--- name: secrets-manager-event-notifications title: Enabling event notifications for Secrets Manager description: As an administrator of IBM Cloud® Secrets Manager, you might want to send notifications of events in Secrets Manager to other users, or human destinations, by using email, SMS, or other supported delivery channels. Additionally, you might want to send these notifications of events to other applications to build logic by using event-driven programming using webhooks, for example. This is made possible by the integration between Secrets Manager and IBM Cloud® Event Notifications. last-updated: 2025-09-19 --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/secrets-manager?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. {:codeblock: .codeblock} {:screen: .screen} {:download: .download} {:external: target="_blank" .external} {:faq: data-hd-content-type='faq'} {:gif: data-image-type='gif'} {:important: .important} {:note: .note} {:pre: .pre} {:tip: .tip} {:preview: .preview} {:deprecated: .deprecated} {:beta: .beta} {:term: .term} {:shortdesc: .shortdesc} {:script: data-hd-video='script'} {:support: data-reuse='support'} {:table: .aria-labeledby="caption"} {:troubleshoot: data-hd-content-type='troubleshoot'} {:help: data-hd-content-type='help'} {:tsCauses: .tsCauses} {:tsResolve: .tsResolve} {:tsSymptoms: .tsSymptoms} {:video: .video} {:step: data-tutorial-type='step'} {:tutorial: data-hd-content-type='tutorial'} {:api: .ph data-hd-interface='api'} {:cli: .ph data-hd-interface='cli'} {:ui: .ph data-hd-interface='ui'} {:terraform: .ph data-hd-interface="terraform"} {:curl: .ph data-hd-programlang='curl'} {:java: .ph data-hd-programlang='java'} {:ruby: .ph data-hd-programlang='ruby'} {:c#: .ph data-hd-programlang='c#'} {:objectc: .ph data-hd-programlang='Objective C'} {:python: .ph data-hd-programlang='python'} {:javascript: .ph data-hd-programlang='javascript'} {:php: .ph data-hd-programlang='PHP'} {:swift: .ph data-hd-programlang='swift'} {:curl: .ph data-hd-programlang='curl'} {:dotnet-standard: .ph data-hd-programlang='dotnet-standard'} {:go: .ph data-hd-programlang='go'} {:unity: .ph data-hd-programlang='unity'} {:release-note: data-hd-content-type='release-note'} # Enabling event notifications for Secrets Manager {: #event-notifications} As an administrator of IBM Cloud® Secrets Manager, you might want to send notifications of events in Secrets Manager to other users, or human destinations, by using email, SMS, or other supported delivery channels. Additionally, you might want to send these notifications of events to other applications to build logic by using event-driven programming using webhooks, for example. This is made possible by the integration between Secrets Manager and IBM Cloud® Event Notifications. {: shortdesc} To send information to Event Notifications, you must connect your Secrets Manager service instance to Event Notifications. For more information about working with Event Notifications, see [Getting started with Event Notifications](https://cloud.ibm.com/docs/event-notifications?format=markdown). If you decide to delete your Secrets Manager service instance, also remove Secrets Manager as a source in your Event Notifications service instance. {: note} ## How events are collected and sent by Secrets Manager {: #event-notifications-how} When an event of interest takes place in your Secrets Manager instance, Secrets Manager communicates with a connected Event Notifications instance to forward a notification to a [supported destination](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-destination&format=markdown). Secrets Manager aggregates a list of your pending notifications by [event type](#event-notifications-list), the type of secret, and expiry details if they apply. Every 1 - 2 minutes, the service checks for and dispatches any pending notifications to the connected Event Notifications service. For example, you might receive notifications that are similar to the following messages: - You have 1 arbitrary secret that expires in 1 day. - You have 5 public certificate secrets that expire in 10 days. - You have 100 imported certificate secrets that expire in 30 days. 100 is the maximum number of secrets that you can be notified of in a single event notification. {: note} ## Events for Secrets Manager {: #event-notifications-list} The following table lists the Secrets Manager actions that generate an event. Depending on the type of secret that you're working with in the service, an event might not be generated by