Audit and compliance

Every credential access attempt is logged — whether it succeeds, is denied, or fails due to a missing credential. Logs are append-only.

These are credential-retrieval records, not a record of subsequent provider actions. The method is the agent's declared intent. Token authentication failures do not create credential-access events; use provider logs for downstream investigation.

What gets logged

Event	Logged	Notes
get_credential — success	Yes	Credential name returned to agent
get_credential — denied (method)	Yes	Method not in access profile
get_credential — denied (service)	Yes	Service not in access profile
get_credential — not found	Yes	No credential stored for service
get_identity	No	Read-only; no credential access
list_audit_events	No	Reading logs doesn't create a log entry
Bearer token validation failure	No	Only credential access is logged

Log fields

{
  "id": "evt_...",
  "agentId": "...",
  "agentName": "cursor-dev",
  "service": "stripe",
  "keyName": "primary",
  "action": "read",
  "method": "POST",
  "outcome": "success",
  "createdAt": "2026-07-27T10:23:41.000Z"
}

The example uses REST account audit-event fields. method is the method declared during retrieval, not an observed provider operation. Outcomes include success, denied and not_found; do not assume a separate denial-reason field is available.

Append-only

There is no individual audit-event deletion action in the dashboard or supported public API. This is not a claim of tamper-proof database storage, permanent retention or certification. Apply your account's retention policy and keep independent exports where required.

Retention

Do not assume lifetime retention. Check the retention policy for your account and plan, and export records needed for your own retention requirements.

Accessing logs

• Dashboard — the Logs page with filtering by agent, service, outcome, and date range
• MCP — list_audit_events({ limit, service }) returns recent events for the calling agent
• REST API — GET /api/v1/audit-events with an account token (paginated account credential-access events)

Compliance use cases

For compliance workflows that require log export, contact support. Enterprise plans include structured log export via API.