Logs

API requests

The HTTP requests Workforce makes to a third party to complete each tool call

API request logs capture the outbound HTTP requests Workforce makes to a third-party provider while completing a tool call: the actual POST https://slack.com/api/chat.postMessage behind a slack__post_message, with the exact request and response on the wire. Each one is correlated to the tool call it was made for, so you can go from a tool call log straight to the raw exchange that produced it.

Where tool call logs show what the employee’s client did (arguments, result, status), API request logs show what Workforce sent the provider and what came back: the layer underneath.

Which log to read

QuestionLook here
The client called the wrong toolTool call logs
A tool call was redacted unexpectedlyTool call logs
What exact request went to the provider, and what did it return?API request logs
The provider rejected the call with a 4xx or 5xxAPI request logs
A provider-side auth failure or rate limitAPI request logs

What’s captured

Per request:

  • Method and URL, the provider endpoint, like POST https://slack.com/api/chat.postMessage
  • Tool call, the toolcall_id this request was made for, which is what ties it to its tool call log
  • Connector and tool, which Connector and tool triggered the request
  • Status code, the provider’s HTTP response status
  • Latency, time from request sent to response received
  • Request body and headers, as they went out
  • Response body and headers, as they came back
  • Timestamp

Credential headers (Authorization, API keys, cookies) and secret-named body fields are scrubbed on the way out of the log endpoint, so what reaches a SIEM carries no credentials. The dashboard detail is the admin view and shows the headers as they were sent.

Filtering

The filter bar covers date, Connector, Tool Pack, employee, method, response code, tool name, URL, request ID, and tool call ID, plus free-text search inside the response body. Response code takes one code at a time, picked from a list of the common ones, so a common shape is every 429 from the slack Connector in the last hour.

Drilling into a request

The table row carries the method, URL, status, start time, and duration. Click it to open the full detail:

  • The request, with its method badge, headers, and full body
  • The response, with its status badge, headers, and full body

To read the client-facing arguments and result alongside the wire exchange, go the other way: open the tool call in Tool call logs and use its API calls tab, which lists every request made for that call.

Pulling them programmatically

The same records come from the GET /api/v1/logs/api-calls/ endpoint, so you can pull them into your own systems or stream them to a SIEM. The endpoint serves the last 30 days, oldest first, with cursor pagination. See Stream logs to a SIEM for per-platform setup and the API reference for the full schema. It is an Enterprise feature, so contact your account team to enable it.

Next

See which model request drove a tool call in LLM calls.