Secrets Manager. For example, you don't receive a notification if a certificate is set to expire in less than 24 hours. For more information, refer to [Events by secret type](#event-notifications-by-secret-type). {: note} | Event name | Event type | Subtype | Description | Severity level | | ---------- | ------------------------------------ | -------------- | ----------- | -------------- | | Secret created | `com.ibm.cloud.secrets-manager.secret_created` | | An event is sent when a secret is added to the instance. | `low` | | Secret creation failed | `com.ibm.cloud.secrets-manager.secret_creation_failed` | | An event is sent when a request to create a secret fails. | `low` | | Secret rotated | `com.ibm.cloud.secrets-manager.secret_rotated` | | An event is sent when a secret is rotated and a new version becomes available. | `low` | | Secret rotation failed | `com.ibm.cloud.secrets-manager.secret_rotation_failed` | | An event is sent when a request to rotate a secret fails. | `high` | | Secret expires in 90 days | `com.ibm.cloud.secrets-manager.secret_about_to_expire` | `in_90_days` | An event is sent when a secret is 90 days from expiration. | `high` | | Secret expires in 60 days | `com.ibm.cloud.secrets-manager.secret_about_to_expire` | `in_60_days` | An event is sent when a secret is 60 days from expiration. | `high` | | Secret expires in 30 days | `com.ibm.cloud.secrets-manager.secret_about_to_expire` | `in_30_days` | An event is sent when a secret is 30 days from expiration. | `high` | | Secret expires in 10 days | `com.ibm.cloud.secrets-manager.secret_about_to_expire` | `in_10_days` | An event is sent when a secret is 10 days from expiration. | `high` | | Secret expires in 1 day | `com.ibm.cloud.secrets-manager.secret_about_to_expire` | `in_1_day` | An event is sent when a secret is 1 day from expiration. | `high` | | Secret expires in less than 1 day | `com.ibm.cloud.secrets-manager.secret_about_to_expire` | `in_0_days` | An event is sent when a secret is less than 1 day from expiration. | `high` | | Secret expired | `com.ibm.cloud.secrets-manager.secret_expired` | | An event is sent when a secret reaches its expiration date and time. | `high` | | Secret revoked | `com.ibm.cloud.secrets-manager.secret_revoked` | | An event is sent when a version of a secret is revoked before it is scheduled to expire. | `low` | | Secret deleted | `com.ibm.cloud.secrets-manager.secret_deleted` | | An event is sent when a secret is deleted from a Secrets Manager instance. | `low` | | Secret deletion failed | `com.ibm.cloud.secrets-manager.secret_deletion_failed` | | An event is sent when a request to delete a secret fails. | `high` | | Secret deletion blocked | `com.ibm.cloud.secrets-manager.secret_deletion_blocked` | | An event is sent when a secret is unable to be deleted because it is locked. | `low` | | Secret revocation blocked | `com.ibm.cloud.secrets-manager.secret_revocation_blocked` | | An event is sent when a secret is unable to be revoked because it is locked. | `low` | | Secret rotation blocked | `com.ibm.cloud.secrets-manager.secret_rotation_blocked` | | An event is sent when a secret is unable to be rotated because it is locked. | `low` | | Secret expiration blocked | `com.ibm.cloud.secrets-manager.secret_expiration_blocked` | | An event is sent when a secret is unable to expire because it is locked. | `high` | | Secret data removed | `com.ibm.cloud.secrets-manager.secret_data_removed` | | An event is sent when a secret's data is removed. | `low` | | Secret version data deleted | `com.ibm.cloud.secrets-manager.secret_version_data_deleted` | | An event is sent when a secret version's data is deleted. | `low` | | Secret task created | `com.ibm.cloud.secrets-manager.secret_task_created` | | An event is sent when a task is created for a secret. | `low` | | Secret task succeeded | `com.ibm.cloud.secrets-manager.secret_task_succeeded` | | An event is sent when a task is successfully completed. | `low` | | Secret task failed | `com.ibm.cloud.secrets-manager.secret_task_failed` | | An event is sent when a task fails. | `high` | | Secret task deleted | `com.ibm.cloud.secrets-manager.secret_task_deleted` | | An event is sent when a task is deleted. | `low` | | Test event | `com.ibm.cloud.secrets-manager.test_event` | | An event is sent when a test notification is forwarded to Event Notifications. | `low` | {: caption="Actions that generate event notifications" caption-side="bottom"} `secret_about_to_expire` events are sent only once, on the specified day. This means that