---
title: "Audit Logs | Gazebo Docs"
description: "Every credential access is logged. Learn how to view, filter, and export Gazebo audit events."
url: "https://gazebohq.com/docs/audit-logs"
---

Every credential access attempt — successful or denied — is recorded in the audit log. Logs are append-only and cannot be deleted from the dashboard.

## What gets logged

| Event | Logged |
|---|---|
| Successful `get_credential` call | Yes |
| Denied `get_credential` call (wrong method) | Yes |
| Denied `get_credential` call (service not in profile) | Yes |
| `get_identity` call | No — read-only, no credentials returned |
| `list_audit_events` call | No — reading logs doesn't create a log entry |
| Agent bearer token validated | No — only credential access is logged |

## Log fields

Each audit event contains:

- **Agent** — the agent name and ID
- **Service** — which service credential was requested
- **Method** — the HTTP method the agent declared it intended to use
- **Outcome** — `success` or `denied`
- **Denial reason** — if denied: `method_not_permitted`, `service_not_in_profile`, or `credential_not_found`
- **Timestamp** — UTC, millisecond precision

## Viewing logs

Go to **Logs** in the Gazebo dashboard. You can filter by:

- Agent
- Service
- Outcome (success / denied)
- Date range

## Filtering by agent

Each agent's detail page shows only that agent's audit events — useful for reviewing a specific agent's behavior before or after a policy change.

## Retention

Audit logs are retained for the lifetime of your account. There is no automatic expiry.

## Using logs for incident response

If you suspect a credential was misused:

1. Check the audit log for the relevant service — look for unexpected methods or access outside normal hours
2. Revoke the agent immediately (delete it from the Agents page)
3. Rotate the underlying API key if the access pattern indicates it may have been forwarded to a third party
4. Review the agent's access profile — tighten method restrictions before re-issuing