Audit Logs

The Audit Logs screen (/audit-logs) is the forensic view of what agents did: every tool call, with its input, its result, and how long it took.

Reading it requires audit_log:read — Admin and above. Results are scoped to the caller’s organization and narrowed to the active workspace, so the “all agents” view means all agents you can see, never the whole deployment.

The three audit trails

Polyant keeps them separate on purpose, and knowing which one to open saves a lot of searching:

Trail	Answers	Where
Tool audit	What did an agent’s tools do?	This screen
Management audit	Who changed an agent’s configuration?	Recorded per mutation — agent create/delete, secret write/delete, member removal, retention config write, retention purge run
Authorization audit	Who changed who could do what?	Authorization audit (enterprise)

A tool call that failed and a role that was widened are different questions; only the first is on this page.

Columns

Column	Content
Timestamp	ISO 8601 in the user’s timezone.
Instance	Instance slug as a clickable badge.
Tool	Tool name in monospace.
Action	What the tool did (`create`, `update`, `delete`, `read`).
Details	First 200 chars of the input or summary; click to expand.
Duration	Tool execution time in ms.
Status	`success` or `error`, with a check or X icon.

Filters

Instance dropdown — filter to one instance.
Tool dropdown — populated from the actual tools that have produced log entries (so the list is always relevant).
Search — free-text search over the details column, debounced.
Date range — last 24 h, 7 days, 30 days, custom.

Stats cards

Three stats cards at the top:

Total entries in the current filter set.
Error count — entries with status = error.
Error rate — derived percentage.

Expandable rows

Click any row to expand it. The expanded view shows:

Full input JSON.
Full output JSON (or error message).
Conversation id (clickable, jumps to Conversations).
Trace id (if LangSmith is enabled).

Pagination

30 entries per page. Use the prev/next buttons at the bottom or jump pages with the input.

Export

The audit-logs page does not ship an Export CSV button today. To extract entries, use GET /api/audit-logs with your filter parameters (instanceId, toolName, action, search, from, to, limit, offset); GET /api/audit-logs/stats returns the same aggregates as the cards. Both require audit_log:read and apply the same organization and workspace scoping as the screen.