if you specify that a secret is to expire in 10 days, you receive a single notification when the secret has 10 days remaining. You do not receive a notification at any other time, for example, when the secret has 9 days remaining. {: note} ### Supported secret types {: #event-notifications-by-secret-type} The following table lists the Secrets Manager events that can be generated based on secret types that are supported in the service. | Event name | Event type | Occurrence | Arbitrary | IAM credentials | Key-value | User credentials | Imported certificates | Private certificates | Public certificates | Service credentials | Custom credentials | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | | Secret created | `com.ibm.cloud.secrets-manager.secret_created` | One time | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | | Secret creation failed | `com.ibm.cloud.secrets-manager.secret_creation_failed` | One time | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | | Secret rotated | `com.ibm.cloud.secrets-manager.secret_rotated` | One time | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) |![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | | Secret rotation failed | `com.ibm.cloud.secrets-manager.secret_rotation_failed` | One time | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | | Secret about to expire | `com.ibm.cloud.secrets-manager.secret_about_to_expire` | 90, 60, 30, 10, 1, 0 days before the secret expires | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | Not applicable[^na-1] | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | | Secret expired | `com.ibm.cloud.secrets-manager.secret_expired` | Daily | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | Not applicable[^na-2]| ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | | Secret revoked | `com.ibm.cloud.secrets-manager.secret_revoked` | One time | Not applicable[^na-4] | Not applicable[^na-5] | Not applicable[^na-6] | Not applicable[^na-7] | Not applicable[^na-8] |![Checkmark icon](../../icons/checkmark-icon.svg) | Not applicable[^na-9] | Not applicable[^na-10] | Not applicable[^na-11] | | Secret deleted | `com.ibm.cloud.secrets-manager.secret_deleted` | One time | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | | Secret deletion blocked | `com.ibm.cloud.secrets-manager.secret_deletion_blocked` | One time |![Checkmark icon](../../icons/checkmark-icon.svg) |![Checkmark icon](../../icons/checkmark-icon.svg) |![Checkmark icon](../../icons/checkmark-icon.svg) |![Checkmark icon](../../icons/checkmark-icon.svg) |![Checkmark icon](../../icons/checkmark-icon.svg) |![Checkmark icon](../../icons/checkmark-icon.svg) |![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | | Secret rotation blocked | `com.ibm.cloud.secrets-manager.secret_rotation_blocked` | One time[^man] \n Daily[^auto] |![Checkmark icon](../../icons/checkmark-icon.svg) |![Checkmark icon](../../icons/checkmark-icon.svg) |![Checkmark icon](../../icons/checkmark-icon.svg) |![Checkmark icon](../../icons/checkmark-icon.svg) |![Checkmark icon](../../icons/checkmark-icon.svg) |![Checkmark icon](../../icons/checkmark-icon.svg) |![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | | Secret revocation blocked | `com.ibm.cloud.secrets-manager.secret_revocation_blocked` | One time | Not applicable[^na-12] | Not applicable[^na-13] | Not applicable[^na-14] | Not applicable[^na-15] | Not applicable[^na-16] |![Checkmark icon](../../icons/checkmark-icon.svg) | Not applicable[^na-17] | Not applicable[^na-18] | Not applicable[^na-19] | | Secret expiration blocked | `com.ibm.cloud.secrets-manager.secret_expiration_blocked` | One time \n Daily |![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | Not applicable[^na-3]| ![Checkmark icon](../../icons/checkmark-icon.svg) | Not applicable[^na-20] | Not applicable[^na-21] | Not applicable[^na-22] | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | | Secret version data deleted | `com.ibm.cloud.secrets-manager.secret_data_removed` | One time |![Checkmark icon](../../icons/checkmark-icon.svg) |![Checkmark icon](../../icons/checkmark-icon.svg) |![Checkmark icon](../../icons/checkmark-icon.svg) |![Checkmark icon](../../icons/checkmark-icon.svg) |![Checkmark icon](../../icons/checkmark-icon.svg) |![Checkmark icon](../../icons/checkmark-icon.svg) |![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | | Secret task created | `com.ibm.cloud.secrets-manager.secret_task_created` | One time | | | | | | | | | ![Checkmark icon](../../icons/checkmark-icon.svg) | | Secret