# Integrate Cribl with Aperture

Last validated Jun 26, 2026

\[Missing snippet: aperture\_release\_note.mdx]

[Cribl][xt-cribl] is a data pipeline platform that routes, reduces, and enriches observability data. By connecting Aperture to Cribl, you can route AI usage data through your existing Cribl pipelines and forward it to any of Cribl's supported destinations (Splunk, Datadog, S3, and others).

Aperture sends data to Cribl using the [hooks system][kb-configuration-hooks]. You configure a webhook endpoint in Cribl, then add a hook in Aperture that sends event data to that endpoint when requests match your grant conditions.

Cribl, and the destinations you route to through it (such as Splunk, Datadog, or S3), are third-party services. When Aperture forwards data to them, that data is handled under your agreement with each provider, not your agreement with Tailscale.

## Prerequisites

Before you begin, ensure you have the following:

* A running [Aperture instance][kb-get-started] accessible from your device.
* A [Cribl Stream or Cribl Cloud][xt-cribl] deployment with a configured [webhook source][xt-cribl-webhook].

## Configure the Cribl webhook source

Get the webhook URL and authentication token from your Cribl deployment. You'll use these to configure a hook in Aperture that sends data to Cribl.

1. In your Cribl deployment, create a webhook source to receive data from Aperture.
2. Note the webhook URL and any authentication token Cribl provides. You'll use these when configuring the hook in Aperture.

For details on configuring webhook sources in Cribl, refer to the [Cribl documentation][xt-cribl-docs].

## Configure the Aperture hook

To integrate Cribl with Aperture, configure a hook in Aperture that points to your Cribl endpoint. This lets you send request data to Cribl for processing and routing.

1. \[Missing snippet: aperture\_admin\_nav.mdx]

2. Add a `cribl` entry in the `hooks` section with the webhook URL from your Cribl source.

   ```json
   "hooks": {
       "cribl": {
           "url": "<cribl-webhook-url>",
           "apikey": "<cribl-auth-token>"
       }
   }
   ```

   Replace `<cribl-webhook-url>` with the URL of your Cribl webhook source and `<cribl-auth-token>` with the authentication token from Cribl.

3. Add a grant with a `send_hooks` entry that references the `cribl` hook. The grant controls which requests trigger the hook and what data Aperture sends.

   ```json
   "grants": [
       {
           "src": ["*"],
           "app": {
               "tailscale.com/cap/aperture": [
                   {
                       "send_hooks": [
                           {
                               "name": "cribl",
                               "events": ["entire_request"],
                               "send": ["tools", "estimated_cost", "request_body", "response_body"]
                           }
                       ]
                   }
               ]
           }
       }
   ]
   ```

   This configuration sends data for every request from all users. The `request_body` and `response_body` send types contain the full prompt and model-output content, not just usage metrics, so this example forwards that content to Cribl and onward to your destinations. Adjust the `events` and `send` fields to the minimum your pipeline needs. To limit which users' requests trigger the hook, replace `"*"` in the `src` field with specific user identities or tags.

4. Save the configuration.

For details on hook events and send types, refer to the [hooks configuration reference][kb-configuration-hooks].

\[Missing snippet: aperture\_grant\_dst\_note.mdx]

## Verify the integration

After configuring the Cribl hook, verify that Aperture is sending data to Cribl and that Cribl is routing it to the expected destination.

1. Send a request through Aperture that matches your grant conditions.
2. Check your Cribl deployment to confirm the event data arrives at the webhook source.
3. Verify that your Cribl pipeline routes the data to the expected destination.

If data doesn't appear, check that the `send_hooks` name matches the key in your `hooks` section and that the grant's `src` field includes the user who made the request.

## Next steps

\[Missing snippet: aperture\_hooks\_next\_steps.mdx]

[kb-configuration-hooks]: /docs/aperture/configuration#hooks

[kb-get-started]: /docs/aperture/get-started

[xt-cribl-docs]: https://docs.cribl.io/

[xt-cribl-webhook]: https://docs.cribl.io/stream/sources-webhook/

[xt-cribl]: https://cribl.io/