Audit logs

Every credential access attempt — successful or denied — is recorded in the audit log. Logs are append-only and cannot be deleted from the dashboard.

These records describe credential retrieval, including the method declared by the agent—not the provider requests it later makes. Token authentication failures do not create credential-access events. Use provider audit logs to investigate downstream activity.

What gets logged

Event	Logged
Successful get_credential call	Yes
Denied get_credential call (wrong method)	Yes
Denied get_credential call (service not in profile)	Yes
get_identity call	No — read-only, no credentials returned
list_audit_events call	No — reading logs doesn't create a log entry
Agent bearer token validated	No — only credential access is logged

Log fields

Each audit event contains:

• Agent — the agent name and ID
• Service — which service credential was requested
• Method — the HTTP method the agent declared it intended to use
• Outcome — success or denied
• Denial reason — if denied: method_not_permitted, service_not_in_profile, or credential_not_found
• Timestamp — UTC, millisecond precision

Viewing logs

Go to Logs in the Gazebo dashboard. You can filter by:

• Agent
• Service
• Outcome (success / denied)
• Date range

Filtering by agent

Each agent's detail page shows only that agent's audit events — useful for reviewing a specific agent's behavior before or after a policy change.

Retention

Audit logs are retained for the lifetime of your account. There is no automatic expiry.

Using logs for incident response

If you suspect a credential was misused:

1. Check the audit log for the relevant service — look for unexpected methods or access outside normal hours
2. Revoke the agent immediately (delete it from the Agents page)
3. Rotate the underlying API key if the access pattern indicates it may have been forwarded to a third party
4. Review the agent's access profile — tighten method restrictions before re-issuing