task succeeded | `com.ibm.cloud.secrets-manager.secret_task_created` | One time | | | | | | | | | ![Checkmark icon](../../icons/checkmark-icon.svg) | | Secret task failed | `com.ibm.cloud.secrets-manager.secret_task_created` | One time | | | | | | | | | ![Checkmark icon](../../icons/checkmark-icon.svg) | | Secret task deleted | `com.ibm.cloud.secrets-manager.secret_task_created` | One time | | | | | | | | | ![Checkmark icon](../../icons/checkmark-icon.svg) | {: caption="Actions that generate events based on secret type" caption-side="bottom"} [^na-1]: Event is not applicable because there isn't a time-to-live (TTL) limit for this secret type. [^na-2]: Event is not applicable because there isn't a time-to-live (TTL) limit for this secret type. [^na-3]: Event is not applicable because there isn't a time-to-live (TTL) limit for this secret type. [^na-4]: Event is not applicable because this notification type applies to private certificates only. [^na-5]: Event is not applicable because this notification type applies to private certificates only. [^na-6]: Event is not applicable because this notification type applies to private certificates only. [^na-7]: Event is not applicable because this notification type applies to private certificates only. [^na-8]: Event is not applicable because this notification type applies to private certificates only. [^na-9]: Event is not applicable because this notification type applies to private certificates only. [^na-10]: Event is not applicable because this notification type applies to private certificates only. [^na-11]: Event is not applicable because this notification type applies to private certificates only. [^na-12]: Event is not applicable because this notification type applies to private certificates only. [^na-13]: Event is not applicable because this notification type applies to private certificates only. [^na-14]: Event is not applicable because this notification type applies to private certificates only. [^na-15]: Event is not applicable because this notification type applies to private certificates only. [^na-16]: Event is not applicable because this notification type applies to private certificates only. [^na-17]: Event is not applicable because this notification type applies to private certificates only. [^na-18]: Event is not applicable because this notification type applies to private certificates only. [^na-19]: Event is not applicable because this notification type applies to private certificates only. [^na-20]: Event is not applicable because expiration date cannot be blocked in this secret type. [^na-21]: Event is not applicable because expiration date cannot be blocked in this secret type. [^na-22]: Event is not applicable because expiration date cannot be blocked in this secret type. [^man]: You receive a notification that informs you that your manual rotation was not successful. [^auto]: When an automatic rotation fails, you are notified daily until it is successful. ## Enabling notifications {: #event-notifications-enable} Events that are generated by an instance of the Secrets Manager service can be forwarded to an Event Notifications service instance that is available in the same account. You can configure only one Secrets Manager instance to one Event Notifications service instance. To get started, you need: - [**Manager** service access](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam&format=markdown) on the Secrets Manager service. - [**Manager** service access](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-service-access-management&format=markdown) on the Event Notifications service. To view an existing Event Notifications service instance in your account, you also need **Viewer** platform access or higher. ### Connecting to Event Notifications in the UI {: #event-notifications-enable-ui} {: ui} Before you can enable notifications for Secrets Manager, be sure that you have an [Event Notifications service instance](https://cloud.ibm.com/catalog/services/event-notifications){: external} that is in the same account as your Secrets Manager instance. Then, you can use the **Settings > Event Notifications** section in the Secrets Manager UI to connect the services. ![The image shows the Event Notifications screen in the Secrets Manager UI.](../images/event-notifications.svg){: caption="Connecting to Event Notifications" caption-side="bottom"} 1. In the console, click the **Menu** icon ![Menu icon](../../icons/icon_hamburger.svg) **> Resource list**. 