---
title: "Update an existing audit log stream configuration"
method: PUT
path: "/enterprises/{enterprise}/audit-log/streams/{stream_id}"
tags: ["enterprise-admin"]
---

# Update an existing audit log stream configuration

`PUT /enterprises/{enterprise}/audit-log/streams/{stream_id}`

Updates an existing audit log stream configuration for an enterprise.

When using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See "[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api)."

## Path parameters

- `enterprise` string, required
- `stream_id` integer, required

## Request body

- object
  - `enabled` boolean, required — This setting pauses or resumes a stream.
  - `stream_type` 'Azure Blob Storage' | 'Azure Event Hubs' | 'Amazon S3' | 'Splunk' | 'HTTPS Event Collector' | 'Google Cloud Storage' | 'Datadog', required — The audit log streaming provider. The name is case sensitive.
  - `vendor_specific` union, required
    - object — Azure Blob Config for audit log streaming configuration.
      - `key_id` string, required — Key ID obtained from the audit log stream key endpoint used to encrypt secrets.
      - `encrypted_sas_url` string, required
      - `container` string, required — The name of the Azure Blob Storage container to which the audit logs will be sent.
    - object — Azure Event Hubs Config for audit log streaming configuration.
      - `name` string, required — Instance name of Azure Event Hubs
      - `encrypted_connstring` string, required — Encrypted Connection String for Azure Event Hubs
      - `key_id` string, required — Key ID obtained from the audit log stream key endpoint used to encrypt secrets.
    - object — Amazon S3 OIDC Config for audit log streaming configuration.
      - `bucket` string, required — Amazon S3 Bucket Name.
      - `region` string, required — AWS S3 Bucket Region.
      - `key_id` string, required — Key ID obtained from the audit log stream key endpoint used to encrypt secrets.
      - `authentication_type` 'oidc', required — Authentication Type for Amazon S3.
      - `arn_role` string, required
    - object — Amazon S3 Access Keys Config for audit log streaming configuration.
      - `bucket` string, required — Amazon S3 Bucket Name.
      - `region` string, required — Amazon S3 Bucket Name.
      - `key_id` string, required — Key ID obtained from the audit log stream key endpoint used to encrypt secrets.
      - `authentication_type` 'access_keys', required — Authentication Type for Amazon S3.
      - `encrypted_secret_key` string, required — Encrypted AWS Secret Key.
      - `encrypted_access_key_id` string, required — Encrypted AWS Access Key ID.
    - object — Splunk Config for Audit Log Stream Configuration
      - `domain` string, required — Domain of Splunk instance.
      - `port` integer, required — The port number for connecting to Splunk.
      - `key_id` string, required — Key ID obtained from the audit log stream key endpoint used to encrypt secrets.
      - `encrypted_token` string, required — Encrypted Token.
      - `ssl_verify` boolean, required — SSL verification helps ensure your events are sent to your Splunk endpoint securely.
    - object — Hec Config for Audit Log Stream Configuration
      - `domain` string, required — Domain of Hec instance.
      - `port` integer, required — The port number for connecting to HEC.
      - `key_id` string, required — Key ID obtained from the audit log stream key endpoint used to encrypt secrets.
      - `encrypted_token` string, required — Encrypted Token.
      - `path` string, required — Path to send events to.
      - `ssl_verify` boolean, required — SSL verification helps ensure your events are sent to your HEC endpoint securely.
    - object — Google Cloud Config for audit log streaming configuration.
      - `bucket` string, required — Google Cloud Bucket Name
      - `key_id` string, required — Key ID obtained from the audit log stream key endpoint used to encrypt secrets.
      - `encrypted_json_credentials` string, required
    - object — Datadog Config for audit log streaming configuration.
      - `encrypted_token` string, required — Encrypted Splunk token.
      - `site` 'US' | 'US3' | 'US5' | 'EU1' | 'US1-FED' | 'AP1', required — Datadog Site to use.
      - `key_id` string, required — Key ID obtained from the audit log stream key endpoint used to encrypt secrets.

## Response `200`

Successful update

- GetAuditLogStreamConfig — Get an audit log streaming configuration for an enterprise.
  - `id` integer, required
  - `stream_type` string, required
  - `stream_details` string, required
  - `enabled` boolean, required
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required
  - `paused_at` string, date-time, nullable

## Other responses

- `422` — Validation error

---

[API](https://skmtc.net/github/apis/github-v3-rest-api-3.md) · [All operations](https://skmtc.net/github/apis/github-v3-rest-api-3/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/github/github-v3-rest-api-3/versions/dc0584ac4e13/schema)