Grammarly Grammarly Integration

TL;DR

Overview

Grammarly is an AI-powered writing assistant and productivity platform (now developed by Superhuman Platform Inc.) used widely in enterprises for writing, editing, and document collaboration. The Grammarly Enterprise Audit Log API exposes organization-level administrative and membership events, such as users joining an organization, invitees being added, document downloads, and other account lifecycle actions performed by administrators, end users, or the Grammarly system itself. These logs are collected via the audit log API (gate.grammarly.com/audit/v1/logs) using a Bearer API key with logs:query scope. For security operations, this data is valuable for monitoring organizational membership changes, detecting unauthorized user additions or invitations, tracking administrative actions, correlating actor and invitee email addresses with known-malicious or suspicious identities, and supporting identity governance and insider-risk investigations within SaaS environments.

Supported data types

Grammarly Enterprise Audit Logs

Table name: grammarly_audit_logs

This data type contains organization-level audit events from Grammarly Enterprise, including user membership changes (joins, invitee additions), document access actions (such as downloads), and other administrative activity performed by users, administrators, or the Grammarly system itself. These events support monitoring of identity and access changes, detection of unauthorized membership or invitation activity, and investigation of document access within the organization.

Expected format

Logs are expected in JSON format.

{"id": "a1b2c3d4-eeee-4a2b-8c3d-1a2b3c4d5e6f", "date_create": 1790983935, "actor": {"type": "user", "user": {"id": "1000000014", "name": "Brandon Fields", "email": "brandon.fields@example.com"}}, "action": "invitee_added", "entity": {"type": "invitee", "invitee": {"name": "", "email": "anthony.price@example.com", "role": "INSTITUTION_USER"}}, "context": {"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36", "organization_id": "500000001"}}

Send data to Hunters

Hunters supports the collection of Grammarly logs using API, S3 List, S3 Notifications, GCP Bucket List, and Azure Block Storage List.

To connect Grammarly logs:

Connect using S3

1. Route Grammarly logs into an AWS S3 bucket.
2. Once logs are in S3, follow the steps in this section.

Connect using Azure Block Storage List

1. Route Grammarly logs into an Azure Storage container as block blobs.
2. Once logs are in the container, follow the steps in this section.

Connect using GCP Bucket List

1. Route Grammarly logs into a Google Cloud Storage bucket.
2. Once logs are in the bucket, follow the steps in this section.

Connect using API

1. Create API credentials in the Grammarly console with read access to the relevant data, following the vendor documentation.
2. Connect the data source in the Hunters portal with those credentials, as described in this section. Hunters pulls the data from the vendor API on a schedule.