2. From the list of services, select your instance of Secrets Manager. 3. In the Secrets Manager navigation, click **Settings**. 4. In the Event Notifications section, and click **Connect**. 5. In the side panel, review the source details for the connection. Optionally, provide a description. 6. Select the resource group and Event Notifications service instance that you want to connect. If an IAM authorization between Secrets Manager and Event Notifications doesn't exist in your account, a dialog is displayed. Follow the prompts to grant access between the services. 1. To grant access between Secrets Manager and Event Notifications, click **Authorize**. 2. In the side panel, select **Event Notifications** as the target service. 3. From the list of instances, select the Event Notifications service instance that you want to authorize. 4. Select the **Event Source Manager** role. 5. Click **Review**. 6. Click **Assign**. 7. To confirm the connection, click **Connect**. A success message is displayed to indicate that Secrets Manager is now connected to Event Notifications. If you need to disconnect from Event Notifications later, you can use the options menu ![options icon](../../icons/actions-icon-vertical.svg) **> Disconnect** to remove the Secrets Manager as a source service in the Event Notifications instance. If you choose to disconnect Event Notifications, do not delete the IAM authorization between Secrets Manager and Event Notifications. Secrets Manager uses the existing authorization to unregister from Event Notifications. If an Event Notifications instance is deleted, any authorizations that exist between the service and the Secrets Manager are also deleted by IAM. {: important} ### Connecting to Event Notifications with the API {: #event-notifications-enable-api} {: api} Before you can enable notifications for Secrets Manager, be sure that you have an [Event Notifications service instance](https://cloud.ibm.com/catalog/services/event-notifications){: external} that is in the same account as your Secrets Manager instance. Then, you can connect to Event Notifications programmatically by calling the Secrets Manager API. The following example shows a query that you can use to register your Secrets Manager source details with Event Notifications. When you call the API, replace the ID variables and IAM token with the values that are specific to your Secrets Manager instance. {: curl} You can find the `event_notifications_instance_crn` value in the console by going to the Resource list and clicking the Event Notifications instance row. {: tip} ```sh curl -X POST --H "Authorization: Bearer {iam_token}" \ --H "Accept: application/json" \ --H "Content-Type: application/json" \ --d'{ "event_notifications_instance_crn": "crn:v1:bluemix:public:event-notifications:us-south:a/22018f3c34ff4ff193698d15ca316946:578ad1a4-2fd8-4e66-95d5-79a842ba91f8::", "event_notifications_source_description": "Optional description of this source in an Event Notifications instance.", "event_notifications_source_name": "My Secrets Manager" }' \ "https://{instance_ID}.{region}.secrets-manager.appdomain.cloud/api/v2/notifications/registration" ``` {: codeblock} {: curl} A successful request returns the CRN value of your connected Event Notifications service instance. For more information about the required and optional request parameters, see the [API docs](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2). ### Connecting to Event Notifications with Terraform {: #event-notifications-enable-terraform} {: terraform} The following example shows a configuration that you can use to to register your Secrets Manager source details with Event Notifications. ```terraform resource "ibm_sm_en_registration" "en_registration" { instance_id = local.instance_id region = local.region name = "test-root-ca" event_notifications_instance_crn = var.en_instance_crn event_notifications_source_description = "My event notification source" event_notifications_source_name = "my_en_source" } ``` {: codeblock} ### Sending a test event to Event Notifications in the UI {: #event-notifications-test-ui} {: ui} After you enable notifications for Secrets Manager, test your connection to ensure that the events that are generated by Secrets Manager are being forwarded to Event Notifications. Before you can send a test Secrets Manager events, you must have [topics, destinations, and subscriptions](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-create-en-topic&format=markdown) created in your Event Notifications instance. Be sure that the **Test event** event type (`com.ibm.cloud.secrets-manager.test_event`) is included as a condition in your Event Notifications topic. {: note} ![The image shows the Event Notifications screen in the Secrets Manager UI.](../images/event-notifications-connected.svg){: caption="Sending a test event to Event Notifications" caption-side="bottom"} 1. In the Secrets Manager UI, click **Settings**. 