---
title: "Audit and Compliance | Gazebo Docs"
description: "What Gazebo logs, when it logs it, and how to export audit data for compliance purposes."
url: "https://gazebohq.com/docs/security/audit"
---

Every credential access attempt is logged — whether it succeeds, is denied, or fails due to a missing credential. Logs are append-only.

## What gets logged

| Event | Logged | Notes |
|---|---|---|
| `get_credential` — success | Yes | Credential name returned to agent |
| `get_credential` — denied (method) | Yes | Method not in access profile |
| `get_credential` — denied (service) | Yes | Service not in access profile |
| `get_credential` — not found | Yes | No credential stored for service |
| `get_identity` | No | Read-only; no credential access |
| `list_audit_events` | No | Reading logs doesn't create a log entry |
| Bearer token validation failure | No | Only credential access is logged |

## Log fields

```json
{
  "id": "evt_...",
  "agent_id": "...",
  "agent_name": "cursor-dev",
  "service": "stripe",
  "method": "POST",
  "outcome": "success",
  "denial_reason": null,
  "timestamp": "2026-07-27T10:23:41.000Z"
}
```

`denial_reason` is populated only when `outcome` is `"denied"` — values: `method_not_permitted`, `service_not_in_profile`, `credential_not_found`.

## Append-only

Audit logs cannot be deleted through the dashboard or API. They are append-only at the database level. This is intentional — a deletable audit log provides no compliance guarantee.

## Retention

Logs are retained for the lifetime of your account. There is no automatic expiry.

## Accessing logs

- **Dashboard** — the Logs page with filtering by agent, service, outcome, and date range
- **MCP** — `list_audit_events({ limit, service })` returns recent events for the calling agent
- **REST API** — `GET /api/v1/audit-logs` (authenticated, returns your account's logs)

## Compliance use cases

For compliance workflows that require log export, contact support. Enterprise plans include structured log export via API.