stalled (n8n.queue.job.stalled) — Fired when a queued execution job stalls

n8n sends each event as a separate JSON POST request with the body { id, ts, eventName, message, payload }. eventName is the event code, id is a unique message ID and ts is the time of the event in ISO 8601 format. payload contains the event details, such as the execution and workflow IDs or the user who performed the action.

n8n retries failed deliveries, so the same event can arrive more than once. Use id to detect duplicates. n8n does not sign its deliveries.