2. In the Event Notifications section, click **Send test event**. A success message is displayed to indicate that the test event was forwarded successfully to Event Notifications. ### Sending a test event to Event Notifications with the API {: #event-notifications-test-api} {: api} After you enable notifications for Secrets Manager, test your connection to ensure that the events that are generated by Secrets Manager are being forwarded to Event Notifications. Before you can send a test Secrets Manager event, you must have [topics, destinations, and subscriptions](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-create-en-topic&format=markdown) created in your Event Notifications instance. Be sure that the **Test event** event type (`com.ibm.cloud.secrets-manager.test_event`) is included as a condition in your Event Notifications topic. {: note} The following example shows a query that you can use to send a test event from the Secrets Manager to Event Notifications. When you call the API, replace the ID variables and IAM token with the values that are specific to your Secrets Manager instance. {: curl} ```sh curl -X GET --H "Authorization: Bearer {iam_token}" \ "https://{instance_ID}.{region}.secrets-manager.appdomain.cloud/api/v2/notifications/registration/test" ``` {: codeblock} {: curl} A successful request returns an HTTP `200 OK` response to indicate that a test event was forwarded successfully to your connected Event Notifications service instance. For more information, see the [API docs](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2). ## Delivering notifications to select destinations {: #event-notifications-destinations} After you enable notifications for Secrets Manager, create topics and subscriptions in Event Notifications so that alerts can be forwarded and delivered to your selected destinations. For a complete list of supported destinations, see the [Event Notifications documentation](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-destination&format=markdown). {: tip} ### Email notifications {: #event-notifications-email} You can use the [IBM Cloud email service](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-destinations-email&format=markdown) as a delivery channel for Secrets Manager event notifications. [Create an Event Notifications subscription](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-create-en-subscription&format=markdown) between an existing topic and the IBM Cloud email service to forward your alerts to various recipients by email. An email from IBM Cloud that contains information about a Secrets Manager event resembles the following example: ```plaintext Subject: Your 2 public certificate secrets expire in 10 days Body: You have 2 public certificate secrets that expire in 10 days: my-certificate-1, my-certificate-2. You can view and manage your existing secrets by accessing Secrets Manager in the console, or by using the CLI or APIs. For more information, check out the docs. ``` {: screen} To receive detailed information about an event notification in your email, select the **Add notification payload** option when you create an Event Notifications subscription. Your email displays the [notification payload details](#event-notifications-payload) that are associated with the event. {: tip} ### Webhooks {: #event-notifications-webhook} You can configure a webhook destination so that an incoming notification can be consumed programmatically by an app or service. For more information about setting up webhooks, check out the [Event Notifications documentation](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-destinations-webhook&format=markdown). ## Notification payload details {: #event-notifications-payload} Successful events that are generated by Secrets Manager contain various fields that help you to identify the source and details of an event. Event notifications from Secrets Manager contain only metadata properties, such as names or identifiers of resources. Sensitive data, for example API keys or passwords, are not included in generated events. {: note} The properties that are sent to Event Notifications vary