Audit Trail
The Audit Trail records every admin action taken in your Agent Handler organization: member invitations, role changes, Access Key rotations, OAuth credential edits, security rule changes, Tool Pack edits, and the handful of reads worth recording on their own, such as a log search. It’s the artifact your security review will ask for, and the evidence you’ll pull when you need to know who changed what and when.
Different from the Tool Call Logs (which capture agent activity) and the API Request Logs (which capture your backend’s calls). The Audit Trail is specifically about administrative actions on the dashboard or via the management API.
What’s captured
For each event:
- Event type. What was done, such as
ROLE_UPDATED,PRODUCTION_API_KEY_REVOKED, orTOOL_PACK_CREATED. - Actor. The dashboard user (or the API key) that performed the action.
- Resource. What was changed - Registered User ID, Tool Pack ID, rule ID, member ID.
- Before/after diff. For updates, the specific fields that changed and their old and new values.
- Source. Web dashboard, API, or system (for automated actions like SCIM-driven changes).
- IP address of the actor, when available.
- Timestamp.
Event catalog
Event types are uppercase strings, and the same value works as an ?event_type= filter on the audit-log endpoint. The authoritative list is the event_type enum on the audit-log endpoint in the API reference: it is generated from the source and picks up new values as features ship, so read it there before you hard-code a filter.
The Skills events are described alongside the flows that write them in Publishing skills, Reviewing submissions, and How agents load skills.
Where to view it
Settings → Audit Trail. The default view is the last 7 days, all events. The filter bar supports event type, actor, resource type, date range, and source.
Click any row to open the event detail with the full diff. For events that touched multiple fields, every field’s old and new value is shown side by side.
Investigation flow
“Who changed this?” Filter by resource type and ID. The Audit Trail shows every event against that resource in chronological order with the actor on each row.
“What did this person do?” Filter by actor. You’ll see everything that member touched across resources - useful when offboarding, before revoking access.
Exporting
The Export button produces CSV of whatever filter is currently applied. For compliance reviews where you need to show a 12-month window, set the date filter and export.
The CSV includes:
- Event ID
- Timestamp (ISO 8601, UTC)
- Event type
- Actor email and ID
- Resource type and ID
- Source (dashboard, API, system)
- Diff (JSON-encoded before/after for update events)
For automated forwarding to a SIEM or data warehouse, the audit-trail export endpoint is documented in the API reference.
Data retention
One window covers audit events, Tool Call Logs, and the violation records behind Violations and alerts.
The default is 90 days. Some plans keep data longer, and an Enterprise contract can set a window of its own, so read the window that applies to you off your plan on Billing and usage or off your contract.
Records belonging to a user who is gone follow the same window. Deprovisioning through SCIM or deleting a Registered User revokes access immediately, and their audit entries and tool-call history are kept until the window closes, then purged.
If your compliance requirements need longer than your window, export on a schedule and keep the results in your own systems. CSV export covers any filtered view in the dashboard, the audit-log endpoint covers audit events, and the log endpoints feed a warehouse or a SIEM.
What it doesn’t capture
The Audit Trail covers administrative actions in the dashboard and over the management API. That is mostly changes to configuration and access, plus the few reads worth recording on their own: a log search, a log detail view, an agent loading a skill, and a sign-in. It doesn’t include tool calls (see Tool Call Logs), backend API requests (see API Request Logs), or the OAuth-flow steps that lead up to a CREDENTIAL_CREATED event. For the full picture, combine the three streams.
Next
Manage who on your team can do what with Team and roles.