Audit Log
The audit log is an immutable record of every tool call your agents make — allowed and denied.
What is logged
Every call through AgenticGuard creates an audit event containing:
| Field | Description |
|---|---|
timestamp | UTC timestamp of the call |
agent_id | Which agent made the call |
tool_name | Target tool (derived from hostname) |
action | HTTP method or action name |
tool_url | Full target URL |
decision | allowed or denied |
reasoning | Agent-provided reasoning (if any) |
task_id | Task or workflow identifier (if provided) |
latency_ms | Round-trip time in milliseconds |
status_code | HTTP status from upstream (for allowed calls) |
policy_message | Denial reason (for denied calls) |
Viewing the audit log
The Audit Log tab in the dashboard shows a paginated, filterable log. Filters available:
- Agent
- Decision (allowed / denied)
- Tool name
- Date range
Exporting
Download the audit log as a PDF report from the dashboard:
- Go to Audit Log
- Set your date range
- Click Export PDF
The report includes a summary table, per-agent breakdown, and a full event listing.
Via API
# Get recent audit events
curl -H "Authorization: Bearer $JWT" \
"https://api.agentic-guard.com/audit?limit=50"
# Filter by agent
curl -H "Authorization: Bearer $JWT" \
"https://api.agentic-guard.com/audit?agent_id=uuid&limit=100"
Retention
Audit events are retained indefinitely. There is no delete API — the log is append-only by design.
Using audit data
The audit log helps you:
- Understand agent behavior before writing policies
- Detect anomalies — unusual tools, unexpected volumes, denied patterns
- Debug issues — see exactly what URL was called and what came back
- Compliance evidence — exportable PDF for security reviews