depending on the event type and type of secret. For example, if an `secret_about_to_expire:in_10_days` event takes place in an instance for one or more `public_cert` secrets, Secrets Manager sends a notification payload to Event Notifications that is similar to the following example. ```json { "event_sub_type": "in_10_days", "event_type": "secret_about_to_expire", "secret_type": "public_cert", "secrets": [ { "domains": "domain1.com", "event_time": "2022-01-04T00:00:00Z", "event_triggered_by": "SecretsManager", "secret_expiration": "2022-01-14T00:00:00Z", "secret_group_id": "default", "secret_id": "crn:v1:bluemix:public:secrets-manager::a/::secret:", "secret_name": "my-certificate-1", "serial_number": "1:2:3:4" }, { "domains": "domain2.com, domain3.com", "event_time": "2022-01-04T00:00:00Z", "event_triggered_by": "SecretsManager", "secret_expiration": "2022-01-14T00:00:00Z", "secret_group_id": "default", "secret_id": "crn:v1:bluemix:public:secrets-manager::a/::secret:", "secret_name": "my-certificate-2", "serial_number": "1:2:3:4" }, ], "source_instance_api_private_url": "https://.private..secrets-manager.appdomain.cloud/api", "source_instance_api_public_url": "https://..secrets-manager.appdomain.cloud/api", "source_instance_crn": "crn:v1:bluemix:public:secrets-manager::a/:::", "source_instance_dashboard_url": "https://cloud.ibm.com/services/secrets-manager/crn%3Av1%3Abluemix%3Apublic%3Asecrets-manager%3A%3Aa%2Fa6cc9f5f21f34323a4175c1117638b40%3A%3A%3A", "source_service": "SecretsManager" } ``` {: screen} Review following table for more information about event notification properties. | Property | Description | | ---- | ---- | | `event_sub_type` | The subtype that corresponds with the [type of event](#event-notifications-list) that triggered a notification. | | `event_type` | The [type of event](#event-notifications-list) that triggered a notification. | | `secret_type` | The type of secret that is associated with the event. \n \n Possible values include: `imported_cert`, `private_cert`, `public_cert`| | `secrets[]` | A list of objects that contain the metadata properties of a secret that is associated with the event. The properties that are listed vary depending on the secret type. \n \n Properties that are sent for all secret types include: \n - `event_time`: The date and time the event was generated. \n - `event_triggered_by`: The entity that triggered the event. This can be the Secrets Manager service or an IBM ID. \n - `secret_group_id`: The ID of the secret group. \n - `secret_id`: The ID that uniquely identifies the secret. \n - `secret_name`: The name of the secret. \n \n Events for `imported_cert`, `private_cert`, and `public_cert` secrets also contain: \n - `domains`: The domains that are associated with the certificate. \n - `serial_number`: The serial number that is associated with the certificate. \n \n Failure events can also contain: \n - `failure_reason`: The reason for the operation failure. | | `tasks[]` | A list of objects that contain the metadata properties of a secret task that is associated with the event. \n \n Properties that are sent for all secret types include: \n - `event_time`: The date and time the event was generated. \n - `event_triggered_by`: The entity that triggered the event. This can be the Secrets Manager service or an IBM ID. \n - `secret_group_id`: The ID of the secret group. \n - `secret_id`: The ID that uniquely identifies the secret. \n - `secret_name`: The name of the secret. \n - `task_id`: The ID that uniquely identifies the secret task. \n - `secret_status`: The status of the secret task. \n - `task_trigger`: The trigger for this task creation. \n - `task_type`: The type of the secret task. \n \n Failure events can also contain: \n - `failure_reason`: The reason for the operation failure. | | `source_instance_api_private_url` | The [private endpoint URL](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-endpoints&format=markdown#service-endpoints) that is assigned to your Secrets Manager service instance.| | `source_instance_api_public_url` | The public endpoint URL that is assigned to your Secrets Manager service instance.| | `source_instance_crn` | The Cloud Resource Name (CRN) that uniquely identifies your Secrets Manager service instance. | | `source_instance_dashboard_url` | The URL to your Secrets Manager service dashboard in the console. | | `source_service` | The display name of the service that sent the event notification. | {: caption="Properties in an event notification payload" caption-side="bottom"}